Federal Grant Compliance Checklist: Thresholds and Audit Prep
A phase-by-phase federal grant compliance checklist for research institutions and public sector grantees, with the current 2 CFR 200 thresholds and audit prep steps.
Last updated: September 2026
A federal grant compliance checklist is the working list of obligations attached to federal money, running from SAM.gov registration until the last record is destroyed. Most of those obligations live in 2 CFR part 200, the Uniform Guidance. The rules changed in 2024, and several thresholds that grants offices memorized years ago are now wrong. What follows runs in award-phase order, and every threshold below carries its citation. The last section covers how a two-person office handles the same rules. For the framework behind these rules, start with Uniform Guidance 2 CFR 200 grant management.
Quick Answer: What Is on a Federal Grant Compliance Checklist?
A federal grant compliance checklist covers nine areas:
- Eligibility and active SAM.gov registration.
- Financial management and internal controls.
- Procurement procedures and competition.
- Allowable, allocable, documented costs.
- Time and effort documentation for salaries.
- Subrecipient risk assessment and monitoring.
- Records kept three years past the final report.
- Financial and performance reporting on time.
- Single Audit readiness at $1,000,000 expended per year.
What Is Grant Compliance and What Does It Cover?
Grant compliance is the ongoing obligation to spend, document, and report federal award funds under the statutes, regulations, and terms attached to the award. It is not an event at year end. Controls have to run while the money is being spent, because an auditor tests the whole period rather than the day of the audit.
Almost every federal award is governed by the same short stack of documents. The Uniform Guidance at 2 CFR part 200 sets administrative requirements, cost principles, and audit requirements. The notice of funding opportunity and the award terms layer on program rules that can be stricter than the baseline. The OMB Compliance Supplement tells auditors what to test.
Agencies did not adopt the 2024 Uniform Guidance revision on the same day. OMB's revision applies to awards issued on or after October 1, 2024 (89 FR 30046). Health and Human Services took a split path: at 89 FR 80055 (October 2, 2024) it applied the raised Part 200 thresholds to awards issued on or after October 1, 2024, then replaced its own 45 CFR part 75 with 2 CFR part 200 effective October 1, 2025. The 2025 Compliance Supplement carries separate sections for awards made before and after October 1, 2024. Check the award terms rather than the calendar to see which version you are working under.
Federal Grant Compliance Requirements That Changed in 2024 and 2025
Seven thresholds moved, and record retention stayed where it was at three years. OMB's Guidance for Federal Financial Assistance, at 89 FR 30046 (April 22, 2024, effective October 1, 2024), raised five of them. A separate FAR rule raised the two procurement figures.
| Item | Current value (previous) | Citation |
|---|---|---|
| Single Audit threshold | $1,000,000 expended per fiscal year ($750,000) | 2 CFR 200.501(a) |
| Equipment capitalization | Lesser of your capitalization level or $10,000 ($5,000) | 2 CFR 200.1 |
| Residual unused supplies | Over $10,000 aggregate at end of performance ($5,000) | 2 CFR 200.314(a) |
| De minimis indirect rate | Up to 15% of modified total direct costs (10%) | 2 CFR 200.414(f) |
| Fixed amount subawards | Up to $500,000 with prior approval ($250,000) | 2 CFR 200.333 |
| Micro-purchase threshold | $15,000 ($10,000) | 48 CFR 2.101 |
| Simplified acquisition threshold | $350,000 ($250,000) | 48 CFR 2.101 |
The procurement figures come from FAR Case 2024-001, 90 FR 41872 (August 27, 2025), effective October 1, 2025. Every value above was checked against the current eCFR text on August 9, 2026.
Federal Grant Compliance Checklist by Award Phase
Each phase has a different owner and different evidence. Citations below are to 2 CFR part 200 unless noted.
Pre-Award Eligibility and Registration
| Requirement | Evidence to keep | Citation |
|---|---|---|
| Active SAM.gov registration | Confirmation and Unique Entity ID | SAM.gov, renew every 365 days |
| Not suspended or debarred | Dated SAM.gov exclusion check | 2 CFR part 180 |
| Cost share commitment | Executive approval of the match | 200.306 |
| Mandatory disclosure policy | Policy naming who reports and to whom | 200.113 |
A lapsed SAM.gov registration can freeze payments on awards you already hold. Put the renewal date on the reporting calendar.
Financial Management and Internal Controls
| Requirement | Evidence to keep | Citation |
|---|---|---|
| Identify every award received and expended | Assistance Listings number, FAIN, agency | 200.302(b)(1) |
| Source documentation per charge | Invoices, receipts, payroll | 200.302(b)(3) |
| Documented internal control | Written narrative, Green Book or COSO | 200.303(a) |
| Safeguards for PII | Access controls and a written policy | 200.303(e) |
Procurement
| Requirement | Evidence to keep | Citation |
|---|---|---|
| Written procurement procedures | The document, approved and dated | 200.318(a) |
| Conflict of interest standards | Policy plus signed annual disclosures | 200.318(c)(1) |
| Price reasonableness for micro-purchases | File note on the basis | 200.320(a)(1)(ii) |
| Quotes below the simplified acquisition threshold | Quotes and selection rationale | 200.320(a)(2)(i) |
| Public notice above the simplified acquisition threshold | Solicitation and award memo | 200.320(b) |
| No covered telecommunications equipment | Vendor certification | 200.216 |
You set your own micro-purchase threshold. You may self-certify up to $50,000 annually with a documented justification plus one supporting condition, such as low-risk auditee status or an annual internal risk assessment (200.320(a)(1)(iv)). A threshold above $50,000 must be approved by the cognizant agency for indirect costs (200.320(a)(1)(v)).
Allowable Costs
| Test | What auditors look for | Citation |
|---|---|---|
| Necessary and reasonable | A prudent-person rationale on file | 200.403(a) |
| Consistent treatment | Never direct here, indirect there | 200.403(d) |
| Not used as match elsewhere | No double counting across programs | 200.403(f) |
| Adequately documented | Source documents, not summaries | 200.403(g) |
| Inside the approved budget period | Date-tested transactions | 200.403(h) |
| Prior written approval where required | The approval email or amendment | 200.407 |
Section 200.407 lists sixteen cost categories where prior written approval can determine allowability, including equipment, pre-award costs, and travel.
Time and Effort Documentation
| Requirement | What satisfies it | Citation |
|---|---|---|
| Records reflect work performed | After the fact, not intentions | 200.430(g)(1) |
| Supported by internal control | Documented review and approval | 200.430(g)(1)(i) |
| Part of official records | Payroll system, not a side spreadsheet | 200.430(g)(1)(ii) |
| Total does not exceed 100% | All funding sources reconciled | 200.430(g)(1)(iii) |
Budget estimates alone do not support a payroll charge. They work for interim accounting only when the system produces reasonable approximations, changes are entered promptly, and controls include after-the-fact reviews that trigger adjustments (200.430(g)(1)(vii)). Effort certified months late with no reconciliation is a finding.
Subrecipient Monitoring
| Requirement | Evidence to keep | Citation |
|---|---|---|
| Verify the subrecipient is not excluded | Dated SAM.gov check | 200.332(a) |
| Identify the award as a subaward | Agreement with all 14 data elements | 200.332(b)(1) |
| State the indirect cost rate | Negotiated, agreed, or de minimis | 200.332(b)(4) |
| Evaluate fraud and noncompliance risk | Written assessment per subrecipient | 200.332(c) |
A subrecipient is an entity that receives a subaward to carry out part of a federal program and is therefore subject to that program's compliance requirements. A contractor sells goods or services in a competitive market and is not. The classification decides which rules flow down.
Records and Retention
| Record type | Retention period | Citation |
|---|---|---|
| General award records | 3 years from the final financial report | 200.334 |
| Records under litigation or audit | Until resolved and closed | 200.334(a) |
| Property and equipment records | 3 years after final disposition | 200.334(c) |
| Indirect cost proposals submitted | 3 years from date of submission | 200.334(f)(1) |
For awards renewed quarterly or annually, the clock runs from that periodic report. Agencies may not add retention rules beyond the exceptions in 200.334.
Reporting
| Report | Deadline | Citation |
|---|---|---|
| Annual financial report | Within 90 days after the reporting period | 200.328(c) |
| Quarterly or semiannual report | Within 30 days after the period | 200.328(c) |
| Final financial report, recipient | Within 120 days after performance ends | 200.328(d) |
| Final financial report, subrecipient | Within 90 days after the subaward ends | 200.328(d) |
| Closeout reports and liquidation | Within 120 days after performance ends | 200.344(b), (c) |
Performance reports must connect financial data to the goals in the award. Building that link while the project runs costs less than reconstructing it at closeout. The narrative side of the job is covered in the grant reporting requirements and progress report template.
Audit Readiness
An audit goes well when the evidence already exists in the form the Uniform Guidance requires, rather than being assembled while the auditor waits.
| Item | What to have ready | Citation |
|---|---|---|
| Schedule of Expenditures of Federal Awards | Reconciled to the ledger | 200.510(b) |
| Summary schedule of prior audit findings | Status of every prior finding | 200.511(b) |
| Corrective action plan | Named owner and date per finding | 200.511(c) |
| Package filed with the Federal Audit Clearinghouse | Submission confirmation | 200.512(d) |
Who Needs a Single Audit and When
An organization that expends $1,000,000 or more in federal awards during its own fiscal year must have a Single Audit or a program-specific audit for that year, under 2 CFR 200.501(a). Below that amount the entity is exempt from federal audit requirements for the year under 200.501(e), though records must still be available to the agency, the pass-through entity, and the Government Accountability Office.
A Single Audit is an organization-wide audit of both the financial statements and federal award compliance, performed under 2 CFR 200.514. A program-specific audit is a narrower alternative, available when the entity expends awards under only one program, excluding research and development, and no financial statement audit is otherwise required (200.501(c)).
The test is what you expended, not what you were awarded. A $3,000,000 five-year award triggers nothing by itself, while drawing $1,050,000 of it in a single fiscal year does. Money you received as a subrecipient counts toward the total, and money you received as a contractor does not (200.501(g)).
The reporting package and data collection form are due within 30 calendar days after the auditee receives the auditor's report, or nine months after the audit period ends, whichever is earlier (200.512(a)(1)). For a June 30 year end, that is March 31. Agencies running several programs can keep those dates visible across departments with public sector grant management.
The Most Common Federal Audit Findings and How to Prevent Each
Subaward oversight is the largest identified cluster. The Government Accountability Office analyzed 3,680 single audit findings from audit years 2022 to 2024 and found that 1,332 of them, 36 percent, were primarily associated with three topics: incomplete subaward reporting, subrecipient monitoring activities, and verifying or justifying eligibility decisions (GAO-25-107315, March 26, 2025).
Within each of those topics, deficient internal control at the prime recipient was the leading attributed cause.
| GAO finding topic | Findings | Attributed to deficient internal control | Prevention |
|---|---|---|---|
| Incomplete subaward reporting | 517 | 199 of 517 (38.5%) | Give FFATA reporting one named owner and a monthly task |
| Subrecipient monitoring activities | 482 | 224 of 482 (46.5%) | Write a monitoring plan at execution, scaled to assessed risk |
| Verifying or justifying eligibility | 333 | 101 of 333 (30%) | Date-stamp the SAM.gov exclusion check in the subaward file |
Two other causes recur. Inside the subaward reporting group, GAO attributed 99 findings (19.1%) to recipients not understanding or not being aware of federal requirements, and 44 (8.5%) to personnel limitations such as inadequate staffing and turnover. Read the award terms at kickoff rather than at closeout, and name a backup owner for every award on day one.
Repeat findings are the second pattern. In a review of Temporary Assistance for Needy Families awards, GAO identified 162 findings across 37 states: 56 were material weaknesses, 37 repeated for two or more years, and three had gone unresolved for over a decade (GAO-25-107291, April 4, 2025). Auditors read a repeat finding as a control failure rather than a one-off error. When a finding is classified as a material weakness, it disqualifies the auditee from low-risk status under 2 CFR 200.520(c), which removes the reduced audit coverage that status allows under 200.518.
The 2025 Compliance Supplement, announced at 90 FR 54400 (November 26, 2025), names twelve requirement types auditors may test: activities allowed or unallowed; allowable costs and cost principles; cash management; eligibility; equipment and real property management; matching, level of effort, and earmarking; period of performance; procurement and suspension and debarment; program income; reporting; subrecipient monitoring; and special tests and provisions. Build one evidence folder per applicable type.
Grant Compliance Checklist Template You Can Copy
A federal grant compliance checklist works on a cadence: some items are set once at award acceptance, others repeat monthly or quarterly until closeout. Paste this into the award file and work it on the stated schedule.
At award acceptance
- SAM.gov registration active, renewal date recorded.
- Award terms read, Uniform Guidance version identified.
- Period of performance and budget period recorded separately.
- Approved budget entered under an award-specific code.
- Indirect rate documented: negotiated, agreed, or de minimis up to 15%.
- Prior approval items from 200.407 flagged in the budget.
- Reporting calendar built, including the final report at 120 days.
- Named owner and named backup assigned.
Monthly
- Ledger reconciled to the award budget by line.
- Payroll charges reconciled to effort records.
- Cumulative federal expenditures compared to the $1,000,000 audit line.
- Drawdowns matched to actual disbursements.
Quarterly
- Subrecipient invoices checked against the approved subaward budget.
- Subrecipient risk ratings revisited.
- Prior findings checked for corrective action progress.
At closeout
- Final reports submitted and obligations liquidated within 120 days.
- Equipment inventoried, disposition instructions requested above $10,000.
- Retention date set at three years from the final financial report.
The full closeout sequence sits in the grant closeout checklist.
How Small Organizations Meet Federal Grant Compliance Requirements Without a Compliance Department
A two-person grants office can be compliant. It cannot run a large university's control structure, so the approach differs: fewer documents and tighter defaults on one calendar.
Elect the de minimis rate. Recipients without a current federally negotiated rate may charge up to 15 percent of modified total direct costs. It needs no documentation to justify, may be used indefinitely, and pass-through entities may not force a lower rate (200.414(f)). That saves a rate negotiation you would otherwise have to run and defend.
Set a low micro-purchase threshold on purpose. The FAR ceiling is $15,000, but 200.320(a)(1)(iii) makes the threshold your decision. At $5,000, most purchases need one documented price justification rather than a competition file.
Write four policies, not a manual. Procurement and conflict of interest, cost allowability and prior approval, time and effort, subrecipient monitoring. Two pages each, approved and dated. Those cover most written-procedure requirements in 200.318(a), 200.302(b), and 200.332.
Track expenditures against the audit line monthly. The $1,000,000 threshold measures federal awards expended in your fiscal year, including funds received as a subrecipient. Organizations get caught out because nobody adds subawards to direct awards until the auditor does.
Use one calendar for every date. SAM.gov renewal, interim reports, the 120-day final report, subrecipient invoice reviews, and the audit deadline belong in one place with an owner attached. Reporting deadlines are what a small team drops first. A spreadsheet usually gives out somewhere past a dozen awards. GrantCue tracks the same deadlines, tasks, and reporting dates across a whole portfolio. Research offices with awards spread across departments can see how that works in research institutions grant management.
Fix findings the first time. A material weakness costs an organization its low-risk auditee status under 200.520(c), and losing that status raises the share of federal expenditures an auditor must cover under 200.518. Give each finding an owner and a date, and check progress quarterly.
FAQ
What is grant compliance?
Grant compliance is the obligation to spend, document, and report grant funds according to the statutes, regulations, and terms of the award. For federal awards, the core requirements sit in 2 CFR part 200, plus any stricter rules in the award terms.
Who needs a Single Audit?
Any non-federal entity that expends $1,000,000 or more in federal awards during its own fiscal year, under 2 CFR 200.501(a). Entities below that are exempt for the year but must still make records available for review (200.501(e)).
How long do you have to keep federal grant records?
Three years from the date you submit the final financial report, under 2 CFR 200.334. Property and equipment records run three years from final disposition, and records tied to open litigation or audit findings are kept until the matter is resolved.
What is the micro-purchase threshold for federal grants?
The federal micro-purchase threshold is $15,000 at 48 CFR 2.101, raised from $10,000 effective October 1, 2025. Recipients may self-certify a threshold up to $50,000 annually with a documented justification, and anything above that must be approved by the cognizant agency for indirect costs (2 CFR 200.320(a)(1)(iv) and (v)).
What are the most common single audit findings?
Subaward oversight leads. GAO found that 36 percent of 3,680 single audit findings issued between 2022 and 2024 were primarily associated with incomplete subaward reporting, insufficient monitoring, or unverified subrecipient eligibility (GAO-25-107315, March 26, 2025).
Do small organizations have to follow the Uniform Guidance?
Yes. The administrative requirements and cost principles in 2 CFR part 200 apply regardless of size. Only the audit requirements in subpart F carry a dollar threshold, so a small grantee follows the same procurement, cost, and reporting rules without necessarily needing an audit.
Next Step
Pick your largest active federal award and answer a few questions about it today: which version of the Uniform Guidance its terms invoke, what your cumulative federal expenditures are this fiscal year, and when its final financial report is due. Those answers tend to surface more gaps than a full policy review does. Then work the phase-by-phase tables in this checklist alongside 2 CFR 200 grant management, and put every date into one tracked calendar with a named owner. Any date without a name next to it is the first thing to fix.