SystemResearch Administration & Compliance

Subrecipient Risk Assessment & Monitoring

Subrecipient monitoring that scores risk from cited sources and checks every invoice line before the university pays

Risk scored before signing and every invoice line checked before the university pays.

See one case, screen by screen ↓
demo$9,400of unbudgeted equipment on one subaward invoice, held before the university paid it
demo58 → 72risk scoreone subrecipient re-scored from Medium to High on three pieces of cited evidence
demo37subrecipientswho lost their Single Audit to the $1,000,000 threshold, flagged instead of scored as clean
target100%of invoice lines checked against budget category, period of performance and backup before payment
In short

What is Subrecipient Risk Assessment & Monitoring?

Subrecipient monitoring is the oversight a pass-through entity, such as a university that passes part of a federal award to another organization, owes under 2 CFR 200.332: evaluate each subrecipient's risk, set the agreement's terms, review what it bills against the approved budget, and follow up on its audit findings. Subrecipient Risk Assessment & Monitoring puts seven agents in front of that reading and drafting, and a named person decides every hold, payment and tier change.

AI in education: a buyer's guide to agentic AI for colleges, universities and school districts →

Updated

The problem

Why subrecipient monitoring misses what is inside the invoice

Subrecipient monitoring is the work a pass-through entity owes under 2 CFR 200.332 for every subaward it issues: check exclusions, put the required elements in the agreement, evaluate each subrecipient's risk, set specific conditions where the risk calls for them, review what it bills, and follow up on its Single Audit findings. Under the Uniform Guidance the subrecipient risk assessment must weigh prior experience with similar subawards, the results of previous audits (including whether a Single Audit was required), new personnel or changed systems, and the results of federal agency monitoring.

Today the subrecipient risk assessment questionnaire goes out by email, the score is added up once in a spreadsheet at signing, invoices arrive in a shared inbox and are approved on their total, and accounts payable pays in the ERP. Since the 2024 revision raised the Single Audit threshold from $750,000 to $1,000,000, many subrecipients have no audit at all, and a clearinghouse search that returns nothing reads like good news. A cost outside the approved budget is then found by an auditor after the university has paid it, and the university repays the sponsor. Subrecipient Risk Assessment & Monitoring puts seven agents in front of that reading, so a grants accountant decides on the line that matters, with the evidence beside it.

typical$1,000,000Single Audit threshold for fiscal years beginning on or after October 1, 2024, up from $750,000
typical30daysto pay a subrecipient's proper invoice, unless the request is improper (2 CFR 200.305(b)(3))
typical6monthsto issue a management decision on a subrecipient's audit finding (2 CFR 200.521)
Where the minutes go on one subaward invoice with a problem in itestimated
By hand105 minutes
With the solution25 minutes
  • Matching the invoice to its subaward, budget period and payment clock10 → 2 min
  • Reading each line against the approved budget category and its pace25 → 5 min
  • Reading the backup and the dates against the period of performance30 → 8 min
  • Looking up the subrecipient's Single Audit and prior findings20 → 3 min
  • Writing the request for detail and recording why the invoice is held20 → 7 min

Estimated split of a grants accountant's minutes on one invoice that needs a hold, by hand and with the agents; the 'after' column is the person's own review and decision time. Our arithmetic, kept modest.

How it works

How a subaward is monitored

Seven agents check every invoice line and re-score each subrecipient on cited evidence; people hold the keys to pay.

What comes in
The evidence6,800 invoices a year · with backup, audits and questionnaires
Agents at work
Intake agentinvoice, lines and backup
Then
Invoice agentbudget, period, backup
Clearinghouse agentaudits by fiscal year
Risk agentre-scored, every factor cited
Then
Monitoring agentrequests, visits, conditions
Flow-down agentterms before signing
Then
Reporting agentsubaward reports, on time
A person decides
PI, accountant, AP; manager and directorcertify, approve, pay, sign
What comes out
Held before it is paid
Tier changed with two signatures
Evidence pack for the Single Audit
One case, step by step

One subaward invoice, through subrecipient monitoring to a held payment

Halden State University, Tuesday, March 17, 2026. Subaward SUB-2025-0418 passes NSF money for a soil carbon and drought sensing network to Pellinore Field Institute, and invoice #7 for January arrived on March 2. Here is what happens to it, screen by screen, in the working solution.

  1. 01Morning

    Every subaward as one rail, the money most at risk on top

    Ruth Abernathy · Post-award grants accountant

    Each of Halden State's 1,150 active subawards is drawn as a rail from the prime award to the subrecipient: the risk score, the signed agreement, every invoice and the audit check. The rails are sorted by the nearest held invoice, so Pellinore's amber invoice #7, with 15 days left on its 30-day payment clock, is on the top line.

    Needs a person today: invoice #7, the tier change, the management decision due March 24 and 41 subaward reports due March 31.

  2. 0210:51 to 10:53

    Each line of the subaward invoice checked against the approved budget

    Intake agent and Invoice agent

    The agents read the $48,210 invoice and its backup line by line: salaries $20,300, fringe $5,887, travel $1,240, equipment $9,400, supplies $3,621 and indirect costs of $7,762 at 25% of $31,048. Five lines are on budget, with their backup cited. Line 4 is held, because the approved budget has $0 for equipment.

  3. 03One click

    The held line beside the budget it breaks

    Ruth Abernathy

    Line 4 is a soil gas flux analyzer at $9,400, on a vendor invoice dated December 18, 2025. It sits beside the approved budget's equipment line of $0 and clause 7 of the agreement, which requires Halden State's prior written approval to rebudget into equipment. None is on file.

    The Invoice agent links it to Pellinore's FY2024 audit finding 2024-001, equipment bought without prior approval, $12,600 questioned, with 96% confidence.

  4. 0410:52

    The Single Audit that is not there

    Clearinghouse agent

    The Federal Audit Clearinghouse has no FY2025 Single Audit for Pellinore. The agent reads why instead of scoring it as clean: the audit certification letter of March 10, 2026 states $870,000 of federal expenditures, under the $1,000,000 threshold. A year earlier, the $750,000 threshold would have required one.

  5. 0510:53

    The subrecipient risk assessment re-scored on evidence, not on the calendar

    Risk agent

    Pellinore's score was 58, Medium, at the annual review on October 1, 2025. Three events move it to 72, High: no FY2025 Single Audit (+6), invoice #7 repeating the cost in finding 2024-001 (+5), and a new controller and accounting system (+3). Each of the ten factors from 2 CFR 200.332(c) and office policy shows its points then and now, and its source.

    The Risk agent proposes the tier. It never changes it.

  6. 0611:15

    Holding a payment takes a reason code

    Ruth Abernathy

    Ruth holds all $48,210 of invoice #7 with reason code HLD-02, unbudgeted category, prior approval not on file. The note is prefilled, and the hold is signed as Ruth Abernathy, Post-Award Grants Accountant.

  7. 07Held

    The payment clock paused, the three keys in view

    Ruth Abernathy

    The invoice now reads held by Ruth Abernathy at 11:15 with HLD-02. The 30-day clock is paused on an improper request, as 2 CFR 200.305(b)(3) allows, and restarts when the ledger detail arrives. The PI has certified the work; accounts payable cannot pay.

  8. 0811:18 and 11:22

    A tier change needs two signatures

    Celeste Navarro · Subaward manager

    Celeste Navarro signs the move from Medium to High at 11:18. Malcolm Ferreira, Director of Sponsored Programs, approves it at 11:22. The person who signs cannot approve, and no agent signs.

  9. 09The plan

    Enhanced monitoring drafted by the agents, owned by people

    Monitoring agent

    With Pellinore at High, the plan in force is general ledger detail with every invoice, starting with #7, due March 31; a site visit on April 21, 2026; amendment 3 with reimbursement-only terms and prior approval for equipment under 2 CFR 200.208; notice to NSF; and the management decision on finding 2024-001 due March 24. Each item has an owner, and a person sends, confirms or approves it.

  10. 10Audit-ready

    One audit trail, exported for the Single Audit

    Harriet Nwosu · Internal audit

    The director's approval at 11:22, Celeste's signature at 11:18, Ruth's hold at 11:15 and the agents' checks from 10:51 sit on one trail, people and agents together, each with the evidence it used. The evidence pack exports for the Single Audit, an NSF review or internal audit. $9,400 was stopped before it was paid, not found by an auditor after.

Who it’s for

Built for everyone who touches a subaward invoice.

The same subaward, seen by the five people who carry it: what their day looked like, and what it looks like now.

RA
Ruth AbernathyPost-award grants accountant · 40 to 60 subaward invoices a week
Post-award grants accountant
Before
Checks each invoice against its budget on the total. "I can see the total is fine. I can't see what is inside it."
Now
Opens the one held line beside the budget it breaks and the audit finding it repeats, and holds or pays with a reason code.
CN
Celeste NavarroSubaward manager · issues and amends subawards, owns the risk tier
Subaward manager
Before
Sets a risk tier at signing and revisits it at the annual review. "The score I set in October is not the subrecipient I have today."
Now
Sees the score move when the evidence moves, with every factor cited, and signs the tier change and the monitoring plan.
MF
Malcolm FerreiraDirector of Sponsored Programs, Post-Award · approves tier changes and specific conditions
Director of Sponsored Programs
Before
Answers for the subaward program's risk, with the reasons for tighter terms spread across email and spreadsheets. "If we tighten the terms, I want the reason written down."
Now
Approves a tier change, a specific condition or a payment above tolerance with the cited reason on the same screen.
DS
Dmitri SatoAccounts payable · pays approved invoices in the ERP
Accounts payable
Before
Pays what reaches him as approved. "I pay what has three keys. Not two."
Now
Can pay only when the PI and the grants accountant have turned their keys, and sees what is missing when they have not.
HN
Harriet NwosuInternal audit · reads everything, decides nothing
Internal audit
Before
Pulls the questionnaire, the score, the invoice and the PI's reply from four places for the Single Audit. "Show me who decided, when, and on what evidence."
Now
Exports one evidence pack with every check, hold, signature and request, people and agents on the same trail.
Built on the engine

7 agents. Each with one job, and hard limits.

Seven agents check every invoice line and re-score each subrecipient on cited evidence; people hold the keys to pay.

Intake agent

Reads each invoice and its backup from the invoice inbox and document management, extracts the lines and matches them to the subaward and budget period.

  • Never matches below 90% confidence without asking a person
  • Never edits an invoice
Invoice agent

Checks every line against the approved budget category, the period of performance, the backup and the indirect base, holds what is outside tolerance, and links a held line to the subrecipient's prior audit findings of the same kind.

  • Never approves or pays
  • Never changes a line
Clearinghouse agent

Searches the Federal Audit Clearinghouse for every subrecipient, applies the threshold for its fiscal year, reads findings and tracks the six-month management decision.

  • Never treats "no audit found" as "no findings"
  • Drafts management decisions; the director signs
Risk agent

Scores each subrecipient against the 2 CFR 200.332(c) factors and office policy, re-scores when the evidence changes, cites every factor and shows what moved the score.

  • Proposes a tier; never changes one
Monitoring agent

Builds the monitoring plan the tier requires and drafts every item: ledger requests, site visits, specific conditions and agency notices.

  • Never sends, signs or amends
Flow-down agent

Checks a draft subaward against the 2 CFR 200.332(b) required elements and the prime award's terms, and drafts any missing clause.

  • Never signs
  • Never removes a prime term
Reporting agent

Drafts subaward reports of $30,000 or more for the federal subaward reporting system and tracks the month-after deadline.

  • Never files; a person files
Accountant, subaward manager, director

Hold, sign, approve. The agents propose; a named person decides.

Ask in plain words

Ask about any subaward, invoice line, risk factor or audit

The assistant answers from the subaward's own documents, cites each one, and takes you to the screen where you act on the answer.

Why is invoice 7 held?

Line 4 bills $9,400 of equipment, a soil gas flux analyzer. The approved budget for budget period 1 has $0 for equipment, and clause 7 of the agreement requires Halden State's prior written approval to rebudget into it. None is on file. It is the same kind of cost as Pellinore's FY2024 audit finding 2024-001. The other five lines, $38,810, are supported by their backup.

Why did Pellinore's risk go up?

Three pieces of evidence moved it from 58 to 72, Medium to High: no FY2025 Single Audit, because $870,000 is under $1,000,000 (+6); invoice #7 repeats the cost in finding 2024-001 (+5); the controller left and there is a new accounting system (+3). The other seven factors did not move. The agent proposes; Celeste Navarro signs and Malcolm Ferreira approves.

Who lost their Single Audit this year?

37 subrecipients spent between $750,000 and $1,000,000 of federal money in FY2025, so they were audited under the old threshold and are not now. Pellinore is one, at $870,000. For these, the office does the monitoring an auditor used to: ledger detail on a sample of invoices, and a desk review of their financial statements.

Draft the ledger request

Drafted. It asks Pellinore for the January 2026 ledger for the subaward's cost center, the purchase order and vendor invoice for line 4, and any prior approval or a rebudget request, due March 31. Nothing goes until you press Send.

Every screen

The working solution, as it ships.

13 screens from the working solution, on its sample data. Pick one to see it large.

Every subaward as one rail, sorted by the nearest held invoiceHalden State University's 1,150 active subawards, each drawn as a rail from the prime award to the subrecipient: risk score, signed agreement, every invoice and the audit check. On the top rail, Pellinore Field Institute's invoice #7 is held with 15 days left on its 30-day payment clock, and the station opens beside the rails with each finding cited.
Each subaward invoice line checked against the approved budgetInvoice #7 for January 2026, $48,210, line by line: salaries $20,300, fringe $5,887, travel $1,240, equipment $9,400, supplies $3,621 and indirect costs $7,762 at 25% of $31,048. Five lines are on budget with their backup cited; line 4 is held because the approved budget has $0 for equipment.
The held line next to the budget it breaksLine 4, a soil gas flux analyzer at $9,400, beside the approved budget's equipment line of $0 and clause 7, which requires prior written approval to rebudget into equipment. The Invoice agent links it to FY2024 audit finding 2024-001, equipment bought without prior approval, $12,600 questioned.
Subrecipient risk assessment re-scored on evidence, every factor citedPellinore Field Institute moves from 58 (Medium), set at the October 1, 2025 annual review, to 72 (High). Three events moved it: no FY2025 Single Audit (+6), invoice #7 repeating the cost in finding 2024-001 (+5), and a new controller and accounting system (+3), across ten factors from 2 CFR 200.332(c) and office policy.
Click any citation to read the source passageEvery factor opens the document it was read from. Here, the subrecipient's audit certification letter of March 10, 2026 states federal expenditures of $870,000 for the fiscal year ended December 31, 2025, so no Single Audit was required.
Holding a payment takes a reason codeGrants accountant Ruth Abernathy holds all $48,210 of invoice #7 with reason code HLD-02, unbudgeted category, prior approval not on file. The 30-day clock pauses as an improper request, and the note goes on the audit trail.
The payment held at 11:15, the clock pausedAfter the hold, the invoice shows the payment clock paused under 2 CFR 200.305(b)(3) and the three keys: the PI certified the work, the accountant held the invoice at 11:15 with HLD-02, and accounts payable cannot pay. The clock restarts when the ledger detail arrives.
A tier change needs two signaturesThe Risk agent proposed Medium to High at 10:53; subaward manager Celeste Navarro signs it; the Director of Sponsored Programs, Malcolm Ferreira, approves it or sends it back. The person who signs cannot approve, and no agent signs.
Enhanced monitoring drafted by the agents, owned by peopleWith the subrecipient at High: general ledger detail with every invoice, due March 31; a site visit on April 21, 2026; amendment 3 with reimbursement-only terms and prior approval for equipment under 2 CFR 200.208; notice to NSF; and the management decision on finding 2024-001 due March 24.
Subrecipients who lost their Single Audit to the $1 million thresholdOf 486 subrecipient entities, 131 were not required to have a FY2025 Single Audit, and 37 of them lost the coverage they had under the old $750,000 threshold. Management decisions on findings are tracked against the six-month limit.
Risk and flow-down checked before a subaward is signedA new $286,400 subaward under an NSF prime award, scored 44 (Medium) before signing, with registration and exclusions checked. The Flow-down agent compares the draft with the 2 CFR 200.332(b) required elements and the prime award's terms; signing stays locked while 2 items are missing.
The subaward invoice queue, sorted by the 30-day clock186 open invoices with their received date, days left on the payment clock, PI certification, risk tier and the agents' result. Filters for held, seven days or fewer, awaiting the PI, ready to approve and escalated, with Assign and Approve selected for bulk work.
One audit trail, exported for the Single AuditEvery check, hold, signature and request in the subaward program, people and agents on the same trail with the evidence each one used, from the agents' checks at 10:51 to the director's approval at 11:22. The evidence pack exports for the Single Audit, an NSF review or internal audit.
Governance

Subrecipient monitoring that stands up in the Single Audit: cited, keyed, on the record.

Seven roles, separated by dutyA grants accountant approves, holds or short-pays; a subaward manager signs tier changes and issues subawards; a PI certifies the work on their own subawards; the director approves tier changes, specific conditions and payments above tolerance; accounts payable pays; an auditor reads and exports, deciding nothing; an administrator runs roles, systems and settings, with no invoice decisions.
Three keys to pay, two signatures for a tier changeThe PI certifies, the grants accountant approves and accounts payable pays, in that order, and a payment above tolerance needs the director too. A tier change is signed by the subaward manager and approved by the director. Nobody turns two keys on the same invoice, and no agent holds a key.
Every factor, line and finding cites its sourceEach value names the document, page and line it came from, and the rule with its version. Click a citation and the passage opens, highlighted.
Reason codes on every hold and overrideA hold takes a code such as HLD-02, unbudgeted category, prior approval not on file. Approving as billed, or overriding the agent's risk score, takes an override reason and a note, and the agent's own result stays visible.
Student names masked, records kept, exports redactedStudent names in payroll backup are masked outside the subaward team, under FERPA. Records are kept 3 years after the final financial report (2 CFR 200.334), with redaction on export.
One audit trail, with an evidence packWho, what, when, why and which evidence, for people and agents alike, exportable for the Single Audit, an agency review or internal audit.
Configuration

Your subrecipient monitoring policy, not ours

The rules every subaward and invoice is checked against are settings, versioned and on the audit trail. A change to the risk model waits for an approver.

SettingDefaultChoose from
Invoice toleranceHold a category more than 10% over its cumulative paceA line in a category with no approved budget is always held
Risk modelv2026.2, ten factorsLow 0–39 · Medium 40–64 · High 65–100; a change waits for an approver
Re-score onClearinghouse result, invoice finding, questionnaire update, exclusion changeSet by the director
Single Audit threshold$1,000,000 for fiscal years beginning on or after October 1, 2024$750,000 for earlier fiscal years
Enhanced monitoring for HighLedger detail with every invoice; site visit within 60 daysReimbursement-only, with prior approval for equipment
Hold and override reason codesHLD-01 to HLD-05 · OVR-01 to OVR-03Kept by the administrator
Agent confidence threshold85%Below it, a finding goes to a person
Models and promptsPinned per agentA change is a new version with an approver
Connections

Works with the systems a sponsored programs office already runs on

Research administration systemsubawards, budgets, amendments and PIs
ERP accounts payable and grants ledgerpayments, and the ledger by fund and cost center
Federal Audit ClearinghouseSingle Audit submissions and findings
Federal award management systemregistration and exclusions
Federal subaward reporting systemwhere subaward reports are filed
Document management and the invoice inboxinvoices, backup, agreements and letters
What it changes

The difference, in numbers.

Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.

target
100%
of invoice lines checked against budget, period and backup before payment
every line, before payment
not a sample, months later
demo
$9,400
of unbudgeted equipment held on one invoice before it was paid
Billed$48,210
Supported$38,810
typical
30days
to pay a proper invoice; a hold pauses the clock with its reason

Sources: 2 CFR 200.332 (requirements for pass-through entities, 2024 revision) · 2 CFR 200.501 (Single Audit threshold of $1,000,000 for fiscal years beginning on or after October 1, 2024; previously $750,000) · 2 CFR 200.305(b)(3) (payment within 30 days of a proper invoice) · 2 CFR 200.521 (management decision within six months) · 2 CFR 200.208 (specific conditions) · 2 CFR 200.334 (record retention) · "target" = design goal, measured in the live solution · "demo" = seen in the working solution, on its sample data · "typical" = published figures, here the federal rules above · "estimated" = our arithmetic, kept modest. Halden State University, Pellinore Field Institute and the people named on this page are fictional: characters and sample data in the working solution.

Questions

What sponsored programs offices ask us.

What is subrecipient monitoring?

Subrecipient monitoring is the oversight a pass-through entity, such as a university that passes part of a federal award to another organization, owes under 2 CFR 200.332: evaluate each subrecipient's risk, set the agreement's terms, review what it bills against the approved budget, and follow up on its audit findings. Subrecipient Risk Assessment & Monitoring puts seven agents in front of that reading and drafting, and a named person decides every hold, payment and tier change.

What does 2 CFR 200.332 require of a pass-through entity?

Under the 2024 revision of the Uniform Guidance, 2 CFR 200.332 covers checking exclusions, putting the required elements in the subaward, evaluating each subrecipient's risk, imposing specific conditions where needed, monitoring the subrecipient, and verifying its Single Audit. The solution works through that checklist subaward by subaward: the Flow-down agent checks the required elements before signing, the Risk agent scores the factors, and the Clearinghouse agent follows the audit.

How does the subrecipient risk assessment work?

The Risk agent scores ten factors, from 2 CFR 200.332(c) and office policy: previous audits, Single Audit coverage, prior experience, new personnel or systems, federal agency monitoring, financial condition and others. Each factor shows its points, its maximum and the source it was read from, including the questionnaire. When the evidence changes, it re-scores and shows what moved the score; it proposes a tier, and the subaward manager and the director decide.

What happens when a subrecipient falls under the $1 million Single Audit threshold?

For fiscal years beginning on or after October 1, 2024, the threshold is $1,000,000 of federal expenditures, up from $750,000, so some subrecipients no longer have a Single Audit. The Clearinghouse agent applies the threshold that fits each fiscal year, flags the subrecipients who lost coverage instead of scoring "no audit found" as clean, and the monitoring an auditor used to do moves onto the office.

How are subaward invoices reviewed before payment?

The Invoice agent checks every line against the approved budget category and its pace, the period of performance, the backup and the indirect base, and links a held line to the subrecipient's prior audit findings of the same kind. The grants accountant holds, short-pays or approves with a reason code, and the 30-day payment clock is shown on every invoice.

Do people stay in control of holds, payments and tier changes?

Yes. No agent approves, pays, signs, changes a tier, sends a letter or files a report. The PI certifies the work, the grants accountant approves and accounts payable pays, in that order; a tier change needs the subaward manager's signature and the director's approval, and the person who signs cannot approve. Findings below the office's confidence threshold go to a person.

Can an office set its own risk model, tolerances and reason codes?

Yes. The invoice tolerance, the risk model and its tiers, what triggers a re-score, the enhanced monitoring for High, the hold and override reason codes, the agents' confidence threshold, masking and retention are all settings, versioned and on the audit trail.

How long does it take to go live?

The Agentic Solution Engine builds and deploys it from your requirements and documents, such as your subaward templates, risk questionnaire and monitoring procedures, and it goes live once every quality gate has passed. We will walk you through it on a sample of your own subawards and invoices first.

See it on
your subawards.

We'll run Subrecipient Risk Assessment & Monitoring on a sample of your own subawards and invoices.