Post-Award Compliance Risk Checklist

Foreword

Foreword

Three decades inside the energy sector taught me to read failures backward from the audit finding. The finding is rarely the whole story. The finding is where the documentation ran out. On a federal award, the actual failure happened months or years earlier: a procurement file assembled in a hurry, a subaward signed without a risk assessment, a certified payroll accepted without a back-check, a quarterly report submitted with numbers the general ledger could not later reproduce. The auditor surfaces the symptom. The discipline that prevents it is built, or not built, long before the audit notice arrives.

This is the second reference in the Energy Compliance, Inc. Grant Funding Series. The first, EC-WP-900, surfaces readiness gaps before the application goes in. This one surfaces risk after the award has been accepted, during the period of performance, while there is still time to close a gap before it becomes a finding. It is written for the people doing the actual administration. The grants administrator at a public power utility. The controller at an electric cooperative. The project manager carrying federal money into construction. The development lead whose tax-credit project also carries a DOE grant. It is not written for the grant writer; post-award work runs on different rules.

A common pattern on federal energy awards goes like this. The application phase runs hot. The award lands. The team breathes. Construction begins. The first quarterly report goes in on time, more or less. Eighteen months later the single audit hits, or the program officer schedules a site visit, or the Wage and Hour Division opens an investigation on the certified payrolls. Suddenly the team is reconstructing a documentation trail that was supposed to be built in real time. Back wages get calculated. Costs get questioned. Subrecipient findings land on the pass-through entity. By the time the corrective action plan closes, the next award the entity wanted to pursue is in a different competitive posture than it would have been.

This diagnostic is built backward from that pattern. Ten risk areas, forty-five items, each one something the recipient should be able to evidence at any moment during the period of performance. The list is not exhaustive. In my judgment, these are the items most likely to cause expensive post-award problems on federally funded energy projects. Score each one Risk Low, Risk Medium, or Risk High based on the documentation and discipline that exist today, not what is planned for next quarter. The 30/60/90 framework on every Risk Medium and Risk High names concrete actions with owners and dates.

These are the right items to score yourself against.

How to Use This Reference

How to Use This Reference

Three steps. The discipline matters more than the speed.

Step One. Score the risk that exists today, not the risk you intend to manage. A Risk Low rating is earned through documentation a federal auditor could pull from your files in under an hour. A Risk Medium rating reflects a control that exists but has not been tested against a real federal review. A Risk High rating reflects either no control at all or a control that has already produced a known exception nobody has fixed. Score against what you can prove from the file.

Step Two. Translate every Risk Medium and Risk High into a 30/60/90 action. The 30-day action is what someone names tomorrow and starts this week. The 60-day action gets the gap to functional. The 90-day action gets it to audit-defensible. Assign every action to a named owner with a calendar date. Anonymous gaps stay open until the audit notice arrives.

Step Three. Re-score quarterly during the period of performance. Post-award risk is not a one-time scan. Subrecipients get added. Contract modifications get signed. Reporting dates shift when a no-cost extension lands. Run this diagnostic at least quarterly during active awards and at least once during the closeout window. The re-score itself becomes part of your defense, because it shows the recipient monitored its own compliance as 2 CFR 200.329(a) and 200.303(c) require.

Scoring. Chapter 11 sets out the scoring and how to read the total.

Who this applies to. Part 200 applies to States, local governments, Indian Tribes, institutions of higher education, and nonprofits. For-profit recipients of DOE awards are covered through 2 CFR Part 910, which applies Part 200 to them with changes. Two of those changes matter here: for-profits use the FAR cost principles at 48 CFR 31.2 instead of 2 CFR 200 Subpart E, and they follow DOE's own audit rules in 2 CFR 910 Subpart F instead of the Part 200 single audit. Chapters 1 and 9 flag both.

Executive Summary

Executive Summary

Federal energy awards rarely fail at the award decision. They fail during administration, in files that were never built to survive a reviewer. This checklist walks a recipient through the ten areas where that happens most, under the Uniform Guidance as revised in 2024 and the thresholds in effect today.

• Cost principles. Every charged cost has to pass the 2 CFR 200.403 tests, and the recipient has to be able to show it did. The de minimis indirect rate is now up to 15 percent of modified total direct costs, not 10 percent.
• Procurement. Part 200 recognizes three families of procurement methods and five circumstances that permit a noncompetitive award. The federal micro-purchase threshold is $15,000 and the simplified acquisition threshold is $350,000, both since October 1, 2025. A recipient may self-certify a micro-purchase threshold up to $50,000.
• Subrecipients. The pass-through entity must assess each subrecipient's risk, including fraud risk, monitor to that risk, and issue management decisions on relevant audit findings within six months of the Federal Audit Clearinghouse accepting the audit.
• Reporting. Quarterly and semiannual reports are due 30 days after the period ends, annual reports 90 days, final reports 120 days after the period of performance.
• Property and records. Equipment is anything at $10,000 or more per unit (or the recipient's lower capitalization level). Physical inventory is required at least every two years. Records are kept three years from the final financial report, longer for litigation, audits, and property.
• Davis-Bacon and BABA. Prevailing wage applies when the program statute requires it, and Department of Labor rules since October 2023 make the clauses effective by operation of law even when a contract omits them. Build America, Buy America applies to infrastructure awards, with a 55 percent domestic component test for manufactured products.
• Single audit and closeout. The single audit threshold is $1,000,000 in federal expenditures. A for-profit DOE recipient faces a $1,000,000 compliance audit trigger under Part 910, raised from $750,000 by a DOE class deviation. Closeout reports are due within 120 days, and a recipient that misses them must be reported by the agency in SAM.gov for material failure to comply.

The scoring at the end converts the forty-five items into a single number and, more useful, a list of named actions with owners and dates.

Chapter 1

Cost Principles (Subpart E)

Cost principles govern every dollar charged to a federal award. Allowability, allocability, and reasonableness apply when the cost is incurred, not when the auditor asks about it. Five items.

For-profit DOE recipients and subrecipients apply the cost principles in 48 CFR 31.2 instead of 2 CFR 200.400 through 200.476 (2 CFR 910.352). The discipline below still applies. Swap the citations.

1.1 Allowability Determination Discipline

Why it matters. Under 2 CFR 200.403, a cost must be necessary and reasonable and allocable to the award; conform to the limits in the cost principles and the award; be consistent with policies that apply to all of the recipient's activities; be treated consistently as direct or indirect; follow GAAP; not be counted as cost share on another federal program; be adequately documented; and be incurred within the approved budget period. A cost that fails any one of those tests can be questioned at audit, however well it passes the others.

Risk Low. Allowability is evaluated when the cost is incurred, by trained staff. The file carries the allowability determination, not just the invoice. Borderline cases are escalated and resolved in writing.

Risk Medium. Staff understand allowability in general, but no documented determination accompanies the cost. Finance assumes program staff applied the tests.

Risk High. No structured allowability evaluation. Costs are coded to federal awards by department or program rather than by a tested determination.

30 / 60 / 90.

• 30: Distribute the 200.403 criteria to every staff member with federal expenditure authority. Confirm acknowledgment.
• 60: Require an allowability notation on every federal expenditure above a threshold you set and document.
• 90: Back-check a sample of last quarter's federal expenditures. Document corrections for any allowability gaps.

1.2 Allocability and Cost Allocation Methodology

Why it matters. A cost that benefits two or more projects must be allocated in proportion to the benefit when that proportion can be determined without undue effort, and otherwise on a reasonable, documented basis (2 CFR 200.405(d)). A cost allocable to one award cannot be moved to another to cover a shortfall (200.405(c)). Allocations performed without a methodology, or that change quarter to quarter without a reason, are an easy finding for any auditor who tests them.

Risk Low. The allocation methodology is written. Allocations use a defensible basis such as direct labor hours, square footage, equipment use, or time studies. The methodology is reviewed at least annually.

Risk Medium. Allocations happen, but the basis is informal. An auditor could not replicate them from the documentation.

Risk High. Shared costs are charged in full to a single award, or allocations vary with no documented basis.

30 / 60 / 90.

• 30: Inventory the shared cost pools touching federal awards. Identify the largest by dollar volume.
• 60: Document the allocation methodology for each pool. Lock the basis. Calendar the annual review.
• 90: Reconcile a sample. Compare this quarter's allocations to the documented methodology. Correct variances.

1.3 Reasonableness Documentation

Why it matters. A cost is reasonable under 2 CFR 200.404 if it does not exceed what a prudent person would incur under the circumstances when the decision was made. The regulation points to ordinary and necessary costs, arm's-length bargaining, market prices for the area, prudent conduct, and consistency with the recipient's own written policies. Costs above market, without competitive support, or that look ceremonial rather than operational draw scrutiny. Documenting the analysis at the point of decision is what protects the cost later.

Risk Low. Reasonableness is evaluated and documented for material costs. Quotes, market comparisons, or written justifications support the price paid.

Risk Medium. Reasonableness is assumed because the purchase followed policy, but nothing written at the time shows the analysis.

Risk High. No reasonableness documentation. Noncompetitive purchases carry no written justification.

30 / 60 / 90.

• 30: Pull the twenty largest federal expenditures from last quarter. Identify which carry reasonableness documentation.
• 60: Build a reasonableness template. Apply it to every material purchase going forward.
• 90: Add reasonableness documentation to past material purchases that lack it, but only where the analysis can be reconstructed and dated honestly as a later memorandum.

1.4 Unallowable Cost Segregation

Why it matters. The selected items of cost in 2 CFR 200.420 through 200.476 make several categories unallowable or restricted. Alcoholic beverages and bad debts are unallowable. So are payments into contingency reserves, entertainment without a specific programmatic purpose included in the award, organized fundraising, interest on borrowed capital outside the capital-asset rules, and lobbying. An unallowable cost charged to the award will be disallowed. If a false claim for it is made knowingly, which under the statute includes reckless disregard, the False Claims Act adds liability of three times the government's damages plus per-claim civil penalties (31 U.S.C. 3729).

Risk Low. Unallowable categories are flagged in the chart of accounts or expense coding. Staff are trained on them. Accidental charges are caught and reclassified before the period closes.

Risk Medium. Staff know the categories, but no system flag stops an accidental charge.

Risk High. No segregation. Unallowable categories are not tracked in the chart of accounts.

30 / 60 / 90.

• 30: Inventory the unallowable categories most likely to show up in your expense profile.
• 60: Configure chart-of-accounts flags or coding rules that segregate them.
• 90: Train staff with expenditure authority. Build the reclassification workflow for items caught after the fact.

1.5 Indirect Cost Rate Application

Why it matters. Indirect costs need a basis: a federally negotiated indirect cost rate, an election of the de minimis rate, or a cost allocation plan or indirect cost proposal under the Part 200 appendices (2 CFR 200.414). The 2024 revision raised the de minimis rate to up to 15 percent of modified total direct costs. A recipient without a current negotiated rate may elect it, needs no documentation to justify it, may use it indefinitely, and once it elects the rate must use it on all federal awards until it chooses to negotiate one (200.414(f)). Under 200.414(c), agencies must accept negotiated rates except where a statute or regulation requires otherwise or the agency approves a deviation under its published policy. Risk Low. The indirect rate basis is documented: negotiated rate agreement on file, de minimis election in writing, or approved cost allocation plan. Indirect costs are applied consistently across awards.

Risk Medium. A rate is applied, but its basis is informal, expired, or inconsistent across awards.

Risk High. Indirect costs are charged without a documented rate basis, or different rates are applied to different awards without justification.

30 / 60 / 90.

• 30: Locate the negotiated rate agreement, de minimis election, or cost allocation plan. Confirm it is current.
• 60: If the basis is informal, formalize it. Make a de minimis election in writing if that is the path, and confirm the rate you elect does not exceed 15 percent of MTDC.
• 90: Reconcile indirect cost application across active awards. Correct inconsistencies.

What Changed in 2024

The original edition of this checklist cited a 10 percent de minimis rate. OMB's 2024 revision of Part 200, effective October 1, 2024, raised it to up to 15 percent of MTDC. Existing negotiated rates stay in place until they expire (2 CFR 200.110(b)).

Chapter 2

Procurement (200.317 to 200.327)

Procurement is where many federal award findings start. States and Indian Tribes follow their own procurement policies plus 200.321, 200.322, 200.323 and 200.327. Every other recipient and subrecipient, including a State's subrecipients, follows 200.318 through 200.327 (2 CFR 200.317), and its documented procedures must also be consistent with State and local law (200.318(a)). Five items.

2.1 Procurement Method Selection Discipline

Why it matters. 2 CFR 200.320 sets three families of methods. Informal methods cover micro-purchases and simplified acquisitions up to the simplified acquisition threshold. Formal methods, sealed bids or proposals, are required above it and require public notice. Noncompetitive procurement is allowed only in the circumstances in 200.320(c). The recipient must keep records showing the rationale for the method chosen (200.318(i)). A method that does not match the dollar value is a finding on its own.

Risk Low. The method is selected from a documented threshold analysis recorded when the procurement starts.

Risk Medium. The method is usually right but is not documented at initiation.

Risk High. Methods are chosen by habit, department preference, or the buyer's discretion without threshold analysis.

30 / 60 / 90.

• 30: Publish your thresholds to all procurement staff. The FAR micro-purchase threshold is $15,000 and the simplified acquisition threshold is $350,000, effective October 1, 2025 (48 CFR 2.101). Part 200 lets you set lower thresholds. You may self-certify up to $50,000 annually with a justification, a clear statement of the threshold, and documentation of one basis: low-risk auditee status (200.520), an annual internal institutional risk assessment, or, for public institutions, consistency with State law. The threshold must also be permitted under State, local, or tribal law, and anything above $50,000 needs approval from your cognizant agency for indirect costs (200.320(a)(1)(iii) to (v)).
• 60: Build the method selection worksheet. Require it at procurement initiation.
• 90: Audit last quarter's federal procurements against the worksheet. Close the gaps.

2.2 Competition and Noncompetitive Justification

Why it matters. Every procurement under a federal award must provide full and open competition (2 CFR 200.319(a)). A noncompetitive award is permitted only if one of five circumstances in 200.320(c) applies: the purchase is at or below the micro-purchase threshold; the item is available only from a single source; a public exigency or emergency will not permit the delay of a competitive solicitation; the recipient asks in writing and the federal agency or pass-through entity approves in writing; or competition is found inadequate after soliciting several sources. A sole-source justification that does not name one of those circumstances, with support, does not hold up.

Risk Low. Every noncompetitive procurement carries a written justification citing the applicable 200.320(c) circumstance with supporting analysis. Competition is the default and is documented when achieved.

Risk Medium. Justifications exist but are formulaic, thin on analysis, or do not consistently cite the regulatory circumstance.

Risk High. Sole-source purchases happen without written justification, or justifications get written after an auditor asks.

30 / 60 / 90.

• 30: Identify every noncompetitive procurement on active awards. Inventory the justifications on file.
• 60: Strengthen justifications that lack a regulatory citation or analysis. Apply the standard going forward.
• 90: Write the sole-source review procedure. Require a second signature above a threshold you set.

2.3 Conflict of Interest in Procurement

Why it matters. 2 CFR 200.318(c)(1) requires written standards of conduct covering conflicts of interest for everyone involved in selecting, awarding, or administering contracts. No employee, officer, agent, or board member with a real or apparent conflict may participate. The standards must also provide for disciplinary action. A recipient with a parent, affiliate, or subsidiary that is not a government entity also needs written standards for organizational conflicts (200.318(c)(2)). DOE recipients have more to do: for DOE awards made on or after August 17, 2026, 2 CFR 910 Subpart C requires a written and enforced conflict of interest and conflict of commitment policy for DOE financial assistance, and written disclosure of organizational conflicts to DOE within 15 business days of learning of one.

Risk Low. A written procurement conflict of interest policy exists and is used. Disclosure happens at procurement initiation, and disclosures are reviewed and filed.

Risk Medium. The policy exists, but disclosure is inconsistent or disclosures are not reviewed.

Risk High. No written policy specific to procurement, or a policy nobody exercises.

30 / 60 / 90.

• 30: Pull the current policy. Compare it against 200.318(c)(1) and (c)(2) and, for DOE awards, 2 CFR 910.230 and 910.250 through 910.260.
• 60: Implement a disclosure form. Build the disclosure step into procurement initiation.
• 90: Train procurement and key program staff on disclosure and on what counts as a conflict.

2.4 Procurement Decision File Completeness

Why it matters. 2 CFR 200.318(i) requires records sufficient to detail the history of each procurement, including the rationale for the method, the contract type, contractor selection or rejection, and the basis for the price.

Risk Low. Every federal procurement uses a standard file holding the solicitation, all responses, the evaluation memorandum, the award rationale, the contract, and modifications.

Risk Medium. Files exist but vary. Some lack evaluation or modification records.

Risk High. No standard structure. Records are scattered across email, network drives, and personal folders.

30 / 60 / 90.

• 30: Build or refresh the standard procurement file template. Define the required contents against 200.318(i).
• 60: Move active federal procurement files into the standard structure. Identify gaps.
• 90: Close gaps where the underlying actions can be reconstructed. Where they cannot, document the limitation and the corrected procedure.

2.5 Contract Provisions Required by 2 CFR 200 Appendix II

Why it matters. 2 CFR 200.327 requires contracts to contain the applicable provisions in Appendix II. Several turn on dollar value: remedies for breach above the simplified acquisition threshold; termination for cause and convenience above $10,000; Davis-Bacon (when the program statute requires it) and Copeland Anti-Kickback on prime construction contracts above $2,000; Contract Work Hours and Safety Standards above $100,000 where laborers or mechanics are employed; Clean Air Act and Clean Water Act compliance above $150,000; and the Byrd Anti-Lobbying certification for bids above $100,000. Others apply by subject: equal employment opportunity on federally assisted construction, rights to inventions, debarment and suspension, recovered materials (200.323), the telecommunications prohibition (200.216), and domestic preferences (200.322). A contract missing a required provision is a finding even if the procurement was otherwise sound.

Risk Low. Templates include every Appendix II provision applicable to the procurement type and value. Staff know what triggers each one.

Risk Medium. Templates carry most provisions but have not been checked against the current Appendix II and the 2024 revision.

Risk High. Contracts go out without Appendix II provisions, or with a generic block pasted in without regard to applicability.

30 / 60 / 90.

• 30: Compare your federal contract templates against the current Appendix II.
• 60: Update the templates. Put the federal template library under revision control.
• 90: Audit recent federal contracts against the updated templates. Amend where warranted.

Chapter 3

Subrecipient Monitoring

A pass-through entity carries monitoring obligations under 2 CFR 200.331 through 200.333 that its subrecipients do not. When a subrecipient fails, the pass-through entity answers for its own oversight. Four items.

3.1 Subrecipient Versus Contractor Classification

Why it matters. 2 CFR 200.331 makes the pass-through entity responsible for case-by-case determinations of whether each recipient of federal funds is a subrecipient or a contractor. The regulation lists characteristics of each, says no single factor decides it, and puts the substance of the relationship ahead of the form of the agreement. The two carry different compliance obligations. The expensive error is treating a subaward as a vendor contract and applying none of the subaward requirements in 200.332. Part 200 does not prescribe a form for the determination. Writing it down is how you show you made one.

Risk Low. A written subrecipient-versus-contractor determination exists for every agreement involving federal funds.

Risk Medium. Determinations are made informally. Some agreements have documentation and some do not.

Risk High. No determination process. Classification follows administrative convenience rather than the substance of the relationship.

30 / 60 / 90.

• 30: Inventory every agreement involving federal funds. Apply the 200.331 characteristics to each.
• 60: Document each determination and file it with the agreement.
• 90: Build the determination into agreement initiation. Require it before execution.

3.2 Subrecipient Risk Assessment

Why it matters. 2 CFR 200.332(c) requires the pass-through entity to evaluate each subrecipient's fraud risk and risk of noncompliance to decide what monitoring is appropriate. The factors it lists are the subrecipient's prior experience with similar subawards, the results of previous audits including whether it gets a single audit, new personnel or new or substantially changed systems, and the extent and results of federal agency monitoring. Before any subaward, the pass-through entity must also confirm in SAM.gov that the subrecipient is not excluded (200.332(a)). Monitoring with no documented risk basis does not meet the standard, however thorough it looks.

Risk Low. A documented risk assessment exists for each subrecipient, covering fraud risk and the 200.332(c) factors. SAM.gov exclusion checks are filed. Monitoring intensity follows the risk rating.

Risk Medium. Risk assessments happen but not consistently, or monitoring does not vary with the rating.

Risk High. No documented risk assessment. Monitoring is uniform or absent.

30 / 60 / 90.

• 30: Inventory current subrecipients. Build the risk assessment template around 200.332(c).
• 60: Score every active subrecipient. Document the basis and file the assessment.
• 90: Set monitoring frequency by risk rating. Amend subaward agreements where the monitoring terms need to reflect it.

3.3 Monitoring Cadence and Documentation

Why it matters. Under 2 CFR 200.332(e), the pass-through entity must monitor each subrecipient as necessary to ensure compliance and achievement of the subaward's goals. At a minimum it must review financial and performance reports, ensure corrective action on significant developments such as audit findings and site visit results, issue management decisions on audit findings related to its subaward, and resolve findings specific to the subaward. Training, site visits, and agreed-upon procedures engagements are listed as tools to use according to risk (200.332(f)). Accepting reports at face value, with no verification proportionate to risk, falls short.

Risk Low. A monitoring plan exists for each subrecipient with cadence set by risk. Desk reviews, site visits, financial reviews, and performance checks are documented. Findings are tracked to closure.

Risk Medium. Monitoring happens but documentation is informal. Findings get addressed but are not tracked in a central log.

Risk High. Subrecipient reports are accepted at face value. No independent verification.

30 / 60 / 90.

• 30: Build the monitoring template. Define minimum activities by risk tier.
• 60: Run the cadence on the highest-risk subrecipients. Document findings and corrective actions.
• 90: Extend the cadence to all subrecipients. Stand up the finding-to-closure log.

3.4 Subrecipient Single Audit Review

Why it matters. The pass-through entity must verify that each subrecipient is audited as Subpart F requires (2 CFR 200.332(g)). That means a single audit for any non-federal entity expending $1,000,000 or more in federal awards in its fiscal year (200.501). The pass-through entity must issue a management decision on audit findings affecting its subawards within six months of the Federal Audit Clearinghouse's acceptance of the audit report (200.521(c) and (d)). For-profit subrecipients fall outside Subpart F, so the pass-through entity has to set the compliance requirements for them in the subaward (200.501(i)).

Risk Low. Each subrecipient's audit status is tracked. Reports are pulled from the FAC and reviewed promptly. Management decisions go out inside the six-month window.

Risk Medium. Reviews happen but timing is loose. Some management decisions are late.

Risk High. No tracking of subrecipient audit status. Audit reports are not reviewed.

30 / 60 / 90.

• 30: Inventory subrecipients. Identify which are subject to single audit. Confirm the most recent fiscal year's report is on file at the FAC.
• 60: Review the audit reports. Identify findings that affect your subawards.
• 90: Issue management decisions on open findings within the window. Write the review and decision procedure.

Chapter 4

Reporting Cadence

Federal awards run on a reporting calendar the recipient does not control. Missed, late, and unreconcilable reports create the trail the auditor follows first. Four items.

4.1 Federal Financial Report (SF-425) Discipline

Why it matters. The Federal Financial Report, SF-425, is the OMB-approved government-wide financial report (2 CFR 200.328(a)). Agencies collect it at least annually and no more than quarterly unless a specific condition applies. Quarterly and semiannual reports are due 30 days after the period ends, annual reports 90 days (200.328(b), (c)). The numbers must tie to the general ledger, the draws, and the approved budget categories. Late or unreconcilable reports invite findings, and one remedy is temporarily withholding payments (200.339(a)).

Risk Low. The SF-425 is filed on time for every active award. Numbers reconcile to the ledger, draws, and budget categories. A documented review happens before submission.

Risk Medium. Reports go in on time, but reconciliation is informal. Discrepancies get fixed ad hoc.

Risk High. Reports are late, or carry numbers that do not reconcile to the ledger.

30 / 60 / 90.

• 30: List each award's SF-425 due dates. Build a filing calendar with named owners.
• 60: Check each award's latest SF-425 against ledger and draws. Document fixes.
• 90: Lock reconciliation into the filing workflow. Require sign-off before submission.

4.2 Performance Report Substance

Why it matters. Under 2 CFR 200.329(b), performance reports must relate financial data and accomplishments to the award's goals and objectives. Under 200.329(c)(2), they should also contain, as applicable, a comparison of accomplishments to the objectives for the period and explanations of goals not met and cost overruns. The recipient must also report significant developments between reporting dates, including problems and delays, with a corrective action plan (200.329(e)). A change in scope or objective needs prior written approval (200.308(f)(1)). A report that recites activity without evidencing outcomes, or quietly reflects an unapproved scope change, is a finding waiting to be written.

Risk Low. Reports cite milestones, deliverables, and outcomes against the approved work plan. Variances are explained. Scope changes get prior approval first.

Risk Medium. Reports lack specifics, or show scope changes made without prior approval.

Risk High. Reports are generic, do not map to the work plan, or are late.

30 / 60 / 90.

• 30: Pull each active award's approved work plan. Confirm reporting milestones map to it.
• 60: Audit the latest performance report against the work plan. Identify substance gaps.
• 90: Strengthen the report template. Lock in prior approval for scope and budget changes that 200.308(f) or the award terms require.

4.3 Payment and Draw Discipline

Why it matters. Many agencies pay through the Automated Standard Application for Payments (ASAP), Treasury's system for drawing against approved balances. For recipients other than States, 2 CFR 200.305(b) requires payment methods that minimize the time between receipt and disbursement of federal funds, and limits advances to the minimum needed, timed to actual, immediate cash requirements. Advances must sit in interest-bearing accounts unless a 200.305(b)(11) exception applies, and interest above $500 per year goes back to the HHS Payment Management System (200.305(b)(11) and (12)). States work under Treasury-State Cash Management Improvement Act agreements, where State interest liability can accrue from the day federal funds are credited until they are paid out (200.305(a); 31 CFR 205.15). For construction awards, reimbursement is the preferred method (200.305(b)(3)).

Risk Low. Draws are sized to immediate cash needs and backed by expenditure records. Cash on hand is monitored. Excess cash and interest above $500 go back on schedule.

Risk Medium. Draws are estimated rather than calculated. Cash on hand is watched informally.

Risk High. Draws follow a schedule rather than actual needs. Federal cash sits unspent.

30 / 60 / 90.

• 30: Document the draw calculation method and the immediate-need basis.
• 60: Monitor cash on hand. Set up the return workflow for excess cash and interest.
• 90: Back-check six months of draws. Document corrections. Set the monitoring cadence.

4.4 Reporting Calendar and Owner Assignment

Why it matters. Late reports are among the most avoidable findings. The cause is almost always the same: no single calendar with named owners and alerts. A calendar in one person's head is one resignation from a missed report.

Risk Low. One calendar covers every active award. Each report has a named owner, a backup, and a lead-time alert. The institution owns the calendar, so it survives turnover.

Risk Medium. A calendar exists, but ownership is concentrated. Alerts are inconsistent.

Risk High. No central calendar. Reports are tracked in project files or personal calendars.

30 / 60 / 90.

• 30: Build the master reporting calendar. Load every active award.
• 60: Assign owners and backups. Set alerts at 30, 14, and 7 days.
• 90: Move the calendar to an institutionally owned platform. Write the procedure for adding awards and modifications.

Chapter 5

Property Management

Awards that buy or improve real property or equipment carry property obligations under 2 CFR 200.310 through 200.316 that outlast the period of performance. Federally funded property is held in trust for the beneficiaries of the program (2 CFR 200.316), and disposing of it wrongly can mean paying the federal share back years after the award closes. Four items.

5.1 Property Records and Inventory

Why it matters. Equipment is tangible personal property with a useful life over one year and a per-unit cost at or above the lesser of the recipient's capitalization level or $10,000 (2 CFR 200.1). Property records must include a description, serial or other identification number, funding source including the FAIN, title holder, acquisition date, cost, federal share, location, use and condition, and disposition data. A physical inventory must be reconciled to those records at least once every two years. Loss, damage, or theft must be investigated, and reported to the agency or pass-through entity when it affects the program (200.313(d)). Tagging each item at receipt is the practical way to tie the asset on the floor to the record in the system.

Risk Low. Federal equipment is tagged at receipt and recorded with every 200.313(d)(1) data element. A physical inventory within the last two years has been reconciled. Missing or transferred items have disposition records.

Risk Medium. Tagging happens, but inventories are informal. Reconciliation gaps exist and are not documented.

Risk High. No federal property tagging or award-specific records. No inventory cycle.

30 / 60 / 90.

• 30: Confirm which active awards involve equipment. Check current records against 200.313(d)(1).
• 60: Tag and record any untagged federal equipment. Write the receipt-time tagging procedure.
• 90: Schedule the biennial inventory. Build the disposition documentation workflow.

5.2 Real Property Federal Interest Documentation

Why it matters. Real property acquired or improved with federal funds must be used for the originally authorized purpose as long as it is needed for that purpose. While it is, the recipient may not dispose of or encumber its title without agency approval (2 CFR 200.311(b)). When it is no longer needed, the recipient must get disposition instructions. The options are to retain title or sell, compensating the agency for its share, or transfer title and be compensated for the recipient's share (200.311(d)). The agency may require liens or notices of record (200.316).

Risk Low. The federal interest is documented in the property record. Restrictions on conveyance, encumbrance, and change of use are tracked. Any contemplated change goes to the agency in advance.

Risk Medium. The federal interest is acknowledged, but documentation is incomplete or scattered.

Risk High. No documentation of federal interest in real property acquired or improved with federal funds.

30 / 60 / 90.

• 30: Identify all real property tied to active or past federal awards.
• 60: Document the federal interest and the federal share on each parcel. Map the restrictions.
• 90: Build the change-in-use and disposition approval workflow. Train property staff on the triggers.

5.3 Equipment Use and Management

Why it matters. Equipment must be used for the project for which it was acquired, as long as it is needed, whether or not the award still supports the project. When it is no longer needed there, it goes first to other awards from the same agency, then to other federal awards (2 CFR 200.313(c)). It may not be encumbered without prior approval. Management procedures must include a loss-prevention control system and regular maintenance (200.313(d)).

Risk Low. Use is monitored against the authorized purpose. Maintenance records are kept. Idle equipment is evaluated for other federal use or disposition.

Risk Medium. Use generally matches the authorized purpose, but nobody monitors it. Maintenance documentation is informal.

Risk High. Use is not monitored. Equipment may be serving another purpose, or sitting idle with no disposition decision.

30 / 60 / 90.

• 30: Identify federally funded equipment. Confirm current use against the authorized purpose.
• 60: Set the use monitoring cadence. Build the maintenance file.
• 90: Evaluate idle equipment for other federal use or disposition. Execute disposition under 200.313(e).

5.4 Disposition Documentation

Why it matters. When equipment is no longer needed for federal purposes, 2 CFR 200.313(e) governs. Items with a current fair market value of $10,000 or less per unit may be kept, sold, or disposed of with no further obligation. Above $10,000, the recipient may keep or sell the item, but the agency is entitled to its percentage share of current market value or sale proceeds. Real property follows 200.311(d). Records for property and equipment must be kept for three years after final disposition (200.334(c)). Disposing of property outside these procedures leaves the federal share unpaid and the recipient exposed.

Risk Low. Disposition follows the regulation. The file holds the method, the valuation, the federal share calculation, and agency correspondence where required.

Risk Medium. Disposition happens, but documentation is incomplete and federal share calculations are informal.

Risk High. Property is disposed of without the regulatory procedure. No record of federal share returned.

30 / 60 / 90.

• 30: Inventory dispositions over the past three years. Identify documentation gaps.
• 60: Complete documentation on past dispositions where the transactions can be reconstructed.
• 90: Write the disposition procedure. Require approval before any federal property leaves your control.

Chapter 6

Record Retention (2 CFR 200.334)

Federal award records must be kept for three years from submission of the final financial report, and longer in defined cases. Records that cannot be found or read are no defense. Four items.

6.1 Retention Period Calculation

Why it matters. 2 CFR 200.334 sets the three-year baseline from submission of the final financial report (or of each quarterly or annual report, for awards renewed on that cycle). Retention runs longer when litigation, a claim, or an audit starts before the three years expire; when the agency or a cognizant agency extends it in writing; for property and equipment records, which run three years past final disposition; and for indirect cost rate records, which run on their own clock. Records destroyed too early cannot be recreated, and the destruction becomes the finding.

Risk Low. The retention period is calculated and documented for each record type, using the correct trigger date and any extension.

Risk Medium. Three years is applied across the board, but extensions and exceptions are not tracked.

Risk High. No documented calculation. Records are kept or destroyed by departmental habit.

30 / 60 / 90.

• 30: Document the retention calculation method. Build a worksheet for each record type.
• 60: Apply it to active and recently closed awards. Lock retention dates in the records system.
• 90: Train records staff on the extension triggers: litigation, claims, audits, written extensions, and property disposition.

6.2 Records Accessibility and Format

Why it matters. Records must stay accessible and inspectable for the full retention period. Records in formats nobody can open anymore (legacy software, obsolete media, a departed employee's personal account) are functionally destroyed even if the bits still exist.

Risk Low. Records are stored in formats that remain readable. A migration plan covers legacy formats. Inspection access is documented.

Risk Medium. Records are accessible today, but nothing addresses format obsolescence.

Risk High. Records are scattered across personal accounts, legacy systems, or storage nobody can reach.

30 / 60 / 90.

• 30: Audit where federal award records live and in what formats.
• 60: Move records out of personal accounts and legacy systems into storage the institution controls.
• 90: Document the inspection access procedure. Name the staff who can produce records for an auditor on demand.

6.3 Litigation and Audit Hold Process

Why it matters. Records involved in litigation, a claim, or an audit that starts before the retention period ends must be kept until it is resolved and final action is taken (2 CFR 200.334(a)). Records destroyed on the routine schedule when they should have been on hold create spoliation exposure and undercut any defense.

Risk Low. The hold process is documented. Triggers are defined. Hold notices reach records custodians promptly and are acknowledged.

Risk Medium. The process is informal. Holds are communicated verbally and not documented.

Risk High. No hold process. Records are destroyed on schedule regardless of open matters.

30 / 60 / 90.

• 30: Document the hold process, its triggers, and the notification chain.
• 60: Implement written hold notices. Confirm acknowledgment from custodians.
• 90: Build a periodic hold review. Lift holds when matters resolve so records do not sit indefinitely.

6.4 Records Inspection Readiness

Why it matters. Under 2 CFR 200.337, the federal agency, the pass-through entity, Inspectors General, the Comptroller General, and their representatives have a right of access to any records pertinent to the award, including timely and reasonable access to personnel for interviews. That right lasts as long as the records are kept, even past the retention period. A slow or partial response to an inspection request is a problem of its own, separate from anything in the records.

Risk Low. Inspection response is documented. Designated staff can produce requested records within agency timelines.

Risk Medium. A response would happen, but it is not planned or rehearsed. It would be slow.

Risk High. Nobody is assigned. A federal records request would be handled ad hoc.

30 / 60 / 90.

• 30: Designate the inspection contact and a backup. Document the role.
• 60: Write the response procedure, with internal escalation and tracking.
• 90: Run a tabletop inspection. Time the response. Document and fix the gaps.

Chapter 7

Davis-Bacon and Prevailing Wage on Construction

Federally assisted construction carries Davis-Bacon prevailing wage requirements whenever the program statute calls for them. Wage findings mean back wages owed to each underpaid worker, and the Wage and Hour Division investigates on its own authority (29 CFR 5.6(b)). Five items.

7.1 Davis-Bacon Applicability Determination

Why it matters. The Davis-Bacon Act itself covers federal contracts over $2,000 for construction, alteration, or repair of public buildings and public works (40 U.S.C. 3142). On grants, coverage comes from the program statute. Appendix II requires the Davis-Bacon clause in prime construction contracts over $2,000 "when required by Federal program legislation." For example, the Infrastructure Investment and Jobs Act applies Davis-Bacon wages to projects funded under its Division D, the energy title (42 U.S.C. 18851). Since October 23, 2023, Department of Labor rules make the required clauses and correct wage determination part of a covered contract by operation of law, retroactive to the start of construction, even if they were left out (29 CFR 5.5(e) and 5.6). Separately, a project claiming the increased Inflation Reduction Act credit amount must meet the tax-law prevailing wage and apprenticeship requirements in 26 CFR 1.45-7 and 1.45-8. Those run in parallel with any grant obligation and are documented separately.

Risk Low. Applicability is determined and documented at the award and contract level. Contractors and subcontractors are notified in writing. The project file is clear on which regime applies.

Risk Medium. Applicability is understood, but documentation is informal and contractor notice is inconsistent.

Risk High. No documented determination. Contractors find out mid-project.

30 / 60 / 90.

• 30: Confirm Davis-Bacon applicability on every active federally assisted construction contract by checking the award terms and program statute. Document the determination.
• 60: Notify contractors and subcontractors in writing. Capture acknowledgment.
• 90: Build the determination into procurement, before contract execution.

7.2 Wage Determination Currency

Why it matters. The correct wage determination has to be in the solicitation and the contract (2 CFR 200 Appendix II (D)). Under 29 CFR 1.6(c)(2), a revised wage determination issued before contract award applies to the project, with defined exceptions. For sealed bids, a revision issued at least 10 calendar days before bid opening applies. A revision issued less than 10 calendar days before opening also applies, unless the agency finds there is not reasonable time to notify bidders and documents that finding in the contract file. If award slips more than 90 days past bid opening, revisions issued before award apply unless the agency gets an extension. A stale wage determination produces underpayment across the whole construction period and back wages calculated at the correct rate.

Risk Low. The wage determination is pulled at the regulatory trigger and locked in the contract file. Revisions are tracked against 29 CFR 1.6.

Risk Medium. The determination is pulled, but timing is not documented. Revision tracking is informal.

Risk High. Nobody can say which determination applies or whether it was current at the trigger date.

30 / 60 / 90.

• 30: Pull the wage determination history for every active federally assisted construction contract. Verify currency to the trigger date.
• 60: Correct contracts with stale determinations. Document the corrective action.
• 90: Lock the wage determination pull into contract execution.

7.3 Certified Payroll Review Discipline

Why it matters. Contractors and subcontractors must submit certified payrolls weekly for every week covered work is performed, with a signed Statement of Compliance. Optional Form WH-347 satisfies the certification (29 CFR 5.5(a)(3)(ii)). The prime contractor is responsible for every subcontractor's submission. Where the agency is not a party to the contract, payrolls go to the applicant, sponsor, owner, or other entity that maintains them. If that entity is you, review for wage rates, classifications, fringe benefits, and apprentice ratios is where the recipient protects itself. Stacking payrolls in a binder without examining them does not survive a Wage and Hour Division investigation.

Risk Low. Weekly certified payrolls arrive from every contractor and subcontractor. Reviews cover rates, classifications, fringes, and apprentice ratios. Exceptions are documented and pursued to correction.

Risk Medium. Payrolls arrive, but review is administrative rather than substantive.

Risk High. Payrolls do not arrive consistently, or arrive and are never reviewed.

30 / 60 / 90.

• 30: Confirm certified payroll receipt on every active federally assisted construction contract. Identify gaps.
• 60: Review against the applicable wage determination. Document each review.
• 90: Train construction project staff on the review standard. Write the exception escalation procedure.

7.4 Apprentice and Trainee Compliance

Why it matters. A worker may be paid apprentice rates only if individually registered in a program registered with the Department of Labor's Office of Apprenticeship or a recognized State Apprenticeship Agency. The ratio of apprentices to journeyworkers may not exceed the registered program's ratio. Anyone paid as an apprentice who is not registered, and any apprentice above the ratio, must be paid the full wage determination rate for the work performed (29 CFR 5.5(a)(4)(i)). Contractors must keep evidence of program and apprentice registration and the program's ratios and wage rates (29 CFR 5.5(a)(3)(i)(D)). Tax-credit projects add a labor-hours test: for facilities beginning construction after December 31, 2023, qualified apprentices must perform at least 15 percent of total construction labor hours, subject to the ratio rules (26 CFR 1.45-8).

Risk Low. Apprentice registration is verified against program documentation. Ratios are monitored daily against program standards. Tax-credit apprenticeship hours are tracked separately where they apply.

Risk Medium. Registration is usually confirmed, but ratio monitoring is informal.

Risk High. Contractors assert apprentice status and nobody verifies it.

30 / 60 / 90.

• 30: Verify registration for every apprentice on active federally assisted construction.
• 60: Monitor ratios against program standards. Track tax-credit apprenticeship hours separately where applicable.
• 90: Build verification into contractor onboarding. Train field staff on the documentation standard.

7.5 Posting and Worker Notification Requirements

Why it matters. The wage determination, including any conformed classifications, and the Davis-Bacon poster (WH-1321) must be posted at all times at the site of the work, in a prominent and accessible place where workers can easily see them (29 CFR 5.5(a)(1)(i)). Missing or hidden postings are a finding independent of whether anyone was underpaid.

Risk Low. Posters and wage determinations are posted at every federally assisted construction site. Site visits confirm they are current and visible.

Risk Medium. Posters go to contractors, but nobody checks the site.

Risk High. Posting is not managed.

30 / 60 / 90.

• 30: Verify posting at every active federally assisted construction site.
• 60: Add posting checks to routine site visits. Document them.
• 90: Train field staff on the standard. Write the corrective action procedure for posting gaps.

Chapter 8

Build America, Buy America

The Build America, Buy America Act requires that none of the funds for a federal award for an infrastructure project be obligated unless the iron, steel, manufactured products, and construction materials incorporated into the project are produced in the United States (2 CFR 184.1(b)). OMB's implementing guidance in 2 CFR Part 184 applies to awards obligated on or after October 23, 2023. Awards obligated from May 14, 2022 to that date follow OMB Memorandum M-22-11 (2 CFR 184.2(b)). Separately, every recipient should prefer U.S.-produced goods where practicable and must flow that preference into its subawards and contracts (2 CFR 200.322). The work is documentation-heavy. Five items.

8.1 BABA Applicability and Coverage

Why it matters. Whether BABA applies to a given award, and to what, depends on whether the award funds an infrastructure project and on the awarding agency's implementation and award terms. Coverage reaches iron and steel, manufactured products, and construction materials. Misreading coverage produces sourcing decisions that cannot be unwound without a contract change or a waiver.

Risk Low. BABA applicability is confirmed for each active award. Covered categories are documented. Project teams know what is in scope.

Risk Medium. BABA is acknowledged, but coverage analysis is informal and teams lack category guidance.

Risk High. Applicability has not been confirmed against the agency's implementation. Sourcing may already be noncompliant.

30 / 60 / 90.

• 30: Confirm BABA applicability and coverage for every active infrastructure award. Document the determination.
• 60: Translate coverage into category-level guidance for project teams.
• 90: Build the coverage determination into award acceptance.

8.2 Domestic Content Calculation Methodology

Why it matters. Under 2 CFR 184.3, iron and steel products qualify only if all manufacturing processes, from initial melting through coating, occurred in the United States. A manufactured product qualifies if it was manufactured in the United States and the cost of its U.S.-origin components is greater than 55 percent of the total cost of all components, unless another applicable standard sets a higher bar. Component costs are determined under 184.5. Construction materials qualify only if all manufacturing processes occurred in the United States, defined material by material in 184.6. The calculation must be documented product by product.

Risk Low. A documented calculation exists for every covered manufactured product. Supplier documentation supports it. Records are kept.

Risk Medium. The method is applied, but documentation varies by product.

Risk High. No documented calculation. Compliance is asserted without support.

30 / 60 / 90.

• 30: Identify covered manufactured products on active awards. Build the calculation worksheet on 184.5.
• 60: Get component cost documentation from suppliers. Run each covered product through the worksheet.
• 90: Lock the calculation into procurement for future product selection.

8.3 Supplier Certification Discipline

Why it matters. BABA compliance leans on supplier statements about origin, manufacturing location, and component cost. A certification accepted without scrutiny, or one that lacks the substance an Inspector General or agency reviewer would expect, leaves the recipient carrying the consequences of a supplier's misstatement.

Risk Low. Certifications are reviewed for substance. Each is specific to the product, dated, and signed by an authorized supplier representative. Discrepancies are resolved before purchase.

Risk Medium. Certifications are collected, but review is administrative.

Risk High. Certifications are not collected, or are accepted without review.

30 / 60 / 90.

• 30: Inventory supplier certifications on active BABA-covered procurements.
• 60: Fix certifications that lack substance. Reissue where necessary.
• 90: Build the review standard into procurement. Train procurement staff.

8.4 Waiver Strategy and Documentation

Why it matters. An agency may waive the preference on three grounds: public interest; nonavailability in sufficient quantity or satisfactory quality; or unreasonable cost, meaning domestic products would raise the overall project cost by more than 25 percent (2 CFR 184.7(a)). A recipient's request must be in writing and follow the agency's instructions. Before a waiver is final, the agency must post it with its justification for at least 15 days of public comment and, unless OMB provides otherwise, send it to the Made in America Office for review (184.7(b) through (d)). That process takes time, so a waiver requested at the moment of a sourcing failure arrives late.

Risk Low. Waiver needs are identified during project planning. Requests are documented and submitted on the agency's schedule, with time built in for the comment period.

Risk Medium. The process is understood, but waiver needs are found reactively.

Risk High. No waiver strategy. Requests are emergency responses to sourcing failures.

30 / 60 / 90.

• 30: Identify products on active awards that may need waivers. Confirm the agency's waiver instructions.
• 60: Develop the waiver request with supporting analysis. Submit on the agency's schedule.
• 90: Build waiver evaluation into procurement planning.

8.5 BABA Recordkeeping Through Closeout

Why it matters. BABA documentation has to last through the record retention period, not just through construction. Agency and Inspector General reviews can revisit domestic content after the project is built. Documentation that lived in a project manager's email and was deleted at closeout is gone.

Risk Low. BABA documentation sits in the award's permanent record. Certifications, calculations, waivers, and supplier records survive the retention period.

Risk Medium. Documentation exists in project files that may never move to permanent records.

Risk High. BABA documentation is informal or scattered. Nobody has planned its retention.

30 / 60 / 90.

• 30: Inventory BABA documentation across active and recently completed projects.
• 60: Move it into the permanent award record.
• 90: Build the BABA folder structure into the standard award file.

Chapter 9

Single Audit Readiness

Audit results follow an entity. Agencies review prior audits and findings when assessing an applicant's risk before new awards (2 CFR 200.206(b)(2)(iv)). The requirements sit in 2 CFR 200 Subpart F. Preparing before the audit year closes separates a clean report from one with findings. Four items.

9.1 Single Audit Threshold Monitoring

Why it matters. A non-federal entity that expends $1,000,000 or more in federal awards in its fiscal year must have a single audit, or in narrow cases a program-specific audit (2 CFR 200.501). The 2024 revision raised the threshold from $750,000. Below it, the entity is exempt from federal audit requirements for the year, but its records must be available for review (200.501(e)). For-profit entities are outside Subpart F (200.501(i)). A for-profit DOE recipient that expends $1,000,000 or more in DOE awards in its fiscal year instead needs a compliance audit under 2 CFR 910.501. Each award with $1,000,000 or more in expenditures is audited. If no single award reaches that amount, the audit covers the largest cluster of awards with common compliance requirements or the largest award, whichever has the greater expenditures (910.501(a) and (b)). DOE Policy Flash 2025-02 (October 2, 2024), a class deviation, raised the codified $750,000 to $1,000,000 until rulemaking is complete. The reporting package is due to the Federal Audit Clearinghouse within 30 days of receiving the auditor's report or nine months after year-end, whichever is earlier (200.512(a)).

Risk Low. Expenditures are tracked in real time. A threshold crossing is anticipated and an auditor engaged before year-end.

Risk Medium. Expenditures are tracked, but threshold awareness comes late.

Risk High. Nobody tracks federal expenditures against the threshold.

30 / 60 / 90.

• 30: Sum federal spending to date. Confirm whether 2 CFR 200 or 910 Subpart F applies.
• 60: Project full-year expenditures. Confirm your audit position.
• 90: Over the threshold? Engage an auditor by year-end. Build the SEFA workflow.

9.2 Schedule of Expenditures of Federal Awards (SEFA) Accuracy

Why it matters. The SEFA lists federal expenditures by agency and Assistance Listing number, identifies awards received as a subrecipient with the pass-through entity's name and identifying number, shows amounts passed to subrecipients, and discloses whether the de minimis rate was used (2 CFR 200.510(b)). The auditor uses it to identify Type A and Type B programs and pick major programs (200.518). An inaccurate SEFA misdirects the whole audit.

Risk Low. The SEFA is maintained all year, not built at audit. Expenditures are coded to Assistance Listing number and award when incurred. The SEFA reconciles to the ledger.

Risk Medium. The SEFA is built at audit from underlying records. Reconciliation is reactive.

Risk High. The auditor builds the SEFA, or it is built from incomplete records.

30 / 60 / 90.

• 30: Review how the SEFA is built today. Identify gaps against 200.510(b).
• 60: Implement year-round SEFA tracking. Check coding on recent expenditures.
• 90: Reconcile the SEFA before the auditor arrives. Correct discrepancies.

9.3 Internal Control Documentation for Major Programs

Why it matters. Recipients must establish, document, and maintain effective internal control over federal awards, aligned to GAO's Standards for Internal Control in the Federal Government (the Green Book) or COSO's Internal Control-Integrated Framework (2 CFR 200.303(a)). The single audit tests major-program controls. Undocumented ones leave nothing to test.

Risk Low. Internal control documentation exists for each major program, aligned to COSO or the Green Book. A self-assessment runs annually.

Risk Medium. Controls operate, but documentation is incomplete or dated.

Risk High. No documented internal control framework over major programs.

30 / 60 / 90.

• 30: Identify likely major programs from your expenditure profile.
• 60: Document the controls over each, mapped to COSO or Green Book components.
• 90: Run the self-assessment. Fix documented control gaps before the audit.

9.4 Prior Finding Corrective Action Tracking

Why it matters. The auditee must prepare a summary schedule of prior audit findings and a corrective action plan for current findings, naming the contact person, the action, and the expected completion date (2 CFR 200.511). A finding not fully corrected stays on the schedule, with the reason it recurred. A material weakness in internal control, among other conditions, in either of the two preceding audit periods bars an entity from low-risk auditee status, which raises the share of expenditures audited as major programs (200.518(f), 200.520).

Risk Low. Prior findings sit in a corrective action log. Implementation is documented and tested.

Risk Medium. Corrective action happens, but documentation is informal.

Risk High. Prior findings are not tracked. Repeat findings are likely.

30 / 60 / 90.

• 30: Inventory prior findings. Confirm corrective action status on each.
• 60: Document implementation. Identify anything not fully closed.
• 90: Test corrective actions in an internal review before the next audit. Fix residual gaps.

Chapter 10

Closeout Readiness

Federal awards do not close themselves. Closeout failures keep awards open past the period of performance and follow the entity into its next application. Five items.

10.1 Closeout Calendar and Timeline Discipline

Why it matters. A recipient must submit all final financial, performance, and other required reports and liquidate all obligations within 120 calendar days after the period of performance ends. A subrecipient owes the pass-through entity the same within 90 days, or earlier if agreed. The agency or pass-through entity may approve an extension when justified (2 CFR 200.344(b) and (c)). A recipient that fails to complete closeout must be reported by the agency in SAM.gov for material failure to comply with the award terms (200.344(i)). Agencies review those SAM.gov records before making any award expected to exceed the simplified acquisition threshold (200.206(a)(2)). A no-cost extension request should go in at least 10 days before the period of performance ends (200.308(f)(10)).

Risk Low. Closeout is calendared 180 days before the period of performance ends. Tasks are sequenced and owned.

Risk Medium. Closeout is recognized as coming, but planning is reactive.

Risk High. Closeout planning starts after the period of performance has ended.

30 / 60 / 90.

• 30: Inventory awards ending in the next twelve months. Calendar each closeout.
• 60: Sequence tasks for awards within 180 days of end. Assign owners.
• 90: Start closeout work on the nearest awards. Document progress.

10.2 Final Financial Reconciliation

Why it matters. The final SF-425 is due within 120 days after the period of performance (2 CFR 200.328(d)). It must reconcile to the ledger, cumulative draws, and the approved budget. Unobligated funds paid out and not authorized to be retained must be refunded promptly (200.344(e)). If a final indirect rate is not yet set, the final report still goes in, and a revised one follows when rates are final (200.344(b)). Discrepancies found at closeout are hard to fix because the people behind the transactions may be gone.

Risk Low. Reconciliation runs progressively through the closeout window. Discrepancies are fixed while staff and records are still available.

Risk Medium. Reconciliation happens at closeout and turns up discrepancies that take real effort.

Risk High. Reconciliation is reactive. Refund of unobligated balances is late.

30 / 60 / 90.

• 30: For awards nearing closeout, start progressive reconciliation now.
• 60: Resolve discrepancies. Identify unobligated balances and the refund procedure.
• 90: File the final SF-425 within the window. Confirm the refund.

10.3 Final Performance Report

Why it matters. The final performance report is due within 120 days after the period of performance (2 CFR 200.329(c)(1)). It documents what the award accomplished against the approved work plan. A final report that cannot evidence the deliverables, milestones, and outcomes promised in the application leaves a record of unfinished business, and the agency reviews that history the next time the entity applies (200.206(b)(2)(iii)).

Risk Low. Evidence for each deliverable is collected throughout the period of performance. Assembling the final report is straightforward.

Risk Medium. The final report is assembled at closeout from existing records, with significant effort.

Risk High. Performance documentation was never collected. Reconstruction at closeout is incomplete.

30 / 60 / 90.

• 30: For active awards, confirm the deliverable evidence collection cadence.
• 60: Build evidence files deliverable by deliverable. Lock the structure.
• 90: For awards nearing closeout, draft the final report from the evidence files.

10.4 Property and Equipment Disposition

Why it matters. At closeout the recipient must account for all property acquired with federal funds (2 CFR 200.344(g)). Equipment conditions under 200.313 and real property conditions under 200.311 do not end with the award. Equipment still needed for the project stays under its use rules. Equipment no longer needed goes through the disposition steps in 200.313(e).

Risk Low. Disposition is planned before closeout. Decisions are documented. Federal share calculations are done where required.

Risk Medium. Disposition is recognized, but planning is reactive.

Risk High. Property is not addressed at closeout. Federal interest continues with no documented plan.

30 / 60 / 90.

• 30: Inventory federally funded property and equipment on awards nearing closeout.
• 60: Decide disposition for each item. Document the rationale.
• 90: Execute disposition. Calculate and remit the federal share where required.

10.5 Records Transition to Permanent Retention

Why it matters. Submitting the final financial report starts the three-year retention clock under 2 CFR 200.334. Records need to move from active project storage into permanent retention with the date locked. Records left in project folders after closeout get reorganized, archived, or lost before the clock runs out.

Risk Low. Closeout includes a structured records transition. Records move to permanent storage with the retention date set. Inspection access is documented.

Risk Medium. Records stay in project files after closeout. Nobody addresses permanent retention.

Risk High. Records are scattered or at risk of early destruction.

30 / 60 / 90.

• 30: For awards nearing closeout, plan the records transition.
• 60: Move records to permanent retention. Lock the retention date.
• 90: Document inspection access for the retained records.

Chapter 11

Scoring and What to Do Next

Score each of the 45 items Risk Low (0), Risk Medium (1), or Risk High (2). The maximum is 90. Lower is better.

11.1 Reading the Total

These bands are my judgment, built from the scoring scale. They are not a regulatory standard.

• Total 0 to 18 (Risk Low). Post-award discipline is audit-defensible across the areas. Keep the cadence. Re-score quarterly.
• Total 19 to 45 (Risk Medium). Material gaps exist that will surface on audit. Work the Risk High items first. Put the 30/60/90 actions on a tracked remediation calendar.
• Total 46 to 90 (Risk High). Audit exposure is substantial. Consider a structured Post-Award Compliance Administration engagement before the next audit, single audit, or program officer site visit. Fixing the files now costs far less than disallowed costs, back wages, and a corrective action plan written under an examiner's timeline.

11.2 Watch the Concentrations

A composite score can hide a problem. A Medium total that conceals two or three Risk High ratings in one area means concentrated exposure, and an auditor who samples that area will find it. Fix the concentration before you work the composite score down.

11.3 Closing Note

Post-award risk does not announce itself. The audit notice is the last warning, not the first. Every item on this checklist is a discipline the entity either maintains or does not. Work the actions.

Entities that come through single audits and agency reviews cleanly tend to be the ones that built their post-award discipline before the first construction draw. The size of the compliance staff matters less. Documentation built in real time holds up. Documentation reconstructed under audit pressure is almost always thin in exactly the places the auditor cares about.

Glossary of Terms

Glossary of Terms

Assistance Listing Number (ALN). The number identifying a federal program in the federal Assistance Listings. The SEFA lists expenditures by it (2 CFR 200.510(b)).

ASAP. Automated Standard Application for Payments, the electronic payment system created by Treasury's Bureau of the Fiscal Service and the Federal Reserve Bank of Kansas City, which recipients use to draw federal funds against approved balances.

Build America, Buy America (BABA). The domestic preference requirement for federal financial assistance for infrastructure projects in the Infrastructure Investment and Jobs Act, implemented by OMB in 2 CFR Part 184.

Cash Management Improvement Act (CMIA). The statute governing transfers of federal funds to States, implemented through Treasury-State agreements and 31 CFR Part 205, under which State interest liability can accrue.

Closeout. The process by which the federal agency or pass-through entity determines that all administrative actions and required work of the award are complete (2 CFR 200.1, 200.344).

COSO. The Committee of Sponsoring Organizations of the Treadway Commission, publisher of the Internal Control-Integrated Framework, one of the two frameworks 2 CFR 200.303 points to.

Davis-Bacon and Related Acts. The Davis-Bacon Act (40 U.S.C. 3141 and following) and the program statutes that extend its prevailing wage requirement to federally assisted construction, administered by the Department of Labor under 29 CFR Parts 1, 3 and 5.

De Minimis Rate. The indirect cost rate of up to 15 percent of modified total direct costs that a recipient without a current negotiated rate may elect (2 CFR 200.414(f)).

Equipment. Tangible personal property with a useful life over one year and a per-unit cost at or above the lesser of the recipient's capitalization level or $10,000 (2 CFR 200.1).

Federal Audit Clearinghouse (FAC). The OMB-designated repository of record for single audit reporting packages and data collection forms (2 CFR 200.1, 200.512).

Green Book. The GAO's Standards for Internal Control in the Federal Government, the other framework 2 CFR 200.303 points to.

Management Decision. The federal agency's or pass-through entity's written determination of the adequacy of the auditee's proposed corrective actions on audit findings (2 CFR 200.1). It is due within six months of FAC acceptance of the audit report (200.521(d)).

Micro-Purchase Threshold. The dollar amount at or below which a recipient may buy without soliciting competitive quotes if it documents that the price is reasonable. It is $15,000 under the FAR since October 1, 2025, and a recipient may self-certify up to $50,000 (2 CFR 200.320(a)(1); 48 CFR 2.101).

Modified Total Direct Cost (MTDC). The base for the de minimis rate: direct salaries and wages, fringe benefits, materials and supplies, services, travel, and up to the first $50,000 of each subaward, excluding equipment, capital expenditures, rental costs, participant support costs and other listed items (2 CFR 200.1).

Pass-Through Entity. A recipient or subrecipient that provides a subaward to a subrecipient to carry out part of a federal program (2 CFR 200.1).

Period of Performance. The time between the start and end dates of a federal award (2 CFR 200.1).

Prevailing Wage and Apprenticeship Requirements (tax credits). The Internal Revenue Code conditions for the increased credit amount, implemented in 26 CFR 1.45-7 and 1.45-8. They are separate from Davis-Bacon obligations under a grant.

Schedule of Expenditures of Federal Awards (SEFA). The schedule of federal expenditures, by program and Assistance Listing number, that accompanies the auditee's financial statements (2 CFR 200.510(b)).

SF-425. The Federal Financial Report, the OMB-approved government-wide financial report for federal awards (2 CFR 200.328(a)).

Simplified Acquisition Threshold. The dollar amount above which formal procurement methods are required. It is $350,000 under the FAR since October 1, 2025, and a recipient may set a lower one (2 CFR 200.1, 200.320; 48 CFR 2.101).

Single Audit. The audit of a non-federal entity's financial statements and federal awards required under 2 CFR 200 Subpart F when it expends $1,000,000 or more in federal awards in a fiscal year.

Subaward. An award a pass-through entity makes to a subrecipient to carry out part of a federal award. It does not include payments to a contractor (2 CFR 200.1).

Uniform Guidance. 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, last revised by OMB effective October 1, 2024.

Unobligated Balance. Funds the recipient was authorized to obligate but has not, after subtracting unliquidated obligations and expenditures (2 CFR 200.1).

Wage Determination. The Department of Labor's listing of prevailing wage and fringe benefit rates for classifications of laborers and mechanics in a locality, incorporated into covered construction contracts (29 CFR Part 1).

WH-347. The Department of Labor's optional certified payroll form. Its signed certification satisfies the weekly Statement of Compliance requirement (29 CFR 5.5(a)(3)(ii)(D)).

How Energy Compliance Can Help

How Energy Compliance Can Help

Gap and risk assessment. We score the forty-five items against your actual files, not your recollection, and hand back the 30/60/90 plan with owners and dates. That turns a self-assessment into evidence you can show a program officer.

Audit preparation and defense. If a single audit, an agency review, or a site visit is already on the calendar, we prepare the evidence, the SEFA reconciliation, and the corrective action plans. If findings have already landed, we help you work out the mitigation.

Compliance program management. We help you run the compliance program that tracks those actions, owners, and dates through the period of performance.

Legal and regulatory compliance support. Procurement policies, conflict of interest standards, and subaward terms are regulatory documents. We draft and review them against the current Part 200 text and your award terms, in coordination with your counsel.

Our seven defined packages:

• Grant Readiness Assessment, pre-application diagnostic and gap closure
• Energy Funding and Grant Application Support, application strategy, narrative engineering, submission management
• Post-Award Compliance Administration. Compliance Obligation Matrix, reporting cycles, sub-recipient monitoring, audit readiness
• IRA / Tax Credit Compliance Support, documentation discipline for ITC, PTC, bonus credit stacking, direct pay and transferability
• Utility Regulatory and Legal Support. FERC, state PUC, RTO/ISO matters in coordination with licensed counsel
• NERC/CIP and Energy Infrastructure Compliance Support. RSAW production, audit defense, mitigation, self-reporting
• Engineering Firm Partnership, white-label and co-delivery for engineering, EPC, and owner's-engineer firms

For a utility or cooperative that is also NERC registered, WattOps Compliance is EC's NERC compliance evidence platform, at wattopscompliance.com. We will run one NERC standard at one of your facilities through WattOps at no cost. CIP standards are excluded.

If your award funds renewable generation, look at RenewOps, EC's renewable operations monitoring and analytics platform, with a Data Center module, for the operating plant.

If you scored yourself and do not like the number, call me.

Website: energycomplianceinc.com · Email: [email protected] · Phone: 763.438.4427

About the Author

About the Author

Rob Smith is the Founder and Principal of Energy Compliance, Inc., with more than thirty years in the industry on every side of the system. He began in control-room operations as a Reliability Coordinator, Transmission Operator, and Power System Operator across RTO/ISO and utility control centers. On the regulator side, he was a senior compliance auditor and subject matter expert for NERC Reliability Standards. He audited grid facilities, evaluated mitigation adequacy, participated in risk-based oversight of utility mitigation activities, and supported the development of violation notifications and settlements in FERC-directed enforcement actions. He conducted a regulatory audit in the Sultanate of Oman against the Sultanate's Sector Law and Grid Code.

He founded Energy Compliance, Inc. to deliver senior regulator-side compliance authority without the layered staffing and billable-hour overhead of larger firms.

Education:

• MBA, Energy Management, University of Mary
• MSL, Compliance Law, Fordham Law University
• BAS, Energy Management, Bismarck State College
• BAS, Mechanical Engineering, Metallurgy minor, University of Florida
• BAS, Criminology, St. Petersburg College (State Law Enforcement Certification)
• AAS, Power Plant Technology, Bismarck State College
• AAS, Electrical Transmission System Technology, Bismarck State College

Certifications: NERC Lead Auditor training; previously NERC-certified at the Reliability Coordinator level; 1st Class A Boiler Engineer License, Minnesota.

The views expressed in this publication are the author's and do not represent the views of any federal agency.

About Energy Compliance, Inc.

About Energy Compliance, Inc.

Energy Compliance, Inc. is a multidisciplinary energy regulatory compliance firm in Bloomington, Minnesota, across NERC, Texas PUCT, and adjacent frameworks.

Compliance program support covers gap and risk assessments, audit preparation and defense, mitigation strategy, RSAW narratives, and monthly NERC evidence packages. Data Request work runs a disciplined pipeline: deliverable mapping, deduplication, scope control, and phased issuance. We provide regulatory and corporate compliance legal services, and engineering support for compliance and operations.

• Post-Award Administration. Compliance Obligation Matrix, reporting cadence, sub-recipient monitoring, single-audit readiness under 2 CFR 200.
• Audit Defense. Single audit preparation, OIG response, finding remediation, corrective action plan drafting and execution.
• Davis-Bacon Discipline. Certified payroll review, wage determination management, apprenticeship compliance, restitution exposure mitigation.
• BABA Documentation. Domestic content calculation methodology, supplier certification discipline, waiver strategy, recordkeeping through closeout.

EC publishes the EC-WP whitepaper library and develops custom NERC and operations training for plant managers, regional managers, and site operations personnel. WattOps Compliance (wattopscompliance.com) is our NERC compliance evidence platform. RenewOps is our renewable operations monitoring and analytics platform, with a Data Center module.

Energy Compliance is not affiliated with, sponsored by, or endorsed by any federal agency, NERC, or any Regional Entity.

Website: energycomplianceinc.com · Email: [email protected] · Phone: 763.438.4427

Sources and Authorities

Sources and Authorities

Uniform Guidance and OMB

• 2 CFR Part 200, Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards, eCFR current through October 15, 2026, including §§ 200.1, 200.110, 200.206, 200.216, 200.303, 200.305, 200.308, 200.311, 200.313, 200.316 through 200.334, 200.337, 200.339, 200.344, 200.403 through 200.476, 200.501, 200.510 through 200.521, and Appendix II. https://www.ecfr.gov/current/title-2/subtitle-A/chapter-II/part-200
• OMB, Guidance for Federal Financial Assistance, 89 Fed. Reg. 30046 (April 22, 2024), effective October 1, 2024 (2024 revision of Part 200, including the $1,000,000 single audit threshold). https://www.federalregister.gov/documents/2024/04/22/2024-07496/guidance-for-federal-financial-assistance
• OMB, Regulation for Federal Financial Assistance, proposed rule, 91 Fed. Reg. 32198 (May 29, 2026); not final as of October 17, 2026. https://www.federalregister.gov/documents/2026/05/29/2026-10817/regulation-for-federal-financial-assistance
• 2 CFR Part 184, Buy America Preferences for Infrastructure Projects, including §§ 184.1 through 184.7. https://www.ecfr.gov/current/title-2/subtitle-A/chapter-I/part-184

Department of Energy

• 2 CFR Part 910, Department of Energy Financial Assistance Regulations, including §§ 910.350, 910.352, 910.356, 910.501 (for-profit cost principles and audits) and Subpart C (conflict of interest and conflict of commitment, applicable to awards on or after August 17, 2026). https://www.ecfr.gov/current/title-2/subtitle-B/chapter-IX/part-910
• DOE, Policy Flash 2025-02, Class Deviation to 2 CFR 910.501 Audit Requirements for For-Profit Organizations (October 2, 2024), raising the for-profit compliance audit threshold from $750,000 to $1,000,000 until rulemaking is complete. https://www.energy.gov/node/4845564
• DOE, Financial Assistance Regulations: Conflict of Interest and Conflict of Commitment Policy Requirements, 91 Fed. Reg. 43511 (July 16, 2026), effective August 17, 2026. https://www.federalregister.gov/documents/2026/07/16/2026-14333/financial-assistance-regulations-conflict-of-interest-and-conflict-of-commitment-policy-requirements

Federal Acquisition Regulation

• 48 CFR 2.101, definitions of micro-purchase threshold ($15,000) and simplified acquisition threshold ($350,000). https://www.ecfr.gov/current/title-48/chapter-1/subchapter-A/part-2/subpart-2.1/section-2.101
• FAR Case 2024-001, Inflation Adjustment of Acquisition-Related Thresholds, 90 Fed. Reg. 41872 (August 27, 2025), effective October 1, 2025. https://www.federalregister.gov/documents/2025/08/27/2025-16412/federal-acquisition-regulation-inflation-adjustment-of-acquisition-related-thresholds

Department of Labor and prevailing wage

• 29 CFR Part 1, Procedures for Predetermination of Wage Rates, including § 1.6. https://www.ecfr.gov/current/title-29/subtitle-A/part-1
• 29 CFR Part 5, Labor Standards Provisions Applicable to Contracts Covering Federally Financed and Assisted Construction, including §§ 5.5 and 5.6. https://www.ecfr.gov/current/title-29/subtitle-A/part-5
• DOL, Updating the Davis-Bacon and Related Acts Regulations, 88 Fed. Reg. 57526 (August 23, 2023), effective October 23, 2023. https://www.federalregister.gov/documents/2023/08/23/2023-17221/updating-the-davis-bacon-and-related-acts-regulations
• 40 U.S.C. 3142, Davis-Bacon Act rate of wages for laborers and mechanics. https://www.govinfo.gov/content/pkg/USCODE-2024-title40/html/USCODE-2024-title40-subtitleII-partA-chap31-subchapIV-sec3142.htm
• 42 U.S.C. 18851, wage rate requirements for projects funded under Division D of the Infrastructure Investment and Jobs Act. https://www.govinfo.gov/content/pkg/USCODE-2024-title42/html/USCODE-2024-title42-chap162-subchapVI-sec18851.htm

Treasury, tax, and enforcement

• 31 CFR Part 205, Rules and Procedures for Efficient Federal-State Funds Transfers, including § 205.15. https://www.ecfr.gov/current/title-31/subtitle-B/chapter-II/part-205
• Bureau of the Fiscal Service, About ASAP. https://asap.gov/ASAPGovHelp_508Project/general_help/about_asap.htm
• 26 CFR 1.45-7, prevailing wage requirements. https://www.ecfr.gov/current/title-26/chapter-I/subchapter-A/part-1/section-1.45-7
• 26 CFR 1.45-8, apprenticeship requirements. https://www.ecfr.gov/current/title-26/chapter-I/subchapter-A/part-1/section-1.45-8
• 31 U.S.C. 3729, False Claims Act liability. https://www.govinfo.gov/content/pkg/USCODE-2023-title31/html/USCODE-2023-title31-subtitleIII-chap37-subchapIII-sec3729.htm