(1) A recipient must have procedures to audit subrecipients for compliance with the terms and conditions of its contract with the subrecipient.

(2) The audit methodologies must be sufficient for a reasonable person to conclude a subrecipient is compliant with requirements in the data sharing agreement.