What Auditors Test First: Records Retention and Procurement
Two document requests open most monitoring visits. Show me the procurement file for this purchase. Show me where your records live and how long you keep them. Both are answerable in minutes or not at all, and the reviewer learns everything they need from which of those it turns out to be.
These are the two policies with the shortest distance between the written rule and the tested reality, which is why they get tested first.
Retention: three years, and the exceptions that matter
The baseline in 2 CFR 200.334 is three years. What people get wrong is when the clock starts.
When the clock starts. Three years runs from the date you submit your final financial report, not from the award date and not from the end of the period of performance. For awards renewed quarterly or annually, it runs from the date you submitted that quarterly or annual financial report.
Then come the exceptions, and they are the reason a blanket three year purge policy creates exposure. If litigation, a claim, or an audit finding involving the records arises inside that window, you keep them until the matter is resolved and final action taken. Records for property and equipment acquired with federal funds run three years past final disposition. Program income earned after performance ends runs three years from the end of the fiscal year in which it was earned. Indirect cost rate proposals and cost allocation plans follow their own rule, which turns on whether you submitted the proposal for negotiation, and that matters if you hold a negotiated rate.
Electronic storage is fine, and 200.336 is explicit that you have to be able to produce records in a usable electronic format when someone asks. A folder of scanned images with no naming convention technically satisfies storage and fails production, which is a distinction organizations discover at the worst possible moment.
Procurement: the file is the control
Procurement compliance is not really about which method you chose. It is about whether the file explains the choice.
2 CFR 200.318(i) requires records sufficient to detail the history of the procurement, and it names what that history includes: the rationale for the method, the contract type selected, the basis for contractor selection or rejection, and the basis for the contract price. Four things, written at the time, in one place.
What belongs in the procurement file
- The written rationale for the method used, tied to the dollar threshold.
- The solicitation, and the list of who it went to.
- Every response received, including the ones you rejected.
- The evaluation, showing why the winner won.
- The price analysis, showing the price is reasonable.
- The signed contract, and any modification with its own justification.
On thresholds, know your own numbers before you need them. The micro-purchase threshold can be self-certified up to $50,000 annually, and 200.320 sets conditions: you keep documentation supporting the higher threshold, and you meet at least one of three tests, which are qualifying as a low-risk auditee, completing an annual internal risk assessment, or matching state law if you are a public institution. Above $50,000 you need approval from your cognizant agency for indirect costs. Organizations that never made this election sit at the default and run full documentation on a $12,000 purchase for no reason.
Procurement documented after the fact is not documentation. It is reconstruction, and it reads that way.
The two ways these fail
Retention fails by attrition. Nobody decides to destroy records. A staff member leaves, their laptop gets wiped, the shared drive reorganizes, and four years later the file that would have closed a finding is gone. The fix is structural: records live in organizational storage from the day they are created, never in personal folders, with a naming convention that survives the person who invented it.
Procurement fails by sequence. The purchase happens because a program needs the thing, and the file gets assembled when someone asks for it. Every element might be truthful and the file still fails, because the rationale was written after the decision it claims to explain. The fix is also structural: no purchase order clears without the threshold rationale attached.
Neither of these requires new software or a new hire. They require deciding where records live and refusing to release money without a file. Do that, and the two requests that open a monitoring visit become the two easiest questions you answer all day.
When your team is ready to move from understanding to action, The Grant Project partners with local governments and nonprofits to build the systems, compliance, and strategy that secure funding for the long term. Work With Us.
