If your organization takes federal grant money, 2 CFR Part 200 requires you to build a written system of internal controls for federal grants that gives reasonable assurance the funds are spent lawfully, documented properly, and monitored throughout the life of the award. The core rule sits in 2 CFR 200.303: every recipient and every subrecipient must establish, document, and maintain effective controls over each federal award.1eCFR. 2 CFR 200.303 – Internal Controls “Document” carries real weight in that sentence. Informal good habits don’t satisfy the rule. Your controls have to exist on paper, in enough detail that an outside auditor can evaluate whether they work.
The 2024 revisions to Part 200, effective for awards issued on or after October 1, 2024, raised several thresholds and added explicit cybersecurity language. The obligations below reflect that current version of the rule.
The Five Duties Section 200.303 Puts on You
The regulation breaks the internal control obligation into five duties. You must comply with the U.S. Constitution, federal statutes, and the specific terms of your award. You must continuously evaluate and monitor your own compliance. You must take prompt action when noncompliance surfaces. And you must take reasonable cybersecurity measures to protect personally identifiable information and any other data the awarding agency designates as sensitive.1eCFR. 2 CFR 200.303 – Internal Controls
The cybersecurity piece catches smaller nonprofits off guard, because it applies whether or not your award document specifically mentions data security. If your program handles PII, you need controls for it.
Pick a Framework: Green Book or COSO
The rule points to two recognized frameworks as the benchmarks: the Standards for Internal Control in the Federal Government (the Green Book), published by the Comptroller General of the United States, and the Internal Control-Integrated Framework published by the Committee of Sponsoring Organizations of the Treadway Commission (COSO).1eCFR. 2 CFR 200.303 – Internal Controls2U.S. Government Accountability Office. The Green Book3COSO. Internal Control – Integrated Framework
Choose one and build your system around it consistently. You don’t need both. The Green Book includes government-specific guidance on appropriations and budget authority; COSO speaks more naturally to nonprofits and universities. Both organize controls into the same five components, and auditors will evaluate all five rather than accept strength in one as making up for weakness in another.
The Five Components in Practice
Control Environment
This is the tone the organization sets. The board actively exercises oversight, leadership models the behavior it expects, and hiring reflects an awareness of compliance obligations. An executive director who routinely bypasses purchase approvals has a control environment problem that no written policy will fix.
Risk Assessment
You identify what could go wrong on each grant and decide what to do about it. A new subrecipient with no audit history, staff turnover that leaves one person handling both purchasing and accounting, a shift to remote work that weakens timekeeping oversight: each of those is a documented risk that needs a documented response.
Control Activities
These are the specific policies and procedures that address the risks you identified. Approval requirements for purchases over set dollar amounts, physical security for grant-funded equipment, monthly bank reconciliations, and separation of duties all fit here.
Separation of duties is where small organizations struggle most. The principle is that no single person controls a transaction from start to finish. On purchasing, one person approves the requisition, another issues the purchase order, another receives the goods, and another records the transaction. On payroll, whoever approves timesheets should not also process payroll. When you’re short-staffed, you compensate by adding a management review layer, requiring dual signatures, or having the board treasurer periodically review transactions.
Information and Communication
Staff need clear written instructions on what the controls require, a working channel to report problems upward, and information systems that produce the reports the awarding agency expects. The 2024 revisions require that recipients inform employees in writing of their whistleblower rights and protections.
Monitoring
Controls drift when staff turn over or programs change. Monitoring means regularly testing whether your controls still work and adjusting when they don’t. A quarterly review of procurement files against your written procedures counts. So does a formal internal audit function that samples transactions throughout the year.
Controls Over Spending
Most of what your internal controls actually do is prevent unallowable charges from hitting a federal award. Under 2 CFR 200.403, a cost must satisfy all of the following to be chargeable:
- Necessary and reasonable for the grant’s objectives.
- Allocable to the specific award based on the benefit that award receives.
- Consistently treated across all your funding sources. A cost you charge as indirect on one grant cannot be charged as direct on another.
- Conforming to any limitations in the cost principles or the award terms.
- Recorded in accordance with generally accepted accounting principles.
- Adequately documented. If you can’t produce records showing what you spent and why, the cost is unallowable no matter how legitimate it was.4eCFR. 2 CFR 200.403 – Factors Affecting Allowability of Costs
Reasonableness is measured against a “prudent person” standard: would a careful person spending their own money pay this amount under the same circumstances?5eCFR. 2 CFR 200.404 – Reasonable Costs Auditors weigh whether the cost is ordinary for your type of organization, whether the price reflects market rates in your area, and whether the expenditure follows your own written policies. Allocability adds a second layer: a cost incurred for one award cannot be shifted to another to cover a shortfall or dodge award restrictions.6eCFR. 2 CFR 200.405 – Allocable Costs
Procurement Thresholds
Buying with federal money is not the same as buying with your own. Part 200’s procurement standards require different levels of competition depending on the size of the transaction. Micro-purchases can be made without soliciting competitive quotes. Recipients can self-certify a micro-purchase threshold up to $50,000 per year if they can document a history as a low-risk auditee or complete an internal risk assessment; anything above $50,000 requires approval from the cognizant agency for indirect costs.7eCFR. 2 CFR 200.320 – Procurement Methods
Between the micro-purchase threshold and the simplified acquisition threshold of $350,000, you use small purchase procedures and gather quotes from multiple sources.8Acquisition.GOV. Threshold Changes Above $350,000, formal methods apply: sealed bids (preferred for construction with a detailed spec and at least two qualified bidders) or competitive proposals when factors beyond price matter.7eCFR. 2 CFR 200.320 – Procurement Methods
Conflict of Interest
Every recipient must maintain written standards of conduct covering conflicts of interest in procurement. No employee, officer, board member, or agent with a real or apparent conflict may participate in selecting, awarding, or administering a federally funded contract. A conflict exists whenever that person, a family member, a partner, or an organization employing any of them has a financial interest in a potential contractor. The standards must also prohibit accepting gifts, favors, or anything of monetary value from contractors or potential contractors (nominal-value exceptions are permitted) and must spell out disciplinary consequences. Organizations with a parent, affiliate, or subsidiary need a separate written policy on organizational conflicts of interest.9eCFR. 2 CFR 200.318 – General Procurement Standards
Personnel Costs Need Their Own Controls
Salary and wage charges are among the most frequently questioned cost categories, and the documentation standard reflects it. Records supporting personnel charges must rest on a system of internal control that provides reasonable assurance the charges are accurate, allowable, and properly allocated.10eCFR. 2 CFR 200.430 – Compensation – Personal Services
When an employee splits time between federal awards, or between federal and non-federal activities, your records must support how the salary distribution was determined. Budget estimates can serve as interim documentation, but only if your system produces reasonable approximations, significant changes in work activity are promptly recorded, and you conduct periodic after-the-fact reviews to confirm the final charges are accurate.10eCFR. 2 CFR 200.430 – Compensation – Personal Services The old detailed time-and-effort certifications are gone; the accuracy expectation is not. Auditors will still pull personnel files and compare timekeeping records against what was charged.
If You Pass Money to Others: Subrecipient Monitoring
Pass money along to another entity and you become a pass-through entity with a distinct set of duties. This is where many recipients underestimate the workload and end up with findings.
Every subaward agreement must include specific data: the subrecipient’s name and unique entity identifier, the Federal Award Identification Number, the subaward period of performance, the amount of federal funds obligated, the Assistance Listings title and number, the applicable indirect cost rate, and a project description as required by the Federal Funding Accountability and Transparency Act, among other items. Missing even a few of these can generate Single Audit findings.11eCFR. 2 CFR 200.332 – Requirements for Pass-Through Entities
Before issuing a subaward, assess the subrecipient’s risk of fraud and noncompliance. The four factors listed in the rule are prior experience with similar awards, results of previous audits, whether the subrecipient has new personnel or substantially changed systems, and the extent of any existing federal agency monitoring. That assessment determines how much monitoring you do; higher-risk subrecipients may need site visits, training, or agreed-upon-procedures engagements. Ongoing monitoring is mandatory regardless of risk: you review financial and performance reports, ensure corrective action on any problems, and issue management decisions on audit findings tied to your subaward.11eCFR. 2 CFR 200.332 – Requirements for Pass-Through Entities
Documentation, Record Retention, and the De Minimis Rate
Your financial management system must identify all federal awards received and expended, track the source and use of funds for each award, compare actual expenditures against budgeted amounts, and support every record with source documentation. Written procedures for determining cost allowability and for handling cash draws are also required.12eCFR. 2 CFR 200.302 – Financial Management
Records must be kept for three years from the date you submit your final financial report. For awards with quarterly or annual reporting, the three-year clock runs from each report submission. Several situations extend this:
- Pending litigation, claims, or audits: keep records until resolved, even past three years.
- Property and equipment: retain for three years after final disposition, not after purchase.
- Program income earned after the performance period: three years after the fiscal year in which the income was earned.
- Written notice from a federal agency or pass-through entity extending the period.13eCFR. 2 CFR 200.334 – Record Retention Requirements
Organizations without a federally negotiated indirect cost rate can elect a de minimis rate of up to 15 percent of modified total direct costs. The 2024 revisions raised this from 10 percent, which is a meaningful bump for smaller nonprofits. Once elected, apply it consistently to all federal awards until you negotiate a rate. No justification documentation is required to use it, but you still need to track direct costs accurately, since that’s the base.14eCFR. 2 CFR 200.414 – Indirect Costs
Mandatory Disclosures
When serious misconduct surfaces, disclosure is not optional. Under 2 CFR 200.113, any recipient or subrecipient must promptly disclose in writing whenever it has credible evidence of fraud, bribery, conflict of interest, or gratuity violations involving federal criminal law (Title 18) or the civil False Claims Act. The disclosure goes to the awarding federal agency, that agency’s Office of Inspector General, and to your pass-through entity if you received the money as a subrecipient.15eCFR. 2 CFR 200.113 – Mandatory Disclosures
The obligation applies even when the evidence is preliminary. Organizations that bury problems and hope they resolve quietly face harsher consequences than those that self-report. A failure to disclose triggers the full menu of noncompliance remedies, including suspension or termination.16eCFR. 2 CFR 200.339 – Remedies for Noncompliance
What Happens When Controls Fail
The Single Audit Threshold
Any organization that spends $1,000,000 or more in federal award funds during its fiscal year must undergo a Single Audit conducted by an independent auditor. The 2024 revisions raised this threshold from $750,000, freeing many smaller recipients from the formal Single Audit process (though other agency monitoring still applies).17eCFR. 2 CFR 200.501 – Audit Requirements
The auditor evaluates your internal controls, tests transactions, and reports findings. Federal agency staff can supplement the audit with site visits, staff interviews, or verification that grant-funded equipment is being used as intended.
Questioned Costs and Corrective Action
Audit findings often produce questioned costs: amounts the auditor concludes were noncompliant, poorly documented, or unreasonable under the prudent person standard.18eCFR. 2 CFR 200.1 – Definitions When an auditor finds documentation gaps in a sample, they project the error rate across the full population to estimate “likely questioned costs.” That extrapolation is how a $2,000 gap on a few transactions turns into a six-figure finding.
For each finding, your organization prepares a corrective action plan as a separate document from the auditor’s report. The plan names a responsible contact, describes the specific steps you’ll take, and gives an anticipated completion date. If you disagree with a finding, you explain why in detail.19eCFR. 2 CFR 200.511 – Audit Findings Follow-Up
Remedies Available to the Agency
When targeted conditions won’t fix the problem, the consequences escalate:
- Withholding payments until corrective action is taken.
- Disallowing costs, meaning the organization repays them from non-federal funds.
- Suspending or terminating the award, partially or entirely.
- Initiating suspension or debarment proceedings, barring the organization from federal awards.
- Withholding future funding or continuation awards for the project or program.16eCFR. 2 CFR 200.339 – Remedies for Noncompliance
Debarment is the most severe outcome and effectively shuts an organization out of federal funding. The more common pain points, though, are disallowed costs and withheld payments. An organization that can’t document how it spent $150,000 in personnel costs may end up writing a check back to the federal government from its operating budget. That outcome is preventable with strong written controls, adequate documentation, and a willingness to fix problems as soon as they surface.