Building a Compliance Program for Federal Grant Cost Principles
Federal grant cost principles sit at the heart of how universities, technical colleges and affiliated state agencies account for the millions of dollars they receive each year from public coffers. In Australia, where institutions such as the University of Melbourne, UNSW and the Australian National University compete for funding from the Australian Research Council, the National Health and Medical Research Council and the Department of Education, the same pressure exists to demonstrate that every dollar is reasonable, allocable and allowable. A well-structured compliance program does more than keep an institution out of trouble with funding bodies — it builds trust with senators, state treasurers and the local community.
The challenge for many senior business officers is that compliance is treated as an audit-season exercise rather than a living operating discipline. Federal cost principles are dense, the guidance documents run to hundreds of pages, and the line between legitimate cost recovery and disallowed expenditure can be surprisingly thin. Embedding these rules into everyday workflows, rather than relying on after-the-fact reconciliation, is the surest way to protect institutional reputation and maximise the strategic impact of grant funding.
Across the sector, there is a growing appetite for cross-institutional learning. Peer associations such as TASSCUBO codify shared standards through a publicly available constitution, and Australian equivalents including Universities Australia and the Australasian Research Management Society are doing the same. The remainder of this article walks through the practical architecture of a compliance program that aligns with federal cost principles while remaining responsive to the realities of the Australian higher education landscape.
Grounding the Program in Federal Cost Principles
The Uniform Guidance codified at 2 CFR Part 200 remains the global reference point for grant cost accounting, even for institutions operating outside the United States. Four tests define whether a cost may be charged to a federal award: it must be necessary and reasonable, allocable to the award, treated consistently with other institutional activities, and conform to any limitations set out in the award terms. Australian funding agreements, while issued under the Commonwealth Grants Rules and Principles, mirror these tests almost word-for-word, which is why a program designed around 2 CFR 200 can be readily adapted to local conditions.
The table below compares the major cost categories in the US framework with the closest Australian equivalent, drawn from ARC and NHMRC funding rules and the NHMRC Direct Research Costs Guidelines.
| Cost Category | US Treatment (2 CFR 200) | Australian Equivalent |
|---|---|---|
| Salaries and wages | Reasonable, supported by time-and-effort certifications | Reasonable, supported by time-allocation logs and workplace agreements |
| Equipment (>$5,000) | Capitalised, depreciation allowable | Capitalised under AASB 116, depreciation allowable |
| Travel | Necessary for the award, economy class preferred | Necessary, economy class required under most ARC schemes |
| Indirect costs | Negotiated F&A rate or de minimis 10% MTDC | Commonwealth-funded at capped percentages; host institution bears the gap |
| Sub-awards | Pass-through entity responsibilities apply | Pass-through obligations under the CGRPs apply |
Designing a compliance program around these shared categories allows business officers to write one policy that satisfies both sets of reviewers. The program should document each test in plain English, link the test to the relevant clauses in the funding agreement, and assign an owner accountable for ongoing application. That single owner is often the senior business officer, whose remit spans finance, research support and facilities.
Translating Principles into Operational Controls
Policies that live in a drawer do nothing to prevent a disallowed cost. Operational controls convert the four tests into workflows that finance teams, researchers and procurement officers actually follow. The first control point is the proposal stage: every budget line submitted to a federal or commonwealth sponsor should be screened against the reasonableness, allocability and consistency tests before submission, not after.
The second control point sits in procurement. Many Australian universities, particularly those operating across multiple campuses in Sydney, Brisbane and Adelaide, have decentralised purchasing arrangements. A compliance program should require that any single purchase above a defined threshold — often $5,000 or $10,000 — carries evidence that the cost is allowable, that the supplier represents best value, and that the goods or services can be tied to a specific award code. Linking the procurement system directly to the grants management module reduces the risk of mis-posting.
The third control point is payroll. Time-and-effort certification is mandatory under the Uniform Guidance, and while Australian universities use different terminology — workload models, research allocation percentages, academic workload agreements — the underlying principle is the same. A robust program integrates payroll data with the research management system so that the proportion of a staff member's salary charged to a grant is automatically reconciled each month, with quarterly certification by the cost-centre manager. For casual academic staff, who make up a significant proportion of the teaching and research workforce in Australia, the system must capture after-the-fact certifications cleanly.
Documentation, Evidence and the Australian Audit Trail
Auditors from the Australian National Audit Office, state auditors-general and the US Office of Inspector General all share a common question: can you show me the paper trail? A compliance program must define, in writing, what evidence is retained for each type of cost and for how long. The Commonwealth grants framework typically requires seven-year retention, and the US Uniform Guidance specifies three years from the date of submission of the final expenditure report, whichever is later.
A practical approach is to maintain a cost-evidence library, ideally digital and searchable, organised by award and by cost category. Receipts, supplier quotes, board minutes approving senior salaries, training attendance records, and equipment depreciation schedules should all be filed against the relevant grant. Where institutions operate across multiple states, indexing evidence by both the funding source and the state jurisdiction avoids the common trap of satisfying one set of record-keeping requirements while breaching another. GST treatment, fringe benefits tax implications and payroll tax exemptions all need to be captured consistently within the evidence trail.
Good documentation also protects institutional memory. In a sector where research office staff turnover is frequent, the compliance program should require that all evidence is stored in systems that survive personnel changes. A documented chain of custody — who created the record, who approved it, where it is stored — is what distinguishes a defensible audit file from a folder of PDFs. Version control on policy documents and standard operating procedures matters just as much as the documents themselves.
Training, Culture and the Role of Senior Business Officers
Compliance programs succeed or fail on the willingness of academic and professional staff to engage with them. A training strategy that targets only finance teams misses the point, because the cost principles are applied by researchers every time they book travel, claim salary, or purchase consumables. Effective programs at institutions such as the University of Queensland and Monash University combine mandatory online modules with face-to-face workshops tailored to specific cohorts — early-career researchers, lab managers, finance business partners and heads of school.
Senior business officers play a unique convening role. They sit at the intersection of finance, research and facilities, and are often the people who translate a cryptic clause in a funding agreement into a working procedure. Investing in their professional development, including attendance at conferences hosted by associations such as TASSCUBO and its Australasian counterparts, pays dividends in the sophistication of the institution's response to audit findings. Mentoring programs that pair a seasoned business officer with a newer colleague are particularly valuable, because much of the practical wisdom of cost compliance is transmitted through stories rather than manuals.
Cultural change is gradual, but it can be accelerated by visible leadership. When the chief financial officer or the deputy vice-chancellor research attends a compliance training session, sends a clear memo about disallowed costs, or co-signs a difficult approval, the message reaches the front line more effectively than any policy document. Recognition matters too: acknowledging teams that spot a potential non-compliance early reinforces the message that compliance is a shared responsibility, not a policing exercise. Embedding compliance responsibilities in position descriptions makes the expectation explicit from the day a researcher or finance officer signs their contract.
Monitoring, Audit Readiness and Continuous Improvement
A compliance program is not a project with a finish line. It is an operating discipline that requires scheduled monitoring, internal audit and continuous refinement. A sensible cadence includes quarterly reviews of cost allocation across major awards, an annual internal audit of one or two high-risk cost categories, and a post-award review after every significant grant closes. Findings should be logged centrally, with owners assigned and deadlines tracked in a register visible to senior leadership.
Benchmarking against peers strengthens the program further. Comparing the indirect cost recovery rate, the proportion of grants with timely financial reporting, and the number of audit adjustments with similar institutions in Australia and abroad provides a reality check. Where gaps appear, the program should treat them as design flaws to be fixed, not as individual failures to be punished. This is the spirit of the Uniform Guidance and the Commonwealth Grants Rules and Principles alike: continuous improvement rather than punitive enforcement.
The program should be reviewed at least every three years, or whenever there is a major change in the regulatory environment. Updates to the Commonwealth Grants Rules, the release of new ARC or NHMRC schemes, and changes in accounting standards such as AASB 15 and AASB 1058 all warrant a structured refresh of the compliance framework. Treating the program as a living system, rather than a static document, is what keeps it relevant and resilient.
If your team is ready to lift the maturity of its cost compliance framework, start by mapping current practice against the four cost principles, then prioritise the highest-risk gaps in a single, board-approved work plan. Reach out to peer networks, share your progress openly, and bring researchers into the conversation from day one — the strongest compliance programs are the ones the whole institution has helped to build.