2 C.F.R. §§ 200.500–200.521

Audit required. A non-Federal entity that expends $1,000,000 or more during the non-Federal entity's fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part.

Single audit. A non-Federal entity that expends $1,000,000 or more in Federal awards during the non-Federal entity's fiscal year must have a single audit conducted in accordance with § 200.514 except when it elects to have a program-specific audit conducted in accordance with paragraph (c) or (d) of this section.

Program-specific audit election (in general). A non-Federal entity may elect to have a program-specific audit conducted in accordance with § 200.507 if the following conditions are met:

Program-specific audit election for research and development. A non-Federal entity may elect to have a program-specific audit for research and development conducted in accordance with § 200.507, but only if all of the following conditions are met:

Exemption when Federal awards expended are less than $1,000,000. A non-Federal entity that expends less than $1,000,000 in Federal awards during its fiscal year is exempt from Federal audit requirements for that year, except as noted in § 200.503. However, in all instances, the records of the non-Federal entity must be available for review or audit by appropriate officials of the Federal agency, pass-through entity, and the Government Accountability Office (GAO).

Federally Funded Research and Development Centers (FFRDC). Management of an auditee that owns or operates a FFRDC may elect to treat the FFRDC as a separate entity for purposes of this part.

Subrecipients and contractors. An auditee may simultaneously be a recipient, a subrecipient, and a contractor. Unless a program is exempt by Federal statute, Federal awards expended as a recipient or a subrecipient are subject to audit under this part. Payments received for goods or services provided as a contractor under a Federal award (see § 200.331) are not subject to audit under this part.

Compliance responsibility for contractors. In most cases, the auditee's compliance responsibility for contractors is to ensure that the procurement, receipt, and payment for goods and services comply with Federal statutes, regulations, and the terms and conditions of a Federal award. Federal award compliance requirements normally do not flow down to contractors. However, for procurement transactions in which the contractor is made responsible for meeting program requirements, the auditee must ensure those requirements are met, including by clearly stating the contractor's responsibilities within the contract and reviewing the contractor's records to determine compliance. Also, when these procurement transactions relate to a major program, the scope of the audit must include a determination of whether these transactions comply with Federal statutes, regulations, and the terms and conditions of a Federal award. See also § 200.318(b).

For-profit subrecipient. This subpart does not apply to for-profit organizations. As necessary, the pass-through entity is responsible for establishing requirements to ensure compliance by for-profit subrecipients. The subaward with a for-profit subrecipient must describe applicable compliance requirements and the for-profit subrecipient's compliance responsibility. Methods to ensure compliance for Federal awards made to for-profit subrecipients may include pre-award audits, monitoring throughout the performance of the subaward, and post-award audits (see § 200.332).

Determining Federal awards expended. The determination of when a Federal award is expended must be based on when the activity related to the Federal award occurs. Generally, the activity related to the Federal award pertains to events that require the non-Federal entity to comply with Federal statutes, regulations, and the terms and conditions of Federal awards, such as:

Loan and loan guarantees (loans). The Federal Government is at risk for loans until the debt is repaid. Therefore, the following guidelines must be used to calculate the value of Federal awards expended under loan programs (except as noted in paragraphs (c) and (d)):

Loan and loan guarantees (loans) at Institutions of Higher Education (IHE). When loans are made to students of an IHE, but the IHE itself does not have continuing compliance requirements for the loans, then only the value of loans made during the audit period are considered Federal awards expended in that audit period. The balance of loans for previous audit periods is not included as Federal awards expended because the lender accounts for the prior balances.

Prior loan and loan guarantees (loans). Loans, the proceeds of which were received and expended in prior years, are not considered Federal awards expended under this part when Federal statutes, regulations, and the terms and conditions of Federal awards pertaining to such loans impose no continuing compliance requirements other than to repay the loans.

Endowment funds. The cumulative balance of Federal awards for endowment funds that are federally restricted is considered Federal awards expended in each audit period in which the funds are still restricted.

Free rent. Free rent received by itself is not considered a Federal award expended under this part. However, free rent received as part of a Federal award to carry out a Federal program must be included in determining Federal awards expended and is subject to audit under this part.

Valuing non-cash assistance. Federal non-cash assistance (such as free rent, food commodities, donated property, or donated surplus property that is received as part of a Federal award to carry out a Federal program) must be valued at fair market value at the time of receipt or the assessed value provided by the Federal agency and must be included in determining Federal awards expended under this part.

Medicare. Medicare payments to a non-Federal entity for providing patient care services to Medicare-eligible individuals are not considered Federal awards expended under this part.

Medicaid. Medicaid payments to a subrecipient for providing patient care services to Medicaid-eligible individuals are not considered Federal awards expended under this part unless a State requires the funds to be treated as Federal awards expended because reimbursement is on a cost-reimbursement basis.

Certain loans provided by the National Credit Union Administration. For purposes of this part, loans from the National Credit Union Share Insurance Fund and the Central Liquidity Facility funded by contributions from insured non-Federal entities are not considered Federal awards expended.

Other financial audits. An audit conducted in accordance with this part must be in lieu of any financial audit of Federal awards which a non-Federal entity is required to undergo under any other Federal statute or regulation. To the extent that such an audit provides a Federal agency with the information it requires to carry out its responsibilities under Federal statute or regulation, a Federal agency must rely upon and use that information.

Conducting additional audits. Notwithstanding paragraph (a) of this section, a Federal agency, Inspectors General, or GAO may conduct or arrange additional audits to carry out its responsibilities under Federal statute or regulation. The provisions of this part do not authorize any non-Federal entity to constrain, in any manner, such Federal agency from carrying out or arranging for such additional audits, except that the Federal agency must plan such audits not to be duplicative of other audits of Federal awards. Prior to commencing such an audit, the Federal agency or pass-through entity must review the FAC for recent audits submitted by the non-Federal entity, and to the extent such audits meet a Federal agency or pass-through entity's needs, the Federal agency or pass-through entity must rely upon and use such audits. Any additional audits must be planned and performed in such a way as to build upon work performed, including the audit documentation, sampling, and testing already performed by other auditors.

Authority to conduct additional audits. The provisions of this part do not limit the authority of Federal agencies to conduct, or arrange for the conduct of, audits and evaluations of Federal awards, nor limit the authority of any Federal agency Inspector General or other Federal officials. For example, requirements that may be applicable under the FAR or CAS and the terms and conditions of a cost-reimbursement contract may include additional applicable audits to be conducted or arranged for by Federal agencies.

Federal agency to pay for additional audits. A Federal agency that conducts or arranges for additional audits must, consistent with other applicable Federal statutes and regulations, arrange for funding the full cost of such additional audits.

Request for a program to be audited as a major program. A Federal agency may request that an auditee have a particular Federal program audited as a major program in lieu of the Federal agency conducting or arranging for the additional audits. Such requests should be made at least 180 calendar days prior to the end of the fiscal year to be audited to allow for planning. After consultation with its auditor, the auditee should promptly respond to such a request by informing the Federal agency whether the program would otherwise be audited as a major program using the risk-based audit approach described in § 200.518 and, if not, the estimated incremental cost. The Federal agency must then promptly confirm to the auditee whether it wants the program audited as a major program. If the program is to be audited as a major program based upon this Federal agency request, and the Federal agency agrees to pay the full incremental costs, then the auditee must have the program audited as a major program. With approval of the Federal agency, a pass-through entity may use the provisions of this paragraph for a subrecipient.

A State, local government, or Indian Tribe that is required by constitution or statute, in effect on January 1, 1987, to undergo its audits less frequently than annually, is permitted to undergo biennial (every other year) audits pursuant to this part. This requirement must still be in effect for the biennial period.

Any nonprofit organization that had biennial audits for all biennial periods ending between July 1, 1992, and January 1, 1995, is permitted to undergo biennial audits pursuant to this part.

Program-specific audit guide available. In some cases, a program-specific audit guide will be available to provide specific guidance to the auditor concerning internal controls, compliance requirements, suggested audit procedures, and audit reporting requirements. A listing of current program-specific audit guides can be found in the compliance supplement (Appendix VI, Program-Specific Audit Guides). When a current program-specific audit guide is available, the auditor must follow Generally Accepted Government Auditing Standards (GAGAS) and the guide when performing a program-specific audit.

Other sections of this part may apply. Program-specific audits are subject to:

Arrange for the audit required by this part in accordance with § 200.509, and ensure it is properly performed and submitted in accordance with § 200.512.

Prepare financial statements, including the schedule of expenditures of Federal awards in accordance with § 200.510.

Promptly follow up and take corrective action on audit findings. This includes preparing a summary schedule of prior audit findings and a corrective action plan in accordance with § 200.511(b) and (c), respectively.

Provide the auditor access to personnel, accounts, books, records, supporting documentation, and any other information needed for the auditor to perform the audit required by this part.

Auditor procurement. When procuring audit services, the auditee must follow the procurement standards in §§ 200.317 through 200.327 of subpart D or the FAR (48 CFR part 42), as applicable. When requesting proposals for audit services, the objectives and scope of the audit must be made clear, and the non-Federal entity must request a copy of the audit organization's peer review report, which the auditor must provide under GAGAS. Factors to be considered in evaluating each proposal for audit services include the responsiveness to the request for proposal, relevant experience, availability of staff with professional qualifications and technical abilities, the results of peer and external quality control reviews, and price. Whenever possible, the auditee must make efforts to contract with businesses as stated in § 200.321 or the FAR (48 CFR part 42), as applicable.

Restriction on auditor preparing indirect cost proposals. An auditor who prepares the indirect cost proposal or cost allocation plan may not be selected to perform the audit required by this part when the indirect costs recovered by the auditee during the prior year exceed $1 million. This restriction applies to the base year used to prepare the indirect cost proposal or cost allocation plan and any subsequent years in which the resulting indirect cost agreement or cost allocation plan is used to recover costs.

Use of Federal auditors. Federal auditors may perform all or part of the work required under this part if they fully comply with the requirements of this part.

Financial statements. The auditee must prepare financial statements that reflect its financial position, results of operations or changes in net assets, and, where appropriate, cash flows for the fiscal year audited. The financial statements must be for the same organizational unit and fiscal year chosen to meet this part's requirements. However, organization-wide financial statements of the non-Federal entity may also include departments, agencies, and other organizational units that have separate audits in accordance with § 200.514(a) and prepare separate financial statements.

Schedule of expenditures of Federal awards. The auditee must also prepare a schedule of expenditures of Federal awards for the period covered by the auditee's financial statements. The schedule must include the total Federal awards expended as determined in accordance with § 200.502. The auditee may choose to provide information requested by Federal agencies or pass-through entities to make the schedule easier to use. For example, when a Federal program has multiple Federal award years, the auditee may separately list the amount of Federal awards expended for each year of a Federal award. The schedule must:

General. The auditee is responsible for follow-up and corrective action on all audit findings. As part of this responsibility, the auditee must prepare a summary schedule of prior audit findings. The auditee must also prepare a corrective action plan for current year audit findings. The summary schedule of prior audit findings and the corrective action plan must include the reference numbers the auditor assigns to audit findings under § 200.516(c). Since the summary schedule may include audit findings from multiple years, it must include the fiscal year in which the finding initially occurred. The corrective action plan and summary schedule of prior audit findings must include financial statement findings that the auditor was required to report in accordance with GAGAS.

Summary schedule of prior audit findings. The summary schedule of prior audit findings must report the status of all audit findings included in the prior audit's schedule of findings and questioned costs. The summary schedule must also include audit findings reported in the prior audit's summary schedule of prior audit findings except audit findings listed as corrected in accordance with paragraph (b)(1) of this section or no longer valid or not warranting further action in accordance with paragraph (b)(3) of this section.

Corrective action plan. At the completion of the audit, the auditee must prepare a corrective action plan to address each audit finding included in the auditor's report for the current year. The corrective action plan must be a document separate from the auditor's findings described in § 200.516. The corrective action plan must also provide the name(s) of the contact person(s) responsible for the corrective action, the corrective action to be taken, and the anticipated completion date. When the auditee does not agree with the audit findings or believes corrective action is not required, the corrective action plan must include a detailed explanation of the reasons.

Data collection. The FAC is the repository of record for subpart F reporting packages and the data collection form. All Federal agencies, pass-through entities and others interested in a reporting package and data collection form must obtain it by accessing the FAC.

Reporting package. The reporting package must include the following:

Submission to FAC. The auditee must electronically submit the data collection form described in paragraph (b) of this section and the reporting package described in paragraph (c) of this section to the FAC.

Requests for management letters issued by the auditor. Auditees must submit, when requested by a Federal agency or pass-through entity, a copy of any management letters issued by the auditor.

Report retention requirements. Auditees must keep a copy of the data collection form described in paragraph (b) of this section and a copy of the reporting package described in paragraph (c) on file for three years from the date of submission to the FAC. Copies of audit records must be maintained in accordance with § 200.336.

FAC responsibilities. The FAC must make available the reporting packages received in accordance with paragraph (c) of this section and § 200.507(c) to the public, except for Indian Tribes exercising the option in paragraph (b)(3) of this section, and maintain a database of completed audits, provide appropriate information to Federal agencies, and follow up with known auditees that have not submitted the required data collection forms and reporting packages.

Electronic filing. Nothing in this part must preclude electronic submissions to the FAC in such a manner as may be approved by OMB.

Oversight agency for audit responsibilities. An auditee who does not have a designated cognizant agency for audit will be under the general oversight of the Federal agency determined in accordance with § 200.1 oversight agency for audit. A Federal agency with oversight for an auditee may reassign oversight to another Federal agency that agrees to be the oversight agency for audit. Within 30 calendar days after any reassignment, both the old and the new oversight agency for audit must provide notice of the change to the FAC, the auditee, and, if known, the auditor. The oversight agency for audit:

Awarding Federal agency responsibilities. In addition to all other requirements of this part, the awarding Federal agency must:

General. The audit must be conducted in accordance with GAGAS. The audit must also cover the entire operations of the auditee, or, at the option of the auditee, such audit must include a series of audits that cover departments, agencies, and other organizational units that expended or otherwise administered Federal awards during the audit period. In these instances, the audit must include the financial statements and schedule of expenditures of Federal awards for each such department, agency, and other organizational unit, which must be considered to be a non-Federal entity. The financial statements and schedule of expenditures of Federal awards must be for the same audit period.

Financial statements. The auditor must determine whether the auditee's financial statements are presented fairly in all material respects in accordance with generally accepted accounting principles (or a special purpose framework such as cash, modified cash, or regulatory as required by State law). The auditor must also determine whether the schedule of expenditures of Federal awards is stated fairly in all material respects in relation to the auditee's financial statements as a whole.

Audit follow-up. The auditor must follow up on prior audit findings regardless of whether a prior audit finding is related to a major program in the current year. Audit follow-up includes performing procedures to assess the reasonableness of the summary schedule of prior audit findings prepared by the auditee in accordance with the requirements of § 200.511. When the auditor concludes that the summary schedule of prior audit findings materially misrepresents the status of any prior audit finding, the auditor must report this condition as a current-year audit finding.

Data collection form. As required in § 200.512(b)(4), the auditor must complete and sign specified sections of the data collection form.

An opinion (or disclaimer of opinion) on whether the financial statement(s) of the auditee is presented fairly in all material respects in accordance with generally accepted accounting principles (or a special purpose framework such as cash, modified cash, or regulatory as required by State law). The auditor must also decide whether the schedule of expenditures of Federal awards is stated fairly in all material respects in relation to the auditee's financial statements as a whole.

A report on internal control over financial reporting and compliance with provisions of laws, regulations, contracts, and award agreements, noncompliance with which could have a material effect on the financial statements. This report must describe the scope of internal control and compliance testing and the results of the tests. Where applicable, the report must refer to the separate schedule of findings and questioned costs described in paragraph (d) of this section.

A report on compliance for each major program and a report on internal control over compliance. This report must describe the scope of testing of internal control over compliance and include an opinion (or disclaimer of opinion) as to whether the auditee complied with Federal statutes, regulations, and the terms and conditions of Federal awards that could have a direct and material effect on each major program and refer to the separate schedule of findings and questioned costs described in paragraph (d) of this section.

A schedule of findings and questioned costs which must include the following three components:

Nothing in this part precludes combining the reporting required by this section with the reporting required by § 200.512(b) when allowed by GAGAS and Appendix X of this part.

Audit findings reported. The auditor must report the following as an audit finding in the schedule of findings and questioned costs:

Audit finding detail and clarity. Audit findings must be presented with sufficient detail and clarity for the auditee to prepare a corrective action plan and take corrective action and for Federal agencies or pass-through entities to arrive at a management decision. As applicable, the following information must be included in audit findings:

Reference numbers. Each audit finding in the schedule of findings and questioned costs must include a reference number in the format meeting the requirements of the data collection form submission (see § 200.512(b)).

Retention of audit documentation. The auditor must retain audit documentation and reports for a minimum of three years after the date of issuance of the auditor's report(s) to the auditee. The cognizant agency for audit, oversight agency for audit, cognizant agency for indirect costs, or pass-through entity may extend the retention period by providing written notification to the auditor. When the auditor is aware that the Federal agency, pass-through entity, or auditee is contesting an audit finding, the auditor must contact the parties contesting the audit finding for guidance prior to the destruction of the audit documentation and reports.

Access to audit documentation. Audit documentation must be made available upon request to the cognizant or oversight agency for audit or its designee, cognizant agency for indirect cost, a Federal agency, or GAO at the completion of the audit, as part of a quality review, to resolve audit findings, or to carry out oversight responsibilities consistent with the purposes of this part. Access to audit documentation includes the right of Federal agencies to obtain copies of audit documentation as is reasonable and necessary.

General. The auditor must use a risk-based approach to determine which Federal programs are major programs. This risk-based approach must consider current and prior audit experience, oversight by Federal agencies and pass-through entities, and the inherent risk of the Federal program. The process described in paragraphs (b) through (h) of this section must be followed.

Step four. At a minimum, the auditor must audit all of the following as major programs:

Percentage of coverage rule. When the auditee meets the criteria in § 200.520, the auditor only needs to audit the major programs identified in paragraphs (e)(1) and (2) of this section and such additional Federal programs with Federal awards expended that, in the aggregate, all major programs encompass at least 20 percent (0.20) of total Federal awards expended. Otherwise, the auditor must audit the major programs identified in paragraphs (e)(1) and (2) of this section and such additional Federal programs with Federal awards expended that, in the aggregate, all major programs encompass at least 40 percent (0.40) of total Federal awards expended.

Documentation of risk. The auditor must include in the audit documentation the risk analysis used for determining major programs.

Auditor's judgment. The auditor's judgment in applying the risk-based approach to determine major programs must be presumed correct when the determination was performed and documented in accordance with this part. Challenges by a Federal agency or pass-through entity must only be for clearly improper use of the requirements in this part. However, a Federal agency or pass-through entity may provide auditors guidance about the risk of a particular Federal program. The auditor must consider this guidance in determining major programs in audits not yet completed.

General. The auditor's determination should be based on an overall evaluation of the risk of noncompliance occurring that could be material to the Federal program. The auditor must consider criteria, such as those described in paragraphs (b), (c), and (d) of this section, to identify risk in Federal programs. Also, as part of the risk analysis, the auditor may wish to discuss a particular Federal program with auditee management and the Federal agency or pass-through entity.

Single audits were performed on an annual basis in accordance with the provisions of this subpart, including submitting the data collection form and the reporting package to the FAC within the timeframe specified in § 200.512. A non-Federal entity that has biennial audits does not qualify as a low-risk auditee.

The auditor's opinion on whether the financial statements were prepared in accordance with generally accepted accounting principles (or a special purpose framework such as cash, modified cash, or regulatory as required by State law), and the auditor's in-relation-to opinion on the schedule of expenditures of Federal awards were unmodified.

No internal control deficiencies were identified as material weaknesses under the requirements of GAGAS.

The auditor did not report a substantial doubt about the auditee's ability to continue as a going concern.

None of the Federal programs had audit findings from any of the following in either of the preceding two audit periods in which they were classified as Type A programs:

General. The management decision must clearly state whether or not the audit finding is sustained, the reasons for the decision, and the expected auditee action to repay disallowed costs, make financial adjustments or take other action. If the auditee has not completed corrective action, a timetable for follow-up should be given. Prior to issuing the management decision, the Federal agency or pass-through entity may request additional information or documentation from the auditee, including a request for auditor assurance related to the documentation, as a way of mitigating disallowed costs. The management decision should describe any appeal process available to the auditee. While not required, the Federal agency or pass-through entity may also issue a management decision on findings relating to the financial statements, which are required to be reported in accordance with GAGAS.

Federal agency. The cognizant agency for audit is responsible for coordinating a management decision for audit findings that affect the programs of more than one Federal agency (see § 200.513(a)(4)(viii)). The awarding Federal agency is responsible for issuing a management decision for audit findings that affect the Federal awards it makes to a non-Federal entity (see § 200.513(c)(3)(i)).

Pass-through entity. The pass-through entity is responsible for issuing a management decision for audit findings that affect subawards it issues to subrecipients under a Federal award (see § 200.332(e)).

Time requirements. The Federal agency or pass-through entity responsible for issuing a management decision must do so within six months of the FAC's acceptance of the audit report. The auditee must initiate and proceed with corrective action as rapidly as possible and corrective action should begin no later than upon receipt of the audit report.

Reference numbers. Management decisions must include the reference numbers the auditor assigned to each audit finding in accordance with § 200.516(c).