Free guide · Question and answer
What auditors actually ask for
Request lists are written in the language of testing, not the language of running a programme. Here is what a dozen common requests are really asking, what satisfies them, and the answers that turn a question into a finding.
"Provide your subrecipient risk assessments for the period."
What is being tested: whether monitoring was proportionate to risk, which requires that risk was assessed at all, before the monitoring was chosen.
What satisfies it: a dated assessment per subrecipient, naming the assessor, stating a tier and giving the reasoning.
The answer that creates a finding: "We know our subrecipients well." Familiarity is not an assessment, and it is not testable.
"Show evidence that monitoring occurred."
What is being tested: execution, not intent. A monitoring plan is a control design; this tests whether the control operated.
What satisfies it: dated records naming who did what — desk review notes, site visit reports, invoice review dispositions, technical assistance follow-ups.
The answer that creates a finding: "We are in constant contact with them." Undated contact is invisible to an audit.
"Provide the performance reports submitted for this award."
What is being tested: that reports were filed, filed on time, and are consistent with the accounting record and with each other.
What satisfies it: the reports as submitted, with submission dates and the portal used — not a current-state document that has been updated since.
The answer that creates a finding: producing a report that no longer matches what was filed, because the working document kept being edited.
"Explain the variance between budgeted and actual costs in this category."
What is being tested: whether the organization noticed, decided, and had authority for the change — not whether variance occurred.
What satisfies it: a dated decision record naming who approved the reallocation and on what basis, plus agency approval where the award terms required it.
The answer that creates a finding: a reconstructed explanation with no contemporaneous decision behind it.
"Who has access to the grant records, and how is that controlled?"
What is being tested: internal control under 2 CFR 200.303 — specifically segregation of duties and whether access is limited.
What satisfies it: a named list of who has what level of access, evidence that access levels are enforced by the system rather than by convention, and a log of material actions.
The answer that creates a finding: a shared login. It eliminates attribution for everything else in the file.
"Provide the corrective action taken on prior-year findings."
What is being tested: whether findings recur. A repeat finding is treated far more seriously than a first occurrence.
What satisfies it: the summary schedule of prior audit findings, with dated evidence that each corrective action was implemented and verified.
The answer that creates a finding: "That was fixed" without a date, an owner, or verification.
"Provide procurement documentation for this purchase."
What is being tested: that competition requirements for the dollar threshold were met and that selection was documented.
What satisfies it: the solicitation, the responses, the basis for selection, and a price or cost analysis.
The answer that creates a finding: a sole-source purchase with no written justification.
"How do you know payroll charged to this award is allowable?"
What is being tested: that personnel costs reflect actual work on the award, since payroll is usually the largest charged cost.
What satisfies it: records supporting how effort was determined, consistent with your written policy and reconciled to payroll.
The answer that creates a finding: budgeted percentages charged every period with nothing reconciling them to actual effort.
"Provide your subrecipients' Single Audit reports and your review of them."
What is being tested: the obligation under 200.332(f) to obtain and act on subrecipient audit results — the review, not just the report.
What satisfies it: the report, evidence you reviewed it, and a management decision issued on any findings within the required period.
The answer that creates a finding: holding the report unread. Possession is not review.
The pattern underneath all of them
Almost every request above tests the same thing in a different costume: was there a contemporaneous, attributable record made at the time by a named person. Not whether the organization was careful, competent or honest — auditors mostly assume that — but whether the care can be demonstrated after the fact by someone who was not there.
That is why reconstruction fails. A file assembled in audit week can show what happened, but it cannot show that anyone recorded it when it happened, and the second thing is what is being tested.
Take this away
Download it, print it, or have us email it. It is free either way, and there is no account, no paywall and no obligation.
This page is also formatted to print cleanly — use your browser's print command and choose Save as PDF to keep the checklist without the navigation and calls to action.
Thank you — we will email the template shortly.
We store your address and which template you asked for, nothing else. No tracking pixel, no analytics, no third party, no marketing sequence. One email, and you can ask us to delete the address at any time.
This material is provided for general information and is not legal, accounting or audit advice. Requirements vary by awarding agency, programme and award terms. Confirm your obligations with your awarding agency and your auditor.
Make the record as you go
Kharazm publishes reports that cannot be edited afterwards, and keeps decisions and monitoring dated and attributed.