What 09 NCAC 03M Means for North Carolina Nonprofits

If your organization took Helene recovery money through a North Carolina State agency, two separate audit rules are counting your spending, and only one of them is federal. The federal one gets written about constantly. The State one almost never does, and it can require an audit in a year when the federal rule does not.

This post is about the second rule, which almost nothing published for nonprofits covers.

What counts as State funds

North Carolina has its own grant reporting rules, in 09 NCAC 03M, adopted under G.S. 143C-6-22 and 143C-6-23. They apply to any non-State entity that receives, holds, uses, or expends grant funds disbursed through the State.

One definition, at .0102(16), carries most of it:

"State Funds" means any funds appropriated by the North Carolina General Assembly or collected by the State of North Carolina. State funds include federal financial assistance received by the State and transferred or disbursed to non-State entities. Both Federal and State funds maintain their identity as they are disbursed as financial assistance to other organizations.

Federal money that arrives through a North Carolina State agency is State funds for the purposes of this Subchapter, and it stays federal money for the purposes of the Uniform Guidance. It is counted under both rules, in the same year, on two separate determinations.

A Helene subaward routed through NC Commerce, NC Emergency Management, or NC DHHS therefore shows up twice. It goes on your Schedule of Expenditures of Federal Awards, and it goes into your State reporting level.

A few organizations are outside the Subchapter entirely. Under .0101, it does not apply to entities subject to the audit and reporting requirements of the Local Government Commission, to tuition assistance, to public assistance payments from federal entitlement programs, or to State funds paid to a contractor rather than a grantee. Most nonprofits are none of those, which means most nonprofits are in scope.

Two levels, and the number that sets them

Rule .0205(a) establishes two reporting levels, based on the allocated funds from all grants disbursed through the State of North Carolina in your fiscal year.

  • Level I is less than the dollar amount requiring audit in 2 CFR 200.501(a).

  • Level II is equal to or greater than that amount.

Notice how the rule sets that amount. The figure arrives by reference to the federal one, including subsequent amendments. When OMB moved the federal threshold, the State threshold moved with it, automatically, without North Carolina amending anything.

So the State number today is $1,000,000, the same as the federal one. It has not always been:

  • Fiscal years ending on or before June 30, 2024: $500,000

  • Fiscal years ending July through September 2024: $750,000

  • Fiscal years ending October 2024 or later: $1,000,000

If you are closing a prior year, or an auditor is asking about one, check which figure governed it. A good deal of published guidance still quotes $750,000 or $500,000 as though they were current.

The scenario that catches people

The two tests count different pools, and this is where it bites.

Take an Asheville nonprofit with a June 30 fiscal year end. Since the storm it has picked up three things:

  • A $300,000 recovery appropriation through a State agency. State money, so it counts toward the State test only.

  • A $450,000 CDBG-DR award through NC Commerce. Federal money passed through a State agency, so it counts toward both.

  • A $200,000 State directed grant. State money again, so the State test only.

Federal awards expended: $450,000. Comfortably under $1,000,000, so no Single Audit.

Grants disbursed through the State: $950,000. Under $1,000,000, so Level I.

Now add one more State award of $100,000, which is an ordinary thing to happen in a recovery year. State total goes to $1,050,000. The organization is Level II and owes a single or program-specific audit under State law, performed in accordance with Generally Accepted Government Auditing Standards.

Its federal expenditures never moved. They are still $450,000. There is no federal Single Audit, and there is no federal report to lean on.

Almost nobody plans for that case: a Yellow Book audit required by North Carolina, triggered mostly by State money, in a year with no federal audit at all.

Level I is not "exempt"

This is the most common misreading of the rule.

Level I organizations owe everything the rule requires except the audit. Rule .0205(b) lists four requirements, and the first three apply to all recipients and subrecipients at either level:

  1. A certification to the distributing agency that grants received or held were used for the purposes for which they were awarded.

  2. An accounting to the distributing agency of all grants received, held, used, or expended.

  3. A report on activities and accomplishments undertaken, including any performance measures established in the contract.

The fourth is the Level II audit.

So a small organization that took one $40,000 State grant is Level I, owes no audit, and still owes an annual certification, an accounting, and a performance report. Organizations miss this constantly, because the word that circulates is "threshold" and the inference people draw is "under it, nothing happens."

Two deadlines

Rule .0205(c) sets both, and they fall at different times.

The reports required by .0205(b)(1) through (3) are due no later than three months after the end of your fiscal year. The Level II audit is due no later than nine months after the end of your fiscal year.

For a June 30 year end, that is September 30 for the reports and March 31 for the audit.

The three-month deadline is the one that surprises people, because it is much tighter than any federal date they are used to and it arrives while the books are often still being closed. Reports are filed with the disbursing agency, in the format and method that agency specifies, unless the same information is already coming through more frequent reporting.

Check that last clause. If your agency already collects quarterly performance reports, some of this may already be satisfied. Ask them which.

You may not need two audits

Two determinations do not always mean two audits, and this is where the rule gives something back.

Rule .0205(f) says that a recipient may satisfy the Level II audit requirement by submitting a copy of the report required under federal law with respect to the same funds.

So if your Level II position is driven by federal money passed through a State agency, and that same money has put you over the federal threshold, your federal Single Audit report can be submitted to discharge the State audit requirement. One audit, filed in two places.

Three limits:

  • It applies with respect to the same funds. If your State total is driven largely by State appropriations, as in the example above, there is no federal report covering them and nothing to substitute.

  • It covers the audit requirement at .0205(b)(4) only. The certification, the accounting, and the activities report at (b)(1) through (3) are still yours to file, on the three-month clock.

  • The deadlines are not the same. The federal reporting package is due the earlier of 30 days after you receive the auditor's report or nine months after year end. The State wants the audit within nine months. Plan to the earlier date.

There is a second cost relief in the rule, at .0205(e). Unless prohibited by law, the cost of an audit performed in accordance with this Subchapter is an allowable charge to State and Federal awards, as either a direct cost or an allocated indirect cost under 2 CFR Part 200 cost principles. There is a limit on that: the cost of any audit not conducted in accordance with the Subchapter cannot be charged to State awards.

What the contract adds

A common assumption is that the grant agreement is the final word. It is not, and the rule says so in both directions.

Rule .0702 states that no contract agreement shall act to eliminate or diminish the requirements contained in the Subchapter. A contract cannot give you a pass on the certification, the accounting, the performance report, or the audit if you are Level II.

It can go the other way. Rule .0205(d) requires agency reporting requirements to be specified in each recipient's contract, and .0703 lists what every grant contract must contain, including required reports and reporting deadlines, identification of the funding source with its CFDA number and the percentage from each source, and a five-year records agreement.

So the contract can impose more than the Subchapter does, including an audit at a dollar figure well below Level II, and plenty of agreements do. Read the reporting section of each award. The threshold alone will not tell you.

One practical note on .0703(2). The contract is supposed to identify the source of funds and the CFDA number where applicable. That field tells you whether a State-agency award is carrying federal money, which is exactly what you need in order to run the federal test. If it is blank, ask for it in writing, and keep the answer with the award file.

What happens if you miss it

The Subchapter has teeth. They are administrative, and easy to underestimate.

There is a Suspension of Funding List, defined at .0102(18) and operated under .0801. It is a database maintained by the Office of State Budget and Management, in consultation with State agencies, naming grantees in a state of noncompliance. An agency shall not disburse grant funds to an entity on that list.

The penalty is every State agency declining to pay you until you are back in compliance, including on awards that have nothing to do with the report you missed. For an organization running several State-funded programs, a missed certification on one of them can hold up cash across all of them.

The sequence under .0801 is: the agency communicates the requirement in writing within 30 business days, directs a written response, and suspends payments until compliance. For noncompliance that is not indicative of management deficiencies or criminal activity, .0801(d) gives 60 days written notice to take corrective action before the agency escalates.

Rule .0802 covers recovery of funds, where an organization cannot fulfill the agreement, cannot accomplish the purpose, is noncompliant with reporting, or used funds for purposes outside the contract. The disbursing agency takes administrative action to recover, with the Attorney General involved if legal action is required.

If you believe you were suspended in error, .0202(3) gives you the right to request removal in writing to OSBM.

Records: five years, and the clock may be longer

Two provisions set it, and you comply with the longer one.

Rule .0202(1) requires recipients and subrecipients to maintain reports and accounting records supporting the allowable expenditure of State funds for five years from the end of the grant agreement, and to make them available for inspection by the awarding agency, OSBM, and the Office of the State Auditor.

Rule .0703(4) requires every grant contract to contain an agreement to maintain all pertinent records for five years or until all audit exceptions have been resolved, whichever is longer.

An open audit exception extends your retention obligation past the five years. So resolve findings. Waiting them out extends the clock.

On access: .0703(14) requires every contract to provide for audit oversight by the Office of the State Auditor, access to accounting records by both the funding agency and the State Auditor, and availability of the audit work papers held by any auditor of any recipient of State funding. Signing a State grant agreement means agreeing to that access.

What to do before your year closes

Five things, in order.

  1. Total your State-disbursed grants separately from your federal awards expended. Keep two running numbers. Every award that came through a North Carolina State agency goes in the State total, whether the money originated in Raleigh or Washington. Only the federal-origin portion goes in the federal total.

  2. Pull the funding source off every award document. Rule .0703(2) says the contract should identify the source and the CFDA number where applicable. That one field decides which totals an award lands in. Where it is missing, ask the agency in writing.

  3. Find the three-month date and put it on the calendar. The certification, the accounting, and the activities report are due within three months of your fiscal year end regardless of level. For a June 30 year end that is September 30, and it comes around faster than the audit does.

  4. Check each contract's reporting section against the Subchapter. A contract can add requirements, and .0702 stops it from removing any. If it names an audit at a figure below Level II, that figure governs you.

  5. If you expect to be Level II, ask whether .0205(f) applies to you. If the same funds are driving a federal Single Audit, one report may satisfy both. If your State total is mostly State money, it will not, and you need to budget for an audit that no federal rule required.

In QuickBooks Online, the practical version of the first two items is a tracking dimension per award, with the funding source recorded as an attribute of the award when you set it up. A State agency is not a reliable proxy for State money. The definition at .0102(16) is the reason.

The federal half of this is covered in our post on the Single Audit threshold, and what the federal schedule has to carry is in what a SEFA is.

If you are not sure which level you are in, that is a reasonable place to be. The answer comes out of your books. The Grant Readiness Review is a fixed-fee, two-week assessment starting at $1,500 that works out where you stand under both rules and what your books would need to produce. More on how we handle grant tracking and restricted funds is on the grant compliance page.

Sources

Figures in the worked example are invented for illustration and are not drawn from any client's books. This post describes the rules as published on the dates above; confirm the current rule text and your own award terms before relying on it.