An audit finding is uncomfortable, but the Uniform Guidance gives you a clear path for responding. This article explains what a corrective action plan must contain, how the management decision works, and how to keep a finding from repeating next year.
Opening the auditor's report and finding a finding is a rough moment for anyone. Take a breath before you do anything else, because findings are common, they're survivable, and the rules for what happens next are quite specific. Knowing them turns a stressful week into a manageable list of tasks.
This is for the person who has to answer the finding, whether that's the finance director, the grants manager, or the executive director who signs the response.
Under 2 CFR 200.516, the auditor reports certain issues in a schedule of findings and questioned costs. That includes significant deficiencies and material weaknesses in internal control over major programs, material noncompliance with federal requirements, and known or likely questioned costs greater than $25,000 for a compliance requirement of a major program. Known or likely fraud is reported too.
Each finding follows a set structure. The auditor identifies the federal program, the criteria the requirement comes from, the condition the auditor found, the cause, the effect, the questioned costs and how they were calculated, and a recommendation. The finding also says whether it repeats one from the prior year, and it includes your views.
Reading a finding in that structure helps. The condition is what happened, the criteria is what should have happened, and the cause is the part you can actually fix.
Under 2 CFR 200.511(c), you prepare a corrective action plan at the completion of the audit, addressing each finding. It must be a separate document from the auditor's report. For each finding, it has to include the name of the person responsible for the corrective action, the action you'll take, and the date you expect to finish.
If you disagree with a finding, or believe no corrective action is needed, the plan has to say so and give a detailed explanation of your reasons. That's a legitimate option, but it works best when you can point to specific documents rather than general disagreement. A strong plan reads like a project plan:
- One response per finding, using the auditor's reference number
- A specific change, such as a new approval step or a revised procedure
- A named owner who has the authority to make the change
- A realistic completion date
Vague language like
"we will strengthen controls" gives a reviewer nothing to check. Language like
"the finance manager will review each drawdown request against a cash forecast before submission, starting November 1" does.
Your plan goes into the reporting package, which is submitted to the Federal Audit Clearinghouse. The due date under 2 CFR 200.512 is 30 days after you receive the auditor's report or nine months after the end of the audit period, whichever comes first. The package is also made available for public inspection, so the plan should be written as something other people will read.
After that, the federal agency or pass-through entity responsible for the finding issues a management decision. Under 2 CFR 200.521, that decision is due within six months of the Clearinghouse accepting the audit report. It has to state whether the finding is sustained, give the reasons, and describe what you're expected to do, which could include repaying disallowed costs or making financial adjustments. It also describes any appeal process that's available.
If your finding affects a subaward, the pass-through entity is the one who issues the decision to you. If you're the pass-through entity, you're the one issuing decisions to your subrecipients.
The regulation also says you should begin corrective action no later than when you receive the audit report. Waiting for the management decision to start is a common mistake, and it costs months you didn't have to give up.
Every year, 2 CFR 200.511 also requires you to prepare a summary schedule of prior audit findings. It reports the status of each finding from the prior audit, along with the fiscal year it first occurred and the reference numbers the auditor used. An auditor will look at that schedule and test whether it's accurate, and a finding that repeats from the prior year is flagged as a repeat.
Treat the plan as a living document rather than an annual submission. Put the completion dates on a calendar. Review progress at a regular meeting. When you finish a fix, save the evidence that shows it's working, such as the new procedure, a sample of completed forms, or an updated checklist. That evidence is what makes next year's summary schedule easy to write.
A finding is information about where your process has a gap, delivered by someone who isn't trying to catch you out. Teams that respond with a clear owner, a specific fix, and a date tend to find that next year's audit is quieter.
If you have an open finding right now, check the completion date in your corrective action plan and confirm that someone's actually working on it this week.
MyFedTrainer offers free resources to help you organize grant files and build practical compliance habits. Take a look when it is useful to you. 
