---
title: "What internal controls must federal grant recipients maintain? Answer in under 100 words. Cite only eCFR (www.ecfr.gov) sources."
canonical: https://www.m-i-n-d.ai/minds/federal-grants/grant-recipient-internal-controls
jurisdiction: "US Federal"
last_verified: 2026-08-28
license: CC BY 4.0 — https://creativecommons.org/licenses/by/4.0/
attribution: "Source: MIND (m-i-n-d.ai)"
---

# What internal controls must federal grant recipients maintain? Answer in under 100 words. Cite only eCFR (www.ecfr.gov) sources.

Under 2 CFR § 200.303, recipients and subrecipients of federal financial assistance awards must establish, document, and maintain effective internal controls providing reasonable assurance of compliance with federal statutes, regulations, and award terms. Such controls should align with the Green Book (GAO) or COSO framework, include ongoing monitoring, and address cybersecurity and protection of personally identifiable information (PII).

## Details / How it works

Per 2 CFR § 200.303 (located in Subpart D, Post Federal Award Requirements), recipients and subrecipients of federal awards must:

- **Establish, document, and maintain** effective internal controls over the federal award providing **reasonable assurance** of managing the award in compliance with applicable federal statutes, regulations (including 2 CFR Part 200), and the terms and conditions of the award.
- **Align** those controls with the **Green Book** ("Standards for Internal Control in the Federal Government," issued by the Comptroller General via the GAO) or the **COSO Internal Control–Integrated Framework**.
- **Comply with** the U.S. Constitution, applicable federal statutes, regulations, and the terms and conditions of the federal award.
- **Evaluate and monitor** compliance through ongoing oversight activities and periodic assessments.
- **Take prompt corrective and remedial action** when instances of noncompliance are identified.
- **Implement reasonable cybersecurity and data protection safeguards** to protect information, including protected PII and other sensitive or confidential data designated by the federal awarding agency or pass-through entity.

## Exceptions & edge cases

The internal control obligation in § 200.303 applies to both **recipients** (entities receiving federal financial assistance directly from a federal agency) and **subrecipients** (lower-tier entities receiving funds through a pass-through entity). Lower-tier subrecipients are not exempt simply because they receive funds indirectly. Fixed Amount Awards referenced in § 200.102(c) reduce some administrative burden and recordkeeping requirements, but core internal control responsibilities under § 200.303 still apply.

## Sources

- [1] U.S. Government Publishing Office / Office of Management and Budget — 2 CFR 200.303 — Internal controls required of federal award recipients · https://www.ecfr.gov/current/title-2/section-200.303 · as of 2026-08-28
- [2] U.S. Government Publishing Office / Office of Management and Budget — 2 CFR 200.1 — Definitions for federal grants Uniform Guidance · https://www.ecfr.gov/current/title-2/section-200.1 · as of 2026-08-28