What is a risk-based approach to subrecipient monitoring?

• A. Monitor all subrecipients at the same intensity
• B. Use a one-size-fits-all monitoring plan
• C. Focus only on financial reporting
• D. Assess risk factors (size, complexity, past performance) and tailor monitoring accordingly

Answer: (D)

The main concept is allocating oversight based on risk. In subrecipient monitoring, a risk-based approach evaluates factors such as the subrecipient’s size and complexity, the nature of the activities, past performance, audit findings, and the strength of internal controls. Based on that assessment, the monitoring plan is customized: higher-risk subrecipients receive more frequent and thorough oversight (for example, more detailed reviews, on-site visits, and follow-up on corrective actions), while lower-risk subrecipients get lighter oversight. This ensures funds are used properly and program results are achieved without imposing unnecessary burden on groups with a strong track record. Focusing only on financial reporting or applying the same level of scrutiny to every subrecipient would miss important programmatic and compliance risks, and a one-size-fits-all plan doesn’t address differences in risk exposure.