SF-SAC

(a) General. (1) The audit, the data collection form, and the reporting package must be submitted within 30 calendar days after the auditee receives the auditor's report(s) or nine months after the end of the audit period (whichever is earlier). The cognizant agency for audit or oversight agency for audit (in the absence of a cognizant agency for audit) may authorize an extension when the nine-month timeframe would place an undue burden on the auditee. If the due date falls on a Saturday, Sunday, or Federal holiday, the reporting package is due the next business day.
(2) The auditee must make copies available for public inspection unless restricted by Federal statute or regulation. Auditees and auditors must ensure that their respective parts of the reporting package do not include protected personally identifiable information.
(b) Data collection. The FAC is the repository of record for subpart F reporting packages and the data collection form. All Federal agencies, pass-through entities and others interested in a reporting package and data collection form must obtain it by accessing the FAC.
(1) The auditee must submit the required data collection form described in Appendix X of this part. This form provides information about the auditee, its Federal programs, the results of the audit, and whether the audit was completed in accordance with this part. The form must include all information required by this part that is necessary for Federal agencies to use the audit to ensure the integrity of Federal programs. The form includes data elements and a format that OMB must approve, is available from the FAC, and include collections of information from the reporting package described in paragraph (c).
(2) A senior-level representative of the auditee (for example, a State controller, director of finance, chief executive officer, or chief financial officer) must sign a statement to be included as part of the data collection form stating that the auditee complied with the requirements of this part, including that:
(i) The data collection form was prepared in accordance with this part (and the instructions accompanying the form);
(ii) The reporting package does not include protected personally identifiable information;
(iii) The information included in its entirety is accurate and complete; and
(iv) The FAC is authorized to make the reporting package and the form publicly available on a website.
(3) An auditee that is an Indian Tribe or a tribal organization (as defined in the Indian Self-Determination, Education and Assistance Act (ISDEAA), 25 U.S.C. 450b(l)) may opt not to authorize the FAC to make the reporting package publicly available on a website. To opt-out, an Indian Tribe or tribal organization must exclude the authorization described in paragraph (b)(2)(iv) of this section. In these instances, the Indian Tribe is responsible for submitting the reporting package directly to any pass-through entities through which it has received a Federal award and to pass-through entities for which the summary schedule of prior audit findings reported the status of any findings related to those Federal awards that the pass-through entity provided. Unless restricted by Federal statute or regulation, if the Indian Tribe opts not to authorize publication, it must make copies of the reporting package available for public inspection.
(4) The auditor must complete the applicable data elements of the data collection form using the information included in the reporting package described in paragraph (c) of this section. The auditor must sign a statement to be included as part of the data collection form stating:
(i) The source of information included in the data collection form;
(ii) The auditor's responsibility for the information;
(iii) The data collection form is not a substitute for the reporting package described in paragraph (c); and
(iv) The content of the form is limited to the collection of information prescribed by OMB.
(c) Reporting package. The reporting package must include the following:
(1) Financial statements and schedule of expenditures of Federal awards discussed in § 200.510(a) and (b), respectively;
(2) Summary schedule of prior audit findings discussed in § 200.511(b);
(3) Auditor's report(s) discussed in § 200.515; and
(4) Corrective action plan discussed in § 200.511(c).
(d) Submission to FAC. The auditee must electronically submit the data collection form described in paragraph (b) of this section and the reporting package described in paragraph (c) of this section to the FAC.
(e) Requests for management letters issued by the auditor. Auditees must submit, when requested by a Federal agency or pass-through entity, a copy of any management letters issued by the auditor.
(f) Report retention requirements. Auditees must keep a copy of the data collection form described in paragraph (b) of this section and a copy of the reporting package described in paragraph (c) on file for three years from the date of submission to the FAC. Copies of audit records must be maintained in accordance with § 200.336.
(g) FAC responsibilities. The FAC must make available the reporting packages received in accordance with paragraph (c) of this section and § 200.507(c) to the public, except for Indian Tribes exercising the option in paragraph (b)(3) of this section, and maintain a database of completed audits, provide appropriate information to Federal agencies, and follow up with known auditees that have not submitted the required data collection forms and reporting packages.
(h) Electronic filing. Nothing in this part must preclude electronic submissions to the FAC in such a manner as may be approved by OMB.

Amended: 2016-11-28, 2020-08-13, 2020-11-12, 2024-10-01 · SHA-256 of the XML as served: 2e435477f3a0baec83be0ca312b540e2da776699dc3025ac228a33ee2a7487ef · eCFR

The eCFR is an editorial compilation maintained by the Office of the Federal Register and GPO; it is updated daily and is not the official legal edition (the annual Code of Federal Regulations is). Text printed here is as the eCFR served it on the read date.

A pass-through entity must:
(a) Verify that the subrecipient is not excluded or disqualified in accordance with § 180.300. Verification methods are provided in § 180.300, which include confirming in SAM.gov that a potential subrecipient is not suspended, debarred, or otherwise excluded from receiving Federal funds.
(b) Ensure that every subaward is clearly identified to the subrecipient as a subaward and includes the information provided below. A pass-through entity must provide the best available information when some of the information below is unavailable. A pass-through entity must provide the unavailable information when it is obtained. Required information includes:
(1) Federal award identification.
(i) Subrecipient's name (must match the name associated with its unique entity identifier);
(ii) Subrecipient's unique entity identifier;
(iii) Federal Award Identification Number (FAIN);
(iv) Federal Award Date;
(v) Subaward Period of Performance Start and End Date;
(vi) Subaward Budget Period Start and End Date;
(vii) Amount of Federal Funds Obligated in the subaward;
(viii) Total Amount of Federal Funds Obligated to the subrecipient by the pass-through entity, including the current financial obligation;
(ix) Total Amount of the Federal Award committed to the subrecipient by the pass-through entity;
(x) Federal award project description, as required by the Federal Funding Accountability and Transparency Act (FFATA);
(xi) Name of the Federal agency, pass-through entity, and contact information for awarding official of the pass-through entity;
(xii) Assistance Listings title and number; the pass-through entity must identify the dollar amount made available under each Federal award and the Assistance Listings Number at the time of disbursement;
(xiii) Identification of whether the Federal award is for research and development; and
(xiv) Indirect cost rate for the Federal award (including if the de minimis rate is used in accordance with § 200.414).
(2) All requirements of the subaward, including requirements imposed by Federal statutes, regulations, and the terms and conditions of the Federal award;
(3) Any additional requirements that the pass-through entity imposes on the subrecipient for the pass-through entity to meet its responsibilities under the Federal award. This includes information and certifications (see § 200.415) required for submitting financial and performance reports that the pass-through entity must provide to the Federal agency;
(4) Indirect cost rate:
(i) An approved indirect cost rate negotiated between the subrecipient and the Federal Government. If no approved rate exists, a pass-through entity must determine the appropriate rate in collaboration with the subrecipient. The indirect cost rate may be either:
(A) An indirect cost rate negotiated between the pass-through entity and the subrecipient. These rates may be based on a prior negotiated rate between a different pass-through entity and the subrecipient, in which case the pass-through entity is not required to collect information justifying the rate but may elect to do so; or
(B) The de minimis indirect cost rate.
(ii) The pass-through entity must not require the use of the de minimis indirect cost rate if the subrecipient has an approved indirect cost rate negotiated with the Federal Government. Subrecipients may elect to use the cost allocation method to account for indirect costs in accordance with § 200.405(d).
(5) A requirement that the subrecipient permit the pass-through entity and auditors to access the subrecipient's records and financial statements for the pass-through entity to fulfill its monitoring requirements; and
(6) Appropriate terms and conditions concerning the closeout of the subaward.
(c) Evaluate each subrecipient's fraud risk and risk of noncompliance with a subaward to determine the appropriate subrecipient monitoring described in paragraph (f) of this section. When evaluating a subrecipient's risk, a pass-through entity should consider the following:
(1) The subrecipient's prior experience with the same or similar subawards;
(2) The results of previous audits. This includes considering whether or not the subrecipient receives a Single Audit in accordance with subpart F and the extent to which the same or similar subawards have been audited as a major program;
(3) Whether the subrecipient has new personnel or new or substantially changed systems; and
(4) The extent and results of any Federal agency monitoring (for example, if the subrecipient also receives Federal awards directly from the Federal agency).
(d) If appropriate, consider implementing specific conditions in a subaward as described in § 200.208 and notify the Federal agency of the specific conditions.
(e) Monitor the activities of a subrecipient as necessary to ensure that the subrecipient complies with Federal statutes, regulations, and the terms and conditions of the subaward. The pass-through entity is responsible for monitoring the overall performance of a subrecipient to ensure that the goals and objectives of the subaward are achieved. In monitoring a subrecipient, a pass-through entity must:
(1) Review financial and performance reports.
(2) Ensure that the subrecipient takes corrective action on all significant developments that negatively affect the subaward. Significant developments include Single Audit findings related to the subaward, other audit findings, site visits, and written notifications from a subrecipient of adverse conditions which will impact their ability to meet the milestones or the objectives of a subaward. When significant developments negatively impact the subaward, a subrecipient must provide the pass-through entity with information on their plan for corrective action and any assistance needed to resolve the situation.
(3) Issue a management decision for audit findings pertaining only to the Federal award provided to the subrecipient from the pass-through entity as required by § 200.521.
(4) Resolve
[…] full text at the eCFR link

Amended: 2016-11-28, 2020-11-12, 2021-02-22, 2024-10-01 · SHA-256 of the XML as served: a88c0e1b8aeceba7db63641b439ca96734f268cea91b7a994743bd8c4d94fad3 · eCFR

The eCFR is an editorial compilation maintained by the Office of the Federal Register and GPO; it is updated daily and is not the official legal edition (the annual Code of Federal Regulations is). Text printed here is as the eCFR served it on the read date.

(a) Audit required. A non-Federal entity that expends $1,000,000 or more during the non-Federal entity's fiscal year in Federal awards must have a single or program-specific audit conducted for that year in accordance with the provisions of this part.
(b) Single audit. A non-Federal entity that expends $1,000,000 or more in Federal awards during the non-Federal entity's fiscal year must have a single audit conducted in accordance with § 200.514 except when it elects to have a program-specific audit conducted in accordance with paragraph (c) or (d) of this section.
(c) Program-specific audit election (in general). A non-Federal entity may elect to have a program-specific audit conducted in accordance with § 200.507 if the following conditions are met:
(1) The non-Federal entity expends Federal awards under only one Federal program (excluding research and development); and
(2) The Federal program's statutes or regulations, or terms and conditions of the Federal award, do not require a financial statement audit of the non-Federal entity.
(d) Program-specific audit election for research and development. A non-Federal entity may elect to have a program-specific audit for research and development conducted in accordance with § 200.507, but only if all of the following conditions are met:
(1) The non-Federal entity expends Federal awards only from the same Federal agency, or the same Federal agency and the same pass-through entity; and
(2) The Federal agency, or pass-through entity in the case of a subrecipient, approves a program-specific audit in advance.
(e) Exemption when Federal awards expended are less than $1,000,000. A non-Federal entity that expends less than $1,000,000 in Federal awards during its fiscal year is exempt from Federal audit requirements for that year, except as noted in § 200.503. However, in all instances, the records of the non-Federal entity must be available for review or audit by appropriate officials of the Federal agency, pass-through entity, and the Government Accountability Office (GAO).
(f) Federally Funded Research and Development Centers (FFRDC). Management of an auditee that owns or operates a FFRDC may elect to treat the FFRDC as a separate entity for purposes of this part.
(g) Subrecipients and contractors. An auditee may simultaneously be a recipient, a subrecipient, and a contractor. Unless a program is exempt by Federal statute, Federal awards expended as a recipient or a subrecipient are subject to audit under this part. Payments received for goods or services provided as a contractor under a Federal award (see § 200.331) are not subject to audit under this part.
(h) Compliance responsibility for contractors. In most cases, the auditee's compliance responsibility for contractors is to ensure that the procurement, receipt, and payment for goods and services comply with Federal statutes, regulations, and the terms and conditions of a Federal award. Federal award compliance requirements normally do not flow down to contractors. However, for procurement transactions in which the contractor is made responsible for meeting program requirements, the auditee must ensure those requirements are met, including by clearly stating the contractor's responsibilities within the contract and reviewing the contractor's records to determine compliance. Also, when these procurement transactions relate to a major program, the scope of the audit must include a determination of whether these transactions comply with Federal statutes, regulations, and the terms and conditions of a Federal award. See also § 200.318(b).
(i) For-profit subrecipient. This subpart does not apply to for-profit organizations. As necessary, the pass-through entity is responsible for establishing requirements to ensure compliance by for-profit subrecipients. The subaward with a for-profit subrecipient must describe applicable compliance requirements and the for-profit subrecipient's compliance responsibility. Methods to ensure compliance for Federal awards made to for-profit subrecipients may include pre-award audits, monitoring throughout the performance of the subaward, and post-award audits (see § 200.332).

Amended: 2016-11-28, 2020-08-13, 2020-11-12, 2024-10-01 · SHA-256 of the XML as served: c08fc79471486e988e6a4285bf05d2d9315ac81eea2e693c66174817ea306613 · eCFR

The eCFR is an editorial compilation maintained by the Office of the Federal Register and GPO; it is updated daily and is not the official legal edition (the annual Code of Federal Regulations is). Text printed here is as the eCFR served it on the read date.