kharazm

Free template · 2 CFR 200.332(b)

Subrecipient risk assessment template

The regulation requires you to evaluate each subrecipient's risk of non-compliance in order to decide appropriate monitoring. It does not prescribe a method. This is a defensible one: six factors, a score, a tier, and the monitoring each tier triggers.

Step one

Score six factors

Score each factor 1 (low concern) to 3 (high concern). The total runs from 6 to 18. What matters far more than the arithmetic is that you write down the reasoning for anything you score above 1.

Risk factors and scoring guidance
Factor Score 1 — lower concern Score 3 — higher concern
Prior experience with the same programme Has managed this award type before, without issue. First federal subaward, or first of this programme type.
Audit history Recent Single Audit with no findings, or below threshold with a clean financial statement audit. Repeat findings, material weakness, going-concern language, or no recent audit at all.
Financial stability and systems Documented accounting system capable of tracking costs by award. Cash-basis bookkeeping, no cost segregation by award, thin reserves.
Personnel and turnover Stable finance and programme leadership with grant experience. Recent departure of the finance lead, or grant duties held by one part-time person.
Subaward size relative to their budget Modest share of their total revenue. A dominant share, creating dependency and concentration risk.
Programme complexity Straightforward services with clear deliverables. Multiple funding streams, cost share, participant-level eligibility rules, or onward subawards.

Step two

Translate the score into monitoring that matches

This is the part auditors actually test. A high-risk subrecipient monitored like a low-risk one is a finding regardless of how careful the assessment was.

Risk tier and the monitoring it should trigger
Tier Score Minimum monitoring for the period
Low 6–9 Desk review of financial and performance reports each period; invoice review before payment; annual Single Audit report review where applicable.
Medium 10–13 Everything in Low, plus a documented check-in each quarter and review of supporting detail on a sample of invoiced costs.
High 14–18 Everything in Medium, plus a site visit or detailed remote review during the period, targeted transaction testing, and specific technical assistance with a written follow-up.

Override the score when you should. The number is an aid, not a decision. If you know something the factors do not capture, assign the tier you believe is right and write down why you departed from the score. A documented override is stronger evidence of judgement than a score nobody questioned.

Step three: record it so it can be tested

For each subrecipient, the file needs six things and none of them are long:

  • Legal name, UEI and the subaward amount and period
  • The date of the assessment and the name of the person who made it
  • The score for each factor
  • The written basis — two or three sentences explaining the tier
  • The monitoring plan that follows from the tier
  • A dated log of what monitoring actually happened

Reassess annually, and whenever something changes materially — a finance lead leaves, an audit report arrives, a subaward is substantially increased. Note the trigger for the reassessment; it demonstrates the process is live rather than annual paperwork.

This material is provided for general information and is not legal, accounting or audit advice. Requirements vary by awarding agency, programme and award terms. Confirm your obligations with your awarding agency and your auditor.

Stop keeping this in a spreadsheet one person owns

Kharazm holds the risk basis, the monitoring plan and the dated monitoring log as part of the award record.

See the monitoring record Start your 14-day trial