The Country's Checkbook

Think about your checking account.

You know who can touch it. Maybe it's just you. Maybe one other person. You know roughly what guards it — a password, a daily limit, a text message when something large goes through. If money left for somewhere it shouldn't, you'd know, and you could say who, and when, and possibly why. The account is small enough to hold in your head. That's not a small thing. That's what control feels like when it's working: you can always answer the question what happened to the money.

Now make the account the size of a country.

Not a metaphor — the actual one. The federal government gives money away, by design, as a function of how the country works. To states, to counties, universities, clinics, tribal nations, and to the nonprofit two towns over running an after-school program out of a church basement. Thousands of programs. Millions of hands that can, lawfully, move the money. And the same question still has to have an answer: what happened to the money. For every dollar. Used as intended, by someone authorized, and you can prove it later.

Hold that question, because everything after this is people trying to answer it. We've gotten astonishingly far.

1977 — the people who didn't have a word for it

Here's the strange place they had to start.

The country was already giving money away at scale. What it didn't have was an agreed-upon word for what kind of giving any particular instance was. When the government handed money to a university, was it buying something — a contract, where you specify what you want and they deliver it? Or was it funding the university to go do something it was already trying to do — a grant, where you support the work and stay mostly out of the way? Or something in between, where the government wanted to stay in the room, hands-on, as the work unfolded?

It sounds like a vocabulary problem. It was a control problem. The answer determines everything that follows — who's accountable, what rules attach, what you're even allowed to ask for later. You cannot build a control around a thing you can't name. And the same dollar, called by the wrong name, came with the wrong rules, the wrong expectations, the wrong proof.

So in 1977 they did the unglamorous, foundational thing. They drew the lines. Contract, grant, cooperative agreement — defined, with criteria, so the country could at least say what kind of giving this is before arguing about how to control it. The line between a grant and a cooperative agreement came down to a single idea: substantial involvement — how much the government stays in the room.

That's the first handoff. They named the thing. They could not yet say how to guard it. That problem they set down for the people who came next.

1982 — the duty to guard

Naming the money was one thing. Keeping it was another.

A name doesn't tell you whose job it is when the money goes wrong. You can define a grant perfectly, draw the cleanest possible line between it and a contract, and still have no answer to the simpler question a taxpayer would ask — who was supposed to be watching? A definition assigns a category. It doesn't assign a duty.

So the next thing the architects did was make the watching itself an obligation. The Federal Managers' Financial Integrity Act of 1982 put it on the managers — not on an inspector who arrives later, not on an auditor two years downstream, but on the people running the programs while the money was moving. Establish internal controls. Safeguard the funds against waste and misuse. Account for the assets. Not try to. Be able to — the capability itself became the requirement.

It's a quietly radical move. The duty isn't to spend the money correctly; that was always the duty. The new duty is to be in a position to show you did — to carry, inside the program, the machinery that makes the spending answerable. Control stops being something done to a program from the outside, at audit time, and becomes something a program is required to possess from the inside, the whole time.

And that's where the next problem opens, the moment you take the duty seriously. A manager running one program, a handful of transactions, can hold that — can watch it, can show it. But the country wasn't running one program. It was running hundreds, every one now owing the same duty to safeguard and account, and there is no version of watch all of it that a person, or a building full of people, can do by looking at every dollar.

They had made the watching a duty. They had not found a way to watch at the scale they'd just obligated everyone to. That they set down for the people who came next.

The 1980s — inspect the risk, not the transactions

The answer, when it came, was a change of subject.

If you cannot look at every dollar — and you cannot — then looking at dollars is the wrong instinct entirely. You look instead at the conditions that make dollars go wrong. Where is the money concentrated. Where are the controls thin. Who has done this before and who is doing it for the first time. You spend your limited attention where the danger is, and you accept that you will never see most of the transactions, because seeing most of the transactions was never possible and pretending otherwise just meant seeing none of them well.

The Single Audit Act gave this a shape: instead of auditing each federal award to an organization separately, audit the organization once, against the whole of what it received, and aim the scrutiny by risk. The federal internal-control standards gave it a spine — a shared definition of what a control even is, so that "safeguard the funds" stopped being a sentiment and became something with parts you could point to.

This is the move the whole system still rests on. Risk-based oversight is how a country-sized account gets watched by a human-sized workforce. It is genuinely elegant, and it was genuinely right.

But risk assessment, done as a living thing, is enormous work — the kind that has to be planned, researched, walked through in the field. Done well it is generative: get the assessment right and the conclusions almost write themselves, the way a properly worked audit leaves you with the report mostly drafted before you sit down to type it. Done as a chore it collapses into a snapshot — a form you fill out once, file, and never look at again. The architects had introduced risk as the organizing idea. They had not yet built it as a posture, something continuous; for decades it would mostly be practiced as a photograph. That gap they set down, and it stayed down a long time.

The late 1990s — the weave

By the late nineties there were more than six hundred federal assistance programs, and the rules to govern them were not in one place. They were scattered across a shelf of OMB circulars, and which ones applied to you depended on what kind of organization you were and what kind of cost you were incurring.

A single grant could pull in four or five documents at once. One circular for the state agency that received the money. A different one for the university that received it next, because higher education had its own cost principles. Another for the audit. The procurement regulations for the piece that flowed down to a commercial contractor. And cost was split from administration, so the cost rules and the administrative rules lived in separate circulars even within a single kind of organization — which is how four becomes six without anyone intending it to.

The way you learned this was by living in it. You opened the circulars side by side, and you cross-referenced, section against section, and the first thing you noticed was that a great deal of it was the same — the same requirement, restated, document to document. The easy conclusion is that this is bloat. The conclusion you reach only after days inside it is that it is woven: the repetition is the regulation making sure that no matter which door you came in — state agency, university, auditor, contractor — the requirement met you there. Spend enough time and you stop hunting and start navigating. You know your way around. It reads less like a thicket and more like an old neighborhood where you know which streets connect.

There is a reason the layering cannot simply be deleted, and it is not sentiment. A control system has to carry at least as much complexity as the thing it controls. You cannot govern a country-sized account with rules simpler than the country. The layers are the price of the scale. The architects of the nineties hadn't failed to simplify; they had built something exactly as intricate as the job required. What they had not done — what no one could yet do — was make that intricacy navigable for the people who hadn't spent days inside it. Most people never get to the neighborhood. They open three circulars, find the same thing in all three, and set the whole stack down.

2013 — the consolidation

So the next generation pulled the shelf into a single book.

The Uniform Guidance gathered the scattered circulars into one place: the administrative requirements, the cost principles, and the audit requirements, for every kind of organization, between two covers. It was carried into the world as burden relief, and it was — real relief. The duplication that someone had once reconciled by hand was now reconciled in the text. You no longer had to hunt for the right document and then check it against the other three. The right thing was in one location.

But notice precisely what consolidation can and cannot do. It can remove the copies — the same requirement restated across six circulars becomes the requirement, stated once. It cannot remove the layers, because the layers were never duplication. The reason a cost has to satisfy several conditions at once isn't that someone forgot to delete a paragraph. It's that the cost genuinely sits inside several jurisdictions at once. Consolidation de-duplicated. It did not — could not — de-layer.

Which means the relief had a ceiling, and the ceiling was built into what a regulation is. A regulation can tell you, in one clean place, everything a cost must satisfy. It cannot be the thing that satisfies it. The architects had given the field one book instead of six. The work of actually carrying all of it, on every cost, in real time, still belonged to whoever was spending the money.

2024 — the continuum

And here, four decades on, someone picked up the baton the 1980s had dropped.

The 2024 revisions came with a rename — the guidance for grants and agreements became the guidance for federal financial assistance, a quiet admission that the rules had always reached further than the word "grants" let people see. But the rename is residue. The substance was in the reshaping: cost sharing simplified, prior approvals loosened, construction work distinguished from the rest — and, at the center, risk reframed. Not a snapshot. A continuum. The language turned the risk assessment from a document you produce once into a posture you hold continuously, which is what the 1980s had meant all along and never quite said.

This is the turn, if there is one. Risk done as a living, continuous thing is the generative kind — the kind where the watching produces the answer instead of checking for it afterward. The architects of 2024 finally put life into the thing their predecessors had only been able to name.

What's still in the air

So here is the system, fifty years on, told honestly. The country named its instruments. It made the watching a duty. It learned to watch by risk instead of by transaction. It wove rules intricate enough to match the scale, then gathered them into one book. It turned risk from a photograph into a posture. Every generation completed something real and set down exactly one thing for the next.

What's left in the air is small to state and heavy to hold.

A cost is allowable only if it meets all of its conditions at once. The regulation lists them — the cost must be necessary, reasonable, consistently treated, conforming to federal and state and local and program limits — and among them sits one that surprises people: the cost must be adequately documented. Not documented afterward, for the auditor. Documented as a condition of being allowable at all. You can satisfy every other factor perfectly, and if it isn't written down, the cost is unallowable. The record is not a description of the control. The record is the control, and it has to exist at the moment the decision is made.

Stack that against the scale, and the shape of the remaining thing comes clear. Every dollar, across thousands of programs and millions of hands, has to be answerable in real time, against several layers of rule at once, with the answer captured as it happens rather than reconstructed two years later from email and memory and a departed employee's files. That is not a thing a person can do by attention. It is barely a thing a building of people can do. It has become so hard, so universally, that not-quite-doing-it has quietly settled in as the floor — the normal condition, the thing everyone is a little out of compliance with, together, all the time.

The regulation is not the failure here. The regulation is one of the most remarkable control systems any society has ever built, intricate exactly in proportion to the impossibility of the job, and its authors did not stint. What it cannot do — what no regulation can do, by its nature — is be the thing that carries it. A regulation can state, with total precision, everything that must be true at the moment of a decision. It cannot be present at the moment of the decision. It cannot hold the layers for you, or write the record as the choice is made, or keep the risk posture continuous between the audits.

That would take a system.

If you don't have one — and most don't — you already know where you're standing.