The compliance areas where federal grantees get flagged most
A finding-level review of what actually draws audit findings across education-sector grantees, and the four requirement areas that recur year after year.
By Fidel Wambura, CPA · Former federal grant auditor · Oct 1, 2026
When a federal grantee opens its single audit and finds a list of findings, the findings are rarely a surprise to anyone who has sat on the audit side of the table. The same requirement areas come up again and again, across very different kinds of organizations, for reasons that have far more to do with how grants are administered day to day than with any single mistake.
This brief sets out the frame for everything Grants Research Center publishes next: the small number of requirement areas that account for the large majority of findings, why each one is hard to operationalize, and what separates an organization that closes the gap from one that sees the same finding return next year.
Four areas, most of the findings
Across the education-sector single audits in our review, the bulk of findings concentrated in four areas: cost principles, procurement, subrecipient monitoring, and personnel charging. Each sits at a point where a federal requirement meets a routine internal process, and where the documentation that would satisfy an auditor is exactly what a busy program team is most likely to skip.
Cost principles
The cost principles in 2 CFR 200 ask a deceptively simple question of every charge: is it allowable, allocable, and reasonable? The finding usually isn't that a cost was improper. It's that the file doesn't show the reasoning. Where that reasoning lives, and who is responsible for recording it, is the first thing we look at.
Procurement
Procurement standards require a documented record of competition appropriate to the size of the purchase. The recurring finding is a missing record, not a missing process: the competition happened, but the file that proves it was never assembled.
Subrecipient monitoring
Subrecipient monitoring remains, in our experience, the single hardest requirement for grantees to get consistently right. The pass-through entity is accountable for the subrecipient's use of funds, but the monitoring that demonstrates that accountability is easy to defer and hard to reconstruct after the fact.
Personnel charging
Personnel costs are typically the largest line on an award and, correspondingly, the largest category of questioned costs. Time-and-effort documentation that reflects actual work, rather than a budgeted estimate applied after the period, is what holds up under review.
A repeat finding tells the auditor something specific: that last year's corrective action never actually took hold. That is the most preventable, and most damaging, thing a report can say.
What closes the gap
The organizations that stop seeing the same finding return tend to share three habits: they assign each requirement area to a named owner, they build the audit file as the work happens rather than at year-end, and they test themselves against the questions an auditor would ask before the auditor arrives. None of this is exotic. It is simply treating compliance as a process with owners and evidence, rather than an event that happens once a year.
In the briefs that follow, we'll take each of these four areas in turn: what the requirement actually demands, where findings concentrate, and the documentation that satisfies review. The training program follows the same map.