Home / Resources / 2 CFR 200.303 explained
Plain-English guide · for nonprofits
2 CFR 200.303 (Internal Controls), explained in plain English
Updated October 2026
§200.303 says you must set up, write down and keep up internal controls over your federal award. You must also follow the rules and check your own compliance. Fix problems fast, and take reasonable steps to protect personal data.
Five paragraphs, (a) to (e), and each one is a duty. You won't find segregation of duties in the text. It's the most common way to show the effective internal control paragraph (a) asks for, and the checklist below shows how to do it with a small team. Two free tools help: the grant reporting requirements checklist, for checking your own compliance under (c), and the time and effort certification template, the kind of written salary record §200.430(g) expects.
The whole section, translated
§200.303 is five short paragraphs of the Uniform Guidance. Here is each one, and what it asks of a small organization.
“Establish, document, and maintain effective internal control over the Federal award that provides reasonable assurance that the recipient or subrecipient is managing the Federal award in compliance with Federal statutes, regulations, and the terms and conditions of the Federal award.”
Document is the operative word. An organization can have genuinely good habits and still fail this paragraph, because habits are not documentation. If your controls exist only in one person's head, you do not have internal control in the sense the regulation means.
The paragraph adds that these controls should align with the Comptroller General's Standards for Internal Control in the Federal Government, known as the Green Book, or the COSO Internal Control-Integrated Framework. Note the word: should, not must. You are not required to adopt either framework wholesale, which is a relief for a five-person organization. You are expected to be pointed in their direction.
“Comply with the U.S. Constitution, Federal statutes, regulations, and the terms and conditions of the Federal award.”
Nothing to translate. Worth noting only because it makes your award's terms and conditions a compliance requirement in their own right, so a promise in the agreement is enforceable through this section.
“Evaluate and monitor the recipient's or subrecipient's compliance with statutes, regulations, and the terms and conditions of Federal awards.”
You check yourself. Not the auditor, not the funder. A quarterly walk through your own requirements with someone writing down what they found satisfies this far better than an annual scramble.
“Take prompt action when instances of noncompliance are identified.”
This is the paragraph that rewards honesty. A problem you found, documented and fixed is evidence that (c) works. The same problem found by an auditor, with no record that you noticed, is evidence that it does not.
“Take reasonable cybersecurity and other measures to safeguard information including protected personally identifiable information (PII) and other types of information…” including anything the federal agency or pass-through entity designates as sensitive, or that you consider sensitive, consistent with applicable privacy law.
The 2024 revision added cybersecurity to this paragraph; protecting personal data was already required. If you hold client names, dates of birth, addresses, benefit eligibility or health information in a spreadsheet on a shared drive that everyone can open, that is the gap. “Reasonable” scales with your size, but it is not zero.
What “reasonable” looks like for a small organization
- Written policies for the things Part 200 assumes you have: procurement, allowability, time and effort, record retention. §200.302 on financial management asks for two of them by name, for payments and for allowable costs, and §200.430 on salaries sets the standard for time and effort records.
- Segregation of duties where you can manage it. If one person requests, approves and pays, add a second pair of eyes even if it is a board treasurer reviewing monthly.
- Access control. People can reach the data their job needs, not all of it. Departing staff lose access the day they leave.
- A named owner for each requirement, so “who checks this?” has an answer.
- A log of what you found and fixed. This is the cheapest evidence for (c) and (d) that exists.
Why auditors cite it
Because it is the section an auditor can reach for when something went wrong and no more specific rule quite fits. A late report, a missing determination, an unreconciled payroll charge, a spreadsheet nobody owns: each of those is also an internal control weakness. Strengthening §200.303 is therefore not one project. It is what you get when the rest of your processes are written down.
This is general information, not legal or accounting advice. Federal grant rules change and are applied differently by different agencies and auditors. Check with your auditor, your grant officer, or an attorney before relying on any of it.
The Ember tool for thisEmber Compliance
Ember Compliance keeps your common filing deadlines in one calendar, and you can add your own dates, like a yearly policy review. Email reminders start 30 days before each one. Unlimited users on every tier.
Sources: 2 CFR Part 200 (eCFR), §200.303. Read August 2026, re-checked against eCFR 1 September 2026 and 3 October 2026. Read the section itself before relying on any summary.