What documentation will EPA auditors expect from contractors receiving State Revolving Fund (SRF) payments? 2026

According to GSA guidelines, contractors must maintain a complete auditable file for each SRF-funded job that includes the contractor's general ledger entries, itemized invoices tied to payment draw requests, subcontractor agreements, change orders, and lien waivers. This opening overview names the key agencies and authorities contractors will meet during SRF audits: EPA Office of Water policy, 2 CFR Part 200 audit standards, and state SRF program rules. GSA guidance and state SRF front-end documents increasingly require clear cross-references between invoices and project milestones; include purchase orders, receiving reports, and inspection sign-offs to match draw request line items. Contractors should also retain correspondence with the borrower (typically the municipality or water utility) and state SRF program managers showing acceptance of completed pay items; these acceptance letters and progress reports are frequently requested during EPA State Review Framework assessments. Include records that demonstrate compliance with Davis-Bacon or state prevailing wages when applicable, and retain copies of certified payroll, benefits worksheets, and fringe-benefit calculations to demonstrate correct labor cost allocation on SRF-funded line items.

Per FAR 19.502, small businesses can and should document subcontracting plans and small-business status when SRF payments flow to small-business subcontractors; that documentation supports both compliance and reporting. The SBA reports that 78% of small contractors award and manage at least one federally influenced construction or engineering sub-award that must be tracked for 2 CFR and state SRF reporting; capture subcontractor invoices, proof of small-business certification, and any SAM.gov entity validation records. Per FAR practices, retain past performance documentation and contracting officer communications that show concurrence on scope changes. Also include evidence of required permits and environmental compliance (NEPA records where required), because EPA auditors will request those when SRF funds involve construction or major upgrades. Maintain a contemporaneous project file that links procurement actions under FAR-like procurement principles to grant-eligible line items required by EPA SRF policy.

Under OMB M-25-21, agencies will require stronger acquisition transparency and cloud security controls for software or data services purchased as part of SRF-funded projects; include FedRAMP authorization copies when cloud services host SRF project data. DoD's CMMC framework requires cybersecurity documentation for controlled unclassified information in defense contracting, and while CMMC does not apply directly to EPA SRF, contractors who also serve DoD should reuse evidence of system security plans and incident response procedures where appropriate. Include system security plans (SSPs), access logs, and configuration change records for systems that store SRF financial or project records. EPA's 2024 updates to 2 CFR Part 200 emphasize records retention, auditability, and allowability of costs—retain timekeeping, allocation methodologies, and indirect cost rate documentation to demonstrate allowability and allocability of charges to SRF contracts.

According to GSA guidelines, contractors must be prepared to show the nexus between SRF-funded expenditures and eligible project activities because EPA and state auditors focus on allowability, allocability, and reasonableness of costs under 2 CFR Part 200. SRF capitalization grants are federal funds routed through states; EPA’s Program Policy and Guidance for the Drinking Water SRF outlines that funding recipients (states) must ensure subrecipients and contractors maintain auditable records supporting draw requests and that states include those records in State Review Framework examinations. States in turn require contractors to provide copies of invoices, progress photos, daily reports, certified payrolls, and procurement documentation so the state can certify eligible costs to EPA. The state-to-contractor audit trail must document competitive procurement (or sole-source justification), bid tabs, statements of work, scope amendments, and change order approvals. EPA auditors use this trail to confirm that SRF dollars paid to contractors directly supported eligible drinking water projects and that costs comply with federal cost principles and any state-specific SRF program requirements.

Per FAR 19.502, small businesses can use set-aside documentation and small-business certifications to demonstrate proper subcontracting and socio-economic compliance when SRF-funded projects include federal-like procurement expectations. The state SRF program frequently asks for SAM.gov validation printouts, small-business certifications (8(a), HUBZone, WOSB, SDVOSB), and documentation of subcontracting opportunities and awards. For awards above the $750,000 single-audit threshold, auditors will expect the contractor’s audited financial statements or single-audit package. The state review framework also checks internal controls over reporting and procurement; contractors should prepare internal control narratives, evidence of segregation of duties, and reconciliation schedules that show SRF funds were segregated or appropriately allocated within the contractor’s accounting system. Without these materials, states and EPA will question costs and may require corrective actions or repayment.

According to GSA guidelines, contractors must keep core financial records: general ledgers, chart of accounts mappings, bank statements, check registers, accounts payable/receivable sub-ledgers, and cost allocation memos showing which costs were charged to SRF projects. Maintain procurement documentation: solicitations, bid evaluations, contractor selection memos, signed contracts, task orders, and subcontract scopes. Keep payroll and labor records: certified payrolls, timecards linked to project codes, benefit-rate calculations, and subcontractor payment certifications. Maintain project delivery records: progress photos, daily reports, inspection reports, material delivery receipts, test results, commissioning certificates, and project closeout documents. For engineering or design contracts, retain design submittals, change order justification, and client approvals. Include indirect cost rate proposals (if used), fringe calculations, and a copy of any negotiated indirect rates. Per EPA SRF policy, retain documentation supporting environmental reviews, permit approvals, and any Davis-Bacon compliance, including wage determinations and notices posted on the job.