Verification is the part of the network someone will inspect
When a program runs through hundreds of community providers, the government is trusting the lead organization's word that every one of them exists, is allowed to take federal money, holds the licenses the work requires, is insured, and can do what it said it could. Verification is how that word becomes evidence. Done well, it is a repeatable workflow with a file per partner that a monitor can open and follow. Done badly, it is a folder of emailed attachments, half of them expired, and a team rebuilding the record the week before a site review.
The difference is not effort. Teams with messy records often work harder than teams with clean ones. The difference is deciding up front what each check proves, where the evidence comes from, who signs off, and when it has to be done again.
What verification has to prove
Every check in the workflow answers one of six questions. Keep the questions in front of the team, because a check that answers none of them is paperwork, and a question with no check behind it is a gap.
- It exists. The organization is a real legal entity in good standing, at the address it gave you.
- It is eligible. It is registered where the program requires and is not suspended, debarred or otherwise excluded.
- It is qualified. It holds every license, certification or accreditation the service requires, and they are current.
- It is protected. It carries the insurance the agreement requires, and the coverage runs through the period of service.
- It is able. It has the staff, space, hours and systems to serve the number of people it committed to.
- It is safe. Where the program requires it, the people who will work with participants have been screened.
The workflow, phase by phase
Run every partner through the same sequence, with the same evidence standard, regardless of size or reputation. Exceptions made for well-known organizations are the ones that show up in audit findings.
Verifying One Partner
Illustrative durations. Most of the elapsed time is waiting on the partner's documents, not doing the checks.
Run the desk checks before asking the partner for anything beyond the profile form. They cost nothing but staff time, and they catch the organizations that should not go further before anyone spends a site visit on them. A dissolved corporation or an active exclusion ends the process on day two.
Legal entity status and tax status
Start with the Secretary of State, or the equivalent office, in the state where the organization is incorporated. The business entity search shows whether it exists, its exact legal name, its status, and its registered agent. Save the result. For partners that will receive meaningful funds, ask for a certificate of good standing, which the same office issues.
Match the legal name everywhere. The name on the agreement, the insurance certificate, the bank account and the registration should all be the same entity. A mismatch is often innocent, such as a program operating under a parent organization's name, but it has to be resolved and documented before payment, because it determines who is legally responsible for the work.
For nonprofits, check tax-exempt status with the IRS Tax Exempt Organization Search, which also shows recent annual filings and whether exemption has been revoked. One exception matters for networks that include congregations: churches are not required to apply to the IRS for recognition of exemption or to file the annual return, so many have neither a determination letter nor a filing history. Decide in advance what alternative evidence your program will accept, so a verifier does not reject a 60-year-old congregation for lacking a document it was never required to have.
Registration and the exclusions check
What SAM.gov registration a partner needs depends on its role. An organization that receives federal funds directly needs an active registration. A subrecipient under a federal award generally needs a Unique Entity ID, which it can obtain in SAM.gov without completing a full registration, unless the award terms ask for more. Confirm the requirement with whoever administers the award, write it into the onboarding packet, and record the UEI in the partner file. For partners with full registrations, record the expiration date, because registrations must be renewed every year and lapse quietly.
Every partner that will receive federal funds gets an exclusions check before the agreement is signed. Federal suspension and debarment rules require a lead organization to confirm that a lower-tier participant in a covered transaction is not excluded, and searching the exclusions records in SAM.gov is the most direct way to do it. Search the organization and its principals, by name and by UEI where you have one, and save the result with the date.
Programs that touch health care funds add the HHS Office of Inspector General's List of Excluded Individuals and Entities, and many states keep their own Medicaid exclusion lists. Rerun exclusions checks on a schedule rather than only at onboarding. An exclusion can be added at any time, and the lead organization learns about it only by looking.
Licenses, accreditations and insurance
List, per service type, exactly which licenses or certifications the work requires, then verify each one at the issuing board's public lookup rather than from a copy the partner sends. A photocopy shows a license existed. The board's lookup shows it is current and whether there are disciplinary actions. Where a program requires accreditation from a named body, check that body's public directory the same way.
Insurance arrives as a certificate of insurance, a one-page summary issued by the agent. Read it against the agreement: the named insured matches the legal entity, each required coverage type is present at the required limit, the policy dates cover the service period, and the lead organization is named as additional insured if the agreement requires it. A certificate is evidence of coverage, not the policy itself, and it states that it confers no rights. For higher-risk services, ask for the additional insured endorsement too, and call the issuing agent if anything looks altered.
Youth-serving and in-home services often call for coverage that general liability policies exclude, such as abuse and molestation coverage. Name it explicitly in the agreement if the program needs it, because many small organizations do not know whether they have it until someone asks.
Capacity attestations and site visits
A capacity attestation is a short signed form in which the partner states its staff serving the program, its locations and hours, the languages it serves in, its accessibility, and the number of participants it can serve per month. Make it specific enough to check. "We can serve the community" cannot be verified. "Two case managers, 30 participants a month, Tuesday through Saturday at the address above" can.
Then check it. A site visit confirms the location exists, is accessible, is open when the attestation says, and has the private space the service requires. For a network spread across hundreds of locations, in-person visits to every site at onboarding are often impractical, and a structured virtual visit works for most of them: a scheduled video call in which the partner walks the camera through the space, shows where records are kept, and introduces the staff who will serve participants. Reserve in-person visits for higher-risk services, large funding amounts, and any partner where something in the desk checks did not line up.
Use a written visit protocol with the same items every time, and have the visitor record what they saw rather than impressions. "Private office with closing door, locked file cabinet, ramp at side entrance" is evidence. "Nice facility" is not.
References and background checks
Call two references who have funded or worked closely with the partner in the last few years, and ask the same four questions each time: what the partner did for them, whether it delivered what it committed to, how it handled a problem, and whether they would work with it again. Write down the answers. References rarely surface disqualifying information, but they often surface the one operational weakness worth planning around.
Where the program requires background checks on staff or volunteers, the partner usually runs them on its own people as the employer, and the lead organization verifies that it did. Collect the partner's written screening policy, a signed attestation that every person serving participants has been screened under it, and the right to review a sample of records. Fingerprint-based checks go through the state's designated agency; the Justice Department's national sex offender public website is a free name search many programs add for work with children. Where a partner uses a commercial screening company for employment purposes, federal consumer reporting law requires a written disclosure and the person's authorization first, which the partner's policy should cover.
The verification file for each partner
Every verified partner has one file, structured the same way, holding the evidence for each item below with the date, the source and the name of the person who checked it.
- Legal entity search result, and a certificate of good standing where required
- Tax-exempt status lookup, or the accepted alternative evidence for a congregation
- UEI and SAM.gov registration status, with the expiration date where registered
- Exclusions search results for the organization and its principals, dated
- License and accreditation lookups from the issuing body, with expiration dates
- Certificate of insurance and any required endorsements, with policy end dates
- Signed capacity attestation
- Site visit record on the standard protocol, with date, method and visitor
- Reference call notes for two references
- Background screening policy and signed attestation, where the program requires screening
- Reviewer sign-off and second reviewer approval, with the decision and any conditions
Re-verification: what to repeat, and how often
Verification is not a one-time gate. Licenses expire, insurance renews, registrations lapse, and organizations change. Every check gets a cadence, and the cadence goes into the tracker as a date, not a policy statement.
| Check | Source | Repeat |
|---|---|---|
| Legal entity status | Secretary of State business search; certificate of good standing | At onboarding, then annually |
| Tax-exempt status | IRS Tax Exempt Organization Search, or accepted alternative evidence | At onboarding, then annually |
| UEI and registration | SAM.gov entity search | At onboarding, and before each registration expiration date |
| Exclusions | SAM.gov exclusions; HHS OIG list and state lists where health funds are involved | Before each agreement or amendment, plus a scheduled batch rerun, monthly or quarterly |
| Licenses and accreditation | Issuing board or accrediting body lookup | At onboarding, at each expiration date, and a periodic check for disciplinary action |
| Insurance | Certificate of insurance and endorsements | At onboarding and at every policy expiration |
| Capacity | Signed attestation compared with actual service data | Annually, and whenever staff or locations change |
| Site visit | Standard protocol, virtual or in person | At onboarding, then a risk-based sample each year |
| Background screening | Partner policy, attestation and sample review | Annual attestation, and screening for every new person serving participants |
The tracker that makes it work at scale
Hundreds of partners times a dozen checks each is thousands of dated items, and a spreadsheet maintained by hand breaks down long before the network reaches that size. The tracker does not need to be elaborate, but it does need a few things. One record per partner with every check as its own row, holding status, evidence link, checked date, checker and next due date. Alerts at 60 and 30 days before any expiration, sent to the partner and the assigned verifier. A dashboard that lists every partner with anything expired or overdue, which is the first screen the team opens each morning.
Tie the tracker to payment. A partner with an expired insurance certificate or an unresolved exclusions hit is placed on hold automatically until the item is cleared. That one rule does more for compliance than any reminder email, because it gives the partner a reason to send the renewal the day it arrives.
Automate the lookups that offer a public interface, such as registration and exclusions checks against SAM.gov's public data, and keep a person in the loop for every match. Name-based exclusion searches return false matches on common names, and deciding whether "J. Smith" on the list is your partner's board treasurer is a human judgment that has to be recorded.
An audit trail the government can inspect
A monitor reviewing the network will pick a sample of partners and ask to see how each one was verified. The file should answer without anyone explaining it. For every check, that means a saved copy of what the verifier saw, a screenshot or exported PDF of the lookup with the date visible, not a note that says "checked SAM, clear."
An audit trail is the verification itself, written down so a stranger can repeat it.
Four properties of a file that holds up
It is complete: every required check is present or has a documented reason it does not apply. It is dated: each item shows when it was checked, and nothing was current only on the day of the review. It is attributable: each item names the person who checked it and the reviewer who approved the decision. It is unaltered: documents are stored as received, corrections are added as new entries rather than overwrites, and the tracker keeps its own change history.
Keep decisions in the file too, including the hard ones. When a verifier approved a partner with a condition, or overrode a name match on the exclusions list, the reasoning belongs next to the evidence. Those are the entries a monitor reads most closely, and a written rationale from the time is worth far more than an explanation reconstructed later.
Frequently asked questions
It depends on the partner's role and the award terms. An organization receiving federal funds directly needs an active registration. A subrecipient generally needs a Unique Entity ID, which can be obtained in SAM.gov without a full registration, unless the award asks for more. Contractors providing a purchased service follow different rules. Confirm the requirement with the award's administrator and write it into the onboarding packet.
Before every new agreement or amendment, and on a fixed schedule in between. Many programs choose a monthly or quarterly batch rerun across the whole network. The right interval depends on program risk and award terms, but checking only at onboarding leaves the lead organization unaware of any exclusion added afterward.
For many services, yes, when it follows a written protocol: a scheduled video walk-through of the space, the records storage, and an introduction to the staff who will serve participants. Keep in-person visits for higher-risk services, larger funding amounts, and any partner whose desk checks raised a question. Record the method used for each visit in the file.
Usually the partner, as the employer of its staff and volunteers. The lead organization verifies the partner did it: a written screening policy, a signed attestation that everyone serving participants was screened under it, and the right to review a sample of records. The program's own requirements decide which checks apply to which roles.