Home / Resources / 2 CFR 200.332 explained
Plain-English guide · for nonprofits
2 CFR 200.332, explained in plain English
Updated October 2026
If you pass federal money to a subrecipient, §200.332 lists your duties. Check they are not barred, write a subaward with the required facts, rate their risk, monitor them, and verify they are audited when required.
The section at a glance
| Paragraph | What the pass-through entity must do |
|---|---|
| (a) | Verify the subrecipient is not excluded or disqualified |
| (b) | Identify every subaward as a subaward, with the required data in it |
| (c) | Evaluate each subrecipient's fraud risk and risk of noncompliance |
| (d) | Where appropriate, add specific conditions under §200.208 |
| (e) | Monitor: review reports, see that problems get fixed, issue a management decision on audit findings, and resolve them |
| (f) | Add monitoring tools as risk warrants: training, site visits, agreed-upon procedures |
| (g) | Verify the subrecipient is audited as subpart F requires |
| (h) | Consider whether audits or monitoring call for changes to your own records |
| (i) | Consider enforcement action against a subrecipient that does not comply |
Reviewing what your subrecipients send you under (e)? The free grant reporting requirements checklist lists what a grant report asks for, so you know what to look for.
First, are they a subrecipient at all?
§200.332, part of the Uniform Guidance, only applies to subrecipients. If the organization is really a contractor, buying from them is a procurement and a different set of rules applies. That call is made at §200.331, and it turns on the substance of the relationship, not what the agreement is called. Get it wrong in the direction of "contractor" and you have skipped everything below.
If you are the group receiving the subaward, this is what your pass-through owes you, and why it asks you for these papers.
What the subaward document has to carry
Paragraph (b) requires every subaward to be clearly identified as a subaward and to carry a defined set of facts. A subaward written as a simple letter of agreement carries almost none of it. The list includes:
- Their name and unique entity identifier.
- The Federal Award Identification Number (FAIN), and the award date.
- Start and end dates, for the period of performance and the budget period.
- Three amounts: obligated now, obligated to date, and committed in total.
- The project description.
- Who the agency is, who you are, and how to reach the awarding official.
- The Assistance Listings title and number.
- Whether the award is for research and development.
- The indirect cost rate, including if it is the de minimis rate.
The indirect cost rule
You must let the subrecipient use an indirect cost rate. It can be a rate they have negotiated with the federal government, a rate you and they negotiate, or the de minimis rate. What you may not do is force the de minimis rate on a subrecipient who already holds a federally negotiated rate. The de minimis figure itself is set at §200.414, not here.
Nor may you simply refuse indirect costs, unless a statute or the award caps them. A subaward that pays only direct costs pushes your subrecipient's overhead onto them.
Risk assessment first
Paragraph (c) makes you rate each subrecipient's risk of fraud and of getting the rules wrong. That rating sets how closely you watch them. The regulation says what to weigh. Have they run a subaward like this before? What did their last audit say, and do they get a Single Audit? Have they changed staff or systems? Has the federal agency flagged anything?
This is a short document, not a project. The rule does not say it must be written, but a dated one-page assessment is the simplest proof you did it before you started monitoring. Asking to see their written procedures helps too, since §200.303 on internal controls binds subrecipients as well as you.
Monitoring, sized to the risk
Paragraph (e) sets the floor: review the financial and performance reports they send you, follow up on deficiencies, ensure the subrecipient takes corrective action on any significant development that negatively affects the subaward, issue a management decision on audit findings relating to their subaward, and resolve those findings. Paragraph (f) lists the tools you may add where risk warrants it, including training and technical assistance, site visits, and agreed-upon-procedures engagements.
Three more duties sit outside the monitoring list. Paragraph (d): where appropriate, apply specific conditions under §200.208 and tell the federal agency. Paragraph (g): verify that the subrecipient is audited as required by subpart F. Paragraph (i): consider enforcement action under §200.339 against a subrecipient that does not comply. Reading the section as "write a good subaward and monitor" stops one paragraph too early.
"We sent the money and asked for a report at the end" is not monitoring, and it is where a pass-through gets a finding.
What is a management decision?
It's your written answer to a subrecipient's audit finding. Paragraph (e)(3) puts it on you, and §200.521 says what goes in it.
Say whether you sustain the finding, and why. Say what the subrecipient has to do: repay disallowed costs, make financial adjustments, or take other action. If their corrective action isn't finished, give a timetable. Include the auditor's reference number for each finding.
The clock: within six months of the Federal Audit Clearinghouse accepting the audit report.
What to actually do
Write one subaward template that carries the data elements
Build the list into the document once. Every subaward after that is fill-in-the-blanks, and the paragraph (b) problem disappears permanently.
Check SAM.gov before every award, and keep the screenshot
It takes a minute, and the evidence that you did it is the part auditors ask for.
Keep the risk assessment to one page
The four factors, a rating, a date, a signature, and what monitoring follows from it.
Decide the indirect rate deliberately
Ask whether they hold a negotiated rate before you offer the de minimis one. Getting this backwards is a compliance problem and a bad-faith look.
This is general information, not legal or accounting advice. Federal grant rules change and are applied differently by different agencies and auditors. Check with your auditor, your grant officer, or an attorney before relying on any of it.
The Ember tool for thisEmber Grants
Ember Grants keeps every award, deadline and report in one place. You can see what you owe each funder, and when. Unlimited users on every tier.
Sources: 2 CFR Part 200 (eCFR), read 29 August 2026, re-checked 1 September 2026 and again 3 October 2026; management decisions from §200.521, read 3 October 2026. Federal grant rules change; check the current text before relying on this.