The Grant You Win Can Be Clawed Back at Closeout Over How You Bought Things. FEMA Is Running Free Procurement Training Through September.

There is a failure mode in federal grants that almost nobody plans for: you win the money, you spend it on exactly what you promised, and years later an auditor claws a chunk of it back — not because the project failed, but because of how you bought things. In FEMA's world, this is not a rare edge case. It is one of the most common reasons recipients and subrecipients lose funds at closeout. And right now, through September 2026, FEMA's Grant Programs Directorate is running a series of free Procurement Under Grants trainings aimed at exactly this problem.

The trainings are facilitated by FEMA's Procurement Disaster Assistance Team (PDAT) and the Buy America Branch, and they are open to the full universe of FEMA grant recipients: state, local, tribal, and territorial government personnel, nonprofit organization staff, and any subrecipient touching FEMA dollars. If you administer or spend FEMA money — disaster or non-disaster — this is worth an hour of your calendar, because the rules behind it are unforgiving and the enforcement environment is getting tighter, not looser.

The rules nobody reads until it is too late

The federal procurement standards live in Title 2 of the Code of Federal Regulations, sections 200.317 through 200.327 — part of the Uniform Guidance that governs virtually all federal financial assistance. FEMA's updated procurement requirements apply to financial-assistance awards and disaster declarations issued on or after October 1, 2024, and the agency has published a "Roadmap to Procurement Compliance" (updated January 2026) to walk recipients through them.

Here is the part that catches organizations off guard: when you spend federal grant money, you generally have to follow the federal procurement rules — even if your own organization's purchasing policies are stricter or looser. A city that has bought services the same way for thirty years can be out of compliance the moment those purchases run through a FEMA award. The standards impose specific obligations that many organizations simply do not have in their normal workflow:

• Full and open competition. You cannot steer contracts to a favored vendor. The rules require genuine competition and prohibit practices that restrict it — geographic preferences, unreasonable qualification requirements, and organizational conflicts of interest among them.
• Documented procurement method. The correct method depends on the dollar amount — micro-purchase, small purchase, sealed bid, competitive proposal, or noncompetitive (sole source). Using the wrong method for the dollar threshold is a finding.
• Cost or price analysis. For purchases above the simplified acquisition threshold, you must perform and document an independent estimate before receiving bids or proposals.
• A written record. You must be able to show the rationale for the method, the selection, the price reasonableness, and — critically — the justification if you did not compete.
• Required contract provisions. Certain clauses (2 CFR Part 200, Appendix II) must appear in the contracts themselves.

Miss any of these and the cost can be disallowed, regardless of whether the underlying purchase was reasonable and the project succeeded.

Where recipients actually get burned

FEMA's own training curriculum is organized around the errors it sees most, which is a useful map of the danger zones:

Emergency and exigency purchasing. After a disaster, organizations buy fast — and the rules do allow noncompetitive procurement in genuine emergencies. But the emergency exception is narrower than people assume, it is time-limited, and it must be documented as an emergency at the time. Retroactively labeling a purchase "exigent" because you forgot to compete it is exactly the pattern auditors look for. The exception covers the period of the actual emergency, not the months of recovery work that follow.

Sole-source creep. Noncompetitive procurement is permitted only under specific conditions — the item is available from a single source, a genuine emergency, the awarding agency authorizes it, or competition was tried and failed. "It was easier to use our usual vendor" is not on that list.

Subrecipient blind spots. This is the quiet killer. A state agency (the recipient) passes FEMA money to local governments or nonprofits (subrecipients), and the recipient remains responsible for monitoring that its subrecipients procured compliantly. A pass-through entity that hands out money without a monitoring plan inherits its subrecipients' procurement mistakes at closeout. If you are a recipient, your subrecipients' files are effectively your files.

Buy America. FEMA's Buy America Branch is part of these trainings for a reason — domestic-preference requirements for infrastructure projects add another compliance layer that has grown more prominent, and non-compliance there carries its own consequences.

Why the stakes just went up

None of this is happening in a vacuum. The OMB proposed overhaul of the Uniform Guidance, published May 29, 2026, points squarely toward more oversight of how grant money is managed — expanded pre-award risk assessments, stronger subrecipient-monitoring requirements, and broader agency authority to suspend or terminate awards. We covered the OMB rule and its frozen timeline separately, but the through-line for procurement is simple: the direction of travel is toward tighter documentation and more aggressive enforcement.

An organization that has been sloppy about procurement documentation has been running an unpriced risk for years. In a tightening environment, that risk gets repriced — and the repricing happens at audit, when it is too late to fix. The compliant procurement file is built before the purchase, not reconstructed afterward.

How to get ahead of it

The good news is that procurement compliance is one of the most learnable areas of grant management, because the rules are explicit and the documentation is mechanical. Here is the practical playbook:

Take the free training. FEMA is offering it through September 2026 at no cost, tailored to all experience levels — introduction, procurement lifecycle, emergency/exigency, and workshops. There is rarely a cheaper way to de-risk a grant portfolio than sending your finance and procurement staff to the agency's own compliance sessions.

Build a procurement file template now. For every purchase over the micro-purchase threshold, standardize a file that captures: the procurement method and why it fits the dollar amount, the solicitation and the responses, the independent cost estimate, the selection rationale, the price-reasonableness determination, and the required contract clauses. If a purchase is noncompetitive, the sole-source justification goes in the file at the time of purchase.

Write down your emergency procedures before the emergency. Have a documented process for exigent purchasing that captures the emergency determination, the time window, and the transition back to competitive procurement once the emergency passes. Improvising this during a disaster is how the exception gets abused.

If you are a pass-through entity, build a subrecipient monitoring plan. Risk-assess your subrecipients, set monitoring expectations in the subaward agreement, and actually review their procurement documentation. You are responsible for their compliance whether or not you look.

Reconcile your own policies to the federal floor. Where your organization's purchasing policy conflicts with 2 CFR 200.317–.327 on a federal award, the federal rule governs. Know where the gaps are before an auditor finds them.

The organizations that treat procurement as a paperwork afterthought are the ones writing repayment checks at closeout. The ones that build a clean procurement file as a habit — and use FEMA's free training to teach their staff how — keep the money they win. In a year when federal oversight is sharpening, that discipline is worth more than another grant application.

Granted helps organizations find the federal and state grants they are eligible for and understand the compliance obligations that come attached. Winning the award is the first step; keeping it through closeout is the one that separates experienced grantees from first-timers.