Audits
Audits
On This Page
Audits are an essential part of research administration and institutional accountability. While they may sometimes feel like a distraction from the core mission of research, audits serve a critical purpose: they help identify areas where practices may need adjustment to maintain strong compliance and support the integrity of the university–sponsor relationship. Proactively addressing these areas reduces the risk of reputational damage, financial penalties, and non-compliance. As members of the research community, we all share responsibility for supporting audit readiness and mitigating potential institutional risk.
Internal Audits
Harvard’s internal audit function is managed by Risk Management and Audit Services (RMAS), which conducts periodic audits of departments, research centers, service centers, administrative systems and software platforms. These audits focus on evaluating financial and operational controls, business processes, management practices, and information system security. Audits are conducted in collaboration with the unit's leadership and staff, and results, including recommendations for improvement, are shared with relevant stakeholders. In addition to its auditing role, RMAS serves as a resource for consultation on compliance with applicable federal, state, local and sponsor regulations.
External Audits
Annual Uniform Guidance (2 CFR Part 200, Subpart F) Federal Audit (formerly A-133)
The most frequent and visible external audit conducted at Harvard is the Annual Uniform Guidance Audit, required under OMB Uniform Guidance Subpart F, “Audits of States, Local Governments, and Other Non-Profit Organizations.” This audit is mandated for all non-profit institutions that expend $750,000 or more in federal funds in a fiscal year.
The audit is conducted annually by PricewaterhouseCoopers LLP (PwC) on behalf of the federal government. Each year, PwC selects a sample of federal awards for audit, typically from large, research-intensive departments on a two-year rotation, and from smaller departments or service centers less frequently. On average, three FAS departments and one service center are audited annually.
Audit areas often include:
- Cost allowability and allocability
- Appropriateness and timeliness of cost transfers
- Effort reporting compliance
- Equipment management controls
- Financial reporting accuracy
- Subrecipient monitoring processes
- Internal controls over payables
- Service center billing rates and methodologies
Throughout the summer and fall, FAS departments and service centers selected for review respond to detailed audit questionnaires and submit supporting documentation for specific transactions requested by PwC. Any transactions deemed high risk receive closer scrutiny. If issues remain unresolved, PwC issues formal "findings."
In response to any findings, FAS prepares a Corrective Action Plan (CAP), to address them. PwC submits the final audit package, including findings and CAP, to the Department of Health and Human Services (DHHS), Harvard’s cognizant agency, in the spring. Shortly after, the process begins again for the next fiscal year.
Special Audits
In addition to regularly scheduled audits, large federal agencies—such as the NIH, NSF, and DoD, may initiate special audits at their discretion through their respective Offices of Inspector General (OIG) or other oversight entities. These audits are often targeted in scope and may focus on specific programs, departments, or broader institutional policies and procedures.
Special audits typically include:
- Detailed review of grant files
- Examination of supporting documentation for selected transactions
- Interviews with faculty, administrators, and other staff
These audits may be prompted by risk-based assessments, whistleblower reports, or findings from prior reviews. Institutions are expected to respond promptly, provide complete documentation, and cooperate fully throughout the process.
Ask for Help
If you are notified of an upcoming external audit, particularly a special agency audit, please reach out promptly to the Office for Sponsored Programs (OSP) and the FAS Office of Research Administration (FORA). Early communication ensures that the appropriate resources can be mobilized to support your department, coordinate a timely response, and help manage the process effectively.
Best Practices for Audit Preparedness
At a large and decentralized institution like Harvard, it’s expected that auditors may identify findings during their reviews. However, there are proactive steps we can all take to reduce audit exposure and maintain a strong compliance position. Audit preparedness is a shared responsibility across the research community. Here are a few reminders to support audit readiness:
Carefully review the terms of each award, including allowable costs, reporting deadlines, and any restrictions. Ensure all expenditures and actions are compliant with both sponsor requirements and University policy.
All charges to sponsored awards must meet three key criteria: they must be allowable, allocable, and reasonable. Expenses must conform to sponsor terms and conditions and institutional policies. And, directly benefiting the project being charged, reflect prudent use of funds, and be applied in a uniform manner across similar activities or projects. When an expense benefits more than one project, it should be allocated accordingly among the benefiting projects using a fair and pre-established allocation method. Accurate and consistent allocation of direct costs helps ensure compliance and strengthens the integrity of financial management. For more information, refer to the Sponsored Expenditures Guidance.
Keep thorough records to support all charges, including receipts, approvals, justifications, effort certifications, and service center usage logs. Well-organized documentation is essential for a successful audit. Please visit Harvard Record Retention Schedule.
Review project accounts regularly to ensure accuracy, catch errors early, and avoid issues such as overspending, unallowable charges, or unspent balances at closeout.
The best way to avoid cost transfers is through proactive and thoughtful financial planning. Expenses should only be charged to sponsored accounts when they directly benefit the project. Clear communication between administrators and principal investigators (PIs) is essential when determining the appropriate account(s) to charge.
Whenever possible and appropriate, allocation plans should be established in advance, and personnel appointments should be carefully timed to align with available funding. Tools like the PI Dashboard can support this planning process by projecting both personnel and non-personnel expenses and helping departments anticipate funding gaps or reallocation needs.
Despite best efforts, cost transfers may occasionally be necessary. In those cases, it’s critical that they are submitted promptly and include thorough complete documentation and clear justification. Delayed or poorly documented transfers can raise audit risk and may reflect negatively on an institution’s compliance record.
Strong planning and timely execution help ensure accurate financial management and minimizing administrative burden across the award lifecycle.
Proper equipment management is essential for compliance with both federal and University policies. The Faculty of Arts and Sciences (FAS) maintains a centralized database of capital equipment, and auditors expect this database to be accurate, complete, and up to date.
Each piece of equipment is assigned a unique tag number, which must be affixed to the item timely upon acquisition. Keeping accurate location information is especially important, if equipment is relocated, loaned, transferred, or decommissioned, the system must be updated accordingly.
Departments are responsible for maintaining current inventories and ensuring that equipment acquisition, tagging, use, and disposal are conducted in accordance with sponsor requirements and institutional guidelines. Forms are available for reporting significant changes; see Section VIII of Property Plant & Equipment Policy - Full Policy.
Effort reporting is a critical component of sponsored award compliance. Principal Investigators (PIs) are responsible for certifying that compensation paid to employees and stipendees accurately reflects the effort contributed to sponsored projects in accordance with Harvard's Effort Reporting Policy. This is done through quarterly certifications for staff and stipendees, and annually for PIs themselves.
To meet compliance standards, effort statements must be:
- Timely: Certified promptly after the reporting period ends.
- Accurate: Reflecting actual effort expended, not budgeted estimates.
- Properly Certified: Signed by the PI or, in rare cases, by a designee or proxy with direct oversight of the research.
Auditors routinely examine the accuracy and timing of effort reporting. Misalignment between effort certifications and payroll charges is one of the most common audit findings. Ensuring that effort is properly tracked and certified strengthens institutional integrity and helps protect federal funding.
Timely and accurate submission of final reports is essential to maintaining sponsor trust and institutional compliance. Auditors pay close attention to whether technical and financial reports are submitted by their deadlines and whether any required resubmissions indicate issues in grants management.
To avoid compliance risks and potential audit findings:
- Ensure all closing transactions (e.g., payroll, cost transfers, subaward invoices) are posted promptly, ideally before or shortly after (within the closeout period) the award end date.
- Adhere to sponsor deadlines for both technical and financial reports.
- Coordinate with PIs and administrators early to finalize documentation and resolve outstanding issues.
- Complete award closeout processes in a timely manner to prevent delays, disallowances, or institutional liability.
Effective award closeout reflects strong internal controls and responsible financial stewardship.
Harvard’s subrecipient monitoring responsibilities are shared between central offices and departments and are governed by a two-part approach:
- Part 1 (OSP): The Office for Sponsored Programs (OSP) reviews each subrecipient’s annual federal audit results to confirm there are no findings that could impact Harvard’s subawards.
- Part 2 (Departments and PIs): Principal Investigators and department administrators are responsible for ongoing programmatic and financial oversight of subrecipients.
Effective monitoring includes:
- Collecting and retaining progress reports from subrecipients
- Ensuring invoices are detailed, reasonable, and align with budgeted costs
- Verifying timely PI review and approval of invoices
- Maintaining clear records of all monitoring activities (e.g., reports, approvals, site visit notes)
- Conducting site visits and, in rare cases, initiating audits of a subrecipient’s internal controls or financial procedures
Proper documentation of subrecipient oversight is critical, as auditors may request to review these records. Maintaining a consistent monitoring process helps ensure compliance, protects federal funding, and supports collaborative research integrity.
Strong internal controls over payables are essential to maintaining financial integrity and ensuring compliance with sponsor and University policies. At Harvard, all purchases and payments must be processed through approved systems, primarily Buy-to-Pay (B2P), Concur, or PCard to ensure proper authorization, tracking, and audit readiness.
A foundational control is the three-way match: the purchase order, invoice, and packing slip should all align to support the transaction. In B2P, this matching is completed electronically and is a key part of the system’s built-in compliance features.
To further support effective internal controls:
- Ensure segregation of duties, where no single individual initiates, approves, and reconciles a transaction. We understand this may not be possible in smaller departments however reach out to FORA for additional guidance if needed.
- Follow documented approval workflows consistently.
- Retain supporting documentation in a centralized and accessible location for audit purposes.
Using Harvard’s required systems and maintaining disciplined controls helps prevent errors, promotes transparency, and ensures stewardship of institutional and sponsored funds.
Harvard’s Service Center Policy outlines the required procedures for establishing billing rates and monitoring the financial operations of service centers and specialized service facilities. These policies apply to all units exceeding established expenditure thresholds and are considered best practice even for smaller units that do not meet those thresholds.
Departments operating service units must:
- Set rates annually in accordance with institutional and federal guidelines
- Document the rate-setting process and retain supporting data for audit readiness
- Ensure compliance with applicable regulations, including OMB Uniform Guidance (2 C.F.R. §200), Subpart E (§200.468)
- Submit rates for review by FAS Office of Research Administration (FORA) and the University-wide Service Center Committee
Auditors closely scrutinize the financial management of service centers, focusing on cost allocation, rate justification, and documentation. Regularly reviewing rates and comparing actual recoveries to projections helps avoid over- or undercharging and supports compliance with both federal and University standards.
Audit expectations and regulations evolve. Stay informed on changes to Uniform Guidance, sponsor-specific rules, and Harvard policies to ensure continued compliance.
When an audit request is received, act quickly to gather and submit documentation. Coordinate with OSP and FORA to ensure responses are complete, accurate, and timely.