At the September 2026 meeting of the AICPA’s Government Performance and Accountability Committee (GPAC), Ken Lish, CPA, CFE, of the National Science Foundation Office of Inspector General, and Pamela Van Dort, J.D., C.F.E., of the Department of the Interior Office of Inspector General, discussed recurring risks in federal subrecipient management and practical steps organizations can take to strengthen oversight.
Federal grant programs often depend on multiple layers of recipients and subrecipients to carry out program objectives. As funds move further from the federal awarding agency, the relationship between financial management, program performance, compliance, and fraud risk becomes more complex.
The emphasis on oversight begins with understanding who is responsible, identifying risks before funds are awarded, and documenting that monitoring occurred.
Start with the relationship
A subrecipient receives a subaward from a pass-through entity to carry out part of a federal award. A contractor, by contrast, generally provides goods or services for the recipient’s or subrecipient’s use. The distinction matters because the applicable oversight requirements differ.
Under the Uniform Guidance, pass-through entities must make a case-by-case determination about whether an entity is a subrecipient or a contractor. The substance of the relationship is more important than the title of the agreement. An organization that makes programmatic decisions, determines eligibility, carries out a public purpose, or is measured against federal program objectives may be a subrecipient even if the agreement is labeled as a contract.
A given entity may act as a recipient, pass-through entity, subrecipient, or contractor in different federal awards. That makes a consistent classification process important at the beginning of each award. Misclassification can have downstream consequences, including failure to perform a required risk assessment, inadequate subaward terms, and insufficient monitoring.
Why downstream oversight matters
Federal grant funds can pass through several layers before reaching the beneficiaries the program was created to serve. A federal agency may award funds to a state, local government, university, or other prime recipient. That recipient may then make subawards to other organizations, which may further subaward funds or engage contractors.
The lowest tier is often where program activities occur and where expenditures are incurred. As a result, pass-through entities need sufficient visibility into lower-tier activity to determine whether the work is being performed, costs are allowable, and beneficiaries are receiving the intended services.
The Uniform Guidance places responsibility on both recipients and subrecipients for oversight of federal awards. Pass-through entities also have specific responsibilities to monitor subrecipient activities, ensure compliance with federal statutes and the terms of the subaward, and assess whether the goals and objectives of the subaward are being achieved.
In practice, responsibility can be shared, but accountability cannot be passed downstream. A pass-through entity remains responsible for understanding and addressing subrecipient performance and financial risks.
Risk assessments should drive the oversight plan
Historically, the thoughtful performance of a risk assessment has been one of the most common areas of weakness. Risk assessments may be missing entirely, incomplete, undocumented, or disconnected from the terms and conditions of the subaward.
A meaningful risk assessment can consider the subrecipient’s experience with similar awards, results of prior audits or monitoring, changes in personnel or systems, financial management capabilities, and prior compliance issues. Other available sources, such as federal exclusion lists, nonprofit tax filings, and payment integrity data, may also provide useful information. That risk assessment should lead to action.
A pass-through entity can use the results to set specific conditions, tailor subaward terms, determine the frequency and type of monitoring, and identify areas that require additional technical assistance.
Monitoring must be timely, effective, and documented
Another recurring finding involves inadequate monitoring. Common problems include no monitoring, monitoring that is not tailored to the subrecipient’s risk profile, insufficiently trained staff, weak documentation, and failure to follow up on identified issues.
A Department of Housing and Urban Development Office of Inspector General review of grantees participating in the Emergency Solutions Grants program highlighted that eight of nine grantees reviewed could have improved their subrecipient monitoring. The findings included delayed or inadequate monitoring, missing information in subaward agreements, lack of program-specific procedures, and failure to close monitoring findings promptly.
Effective monitoring requires staff with the skills to evaluate both financial and programmatic information. A program specialist may understand the service objectives but lack the training to assess a general ledger. Conversely, a finance professional may be able to identify unusual transactions but lack the program knowledge needed to determine whether performance objectives are being met.
Monitoring should also include follow-up. Identifying a deficiency is only the first step. The pass-through entity should track corrective actions, determine whether the subrecipient resolved the issue, and retain documentation supporting the conclusion.
Data quality and guidance affect oversight
Reliable subaward data is necessary for transparency and effective management. Another Government Accountability Office review of approximately 6 million grant subaward records on USAspending.gov identified missing and incomplete information, untimely reporting, likely duplicate records, and amounts that were not plausible. These data quality problems make it difficult for federal agencies, pass-through entities, auditors, and the public to understand where grant funds are going and how they are being used.
Subrecipients may also struggle to produce reliable financial and performance information when their systems and processes are not designed to meet federal requirements.
Clear guidance is equally important. Federal agencies must communicate applicable requirements to recipients, and pass-through entities must communicate relevant requirements to subrecipients.
When guidance is unclear or inconsistent, subrecipients may apply rules differently, delay implementation, or use resources inefficiently.
A key reminder is the need for position-specific procedures. High-level policies may not adequately explain who is responsible for reviewing expenditures, monitoring performance, following up on findings, or reporting concerns. Staff at each level should understand their responsibilities and receive training appropriate to the program.
Costs and fraud require active controls
Recurring cost concerns include unallowable or unsupported costs, costs that cannot be allocated to the award, inadequate documentation, and differences between drawdowns, general ledger records, and federal financial reports.
These issues can exist even at organizations with sophisticated grant management functions. Examples discussed during the GPAC session included questioned costs related to unsupported expenses, unallowable expenses, and inappropriate indirect cost rates. Another Department of Justice Office of Inspector General review resulted in more than $450,000 in questioned costs after the subrecipient could not substantiate specific activities or maintain adequate financial and performance records.
The layered structure of federal awards also creates a decentralized fraud risk. Weak internal controls, ineffective monitoring, inadequate fraud awareness training, and unclear reporting channels can allow improper activity to continue.
One case involved false certifications of service hours by a prime recipient and two university subrecipients, resulting in an $842,500 civil settlement. Another involved a nonprofit manager who diverted federal funds for personal use through false invoices and shell-company transactions. The manager ultimately pleaded guilty, received a prison sentence, and was ordered to pay restitution.
These examples reinforce the importance of tone at the top, segregation of duties, review of unusual activity, employee training, and clear reporting procedures. Employees of grantees, subgrantees, contractors, and subcontractors may be protected from retaliation when they report suspected violations, gross mismanagement, waste, abuse of authority, or threats to public health or safety. In addition, recipients and subrecipients must promptly disclose credible evidence of violations of criminal or civil law connected to a federal award or subaward.
The bottom line for practitioners
Effective subrecipient oversight is a life cycle process. It begins with correctly classifying the relationship and performing a documented risk assessment. It continues through clear subaward agreements, trained personnel, risk-informed monitoring, reliable reporting, cost reconciliation, corrective-action follow-up, and appropriate fraud escalation.
There is no single oversight model that applies to every subrecipient. The appropriate level of monitoring depends on the nature and magnitude of the award, the subrecipient’s capabilities, prior performance, and identified risks. A thoughtful, documented, risk-based approach allows organizations to focus limited resources where they matter most.
Subrecipients carry out and expend significant amounts of federal funding, and pass-through entities must verify that the work and spending comply with applicable requirements. Trust may support a relationship, but it does not replace oversight. When it comes to federal awards, documentation remains one of the most important controls.