Subrecipient Monitoring Requirements Tracker

Subrecipient monitoring plans nearly all do the same thing: score a subrecipient against the four risk factors named in 2 CFR 200.332(c) and set a monitoring cadence from the result. That answers how closely to watch the relationship. It does not answer a separate, non-negotiable question: whether the subrecipient's own total federal expenditure this year, counting every source, has crossed the dollar line that makes a Single Audit mandatory. An obligations register tracks what the subaward agreement itself requires. Neither one, alone, tells you whether that verification is actually owed.

The two checks measure different things, and a good score on one says nothing about the other. Risk tier is built from prior experience, audit history, personnel and system changes, and other federal oversight, exactly as 200.332(c) lists them. The audit threshold in 2 CFR 200.501(a) is a flat $1,000,000 test on the subrecipient's own fiscal year, and 200.332(g) makes verifying it this organization's job, regardless of the risk score attached to that same subrecipient.

Foothill Youth Alliance passes $1,650,000 of a $2,400,000 federal award to four subrecipients. Riverside Youth Corps scores zero on every one of the four risk factors, the lowest tier possible, and still crosses $1,000,000 once a direct federal award it holds elsewhere is added to its $180,000 subaward. Northgate Community Partners scores High from a prior finding and separately crosses the same line through a second pass-through entity's funding. Half the subrecipients owe Single Audit verification, and only one of the two was already flagged as risky.