For auditors and finance officers

What monitoring documentation for Build America, Buy America and Section 889 looks like

The single audit asks a recipient for its documentation that it monitored the contractor's compliance with the Buy America preference. Under a federal award, Section 889 is certified by accepting the award. Neither rule says what a recipient keeps behind the vendor's signature. A file that answers the auditor's question has five parts, and the Protocol supplies the largest of them.

Source: 2025 Compliance Supplement, Part 3, section I, procedure 8.a; 2 CFR 200.216(e).

Protocol Version 1.0, Public Comment Draft, Revision 3, September 17, 2026. Comments through October 31, 2026.

The audit step

What the auditor is told to look for.

Procedure 8 tests whether the recipient “included the Buy America domestic preference provisions in each agreement, or obtained a BABA waiver.” Procedure 8.a reviews the recipient's “documentation supporting that it monitored the contractor's compliance.” The procedure does not test origin in fact or the component-cost arithmetic, and it does not say what the monitoring documentation is.

Part 3 of the Supplement carries no procedure for 2 CFR 200.216. The certification there is made by accepting the award, so the question an auditor can still ask is what the recipient did to keep that certification true.

Source: 2025 Compliance Supplement (revised June 18, 2025), Part 3, section I, at 3.1-I-6; 2 CFR 200.216(e).

The rules

What stands behind a certificate today.

2 CFR part 184 requires the Buy America preference to be included in every subaward, contract and purchase order under the award. It states no documentation, recordkeeping or certification requirement; the documentation duties it carries attach to waivers.

Source: 2 CFR 184.4(b); 184.7(b) to (d).

FHWA's 2025 manufactured-products rule applies the 55 percent component-cost test to Federal-aid projects obligated on or after October 1, 2026, and prescribed no form of compliance. It wrote that the recipient “is in the best position to determine the best form of any certification,” and listed the remedies for a bad one, up to “determining that all project costs are ineligible.”

Source: 90 FR 2946 (January 14, 2025); 23 CFR 635.410(c)(1)(vii)(B).

NTIA's manufacturer certification letter for its broadband programs holds four items: the requirement referenced, the equipment's name, description and quantity, the place of manufacture, and a signature.

Source: NTIA, Build America, Buy America Compliance and Documentation Requirements and Procedures, at 12.

DOE requires the certification or proof of compliance to flow up from every subawardee, contractor and vendor to the prime recipient, which keeps it with the award files to produce “upon request from DOE, auditors or Office of Inspector General.” It names no required content.

Source: DOE, Build America, Buy America, energy.gov/management/build-america-buy-america, as retrieved September 18, 2026.

Under 2 CFR 200.216, acceptance of the award is the certification. The recipient is not required to certify beyond that, apart from the certifications that ride with payment requests and financial reports.

Source: 2 CFR 200.216(e).

Each of those rules leaves the content of the evidence to the party asking for it. In a single audit that party is the recipient.

The file

A monitoring file that answers the question.

For each purchase of connected hardware under a federal award, a file that answers the question has five parts.

The requirement as flowed down. The Buy America preference and the Section 889 term in the solicitation, the subaward or the purchase order. 2 CFR 184.4(b); 2 CFR 200.216 and Appendix II to part 200.
The vendor's certificate or representation, dated and signed, naming the models it covers.
The origin evidence behind that certificate: an Origin Evidence File under the Protocol, at a stated conformity level and currency date. Part IV of the Protocol fixes its contents: device identity, a coverage determination against the rules that apply, production provenance, component origin down to a bill-of-materials origin schedule, corporate provenance, software and firmware provenance, evidence quality and retention, and an officer's attestation. Under Profile BA the schedule is extended by a component cost worksheet prepared under the 2 CFR 184.5 instructions. Gatewell Protocol, Version 1.0, Part IV and Annexes A and B; Profile BA, sections BA.5.4 and BA.7.1.
The recipient's own review record, dated: who examined the file, when, and against which questions. For Buy America the questions are the scope, the category and the cost worksheet under Profile BA; for Section 889, the carrier, the producer and the screen under Profile S889; for the Covered List, the fourteen questions of the buyer's kit questionnaire.
Retention. Three years from the date of submission of the final financial report, or longer while an audit, a claim or litigation is open; for equipment records, three years after final disposition. 2 CFR 200.334(a) and (c).

A file built this way lets a finding point at a document that is missing, lapsed or out of date, rather than at an opinion about a signature.

Buy America

For Build America, Buy America, the scope and the arithmetic.

The test for a manufactured product is manufacture in the United States and a domestic component cost greater than 55 percent of the total cost of all components, unless another standard is set by law or regulation, computed under the 2 CFR 184.5 instructions. Profile BA applies the file to that test: a scope determination under OMB Memorandum M-24-02 (consumed in, incorporated into or affixed to the project), a single-category classification under 2 CFR 184.4(e) and (f), and a component cost worksheet that carries the 184.5 figures, so the 55 percent can be re-added from the file rather than taken from the certificate. A component whose origin the file does not establish is excluded from domestic component cost.

The part 184 test is not the domestic end product test of 48 CFR 25.101(a), which the FCC's National Security Determinations use to define “foreign-produced” and which stands at 65 percent for items delivered through 2028. One file can serve both; the schedule states which documents evidence which regime.

Source: 2 CFR 184.3, 184.4(e) and (f), 184.5; OMB M-24-02 at 4; 48 CFR 25.101(a); FCC National Security Determination on advanced robotic devices, July 27, 2026; Profile BA, sections BA.2 to BA.5 and BA.7.

Section 889

For Section 889, who produced it.

The test is who produced the equipment, not what share of it came from where. Profile S889 records which carrier applies, the FAR clause or 2 CFR 200.216, the producer's identity for each item, and the covered-entity screening behind the representation or the certification, so the representation has a file behind it. The FAR defines the “reasonable inquiry” that precedes a representation as one that excludes the need for an internal or third-party audit; the file is what that inquiry produced.

Source: 48 CFR 52.204-25(a); 2 CFR 200.216(a) and (e); Profile S889, sections S889.3 and S889.5 to S889.7 (Annex E as modified by S889.6).

Questions auditors ask

Does the Protocol prescribe the recipient's monitoring file?

No. The Protocol specifies the manufacturer's file and says nothing about a recipient's administration of its award. The five-part file above is a recipient's file that holds the manufacturer's file; the rules cited beside each part are its source.

Source: Profile BA, section BA.1.2; Gatewell Protocol, Version 1.0, section 1.2.

Is a manufacturer's certificate alone a finding?

The Supplement does not say so. Procedure 8.a asks for documentation that the recipient monitored compliance. A certificate is evidence that the requirement was flowed down and answered; what stands behind it is a separate question, and whether a certificate alone is adequate is the auditor's judgment under the procedure.

Source: 2025 Compliance Supplement, Part 3, section I, at 3.1-I-6.

Does a Section 889 test appear in the Compliance Supplement?

Not as a generally applicable procedure. Part 3 contains no test for 2 CFR 200.216; the requirement appears in the Part 2 matrix and in program-specific text. The certification is made by accepting the award.

Source: 2025 Compliance Supplement, Parts 2 and 3; 2 CFR 200.216(e).

Can an audit office refer to the Protocol before anyone adopts it?

Nothing in the licence stands in the way. The Protocol is published under CC BY 4.0, and the clause language and the questionnaire in the buyer's kit are dedicated to the public domain under CC0, so the words “an origin-evidence file at a stated level under the Gatewell Protocol, or an equivalent documented method” can be quoted in a monitoring procedure or a management letter without permission. Whether to write them in is a judgment under the auditor's own professional standards.

Source: Gatewell Protocol, Version 1.0, licence terms; buyer's kit, licence statements for the clause text and the questionnaire.

Comment on the draft.

Version 1.0 is a public comment draft through October 31, 2026. Comments from audit offices and single-audit practices go to protocol@gatewellgroup.com; the comments page sets out the questions open for comment.