Federal Subrecipient Risk Assessment Worksheet (2 CFR 200.332)

Use it when your organization is preparing to issue a federal subaward and needs a documented risk review under 2 CFR 200.332. It is typically completed by grants management, compliance, finance, or program staff who can review prior performance, audit results, and internal control changes. The reviewer should be someone who can recommend monitoring actions and escalate concerns when needed. If your process includes approval routing, the approver can use the worksheet as the audit trail.

Complete it before the subaward is issued, and update it when there is a material change in the subrecipient’s risk profile. Common triggers include a new award, a renewal, a significant scope change, a new audit finding, or a major staffing or system change. Many organizations also revisit the worksheet during annual monitoring or when performance concerns arise. The goal is to set the monitoring plan before funds are disbursed, not after issues appear.

It helps you determine the subrecipient’s overall risk level and the monitoring actions that should follow. The worksheet pulls together prior federal award experience, prior monitoring findings, audit results, internal control strength, fraud risk indicators, and recent personnel or system changes. That gives reviewers a structured basis for deciding whether to require more frequent reporting, desk reviews, site visits, corrective action follow-up, or other controls. It also creates a clear record of why those actions were chosen.

No. This worksheet supports the pre-award risk review, but it does not replace the subaward agreement, monitoring plan, or any required award terms. It is the decision-support document that informs how the subrecipient will be monitored. In practice, the monitoring actions selected here should be reflected in the subaward file and carried into ongoing oversight. Keeping those documents aligned helps avoid gaps between review, approval, and follow-up.

The structure is built around the factors commonly reviewed when assessing subrecipient risk: prior experience, audit results, internal controls, and changes in personnel or systems. It also includes a place to document the reviewer’s attestation, approval status, and monitoring plan, which helps create an audit trail. That makes it easier to show that the risk review was performed consistently and that monitoring was tailored to the subrecipient’s risk profile. It is especially useful when you need to explain why one subrecipient received enhanced oversight.

The biggest mistake is using vague language like "low risk" without explaining the facts behind that rating. Another common issue is treating every field as required even when some items do not apply, which can create noise instead of useful documentation. Reviewers also sometimes skip the monitoring plan or fail to connect findings to specific actions. Finally, people often forget to update the worksheet after a personnel, system, or organizational change that materially affects risk.

Yes. You can tailor the scoring scale, add program-specific risk indicators, or expand the monitoring actions to match your grant structure and internal policy. For example, a high-volume pass-through program may need tighter thresholds and more frequent reporting, while a smaller award may use a lighter review path. Keep the core sections intact so you still capture prior performance, audit results, change events, and approval. That preserves consistency across awards while allowing local flexibility.

This worksheet can sit alongside your grants management system, document repository, or approval workflow as the formal risk review record. Many teams attach audit reports, prior monitoring notes, and supporting evidence directly to the record, then route the approval status through an internal workflow. If your process uses conditional logic, you can hide sections that do not apply, such as audit follow-up fields when no audit findings exist. The key is to keep the worksheet tied to the subaward file so reviewers can trace the decision later.