GRANTS MANAGEMENT:

Report to the Ranking Member

Committee on Homeland Security and Governmental Affairs

U.S. Senate

November 2026

GAO-27-108450

United States Government Accountability Office

A report to the Ranking Member, Committee on Homeland Security and Governmental Affairs, U.S. Senate

Contact: Jeff Arkin at arkinJ@gao.gov

What GAO Found

Federal regulations assign most oversight responsibility for grant funds that are passed through as a subaward to prime recipients, such as states. This oversight is essential for reducing the risk of fraud and ensuring program goals are met.

Nonfederal entities, such as states, that expend over $1 million in federal awards during a fiscal year are required to have a single audit. GAO reviewed a nongeneralizable random sample of single audit findings from 2020 through 2024 and identified the four most frequently cited oversight deficiencies related to state oversight of subawards.

·       Evaluating subrecipient risk. States must assess subrecipients’ risk to inform appropriate monitoring. Deficiencies in this area included assessments that were incomplete.

·       Monitoring subrecipients. States must monitor activities to ensure that subrecipients comply with federal statutes, regulations, and the terms and conditions of the subaward. Deficiencies in this area included not ensuring that subrecipient expenses were supported or allowable and not ensuring subrecipients undergo required single audits. 

·       Addressing issues that arise. States must take action when instances of subrecipient noncompliance are found. Deficiencies in this area included not issuing timely management decisions on reported audit findings and not ensuring that subrecipients resolved issues.

·       Reporting on subawards. States generally must report subawards of $30,000 or more. Deficiencies in this area included reports that were inaccurate or had not been submitted.

Challenges with capacity, streamlining, transparency, and internal controls and oversight can contribute to these deficiencies. State grant management officials and other knowledgeable entities GAO interviewed made suggestions for addressing some of these challenges.

·       Capacity challenges: Suggestions included automating oversight steps and conducting more training to mitigate the effects of staff turnover.

·       Streamlining challenges: Suggestions included standardizing forms and receiving more consistent federal guidance.

·       Transparency challenges: Suggestions included sharing data between state and federal agencies and collecting additional data on subrecipients.

·       Internal control and oversight challenges: Suggestions included receiving timely federal guidance on changes and updating grant management systems to expand capabilities.

Statutory and regulatory changes, agency action, and open recommendations could also be opportunities to enhance subaward oversight. Many of these suggestions and opportunities align with practices in GAO’s Fraud Risk Framework and could help reduce the risk of fraud. For example, automated data-analytic tests can help manage fraud risk.

Why GAO Did This Study

The federal government obligated over $1.2 trillion in grant awards in fiscal year 2025. The majority of those funds were awarded to states through a variety of grants programs. States can be directly involved in delivering program benefits and services or they can pass a portion of this funding onto other entities in the form of subawards to carry out parts of the work associated with the grant.

Understanding how states address their oversight responsibilities, the challenges they face, and opportunities to improve oversight is important for ensuring federal funds are safeguarded from fraud risks and federal programs are operating efficiently and effectively.

GAO was asked to review various issues related to subaward oversight. This report describes (1) the requirements for states’ oversight of subawards most frequently cited in audit report findings and how selected states conduct oversight; and (2) opportunities to address the challenges associated with these requirements to reduce fraud risk.

GAO analyzed findings from a nongeneralizable random sample of 96 single audits reported on the Federal Audit Clearinghouse to identify the most frequently cited oversight requirements related to state subaward oversight. GAO also reviewed inspectors general reports and prior GAO work. GAO met with nine knowledgeable entities and officials from nine state grant offices with experience overseeing subawards to describe how state grant recipients carry out their oversight responsibilities, any challenges they face, and opportunities to address those challenges.

 

 

 

 

 

BIE	Bureau of Indian Education
CDBG-DR	Community Development Block Grant - Disaster Recovery
CDO	Chief Data Officer
CIGIE	Council of the Inspectors General on Integrity and Efficiency
FAC	Federal Audit Clearinghouse
FSRS	Federal Funding Accountability and Transparency Act of 2006 Subaward Reporting System
GSA	General Services Administration
HHS	Department of Health and Human Services
HUD	Department of Housing and Urban Development
OIG	Office of Inspector General
OMB	Office of Management and Budget
SAM.gov	System for Award Management
SEFA	Schedule of Expenditures of Federal Awards
TANF	Temporary Assistance for Needy Families
Uniform Guidance	Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards

November 10, 2026

The Honorable Gary C. Peters
Ranking Member
Committee on Homeland Security and Governmental Affairs
United States Senate

Dear Ranking Member Peters:

The federal government obligated over $1.2 trillion in grant awards in fiscal year 2025.[1] The majority of those funds were awarded to states through a variety of grants programs. States receiving federal grants can be directly involved in delivering program benefits and services or they can pass through a portion of the funding to other entities (such as local governments) in the form of subawards to carry out parts of the work associated with the grant.[2] States have collectively reported passing through over $200 billion in federal assistance to subrecipients each year from 2021 through 2024.[3]

Our prior work, as well as federal Offices of Inspectors General (OIG) reports, have identified a number of issues related to subaward oversight, including instances of subawards not being reported properly, grant recipients not performing required risk assessments of subrecipients, and grant recipients not reviewing single audit reports for their subrecipients.[4] While subrecipients can be effective in delivering federal program benefits and services, every level added to the flow of federal funds creates new entry points for fraud risk. Understanding how states address their oversight responsibilities to reduce this risk, the challenges they face, and opportunities to improve oversight is important for ensuring federal funds are safeguarded and federal programs are operating efficiently and effectively.

You asked us to review various issues related to subaward oversight. This report describes (1) the requirements for states’ oversight of subawards most frequently cited in audit report findings and how selected states conduct oversight; and (2) opportunities to address the challenges associated with these requirements to reduce fraud risk.

We reviewed relevant federal statutes and regulations to identify oversight requirements for prime recipients or pass through entities. We reviewed Office of Management and Budget (OMB) guidance to identify oversight requirements for prime recipients or pass through entities. To identify the most common audit report findings related to state oversight of subawards, we used data from the Federal Audit Clearinghouse (FAC) to identify roughly 2,900 single audit findings from fiscal years 2020 through 2024 that were directed to states and related to funding the states passed through to other entities.[5] We conducted a content analysis on a nongeneralizable random sample of 96 of these single audit findings to identify the oversight requirements most frequently cited. We also reviewed our own reports and conducted a literature search of Inspectors General reports published between January 2020 and July 2025 to supplement our review of previously published audit reports relevant to states’ oversight of subrecipients.

We interviewed state grant officials to further understand these common audit findings related to subaward oversight challenges and to identify opportunities to address them. To select these officials, we first analyzed state-reported pass-through funding amounts to identify the three federal agencies with the most federal funding reported being passed through by states from fiscal years 2020 through 2024. We then selected three programs with some of the highest reported pass-through amounts for each agency. We then randomly selected nine states and identified the relevant state agencies that administered the nine programs for interviews. The results from these interviews cannot be generalized to all states and state agencies, but they are designed to reflect a range of experiences and perspectives on oversight challenges and opportunities to address them. We also interviewed nine knowledgeable entities, including associations that represent state governments, about common subaward oversight challenges and opportunities to address them.

We also reviewed our prior work to identify open recommendations that could lead to improvements in subaward oversight.

To find illustrative examples of adjudicated fraud involving federal grants that were passed on as subawards, we conducted a literature search of press releases from the Department of Justice and state attorneys general offices. For more information on our scope and methodology, see appendix I.

We conducted this performance audit from April 2025 to November 2026 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Background

Federal agencies award funds to nonfederal entities, such as state governments, to support a wide range of national priorities such as health care, transportation, income security, education, job training, social services, community development, and environmental protection.[6] These awards–known as prime awards–can be passed through to other entities, such as local governments or nonprofit organizations, in the form of a subaward, to carry out part of the work associated with the grant award. Federal awarding agencies do not have a direct legal relationship with subaward recipients, also known as subrecipients.[7] Instead, OMB’s Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) assigns most oversight responsibility for those funds to the states and other pass-through entities, while federal agencies are to monitor states and other prime recipients’ oversight of their subawards.[8]

When awarding and managing federal grants, effective oversight and internal controls are important to provide reasonable assurance to federal managers and taxpayers that grants are awarded properly, recipients are not barred from receiving the award, and federal grant funds are used as intended and in accordance with applicable laws and regulations. To that end, OMB issues Uniform Guidance, which provides requirements for prime recipient oversight of grants and other forms of federal assistance, including subawards.[9] For example, prime recipients are responsible for determining whether the funds they pass through to another entity are for the procurement of goods and services, making them a contractor, or for delivering a portion of the work associated with the grant, making them a subrecipient.[10] See figure 1 for a summary of Uniform Guidance oversight requirements for prime recipients of grants, such as states, that pass funds through to subrecipients.

Note: Previously, prime recipients (e.g., states) reported subawards to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). FSRS has been retired and replaced by the System for Award Management (SAM.gov), which is an official U.S. government website that centralizes federal award life cycle management.

^aThroughout this report, we refer to state pass-through entities as prime recipients that award funds to a subrecipient to carry out part of a federal program.

In addition to Uniform Guidance, prime recipients may be subject to additional oversight requirements specified in federal statutes, federal regulations, or state statutes.[11]

Selected States Reported Using a Variety of Approaches to Address the Oversight Requirements We Identified with the Most Frequently Cited Deficiencies

In our review of single audit report findings, we identified four requirements related to state subaward oversight that were most often cited: (1) evaluate subrecipients’ risk to determine appropriate monitoring, (2) conduct monitoring of subrecipients to ensure compliance with requirements, (3) address issues that arise, and (4) report on subawards and subrecipients.[12] We observed similar findings in OIG reports we reviewed. We discussed these oversight areas with state officials to describe what they consider to be effective oversight practices.

Evaluating Subrecipients’ Risk to Determine Appropriate Monitoring

Evaluating subrecipients’ risk to determine appropriate monitoring was one of the most frequently cited oversight requirement deficiencies we identified in state audit findings. Examples of the deficiencies included

·       incomplete assessments of the subrecipient’s risk,

·       inadequate procedures for assessing subrecipient risk, and

·       lack of documentation for subrecipient risk assessments.

For example, a fiscal year 2020 single audit of a state’s health care authority found that the state agency did not comply with federal requirements to ensure all subrecipients received risk assessments and did not have a uniform process to ensure risk assessments when new contracts were executed. Specifically, the audit reported that the health care authority executed 99 subrecipient contracts during the fiscal year and found that risk assessments were not performed on 90 of the subrecipient contracts (91 percent). The audit concluded that without establishing adequate internal controls and monitoring procedures, the state health care authority cannot ensure risk assessments are performed and ensure consistency in determining the appropriate amount of monitoring for each subrecipient.

We identified similar types of deficiencies regarding risk assessments in the federal OIG audits we reviewed. For example, a fiscal year 2024 OIG audit found that a state’s attorney general’s office had not conducted any subrecipient risk assessments since 2020. When the OIG inquired about the lack of risk assessment, state officials responded that they were unsure what risk assessments entailed and how to document them. The OIG concluded that because the state office was not complying with its policy to conduct risk assessments, it may not know which subrecipients would be considered high risk and, therefore, should receive enhanced monitoring efforts.[13] Effective risk assessments are a key component of internal controls and GAO’s Framework for Managing Fraud Risks in Federal Programs (Fraud Risk Framework).[14] If risk is not properly assessed, federal funds could be passed through to entities with outstanding audit findings or that do not have the capability to effectively manage federal funds.

The Uniform Guidance requires that pass-through entities, such as states, evaluate each subrecipient’s fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring. Under the Uniform Guidance, when evaluating a subrecipient’s risk, a pass-through entity should consider, among other things: (1) the subrecipient’s prior experience with the same or similar subawards; (2) the results of previous audits, such as single audit reports; (3) whether the subrecipient has new personnel or new or substantially changed systems; and (4) the extent and results of any federal agency monitoring, for example, if the subrecipient also receives federal awards directly from the federal agency.

State grant officials we interviewed identified effective practices for assessing subrecipients’ risk, including

·       using a formal, standard, objective risk assessment form, which is scored or weighted to evaluate risk level;

·       incorporating staff knowledge and experience in risk assessments;

·       assessing the subrecipient’s prior grant experience by reviewing prior audit reports and other available information; and

·       maintaining familiarity with subrecipients through regular communication and outreach, such as site visits.

State grant officials we spoke to shared with us examples of their subrecipient risk assessment processes. For example, grant officials from one state told us that they developed a risk assessment with 28 risk indicators which, among other things, asks whether subrecipients have received a management decision letter with sustained findings in prior years, had grant management concerns, or experienced key staff turnover. Another state provided us with a risk assessment tool that includes seven fields that collect data about the subrecipient and the grant, including the award size, the subrecipient’s history with federal grants, and the experience of program leadership. Some states use these kinds of assessments to assign subrecipients a risk level (such as high, medium, and low), which often informs the level of monitoring that is appropriate for each subrecipient.

Conducting Monitoring of Subrecipients to Ensure Compliance with Requirements

Conducting monitoring of subrecipients to ensure compliance with requirements was also a frequently cited oversight requirement deficiency we identified in state single audit findings. Examples of these included

·       failing to monitor subrecipients,

·       failing to document subrecipient monitoring,

·       reimbursing subrecipients for costs outside the authorized period of performance,

·       failing to ensure that progress data reported by subrecipients were accurate or complete,

·       failing to ensure that subrecipient reported expenses were adequately supported,

·       having incomplete plans or procedures for overseeing subrecipients,

·       failing to ensure that subrecipient costs were allowable,

·       failing to ensure that subrecipients receive single audits, and

·       failing to review subrecipients’ single audit reports within required time frames.[15]

For example, a fiscal year 2023 single audit of a state’s department of public safety found that the state did not perform required reviews of single audits for subrecipients. Specifically, the state did not monitor whether 12 of the department’s subrecipients required a single audit or review the subrecipients’ single audit reports and issue a management decision on findings, if applicable. These deficiencies could limit the state’s ability to identify enforcement actions that may be needed against noncompliant subrecipients or to make subsequent revisions to the risk assessments of the subrecipients.

OIG audit reports we reviewed identified similar issues related to states’ monitoring. For example, a fiscal year 2023 OIG audit found that a state’s department of health care services did not ensure that the cost related to the subrecipient’s submission for reimbursement of transitional housing services was allowable. Specifically, the subrecipient had submitted for reimbursement approximately $1.7 million for transitional housing services that had been previously reimbursed. OIG reported that the state’s cost review process was limited and therefore did not identify that this subrecipient expenditure had already been reimbursed.[16]

We also identified a fraud case that illustrates the importance of states complying with subrecipient monitoring requirements. In March of 2025, the Department of Justice announced that a former executive of a nonprofit organization pleaded guilty to a federal fraud charge for her role in misappropriating $1.8 million intended to support the organization’s work with underprivileged youth between 2012 and 2017.[17] According to the announcement, the grants this nonprofit received included funds from a federal program offering financial support for academic enrichment opportunities. The state agency that passed these funds to the nonprofit subrecipient in question received a single audit finding across several programs (including the program offering financial support for academic enrichment opportunities) in which auditors determined that the state had not adequately monitored their subrecipients.

Effective monitoring is another key component of internal controls and our Fraud Risk Framework.[18] Standards for Internal Control states that management should establish activities to monitor the internal control system and evaluate the results. Our Fraud Risk Framework states that ongoing monitoring and periodic evaluations provide assurances to managers that they are effectively preventing, detecting, and responding to potential fraud. Monitoring and evaluation activities can also support managers’ decisions about allocating resources and help them to demonstrate their commitment to effectively managing fraud risks.[19] Inadequate subrecipient monitoring provides less assurance that subrecipients are following award requirements and meeting program goals and increases the risk of fraud.

Prime grant recipients are required to monitor subrecipients’ activities as necessary to ensure that the subrecipients comply with federal statutes, regulations, and the terms and conditions of their subawards. Monitoring includes reviewing subrecipients’ financial and performance reports, verifying that subrecipients that meet requirements receive audits, which can be a single or program-specific audit, and monitoring cash drawdowns to ensure that the time elapsing between the transfer of federal funds to subrecipients and their disbursement for program purposes is minimized. Monitoring can also include conducting site visits and providing training and technical assistance.[20]

State grant officials we interviewed identified effective practices for monitoring subrecipients, including the following:

·       communicating frequently with subrecipients,

·       building relationships with subrecipients,

·       maintaining written procedures and policies for subrecipient monitoring,

·       conducting desk reviews and site visits, and

·       reviewing documents, such as invoices, audit findings, or performance reports.

State grant officials we spoke to shared examples of their various subrecipient monitoring processes with us. For example, grant officials from one state told us they try to visit their subrecipients quarterly, where they check invoices of expenditures to verify spending claims, review equipment, and take photographs of each purchased item. Grant compliance officers then use the photographs to verify whether the equipment costs were allowable and in line with the approved amounts. Grant officials from another state told us that they conduct desk reviews annually and site visits every 3 years unless there is an issue such as major staff turnover or compliance issue that would cause them to conduct a site visit more frequently.

Addressing Issues that Arise

For effective oversight, agencies must be able to identify the risk of recipients misusing federal awards and develop appropriate responses to those risks. We have previously reported on severe and persistent findings in single audit reports.[21] For example, in April 2024, we reported that $1.17 trillion of the reported $6.97 trillion of direct federal award funds spent by recipients from 2017 through 2021 were linked to single audit findings that were both severe and persistent.[22]

Addressing issues that arise was a frequently cited oversight requirement deficiency we identified in the state single audit findings. Examples of these deficiencies included

·       failing to ensure that subrecipients addressed identified issues,

·       failing to issue timely management decisions on reported audit findings, and

·       failing to follow up on potential issues with the program.

For example, a fiscal year 2020 single audit found that a state family and children services agency did not always ensure that subrecipients took timely and appropriate action to correct deficiencies noted during monitoring. Specifically, the audit found that after the state had reported findings in its subrecipient monitoring report, the state did not prepare a corrective action plan or document that the appropriate follow-up procedures were conducted to ensure that the findings were corrected. The audit concluded that if the state agency does not follow up with subrecipients about deficiencies noted during monitoring, it cannot ensure that all deficiencies are corrected or that the subrecipients are utilizing subawards for authorized purposes, and that subaward performance goals are achieved.

Addressing issues that arise is a key component of internal controls and our Fraud Risk Framework. If monitoring identifies a noncompliance deficiency, Standards for Internal Control states that management should remediate identified internal control deficiencies with appropriate corrective actions on a timely basis. Our Fraud Risk Framework states that monitoring activities can serve as an early warning system for managers to help identify and promptly resolve issues through corrective actions and ensure compliance with existing laws, regulations, and standards. If issues are not addressed, they could lead to inappropriate use of federal funds and allow non-compliant subrecipients to continue receiving federal funds. This can put federal funds and program objectives at risk.

The Uniform Guidance also requires that recipients, such as states, take action when instances of noncompliance are found. Such actions include

·       ensuring that subrecipients take corrective action on all significant developments that negatively affect their subawards;

·       issuing a timely management decision for audit findings for the federal award provided to subrecipients from pass-through entities;

·       considering whether the results of subrecipients’ audits, site visits, or other monitoring necessitate adjustments to pass-through entities’ records; and

·       considering enforcement action against noncompliant subrecipients.

State grant officials we interviewed identified effective practices for addressing issues that arise with subrecipients, including the following:

·       issuing letters identifying the noncompliance issues and the corrective actions needed to resolve the noncompliance;

·       communicating regularly with the subrecipients experiencing issues;

·       providing technical assistance, if needed; and

·       communicating that funds may be withheld if the issue is not corrected.

State grant officials we spoke to shared examples of their various processes for addressing issues that arise with their subrecipients. For example, grant officials from one state told us they immediately follow up in writing with detailed instructions on how the subrecipient can correct the problem. Officials from another state told us that when issues are identified (whether through program monitoring, fiscal reviews, documentation reviews, or audit findings) they work directly with subrecipients to clarify requirements, request additional documentation, and provide technical assistance as needed. They added that if deficiencies persist or present an elevated risk, corrective actions are formally documented, and follow-up monitoring is conducted until the issues are resolved.[23]

Reporting On Subawards and Subrecipients

Generally, prime grant recipients that pass through federal funds must report each subaward that equals or exceeds $30,000 in federal funds to the System for Award Management (SAM.gov) for display on USAspending.gov as required by the Federal Funding Accountability and Transparency Act of 2006.[24]

Reporting on subawards and subrecipients was frequently cited as an oversight requirement deficiency we identified in single audit findings. Examples of these deficiencies included

·       failing to submit required subaward reports for display on USAspending.gov,

·       reporting inaccurate subaward information for display on USAspending.gov,

·       failing to document reviews of subaward reports before submitting them for display on USAspending.gov, and

·       failing to report subaward information for display on USAspending.gov within required time frames.

For example, a fiscal year 2023 single audit showed that a state agency failed to report complete and accurate information for display on USAspending.gov related to $6.4 million in subawards made in fiscal year 2023. Specifically, the state did not require a review to verify that the subaward data it uploaded into the federal government’s reporting system were complete and correctly displayed. This led the auditors to conclude that the state’s stakeholders and the public did not have access to transparent and timely information about the state agency’s subaward spending decisions on USAspending.gov as required and that other federal programs the state agency administers could potentially be affected by this noncompliance.

OIG audit reports we reviewed found similar issues related to federal reporting requirements. For example, a fiscal year 2023 OIG audit showed that a state agency did not report all subawards greater than $30,000 on USAspending.gov. Specifically, the state agency did not publicly report for 12 of the 13 subawards it sampled. The audit reported that the 12 subawards totaled more than $7.7 million. The state agency said that it did not publicly report all subawards of more than $30,000 because it did not have a process in place to require personnel to do so. The OIG concluded that not reporting subawards as required created a lack of transparency for how the federal funds were spent.[25]

Our prior work also has identified issues with some subaward data displayed on USAspending.gov, such as award amounts that are impossibly large, descriptions that do not clearly communicate the purpose of the award, reports that are likely duplicative, and reports that are not submitted timely.[26]

Inaccurate and incomplete data on subawards make it more difficult to track federal funds and to identify and prevent fraud risks. We previously reported that incomplete subaward data on USAspending.gov affect users’ ability to effectively and efficiently track spending.[27] We have also reported that quality subaward data can help detect and prevent improper payments and fraud, waste, and abuse of federal funds.[28]

State grant officials we interviewed identified effective practices for reporting subaward and subrecipient information. These included

·       reviewing the data for accuracy before submission,

·       having clear reporting timelines, and

·       involving staff familiar with the specific subrecipients and subawards, such as grant analysts, in the reporting process.

State grant officials we spoke to shared examples of their various subaward reporting processes with us. For example, grant officials from one state told us they use the SAM.gov system to report subawards weekly. Officials from another state told us that they conduct a review among the various divisions within their agency responsible for grant data to identify any discrepancies between their grant data and the draft subaward report and that they validate that their reports appear on USAspending.gov monthly.

Opportunities Exist to Address State Subaward Oversight Deficiencies Identified in Audits

Some of the causes of subaward oversight deficiencies that auditors and interviewees identified are consistent with long-standing grant management challenges we have reported in our prior work.[29] These grant management challenges include capacity, streamlining, transparency, and internal controls and oversight. These challenges can adversely affect recipients’ ability to successfully manage and implement grant programs, increase burden for recipients, reduce understanding of how and where funds are spent, and introduce the risk that federal grant funds are not used properly.

State grant officials and other knowledgeable entities we interviewed, our prior recommendations, and recent federal efforts highlight opportunities that could help address some of these challenges. Some of these opportunities would require federal action, some would require state action, and others could be addressed by both.

Capacity Challenges and Opportunities to Address Them

Our analysis of single audit reports and our interviews with state grant officials and knowledgeable entities identified limited capacity as a common challenge for states providing oversight of their subawards.[30] For example, limited staff to conduct required work was one of the most common causes that auditors identified in the sample of state single audit findings related to pass-through funds we analyzed. It was cited as a cause across findings related to deficiencies with risk assessments, monitoring, addressing issues that arise, and subaward reporting.

Our prior work has shown that limited capacity for grant recipients can adversely affect their ability to successfully access, manage, and implement grant programs. State grant officials and knowledgeable entities we spoke with pointed to capacity limitations as a cause of several challenges. For example, they told us it can be difficult for state agencies to handle the volume of data required for monitoring and conducting risk assessments. Likewise, they told us that state agencies sometimes do not have the staff required to conduct detailed reviews of reimbursement requests or in-person site visits.

State officials and other knowledgeable entities identified changes they thought could help address some of the capacity-related challenges that states can face in carrying out their subaward oversight responsibilities. These suggestions included

·       prioritizing more resources for oversight activities (such as considering monitoring and site visits in award budgets);

·       conducting more staff training and education at both the state and subrecipient levels to help mitigate the effects of staff turnover;

·       developing state agency staff’s data analytic capabilities (such as locating and analyzing data to inform risk assessments);

·       automating elements of the oversight process (such as risk assessments, data collection and analytics, and integration of grant management systems with SAM.gov);

·       improving grant management systems and software to track monitoring, grant activity, and areas of recurring risk across subrecipients; and

·       reducing the burden of subaward reporting, such as by automating parts of the process.

A recent General Services Administration (GSA) initiative also could lead to some improvements in the capacity challenges associated with managing subawards. GSA operates and maintains the Federal Audit Clearinghouse (FAC), the website where single audit findings are collected and made available to the public. GSA recently developed a dashboard, which gives users an interactive way to explore and analyze FAC data without needing to query the underlying FAC data or work directly with large datasets. Users can filter and analyze audit data, identify trends and patterns, view summary metrics and visualizations, and download the underlying results for further analysis.[31] Some interviewees told us that data collection and analysis to inform risk assessments and monitoring can be burdensome for state grant offices, so initiatives that automate parts of this process and make it easier to find and use data could help states address capacity challenges.

Many of these opportunities align with practices in our Fraud Risk Framework and could reduce the risk of fraud. For example, the Fraud Risk Framework states that automating data-analytic tests to monitor data for fraud indicators, combining data across programs and from separate databases, pursuing access to necessary external data, and collecting and analyzing data for real time monitoring of fraud trends and identification of potential control deficiencies can help manage fraud risks. Additionally, automated control activities tend to be more reliable because they are less susceptible to human error and are typically more efficient than manual activities.

Streamlining Challenges and Opportunities to Address Them

Streamlining was cited in our review of single audit findings and our discussions with state grant officials and knowledgeable entities as a challenge with subaward oversight.[32] For example, grant officials from one state we spoke to told us the federal portal they use allows funds to be drawn down automatically, but any deobligations that need to be returned to the federal awarding agency have to be mailed back by check, which can result in delays. Officials from one knowledgeable entity we interviewed told us that there are different risk assessments used across different state agencies and awards, which can add burden to managing the grant funds. Our prior work has shown that when grants management requirements are duplicative or overly burdensome, agencies must direct resources toward meeting them.[33] This outcome can make an agency’s programs and services less cost effective and increase burden for grant recipients.

State officials and other knowledgeable entities told us about opportunities they thought could help address some of the streamlining-related challenges that states can face in carrying out their subaward oversight responsibilities. Interviewee suggestions included

·       standardizing state forms, templates, checklists, and tools (such as risk assessment templates);

·       sharing available data and tools between state and federal agencies;

·       simplifying federal grant guidance and requirements (such as putting all requirements in one location);

·       receiving timelier, clearer, and more consistent federal guidance; and

·       standardizing and enhancing state technology systems.

In addition, we have made recommendations in the past that could lead to improvements in subaward oversight. Some of these could address streamlining challenges. For example, in January 2025, we recommended that the Department of Health and Human Services update the design of its Fraud Risk Assessment Portal to allow users to assess the likelihood and impact of each fraud risk identified in a program, such as Temporary Assistance for Needy Families; determine the related fraud risk tolerance; and include those results in the portal as part of their fraud risk assessments.[34]

Many of these opportunities align with practices in our Fraud Risk Framework and could reduce the risk of fraud. For example, the Fraud Risk Framework states that combining data across programs and separate databases within the agency can help manage fraud risks.

Transparency Challenges and Opportunities to Address Them

State grant officials and knowledgeable entities we spoke to pointed to transparency-related issues as a cause of several compliance challenges.[35] For example, states may not know about other federal funds their subrecipients are receiving and spending, which can make it difficult to identify subrecipients that should undergo a single audit, ensure that the audit has been done, and review the results of that audit.[36] Additionally, interviewees told us states may not have data that could inform their subrecipient monitoring and risk assessments. For example, several of the state grant officials we interviewed told us they were not familiar with the FAC site.

Our prior work has shown that greater transparency of grant spending can help Congress and the public understand how and where federal grant funds are spent.[37] We have also identified limitations in the timeliness, completeness, and accuracy of subaward information displayed on USAspending.gov that affects the usefulness of these data to states and other users for tracking federal spending to identify fraud and improper payments.[38]

State officials and other knowledgeable entities told us about opportunities they thought could help address some of the transparency-related challenges that states can face in carrying out their subaward oversight responsibilities, including the following:

·       sharing available data and tools between state and federal agencies;

·       automating subaward reporting to increase compliance and accuracy of reporting; and

·       developing, collecting, and using additional data on subrecipients, including system-generated data, to build profiles of subrecipients.

Recent government initiatives could lead to some improvements in the transparency challenges associated with managing subawards. For example, the Stop Secret Spending Act of 2025 expanded the requirements for the OIGs of specified federal agencies to periodically submit to Congress and make publicly available a report assessing the agency’s spending data and use of data standards.[39] OIG audits could strengthen accountability for agencies’ oversight of subaward data.

Our prior work also has addressed some subaward data transparency issues. In November 2023, we recommended that the Office of Management and Budget (OMB) clarify expectations for agencies to support the quality of subaward data reported by prime recipients.[40] OMB addressed this recommendation by issuing a memorandum which clarified that while prime recipients are responsible for subaward reporting, agencies are responsible for ensuring that accurate subaward reporting takes place. OMB’s recently proposed changes to its Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) would include formalizing similar language.[41]

We have made recommendations in the past that could lead to improvements in subaward oversight. Some of these recommendations could address transparency challenges. For example, in August 2023, we recommended that the Department of Housing and Urban Development (HUD) identify ways to collect and combine contractor and subcontractor data across grantees and subrecipients to facilitate risk analyses.[42]

Many of these opportunities align with practices in our Fraud Risk Framework and could reduce the risk of fraud. For example, the Fraud Risk Framework states that pursuing access to necessary external data can help manage fraud risks.

Internal Control and Oversight Challenges and Opportunities to Address Them

Internal controls and oversight challenges for subawards were a common theme across the single audit findings we reviewed, as well as discussions with state grant officials and knowledgeable entities.[43] For example, insufficient procedures and ineffective internal controls were two of the most common causes that auditors identified in our sample of state single audit findings related to pass-through funds. They were also cited as causes across findings related to risk assessments, monitoring, addressing issues that arise, and subaward reporting. Our prior work has shown that when awarding and managing federal grants, effective oversight and internal control are important for providing reasonable assurance to federal managers and taxpayers that grants are awarded properly, recipients are not excluded from receiving the award, and federal grant funds are used as intended and in accordance with applicable laws and regulations.[44]

State grant officials and knowledgeable entities we spoke to pointed to internal control and oversight-related issues as a cause of several compliance challenges. For example, it can be difficult for state agencies to identify how to weigh different risks factors among their subrecipients, whether their monitoring meets federal standards and requirements, and what federal expectations are for resolving issues that arise with their subrecipients.

These officials told us about opportunities they thought could help address some of the internal controls and oversight-related challenges that states can face in carrying out their subaward oversight responsibilities. Interviewee suggestions included

·       conducting pre-award risk assessments;

·       developing automated tools (for identifying application errors, assessing risk, etc.);

·       more state training for subrecipients on federal grant compliance;

·       updating state grant management systems to expand capabilities;

·       continually reviewing state risk assessment indicators to ensure they align with requirements and changing risk landscapes;

·       more involvement and responsiveness from federal partners (such as responding to state inquiries and questions);

·       more training for state pass-through entities from federal agencies (such as establishing clear and specific monitoring expectations);

·       providing state grant offices sufficient advance notice of changes to federal requirements; and

·       making federal guidance clearer, more consistent, and more specific by simplifying federal grant guidance, establishing clearer federal expectations on how pass-through entities should address issues they identify with their subrecipients, and providing more federal guidance and technical support for using SAM.gov to report subaward information.

We have made recommendations in the past that could lead to improvements in subaward oversight. Some of these could address internal control and oversight challenges. For example, in March 2024, we recommended that the Bureau of Indian Education (BIE), a subagency of the Department of the Interior, establish controls to ensure that staff consistently follow agency standard procedures when schools and other BIE grantees do not submit timely single audit reports.[45]

Many of these opportunities align with practices in our Fraud Risk Framework and could reduce the risk of fraud. For example, the Fraud Risk Framework states that managers who effectively manage fraud risks develop and document an antifraud strategy that describes the program’s approach for addressing the prioritized fraud risks identified during the fraud risk assessment.

Agency Comments

We provided a draft of this report to OMB and GSA for review and comment. GSA provided technical comments, which we incorporated as appropriate. OMB did not provide comments on the draft report.

We are sending copies of this report to the appropriate congressional committees, the Director of OMB, the Administrator of GSA, and other interested parties. In addition, the report is available at no charge on the GAO website at www.gao.gov.

If you or your staff have any questions about this report, please contact me at arkinj@gao.gov. Contact points for our Offices of Congressional Relations and Media Relations may be found on the last page of this report. GAO staff who made key contributions to this report are listed in appendix IV.

Sincerely,

Jeff Arkin
Director, Strategic Issues

This report describes (1) the requirements for states’ oversight of subawards most frequently cited in audit report findings and how selected states conduct oversight, and (2) opportunities to address the challenges associated with these requirements to reduce fraud risk.[46]

We reviewed relevant federal statutes and regulations to identify oversight requirements for prime recipients or pass through entities. We reviewed the Office of Management and Budget (OMB)’s Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance) to identify oversight requirements for prime recipients passing funds to subrecipients.[47] Using the existing Uniform Guidance, we selected 10 oversight requirements that prime recipients have in overseeing subawards they pass through to subrecipients.[48]

To identify the most common audit findings related to state oversight requirements for subawards, we used data from the Federal Audit Clearinghouse (FAC) to identify roughly 2,900 single audit findings from fiscal years 2020 through 2024 that were directed to states and related to funding the states passed through to other entities.[49] We then manually conducted a nongeneralizable content analysis of a simple random sample of 96 of these single audit findings.[50] This analysis allowed us to identify which Uniform Guidance requirement areas the findings were related to for prime grant recipients passing funds through as subawards. We then counted the findings to identify the oversight requirements most frequently cited. We also reviewed and analyzed the cause statements included with each finding in our sample to determine themes in the underlying causes auditors ascribed to these compliance findings. Finally, we also reviewed our own reports and conducted a literature search for inspectors general reports issued between January 2020 and July 2025 to supplement our review of previously published audit reports relevant to states’ oversight of their subrecipients.[51]

To describe how state grant recipients carry out their subaward oversight responsibilities, any challenges they face, and opportunities to address challenges, we interviewed state officials who are responsible for subaward oversight and grant management. To select these officials, we analyzed state-reported pass-through funding amounts from state SEFAs to identify the three federal agencies that administered grant programs with the most federal funds reported being passed through by state recipients. Then we identified three programs with a high reported dollar value of federal funding passed through to subrecipients from fiscal years 2020 through 2024 for each selected agency. We then randomly selected nine states across these three programs and agencies and identified the relevant state agencies that administered these programs for interviews.[52] During these interviews, we inquired about states’ experiences with the issue areas related to subaward oversight that we identified in Uniform Guidance, oversight practices they considered effective, and state suggestions for improvement. We do not endorse any identified state suggestions for improvement. We supplemented these interviews by obtaining and analyzing documentation from state agencies to learn about examples of their subaward oversight tools and practices (e.g., risk assessments, monitoring, etc.). The results from these interviews cannot be generalized to all states and state agencies, but they are designed to reflect a range of experiences and perspectives on oversight challenges and opportunities to address them. We also interviewed nine knowledgeable entities, including associations that represent state governments, about common oversight challenges and opportunities to address them.[53]

We also reviewed our open recommendations from reports published from 2021 to 2026 to identify additional opportunities to address compliance challenges. Using an internal database, we conducted a keyword search using terms related to the engagement topic to narrow the list of recommendations. We then used multiple analysts independently reviewing the list to confirm a smaller set of recommendations that could lead to improvements in subaward oversight by prime recipients, such as states, if implemented. We then verified that the smaller set of recommendations were sufficient by consulting with our knowledgeable staff who worked on those recommendations. See appendix III for a list of selected, relevant open recommendations we have made that could lead to improvements in subaward oversight.[54]

To understand ongoing efforts to improve available data on subrecipients, we interviewed the General Services Administration (GSA), which is responsible for FAC and the System for Award Management (SAM.gov).[55] Notably, we inquired about GSA’s development of a demonstration version for a new data analysis dashboard on FAC’s website.

To identify examples of adjudicated fraud involving federal grants that were passed on as subawards, we conducted a literature search of press releases from the Department of Justice and state attorneys general offices released from 2021 through 2026 that mentioned a state-level agency. We then evaluated the list of possible cases to confirm that they pertained to a federal award passed through as a subaward, that adjudication began no earlier than 2022, and that the case was fully adjudicated at the time we conducted our analysis.

We tested the reliability of the databases we used by reviewing related documentation, testing for outliers and missing data, and interviewing knowledgeable officials as appropriate. We used USAspending.gov data and single audit data from the FAC to help inform scoping decisions and to describe the data available from these databases. We also used FAC data to inform interviewee selection and identify single audit findings related to states’ oversight of subrecipients for our content analysis of single audit findings. We are aware of data quality issues in both datasets. For example, we have reported on USAspending.gov subaward data that are likely duplicative and FAC data that were inaccurate and inconsistent when compared with the corresponding single audit report.[56] We performed some data cleaning to address some of these issues; aside from that cleaning, we are reporting the nominal values as they appear in the datasets. We also tested a sample of single audit findings from the data we analyzed to confirm that the text we reviewed in our content analysis matched the findings text in corresponding single audit reports. We concluded that the data elements we used were sufficiently reliable for our purposes.

We conducted this performance audit from April 2025 to November 2026 in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives.

Table 1 lists selected oversight requirements for prime grant recipients provided in the Office of Management and Budget’s Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards.[57]

Classify agreements as subawards or procurement contracts.

2 C.F.R. § 200.331. The pass-through entity is responsible for making case-by-case determinations to determine whether the entity receiving federal funds is a subrecipient or a contractor.

Verify subrecipients are not excluded from receiving the award.

2 C.F.R. § 200.214. Recipients and subrecipients are subject to the nonprocurement debarment and suspension regulations implementing Executive Orders 12549 and 12689, as well as 2 C.F.R. part 180. The regulations in 2 C.F.R. part 180 restrict making federal awards, subawards, and contracts with certain parties that are debarred, suspended, or otherwise excluded from receiving or participating in federal awards.

2 C.F.R. § 200.215. Federal agencies, recipients, and subrecipients are subject to the guidance implementing Never Contract with the Enemy in 2 C.F.R. part 183. The guidance in 2 C.F.R. part 183 affects covered contracts, grants, and cooperative agreements that are expected to exceed $50,000 during the period of performance; are performed outside the United States and its territories; and are in support of a contingency operation in which members of the Armed Forces are actively engaged in hostilities.

2 C.F.R. § 200.332(a). A pass-through entity must verify that the subrecipient is not excluded or disqualified in accordance with § 180.300. Verification methods are provided in Office of Management and Budget (OMB) regulations and can include confirming with the General Services Administration’s website (SAM.gov) that a potential subrecipient is not suspended, debarred, or otherwise excluded from receiving federal funds.

Determine and communicate appropriate subaward payment structure and conditions.

2 C.F.R. § 200.208(b). The federal agency or pass-through entity may adjust specific conditions in the federal award based on an analysis of the following factors: (1) review of OMB-designated repositories of government- wide data (for example, SAM.gov) or review of its risk assessment (see § 200.206); (2) the recipient’s or subrecipient’s history of compliance with the terms and conditions of federal awards; (3) the recipient’s or subrecipient’s ability to meet expected performance goals as described in § 200.211; or (4) a determination of whether a recipient or subrecipient has inadequate financial capability to perform the federal award.

2 C.F.R. § 200.208(c). Specific conditions may include the following: (1) requiring payments as reimbursements rather than advance payments; (2) withholding authority to proceed to the next phase until receipt of evidence of acceptable performance; (3) requiring additional or more detailed financial reports; (4) requiring additional project monitoring; (5) requiring the recipient or subrecipient to obtain technical or management assistance; or (6) establishing additional prior approvals.

2 C.F.R. § 200.208(d). Prior to imposing specific conditions, the federal agency or pass-through entity must notify the recipient or subrecipient as to: (1) the nature of the specific condition(s); (2) the reason why the specific condition(s) is being imposed; (3) the nature of the action needed to remove the specific condition(s); (4) the time allowed for completing the actions; and (5) the method for requesting the federal agency or pass-through entity to reconsider imposing a specific condition.

2 C.F.R. § 200.208(e). Any specific conditions must be promptly removed once the conditions that prompted them have been satisfied.

2 C.F.R. § 200.305(b). For recipients and subrecipients other than states, payment methods must minimize the time elapsing between the transfer of funds from the federal agency or the pass-through entity and the disbursement of funds by the recipient or subrecipient regardless of whether the payment is made by electronic funds transfer or by other means. See § 200.302(b)(6). Except as noted in this part, the federal agency must require recipients to use only OMB-approved, government-wide information collections to request payment.

2 C.F.R. § 200.305(b)(3). Payments for recipients and subrecipients other than States. Reimbursement is preferred when certain requirements cannot be met, when the federal agency or pass-through entity sets a specific condition per § 200.208, when requested by the recipient or subrecipient, when a federal award is for construction, or when a significant portion of the construction project is accomplished through private market financing or federal loans and the federal award constitutes a minor portion of the project. When the reimbursement method is used, the federal agency or pass-through entity must make payment within 30 calendar days after receipt of the payment request unless the federal agency or pass-through entity reasonably believes the request to be improper.

2 C.F.R. § 200.305(b)(4). If the recipient or subrecipient cannot meet the criteria for advance payments and the federal agency or pass-through entity has determined that reimbursement is not feasible because the recipient or subrecipient lacks sufficient working capital, the federal agency or pass-through entity may provide cash on a working capital advance basis. Under this procedure, the federal agency or pass-through entity must advance cash payments to the recipient or subrecipient to cover its estimated disbursement needs for an initial period generally aligned to the recipient’s or subrecipient’s disbursing cycle. After that, the federal agency or pass-through entity must reimburse the recipient or subrecipient for its actual cash disbursements. Use of the working capital advance payment method requires that the pass-through entity provide timely advance payments to any subrecipients to meet the subrecipient’s actual cash disbursements. The pass-through entity must not use the working capital advance method of payment if the reason for using this method is the unwillingness or inability of the pass-through entity to provide timely advance payments to the subrecipient to meet the subrecipient’s actual cash disbursements.

2 C.F.R. § 200.333. With prior written approval from the federal agency and subject to certain requirements, the recipient may provide subawards based on fixed amounts up to $500,000.

Provide award information to subrecipients.

2 C.F.R. § 200.332(b). A pass-through entity must ensure that every subaward is clearly identified to the subrecipient as a subaward and includes certain information, such as subaward period of performance and amount of federal funds obligated in the subaward.

2 C.F.R. § 200.332(b). A pass-through entity must provide the subrecipient with the best available information on the federal subaward when certain award information is unavailable. A pass-through entity must provide unavailable information when it is obtained.

2 C.F.R. § 200.332(b)(2). A pass-through entity must provide the subrecipient with all requirements of the subaward, including requirements imposed by federal statutes, regulations, and the terms and conditions of the federal award.

2 C.F.R. § 200.332(b)(3). A pass-through entity must provide the subrecipient any additional requirements that the pass-through entity imposes on the subrecipient for the pass-through entity to meet its responsibilities under the federal award, which includes information and certifications required for submitting financial and performance reports that the pass-through entity must provide to the federal agency.

2 C.F.R. § 200.332(b)(4)(i). A pass-through entity must provide the subrecipient with an approved indirect cost rate negotiated between the subrecipient and the federal government. If no approved rate exists, a pass-through entity must determine the appropriate rate in collaboration with the subrecipient.

2 C.F.R. § 200.332(b)(5). A pass-through entity must ensure the subaward includes a requirement that the subrecipient permits the pass-through entity and auditors access to the subrecipient’s records and financial statements for the pass-through entity to fulfill its monitoring requirements.

2 C.F.R. § 200.332(b)(6). A pass-through entity must provide the subrecipient with information on appropriate terms and conditions concerning the closeout of the subaward.

Evaluate subrecipients’ risk to determine appropriate monitoring.

2 C.F.R. § 200.308(d). The federal agency or pass-through entity must review the request for budget or program plan revision and should notify the recipient or subrecipient whether the revisions have been approved within 30 days of receipt of the request. The federal agency or pass-through entity must inform the recipient or subrecipient in writing when a decision can be expected if more than 30 days are required for a review.

2 C.F.R. § 200.332(c). A pass-through entity must evaluate each subrecipient’s fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring.

2 C.F.R. § 200.332(c)(1). When evaluating a subrecipient’s risk, a pass-through entity should consider the subrecipient’s prior experience with the same or similar subawards.

2 C.F.R. § 200.332(c)(2). When evaluating a subrecipient’s risk, a pass-through entity should consider the results of previous audits. This includes considering whether the subrecipient receives a single audit and the extent to which the same or similar subawards have been audited as a major program.

2 C.F.R. § 200.332(c)(3). When evaluating a subrecipient’s risk, a pass-through entity should consider whether the subrecipient has new personnel or new or substantially changed systems.

2 C.F.R. § 200.332(c)(4). When evaluating a subrecipient’s risk, a pass-through entity should consider the extent and results of any federal agency monitoring (for example, if the subrecipient also receives federal awards directly from the federal agency).

2 C.F.R. § 200.332(d). A pass-through entity must, if appropriate, consider implementing specific conditions in a subaward by setting up specific conditions (as described in § 200.208) and notify the federal agency of the specific conditions.

Ensure compliance of for-profit subrecipients.

2 C.F.R. § 200.501(i). As necessary, the pass-through entity is responsible for establishing requirements to ensure compliance by for-profit subrecipients. The subaward with a for-profit subrecipient must describe applicable compliance requirements and the for-profit subrecipient’s compliance responsibility. Methods to ensure compliance for federal awards made to for-profit subrecipients may include pre-award audits, monitoring throughout the performance of the subaward, and post-award audits (see § 200.332).

Conduct monitoring of subrecipients to ensure compliance with requirements.

2 C.F.R. § 200.303(c). The recipient and subrecipient must evaluate and monitor the recipient’s or subrecipient’s compliance with statutes, regulations, and the terms and conditions of federal awards.

2 C.F.R. § 200.329(a). The recipient and subrecipient are responsible for the oversight of the federal award. The recipient and subrecipient must monitor their activities under federal awards to ensure they are compliant with all requirements and meeting performance expectations. Monitoring by the recipient and subrecipient must cover each program, function, or activity.

2 C.F.R. § 200.329(f). The federal agency or pass-through entity may conduct in-person or virtual site visits as warranted.

2 C.F.R. § 200.332(e). A pass-through entity must monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved.

2 C.F.R. § 200.332(e)(1). In monitoring a subrecipient, a pass-through entity must review financial and performance reports.

2 C.F.R. § 200.332(f). Depending upon the pass-through entity’s assessment of the risk posed by the subrecipient (as described in paragraph (c) of this section), the following monitoring tools may be useful for the pass-through entity to ensure proper accountability and compliance with program requirements and achievement of performance goals: (1) providing subrecipients with training and technical assistance on program-related matters; (2) performing site visits to review the subrecipient’s program operations; and (3) arranging for agreed-upon-procedures engagements as described in § 200.425.

2 C.F.R. § 200.332(g). A pass-through entity must verify that a subrecipient is audited as required by subpart F on Post Federal Award Requirements Subrecipient Monitoring and Management.

2 C.F.R. § 200.425(c). Pass-through entities may charge federal awards for the cost of agreed upon procedures engagements to monitor subrecipients exempt from having an audit conducted under the Single Audit Act and certain requirements. This cost is allowable only if the agreed-upon procedures engagements are: (1) conducted in accordance with generally accepted government auditing standards or applicable international attestation standards, as appropriate; (2) paid for and arranged by the pass-through entity; and (3) limited in scope to one or more of the following types of compliance requirements: activities allowed or unallowed; allowable costs/cost principles; eligibility; and reporting.

Address issues that arise.

2 C.F.R. § 200.303(d). The recipient and subrecipient must take prompt action when instances of noncompliance are identified.

2 C.F.R. § 200.332(e)(2). In monitoring a subrecipient, a pass-through entity must ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward.

2 C.F.R. § 200.332(e)(3). In monitoring a subrecipient, a pass-through entity must issue a management decision for audit findings pertaining only to the federal award provided to the subrecipient from the pass-through entity as required by 200.521.

2 C.F.R. § 200.332(e)(4). In monitoring a subrecipient, a pass-through entity must resolve audit findings specifically related to the subaward.

2 C.F.R. § 200.332(h). A pass-through entity must consider whether the results of a subrecipient’s audit, site visits, or other monitoring necessitate adjustments to the pass-through entity’s records.

2 C.F.R. § 200.332(i). A pass-through entity must consider taking enforcement action against noncompliant subrecipients as described in § 200.339 and in program regulations.

2 C.F.R. § 200.339. The federal agency or pass-through entity may implement specific conditions if the recipient or subrecipient fails to comply with the U.S. Constitution, federal statutes, regulations, or terms and conditions of the federal award.

2 C.F.R. § 200.505. In cases of continued inability or unwillingness of a nonfederal entity to have an audit conducted in accordance with this part, federal agencies or pass-through entities must take appropriate action as provided in § 200.339.

2 C.F.R. § 200.521(c). The pass-through entity is responsible for issuing a management decision for audit findings that affect subawards it issues to subrecipients under a federal award.

2 C.F.R. § 200.521(d). The pass-through entity responsible for issuing a management decision must do so within 6 months of the Federal Audit Clearinghouse’s acceptance of the audit report.

Report on subawards and subrecipients.

2 C.F.R. § 200.329(b). The federal agency must use OMB-approved common information collections (for example, Research Performance Progress Reports) when requesting performance reporting information. The federal agency or pass-through entity may not collect performance reports more frequently than quarterly unless a specific condition has been implemented in accordance with § 200.208. To the extent practicable, the federal agency or pass-through entity should align the due dates of performance reports and financial reports. When reporting program performance, the recipient or subrecipient must relate financial data and project or program accomplishments to the performance goals and objectives of the federal award.

2 C.F.R. § 200.329(c)(1). The recipient or subrecipient must submit performance reports as required by the federal award. Intervals must be no less frequent than annually nor more frequent than quarterly except if specific conditions are applied (see § 200.208).

2 C.F.R. pt. 170, app. A(I)(a)(1)-(2). Recipients must report each subaward that equals or exceeds $30,000 in federal funds to SAM.gov by no later than the end of the month after the month in which the subaward was made (unless otherwise exempt).a

2 C.F.R. pt. 170, app. A(I)(b). If a subrecipient received at least 80 percent of its annual gross revenue from federal awards subject to the Transparency Act (including contracts and financial assistance) and had at least $25 million in annual gross revenue from federal awards in the preceding fiscal year, and if the public does not have access to information about the compensation of the subrecipient’s senior executives through periodic reports, the pass-through entity must report information on the subrecipient’s five most highly compensated executive officials if the total award is at least $30,000.

Finalize award closeout requirements.

2 C.F.R. § 200.344(a). The pass-through entity must close out the federal award when it determines that all administrative actions and required work of the federal award have been completed. When the subrecipient fails to complete the necessary administrative actions or the required work for an award, the pass-through entity must proceed with closeout based on the information available.

Exemptions

2 C.F.R. § 200.102(a). In certain circumstances, OMB may allow for exceptions from requirements of the Uniform Guidance for classes of federal awards, recipients, or subrecipients when the exceptions are not prohibited by statute.

2 C.F.R. § 200.102(b). A federal agency may adjust requirements to a class of federal awards, recipients, or subrecipients when required by federal statutes or regulations, except for audit requirements in subpart F. Except for audit provisions in subpart F, when a federal statute requires exceptions to requirements of this part for a class of federal awards, recipients, or subrecipients, a federal agency does not need OMB approval to allow those exceptions. See also § 200.106.

2 C.F.R. § 200.102(c). Federal agencies may allow exceptions to requirements of the Uniform Guidance on a case-by-case basis for individual federal awards, recipients, or subrecipients, except when the exceptions are prohibited by law or other approval is expressly required by the Uniform Guidance. Only the cognizant agency for indirect costs may authorize exceptions related to cost allocation plans or indirect cost rate proposals. A federal agency may also apply less restrictive requirements when issuing fixed amount awards (see § 200.1), except for those requirements imposed by statute or in the audit provisions of subpart F.

2 C.F.R. § 200.333. With prior written approval from the federal agency, the recipient may provide subawards based on fixed amounts up to $500,000.

Source: GAO analysis of 2 C.F.R. pt. 170, 200. |  GAO‑27‑108450

^aPreviously, states reported subawards to the Federal Funding Accountability and Transparency Act Subaward Reporting System (FSRS). FSRS has been retired and replaced by the System for Award Management (SAM.gov), which is an official U.S. government website that centralizes federal award life cycle management.

Table 2 provides information about selected open recommendations that, if implemented, could lead to improvements in subaward oversight.[58]

Report Number/Publication Date	Agency	Recommendation
GAO‑21‑177 May 5, 2021	Department of Housing and Urban Development	The Assistant Secretary for Community Planning and Development should comprehensively assess fraud risks to the Community Development Block Grant – Disaster Recovery (CDBG-DR) program, including identifying inherent fraud risks affecting it, assessing the likelihood and impact of inherent fraud risks, determining fraud risk tolerance, and examining the suitability of existing fraud controls. The assessment should also consider CDBG-DR’s risk environment and be informed by the fraud risks identified in this report. (Recommendation 1)
GAO‑21‑177 May 5, 2021	Department of Housing and Urban Development	In comprehensively assessing fraud risks to CDBG-DR, the Assistant Secretary for Community Planning and Development should involve relevant stakeholders in the assessment process, including CDBG-DR grantees (states, territories, and local governments) that design and implement fraud controls. (Recommendation 2)
GAO‑23‑104382 August 17, 2023	Department of Housing and Urban Development	The Assistant Secretary for Community Planning and Development should develop guidance for CDBG-DR grantees and subrecipients on collecting complete and consistent data to better support applicant eligibility determinations and fraud risk management. (Recommendation 1)
GAO‑23‑104382 August 17, 2023	Department of Housing and Urban Development	The Assistant Secretary for Community Planning and Development should update the Monitoring Handbook for CDBG-DR monitoring activities to provide additional guidance in the selection of contracts for review. This should include factors such as contractors that present increased risk to the CDBG-DR environment, including those where allegations of fraud, waste, or abuse have been made. (Recommendation 2)
GAO‑23‑104382 August 17, 2023	Department of Housing and Urban Development	The Assistant Secretary for Community Planning and Development should identify ways to collect and combine contractor and subcontractor data across grantees and subrecipients to facilitate risk analyses, such as by expanding the Disaster Recovery Data Portal, Disaster Recovery Grant Reporting System, or other appropriate systems. (Recommendation 3)
GAO‑23‑104382 August 17, 2023	Department of Housing and Urban Development	The Assistant Secretary for Community Planning and Development should develop and implement guidance for CDBG-DR grantees and subrecipients to collect contractor and subcontractor data to facilitate identification of contractor and cross-cutting fraud risks through approaches such as network analysis. (Recommendation 4)
GAO‑23‑104382 August 17, 2023	Department of Housing and Urban Development	The Assistant Secretary for Community Planning and Development should develop guidance on data elements to be collected by grantees and subrecipients to determine if a contractor has been suspended, debarred, or excluded from working on government contracts. (Recommendation 5)
GAO‑23‑104382 August 17, 2023	Department of Housing and Urban Development	The Assistant Secretary for Community Planning and Development should ensure that grantees and subrecipients have attended fraud-related training as required. This could include requesting and reviewing attendance documentation from the Department of Housing and Urban Development (HUD) Office of Inspector General (OIG) and grantees. (Recommendation 6)
GAO‑23‑104382 August 17, 2023	Department of Housing and Urban Development	The Assistant Secretary for Community Planning and Development, in coordination with the HUD OIG, should ensure that grantees and subrecipients are made aware of available fraud-related training and make training available on demand to grantees and subrecipients. (Recommendation 7)
GAO‑24‑106164 January 25, 2024	Department of Health and Human Services	The Secretary of the Department of Health and Human Services (HHS), in consultation with the Director of the Office of Management and Budget (OMB), should review and revise as necessary the Version 2.0 grant data elements based on leading practices for the formulation of data definitions. (Recommendation 2)
GAO‑24‑105451 March 27, 2024	Bureau of Indian Educationa	The Director of the Bureau of Indian Education (BIE) should establish controls to ensure that staff consistently follow agency standard procedures when schools and other BIE grantees do not submit timely single audit reports. (Recommendation 1)
GAO‑24‑106173 April 22, 2024	General Services Administration	The Administrator of the General Services Administration (GSA) should, in coordination with federal agencies, develop proposed funding and timelines for implementing the identified and prioritized features to enhance the usefulness of Federal Audit Clearinghouse (FAC) data for federal oversight through interagency agreements or other methods. (Recommendation 3)
GAO‑24‑106173 April 22, 2024	Office of Management and Budget	The Director of OMB should, after consultation with federal agencies, implement the government-wide single audit quality review by naming a federal agency to lead the review as required by the Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards. (Recommendation 4)
GAO‑24‑106173 April 22, 2024	Office of Management and Budget	The Director of OMB should ensure that each of the federal agencies responsible for single audit oversight (cognizant and oversight agencies for audit) collects and reports to GSA a list of the recipients of its federal awards that should have submitted a single audit report for audit year 2023 and did not. (Recommendation 5)
GAO‑24‑106173 April 22, 2024	Office of Management and Budget	The Director of OMB should work with the Administrator of GSA to establish formal guidance implementing an annual process for each of the federal agencies to collect and report to GSA a list of its federal award recipients that should have submitted a single audit report and did not and to then communicate the guidance to federal agencies for single audits in 2024 and beyond. (Recommendation 6)
GAO‑24‑106173 April 22, 2024	Office of Management and Budget	The Director of OMB should work with the Administrator of GSA to develop a method for determining federal award recipients that did not submit a single audit report but should have based on their combined funds received from multiple federal agencies and communicate this method to federal awarding agencies. (Recommendation 7)
GAO‑24‑106173 April 22, 2024	General Services Administration	The Administrator of GSA should, upon consulting with professional audit organizations, provide additional training to auditors and recipients to help ensure that they complete FAC data collection forms accurately, completely, and consistent with the audit report. (Recommendation 8)
GAO‑24‑106173 April 22, 2024	Office of Management and Budget	The Director of OMB should consult with federal agencies, the Council of the Inspectors General on Integrity and Efficiency (CIGIE), and relevant OIGs to discuss methods to help ensure that single audit report reviewers are verifying that the information in a single audit report aligns with the summary information entered on the FAC data collection form. These methods could include adding a procedure to conduct a final quality check in CIGIE’s Guide for Desk Reviews of Single Audit Reports. (Recommendation 9)
GAO‑24‑106173 April 22, 2024	Office of Management and Budget	The Director of OMB should work with GSA and agency key management single audit liaisons to develop a strategy to use FAC data to identify government-wide risks to federal award funds, such as single audit reports that contain findings that are severe or have remained unresolved for multiple years. This strategy should include steps to analyze and respond to significant risks identified. (Recommendation 10)
GAO‑25‑106741 November 7, 2024	Department of the Treasury	The Secretary of the Treasury should develop and implement procedures to identify tribal recipients that did not submit required single audit reports when due and follow up with those recipients. (Recommendation 1)
GAO‑25‑106741 November 7, 2024	Department of the Interior	The Secretary of the Interior should develop and implement procedures for tracking the implementation of corrective action plans, including tracking repeat single audit findings, to ensure that tribal recipients take appropriate and timely action to correct single audit findings. (Recommendation 2)
GAO‑25‑106741 November 7, 2024	Department of the Treasury	The Secretary of the Treasury should develop and implement procedures to use metrics to improve the effectiveness of the Department of the Treasury’s process for following up on audit findings, including developing baselines and targets, tracking the implementation of corrective action plans, and sharing the metrics with the Office of Capital Access’s Chief Operating Officer. (Recommendation 3)
GAO‑25‑107235 December 12, 2024	Congress	Congress should consider granting HHS the authority to collect from states specific additional information needed to enhance its oversight authority, such as planned and actual Temporary Assistance for Needy Families (TANF) non-assistance expenditures, beyond what is provided for in the Personal Responsibility and Work Opportunity Reconciliation Act of 1996. (Matter for Consideration 1)
GAO‑25‑106944 December 17, 2024	Substance Abuse and Mental Health Services Administrationb	The Assistant Secretary for Mental Health and Substance Use should complete and implement a documented plan for collecting and reporting information about Opioid Response grant subrecipients. (Recommendation 1)
GAO‑25‑107290 January 28, 2025	Department of Health and Human Services	The Secretary of HHS should finalize its key guidance documents on fraud risk management—the Fraud Risk Management Implementation Plan and the Fraud Risk Assessment Portal Methodology—and clearly establish a process for conducting fraud risk assessments for HHS programs, including TANF, at regular intervals and when there are changes to the program or its operating environment. (Recommendation 1)
GAO‑25‑107290 January 28, 2025	Department of Health and Human Services	The Secretary of HHS should develop and document standard operating procedures for conducting regular fraud risk assessments tailored to TANF. This should include the roles and responsibilities of HHS entities involved in the process. (Recommendation 2)
GAO‑25‑107290 January 28, 2025	Department of Health and Human Services	The Secretary of HHS should develop a process for direct and regular communication with state and local agencies, and their respective OIGs or auditors, about TANF fraud risks that includes an approach for soliciting information from these entities and document this process in its standard operating procedures for conducting fraud risk assessments tailored to TANF. (Recommendation 3)
GAO‑25‑107290 January 28, 2025	Department of Health and Human Services	The Secretary of HHS should update the design of HHS’s Fraud Risk Assessment Portal to have the functionality to allow users to assess the likelihood and impact of each fraud risk identified in a program, such as TANF; determine the related fraud risk tolerance; and include those results in the portal as part of their fraud risk assessments. (Recommendation 4)
GAO‑25‑107290 January 28, 2025	Department of Health and Human Services	As part of finalizing HHS’s key guidance documents on fraud risk management, the Secretary of HHS should require users to assess the likelihood and impact of each fraud risk identified in a program, such as TANF; determine the related fraud risk tolerance; and include those results in the Fraud Risk Assessment Portal as part of their fraud risk assessments. (Recommendation 5)
GAO‑25‑107290 January 28, 2025	Department of Health and Human Services	The Secretary of HHS should update the design of HHS’s Fraud Risk Assessment Portal to have the functionality to allow for the regular assessment of any additional fraud risks facing TANF, including those we have identified. (Recommendation 6)
GAO‑25‑107290 January 28, 2025	Department of Health and Human Services	As part of finalizing HHS’s key guidance documents on fraud risk management, the Secretary of HHS should require users to regularly assess any additional fraud risks facing TANF. (Recommendation 7)
GAO‑25‑107291 April 4, 2025	Department of Health and Human Services	The Secretary of HHS should ensure that the Administration for Children and Families develops and implements a strategy to eliminate the accumulated TANF audit backlog, to ensure that management decisions are issued within the required time frame. (Recommendation 2)
GAO‑25‑107291 April 4, 2025	Department of Health and Human Services	The Secretary of HHS should develop, document, and implement additional procedures to timely impose penalties or alternatively obtain corrective compliance plans for states that are not meeting TANF program requirements. (Recommendation 3)
GAO‑26‑107466 June 16, 2026	Congress	Congress should consider assigning Treasury explicit authority to lead, in coordination with the Chief Data Officers Council and in consultation with OMB—and others, as needed—the development and implementation of government-wide data standards and interoperability requirements, including data definitions, dictionaries, validation rules, and disclosures, for recipient eligibility data sources, including relevant financial, award, spending, and payment data needed to support eligibility determinations throughout the award life cycle. (Matter for Consideration 1)

Source: GAO | GAO‑27‑108450

^aBIE is a subagency of the Department of the Interior.

^bThe Substance Abuse and Mental Health Services Administration is a subagency of HHS.

GAO Contact:

Jeff Arkin, arkinj@gao.gov

Staff Acknowledgments:     

In addition to the contact named above, Kathleen Drennan (Assistant Director), Sam Gaffigan (Analyst-in-Charge), Mark Abraham, Jieun Chang, Virginia Chanley, Jacqueline Chapin, Heather Dunahoo, Amalia Konstas, Meredith Moles, Nathan Parmeter, Robert Robinson, Rebecca Shea, and Crystal Wesco made key contributions to this report.

GAO’s Mission

The Government Accountability Office, the audit, evaluation, and investigative arm of Congress, exists to support Congress in meeting its constitutional responsibilities and to help improve the performance and accountability of the federal government for the American people. GAO examines the use of public funds; evaluates federal programs and policies; and provides analyses, recommendations, and other assistance to help Congress make informed oversight, policy, and funding decisions. GAO’s commitment to good government is reflected in its core values of accountability, integrity, and reliability.

Obtaining Copies of GAO Reports and Testimony

The fastest and easiest way to obtain copies of GAO documents at no cost is through our website. Each weekday, GAO posts on its website newly released reports, testimonies, and correspondence. You can also subscribe to GAO’s email updates to receive notification of newly posted products.

Connect with GAO

Connect with GAO on X, LinkedIn, Instagram, and YouTube.
Subscribe to our Email Updates. Listen to our Podcasts.
Visit GAO on the web at https://www.gao.gov.

To Report Fraud, Waste, and Abuse in Federal Programs

Contact FraudNet:

Website: https://www.gao.gov/about/what-gao-does/fraudnet

Automated answering system: (800) 424-5454

Media Relations

Sarah Kaczmarek, Managing Director, Media@gao.gov

Congressional Relations

David A. Powner, Acting Managing Director, CongRel@gao.gov

General Inquiries

https://www.gao.gov/about/contact-us