Risk and Subaward Management under the Uniform Guidance

U.S. Department of Education

‹#›

During this class, we will briefly discuss the Uniform Guidance, then go to general concepts of risk, risk assessments, and risk-based monitoring and other requirements for pass-through entities. 

1

Purpose and Use of this Presentation

The Department of Education is providing this presentation to help its grantees understand the contents of the Uniform Guidance and should be viewed after or alongside of the regulations.  It is not a substitute for reading the regulations. 

To get the most out of this presentation, view this as a notes page.  The notes section of each slide provides information to supplement the points on the slide.  To change to notes page: Go to View and click on Notes Page. 

‹#›

The Uniform Guidance, which is title 2 of the Code of Federal Regulations (CFR) Part 200, has also been called the omni-circular and the supercircular.  The full name is the Uniform Administrative Requirements, Cost Principles, and Audit Requirements.  We refer to it as either the Uniform Guidance or 2 CFR Part 200, throughout this presentation. 

The Uniform Guidance is found at: http://www.ecfr.gov/cgi-bin/text-idx?SID=6214841a79953f26c5c230d72d6b70a1&tpl=/ecfrbrowse/Title02/2cfr200_main_02.tpl

Additional resources for grantees are found at: http://www2.ed.gov/policy/fund/guid/uniform-guidance/index.html

2

Learning Outcomes

Understand concepts of risk and risk-based monitoring;

Understand the risk requirements in 2 CFR Part 200; 

Be able to find the relevant regulations in 2 CFR Part 200; and

Apply this knowledge in your job.

‹#›

3

Uniform Guidance	

Title 2 of the Code of Federal Regulations, Part 200 (2 CFR Part 200)

Accepted by the Department of Education in 2 CFR Part 3474

‹#›

‹#›

2 CFR Part 200 was adopted by Department of Education (the Department) on December 19, 2014 at 2 CFR Part 3474, as its regulations for administering all grants, with one exception and one clarification.  The clarification is that we will continue to use high risk designations when awarding grants.  The exception concerns the process the Department will follow in granting exceptions from the requirements of the Uniform Guidance.  

Exceptions is an important point because it explains why there seem to be so many differences in implementation when this guidance was supposed to bring consistency across the Federal government. The Department has only one exception; while some Departments have a large number of exceptions.  

4

“This guidance does not change or modify any existing statute or guidance otherwise based on any existing statute.”

Authorities to consider when using 2 CFR Part 200

‹#›

The quote comes from the UG summary statement on the Federal Register site https://www.federalregister.gov/articles/2013/12/26/2013-30465/uniform-administrative-requirements-cost-principles-and-audit-requirements-for-federal-awards:  

The Uniform Guidance does not supersede:

Program laws and regulations.

Other Federal statutes (ADA, for example) 

It does replace EDGAR parts 74 and 80 and six OMB Circulars.  EDGAR part 77 has been updated to reflect the new definitions. 

See the Webcast for Grantees (May 27, 2015) at http://www2.ed.gov/policy/fund/guid/uniform-guidance/index.html for more information.

5

When does 2 CFR Part 200 start? 

Uniform Guidance (2 CFR Part 200) applies to:

New and Continuation grants awarded on or after December 26, 2014

Former regulations (EDGAR Part 74 or 80 and OMB circulars) apply to:

Grants awarded prior to December 26, 2014 

‹#›

See the Presentation for Grantees and the Department’s FAQs for more information on implementation dates.

6

Relationships and Key Terms 

Subaward or Contract?

The relationship, rather than the document title, is the basis for determining which requirements are applicable.

Know the Difference.

‹#›

‹#›

The requirements we are discussing in this presentation are only for subawards (subgrants), not for contracts. 

7

Definitions: Pass-through entities

A non-Federal entity that provides a subaward to a subrecipient to carry out part of a Federal program (§200.74). 

At ED:

State-Administered Formula Grants: SEAs, other grantees which make subawards

Discretionary Grants: under EDGAR 75.708 or authorizing statute, some discretionary grantees may make subawards.  These are not the same as partnerships.  

‹#›

According to 2 CFR Part 200, Subpart D, risk assessments and risk based monitoring must be conducted by pass-through entities. 

Many State-administered formula programs involve pass-through entities to get money to local educational agencies (e.g., Title I, Title II, IDEA). 

Some discretionary programs involve pass-through entities (Early Learning Challenge, i3), but most do not.  There must be an explicit authority to subgrant either in statute or in the Federal Register (as per EDGAR 75.708).  

8

Definitions:  Subrecipient and Contractor

A pass-through entity must determine the relationship and the applicable requirements:

Subrecipient means a non-Federal entity that receives a subaward from a pass-through entity to carry out part of a Federal program (§200.93). 

Contractor means an entity that receives a contract as defined in 200.22 Contract (§200.23).

§200.330 explains the roles of subrecipients and contractors

‹#›

Subawarding is not to be confused with group/partner grants or standard contractual arrangements.  As explained in slide 7, however, subgranting is only allowed if authorized by statute or announced in the Federal Register.

9

Understanding Risk

‹#›

‹#›

10

What is Risk? (GAO – The Green Book)

Risk is the possibility that an event will occur and adversely affect the achievement of objectives. 

‹#›

The Green Book can be found at: http://www.gao.gov/greenbook/overview.  

11

What is Risk Management? (GAO)

Risk management can be described as the continuous process of assessing risks, reducing the potential that an adverse event will occur, and putting steps in place to deal with any event that does occur.   

‹#›

In a 2005 report (http://www.gao.gov/assets/160/157672.pdf), GAO said (see context of slide)

It’s managing to reduce the likelihood that an event will have an adverse affect on a project’s goals.

NOT just fraud prevention

NOT just reacting to a catastrophe 

NOT just about financial issues

It addresses performance and fiscal compliance.  

Risk is about events that may or may not happen; risk management is planning for uncertainty.

For example, you buy a home computer.  The risks include damage to the hardware (crashed system) and malware attacks which damage your files or allow someone to steal your identity.  

To manage those risks, you have a back up system, such as an external drive or cloud space to keep duplicates, and virus protection software. You also download patches as they become available. Then you monitor your backups and your virus to ensure they are effective. It’s a continuous process.

12

Risk Management

Risk Assessment

Risk Mitigation

Risk-Based

Monitoring

‹#›

The risk management cycle is a framework for continuous discovery, analysis, action, and improvement.

Risk assessment considers the relevance, importance, incidence, and manageability of risk related to subrecipient performance and financial operations. 

Risk mitigation is taking appropriate action to address potential problems, including imposing the appropriate types and levels of requirements and provides appropriate types of monitoring and levels of technical assistance.

Monitoring is the process followed to assess how well a grant is being implemented, achieving program objectives, and complying with requirements, terms and conditions. 

Throughout the entire cycle, every decision at every step must be documented. 

13

Risk and Monitoring 

Key Concepts and Changes in the Uniform Guidance

Indicates a new requirement or change to existing requirement for pass-through entities. 

‹#›

‹#›

14

Parallels: ED and Pass-through entities

Whether an ED program office or pass-through entity, the following concepts are the same.  The practices and tools, however, may differ.

Risk Assessment, 

Risk Mitigation, and 

Risk-based Monitoring. 

‹#›

Like pass-through entities, the Department has requirements for risk assessment, mitigation, and monitoring to reduce risk.  This presentation focusses on what the pass-through entities should and must do.  

Note that in the Uniform Guidance “must” means that statement is required; while “should” and “may” are not requirements, but suggestions.  

15

Overview (2 CFR 200.331)

Grantees, as pass-through entities, must:

Assess risk of subrecipients.  (§200.331(b))

Monitor to ensure the subaward is used appropriately and in compliance with the award and all associated regulations.  The monitoring plan should be based on the results of the risk assessment. (§200.331(d))

The risk assessment and monitoring should address both financial and programmatic considerations.

‹#›

The Uniform Guidance does not specify when a risk assessment must be completed.  A grantee can complete a risk assessment before making a subgrant  if it chooses, but it is not required.  A grantee may find it prudent to do so for certain programs or certain subawards; for example, to identify situations where specific conditions are needed. 

There is a tendency to think about risk and control environments to be matters of fiscal compliance.  And, while that is important, there is also a risk that programs will fail to accomplish their programmatic goals.  Therefore, risk and monitoring must look at successful programmatic implementation in addition to fiscal compliance.  

16

Where are the Requirements? 
| Topic                 | Pass-through entities      |
|-----------------------|----------------------------|
| Award Notification    | §200.331(a)                |
| Risk Assessment       | §200.331(b)                |
| Specific Conditions   | §200.207*                  |
| High-Risk Designation | §3474.10                   |
| Monitoring            | §200.331(d)-(e)Subpart F*  |
| Non-Compliance        | §200.338*                  |

*Section 200.331 references these sections for requirements.

‹#›

Here is a quick reference for key items in the Uniform Guidance relevant to subaward management.  

17

Pass-Through Risk Review (§200.331(b))

Items that may be part of the Pass-through entity’s review:

Prior experience with same or similar subawards 

Results of previous audits

Whether new or substantially changed personnel or systems

Extent and results of Federal awarding agency monitoring

‹#›

The Uniform Guidance does not specify how to conduct an assessment or what must be included.  However, ED recommends that pass-through entities develop a framework for review, as many SEAs have already done, to ensure greater consistency in the reviews.  The Uniform Guidance suggests the items on the slide be part of the review. 

Remember to include both programmatic and financial criteria in your risk review.  

18

Risk Rubric 

Risk Rubric highlights

Risk indicators

Risk categories

Scoring mechanism

Risk designation levels

‹#›

A risk rubric is not required, but is a method grantees can use to consistently assess risk.  

It identifies the risk indicators, typically those specific to an organization.  Program-wide risks would apply to all subgrantees and can be addressed through general training and technical assistance.  

It identifies categories of risk; for example, financial, programmatic, and compliance risks.  

It provides a scoring mechanism which weights the most important risks and measures and individual entity’s risk.  

The designation levels takes the score and identifies whether that is high, medium, or low risk.  

All of these elements of the rubric should be developed by the pass-through entity.  Neither the Department nor the Uniform Guidance provides guidance on how to measure or designate risk.   

19

Specific Conditions (§200.207)

If deemed appropriate based on the risk assessment, specific conditions (e.g., increased reporting, reimbursement plan) may be placed on:

A subaward from a pass-through entity (§200.331(c) refers to (§200.207)) 

In addition, a high-risk designation can be added to a subaward, as per §3474.10.

‹#›

Based on the assessment of risk, a pass-through entity may determine that specific conditions should be placed on a subaward to mitigate risk.  

§200.207 Specific conditions, (b) These additional Federal award conditions may include items such as the following:

(1) Requiring payments as reimbursements rather than advance payments;

(2) Withholding authority to proceed to the next phase until receipt of evidence of acceptable performance within a given period of performance;

(3) Requiring additional, more detailed financial reports;

(4) Requiring additional project monitoring;

(5) Requiring the non-Federal entity to obtain technical or management assistance; or

(6) Establishing additional prior approvals.

20

Pass-Through Monitoring Procedures

When monitoring subrecipients, the pass-through entity must (§ 200.331(d)):

Review reports required by the pass-through entity

Ensure subrecipient takes appropriate action on deficiencies identified through audits, on-site reviews, and other means

Issue a management decision for single-audit findings pertaining to Federal award

Verify audits of subawards (§ 200.331(f))

Threshold for required audits increased to $750,000

‹#›

The UG also identifies requirements for pass-throughs monitoring their subawards. These are not substantially changed over what was required through the audit requirements in previous years.  However, the threshold for audits did increase with the UG. 

21

Pass-Through Entity Monitoring Tools

The following tools may be useful, depending upon the risk assessment (§ 200.331(e))

Providing subrecipient training and technical assistance

Performing on-site reviews

Arranging for agreed-upon-procedures engagements under § 200.425, Audit services [in Cost Principles]

The pass-through entity determines which tools to use based upon its assessment of risk

‹#›

Tools: 

- Providing subrecipient training and technical assistance – based on risk specific to specific entities and to the program. 

- Performing on-site reviews (or other types of monitoring such as virtual or desk monitoring), and 

- Arranging for agreed-upon-procedures engagements under § 200.425, Audit services [in Cost Principles].  The agreed-upon-procedures do not provide auditors’ opinions, but will provide a factual assessment based on the particular parameters identified for the procedrues.  Note the list of what parameters that Federal funds can be used to review in §200.425(c)(3) (see below).  Other parameters can be used, but not paid with Federal funds.  

Also, monitor as per any specific conditions attached to the award. 

§200.425(c) -  

Agreed-Upon-Procedures costs are allowable only if the agreed-upon-procedures engagements are:

(1) Conducted in accordance with GAGAS attestation standards;

(2) Paid for and arranged by the pass-through entity; and

(3) Limited in scope to one or more of the following types of compliance requirements: activities allowed or unallowed; allowable costs/cost principles; eligibility; and reporting.

22

Risk-Based Monitoring Plan

Monitoring Plan highlights

Assessment methodology

Last Fiscal Year (FY) assessment & monitoring activities

Current FY assessment & monitoring strategies

Resource constraints

‹#›

Although not required, a risk monitoring plan is very useful to ensure efficient use of resources (time and money) and tools in monitoring performance and risk of subgrantees.  To develop an effective plan, know your program and your subrecipients.  

Risk assessment methodology – What to do when reviewing reports and conducting site/desk/virtual monitoring.  

Risk assessment and monitoring activities from previous FY – How did it work and what improvements can be made? 

Current FY risk assessment and monitoring strategies – Do you need to make changes to improve the effectiveness of your monitoring? 

23

Audit Requirements 

Single Audit (2 CFR Part 200 Subpart F)

Alternatives to Single Audits 

Program specific audit

Agreed-Upon-Procedures

Additional Audits, as requested by Congress or the Federal Government

GAO Audits

OIG General Audits

‹#›

Pass-through entities must ensure their subgrantees comply with audit requirements.  Single audits are required for entities which expend $750,000 in Federal funds in one fiscal year.  If the entity receives all Federal funds from only one program, an alternative is a program specific audit, as outlined in subpart F.  The non-Federal entity is now required to submit its single audit directly to the Federal Audit Clearinghouse. 

Otherwise, if the entity is not required to have an audit (e.g., if the entity receives less than $750,000 in Federal funds), the PTE can include agreed-upon-procedures as an alternative.  It is less stringent and powerful than an audit, but it can provide a glimpse into the workings of a smaller entity (see slide 21 notes).  

In addition, GAO and OIG perform audits, which can be financial or performance audits.  See the audit presentation posted to the technical assistance for grantees at Ed.gov for more information.  

24

Other Pass-through Requirements

The pass-through entity must provide specific information in the subaward (§200.331 (a)), including but not limited to: 

Federal award identification, e.g., DUNS number

Indirect cost rate 

Requirements imposed by the pass-through entity

Requirement to provide access to records for audit

‹#›

Although we are focusing this class on risk, the second part of the title is subaward management.  Your grantees and you should be aware of the requirements for award notification to their subgrantees.  See our FAQs for more information. 

25

Continuous Improvement Standard

Evaluate annually the risk management process to identify its strengths and weaknesses and refine ability to reduce risk throughout the grant process

‹#›

Continuous Improvement is an ongoing process that uses the results of risk identification, assessment, and mitigation to refine and enhance ED’s risk management structure.

Evaluate annually the risk management process to identify its strengths and weaknesses and refine ED’s capability to reduce risk throughout the grant management process. 

26

Responsibilities

‹#›

‹#›

27

Compliance: Grantees

Responsibility for subawards:

Strong Internal Controls for managing subawards

Communication with ED Staff  and with subrecipients 

Documentation of all activities 

Monitoring subawards

Verifying subgrantees are audited, if required

‹#›

# image4.png

# image2.png

# image3.jpeg