Features, organised by obligation
Everything you need to run a grant-funded program
Tasks, milestones, timelines, a board, status reports and a team view — the project management you would expect — plus the award, subrecipient, monitoring and evidence records that 2 CFR 200 asks for. Each section below states the obligation, how Kharazm satisfies it, and what the person reviewing you actually sees.
How to read this page. Kharazm does not interpret the Uniform Guidance for you and does not certify your compliance. It gives each obligation somewhere to live so the record exists when a monitor, an auditor or a program officer asks. Confirm your own obligations with your awarding agency and your auditor.
2 CFR 200.329
Published performance reports, kept read-only
The requirement
Recipients must monitor their programme and report performance for defined periods — typically an SF-PPR, an RPPR or an agency-specific narrative on a quarterly, semi-annual or annual cadence. The report describes a closed period and is expected to reflect what was known and true at the time it was submitted.
How Kharazm satisfies it
You draft the report inside the period it covers, then publish it. Publication writes a fixed, versioned snapshot: the narrative, the health rating, the period boundaries, the publishing user and the timestamp, plus a frozen copy of the evidence index and the completed work as they stood. There is no edit or delete path on a published report. A correction is a new version; the earlier version remains readable. This is enforced by the application and the database, not by write-once storage.
What the auditor sees
A numbered series of reports for the award, each with its period, its author and its publication time — and the ability to open version 1 after version 3 exists. The absence of an edit path is the point: the application gives the organisation no way to quietly revise what it said last spring.
2 CFR 200.332
Subrecipient risk assessment and monitoring
The requirement
A pass-through entity must evaluate each subrecipient's risk of non-compliance, apply monitoring proportionate to that risk, review findings, issue management decisions, and ensure corrective action. The evaluation has to be documented — an unwritten judgement is not testable and therefore does not count.
How Kharazm satisfies it
Each subrecipient carries a legal name, UEI, subaward amount, a risk level, a written basis for that risk level which the form requires rather than suggests, and a monitoring plan. Monitoring events — desk reviews, site visits, invoice reviews, audit report reviews, technical assistance — are logged with a date, a named performer, findings and corrective action. Closing a finding records the verified corrective action and who closed it, and a closed finding cannot be rewritten.
What the auditor sees
A monitoring log per subrecipient showing risk level, the reasoning behind it, what monitoring was planned, what actually happened and when, and how each finding was resolved. Gaps show as gaps rather than being omitted: the Awards page lists every award by period end with its open findings and the subrecipients not yet monitored, while there is still time to close them.
Supports 2 CFR 200.303 and management decisions
Decision records with written resolution
The requirement
Programme decisions that change scope, budget, schedule or approach need to be explainable later. When a monitor asks why a milestone moved or why funds were reallocated, "we discussed it in a meeting" is not a record.
How Kharazm satisfies it
The RAID register holds risks, assumptions, issues and decisions. Each carries an owner, a due date, an impact statement and — when closed — a written resolution. Closed items stay in the record rather than disappearing, and the items open when a report is published are captured in that report's snapshot.
What the auditor sees
A dated register of what went wrong, who owned it, and what was decided — with names attached. This is the single artifact most often missing entirely from a reconstructed file, because it is the one thing email threads cannot be turned into after the fact.
2 CFR 200.303
Audit-log evidence of internal control
The requirement
Recipients must establish and maintain effective internal control over the award, providing reasonable assurance that it is managed in compliance with the terms and conditions — and must be able to show that the control operated, not merely that a policy exists.
How Kharazm satisfies it
Access is decided on the server from the session and membership, never from the request body — a signed-in viewer who forges a write request is rejected, and that behaviour is covered by an integration test rather than a claim. Every change is written to a per-organisation audit log with who, when, a request id and the before and after values; a database trigger makes the log append-only, and admins can download it as CSV. Organisations are the tenant boundary and membership is checked before every read and write.
What the auditor sees
Four access levels with real boundaries — admin, manager, member, viewer — and a log showing who changed what, when, and from what to what. Combined with read-only published reports, this answers the control question with evidence rather than assertion.
2 CFR 200.334
Records protected from piecemeal deletion
The requirement
Financial records, supporting documents and statistical records must be retained for three years from the date of submission of the final expenditure report — longer if litigation, a claim or an audit started before that period expired.
How Kharazm satisfies it
Published reports and monitoring events cannot be deleted. An award with subrecipients or evidence on file, and a subrecipient with monitoring history or evidence, cannot be deleted either, and a program that holds an award or published reports can only be archived, which keeps it readable and exportable. This is enforced by the application and backed by database constraints, not merely hidden in the interface — though it is not write-once storage, and an admin can still deliberately delete the whole workspace. There is no configurable retention schedule or legal hold.
What the auditor sees
Records that still exist, an evidence index pointing at the documents in your own systems, and an audit log showing that nothing on file was removed one record at a time. This is also the answer to "what happens when our grant ends" — the record outlives the programme, because it has to, and it is not hidden or deleted if you stop paying.
2 CFR 200.337
Scoped external access for funders and auditors
The requirement
The awarding agency, the Inspector General, the Comptroller General and the pass-through entity must have access to records pertinent to the award. In practice you want to give an auditor or a funder sight of the award they are reviewing — without exposing everything else.
How Kharazm satisfies it
An external viewer is invited with read-only access limited to the awards you choose, optionally with an end date after which access stops automatically. The server cuts the workspace down to those awards before anything reaches the browser, based on the session — not a share link that anyone holding the URL can use, and not a client-side filter. Scope is per award, not per subrecipient: a viewer on an award sees every subrecipient on it.
What the auditor sees
Only the chosen awards: each award record, its subrecipients and monitoring, its evidence, the basics of its program, that program's published reports and recorded decisions, and the names of the people those records cite. Not tasks, drafts, comments, portfolios or the team roster — and they can generate the audit pack for those awards themselves.
See it against one of your own awards
Take a 14-day trial, publish one report, and judge the record on your own material.