What internal controls must federal grant recipients maintain? Answer in under 100 words. Cite only eCFR (www.ecfr.gov) sources.

Details / How it works

Per 2 CFR § 200.303 (located in Subpart D, Post Federal Award Requirements), recipients and subrecipients of federal awards must:

• Establish, document, and maintain effective internal controls over the federal award providing reasonable assurance of managing the award in compliance with applicable federal statutes, regulations (including 2 CFR Part 200), and the terms and conditions of the award.
• Align those controls with the Green Book ("Standards for Internal Control in the Federal Government," issued by the Comptroller General via the GAO) or the COSO Internal Control–Integrated Framework.
• Comply with the U.S. Constitution, applicable federal statutes, regulations, and the terms and conditions of the federal award.
• Evaluate and monitor compliance through ongoing oversight activities and periodic assessments.
• Take prompt corrective and remedial action when instances of noncompliance are identified.
• Implement reasonable cybersecurity and data protection safeguards to protect information, including protected PII and other sensitive or confidential data designated by the federal awarding agency or pass-through entity.

Exceptions & edge cases

The internal control obligation in § 200.303 applies to both recipients (entities receiving federal financial assistance directly from a federal agency) and subrecipients (lower-tier entities receiving funds through a pass-through entity). Lower-tier subrecipients are not exempt simply because they receive funds indirectly. Fixed Amount Awards referenced in § 200.102(c) reduce some administrative burden and recordkeeping requirements, but core internal control responsibilities under § 200.303 still apply.