This site is best experienced in a newer version of your browser. Please take a few seconds to upgrade your browser.

Through a cooperative agreement between BJA and NCCD

Audit and Compliance

1. What information is forthcoming on the audit?

Click here for the latest information on audits.

Last updated March 14, 2013.


2. Does my agency have to audit exactly one third of its facilities each year? We are on an ACA audit schedule and ACA does not audit exactly one third of our agencies per year. Do we need to change the auditing schedule to comply with PREA?

Standard 115.401 discusses the audit frequency and timeframes and specifies that the agency shall ensure that each facility operated by the agency, or by a private organization on behalf of the agency, is audited at least once during each three-year period. The standards require an audit during each one-year period of at least one third of each facility type (prison, jail, juvenile facility, overnight lockup, and community confinement facility) operated by an agency, or by a private organization on behalf of an agency. DOJ is still determining potential coordination between ACA audits and PREA audits; in the future, the PREA and ACA audits may work in tandem. However, regardless of any such coordination, agencies must audit one third of each type of facility as specified in Standard 115.401 (b), irrespective of the timing of any ACA audit schedule.

Last updated February 7, 2013.


3. What is the minimum period of time, prior to the start of an audit, that an agency needs to demonstrate compliance with the standards in order to achieve favorable audit findings? For example, if an agency can demonstrate it is in compliance on a specific standard for 30 days prior to the audit, but not the eight months prior to the audit, is the agency considered compliant?

DOJ recognizes that audits conducted toward the beginning of the first audit cycle, which begins August 20, 2013, will take into consideration the fact that facilities will have spent a significant period of time institutionalizing the standards. By contrast, a short period of compliance during the end of the audit review period (meaning closer to August 2014 or thereafter) would not be sufficient to achieve compliance. DOJ is working with the PRC to define specific measures auditors will use to assess compliance. Additional information will be forthcoming soon. Additionally, pursuant to PREA Standard 115.404(d), facilities that auditors find not in compliance with provisions of PREA have an automatic 180-day corrective action period during which auditors will work with agencies to remedy and verify remedial action for any deficiencies. This process provides additional time for facilities to achieve compliance before the auditor issues a final audit determination.

Last updated March 14, 2013.


4. Please provide recommendations for identifying an auditor while maintaining appropriate independence from the state criminal justice department. What role, if any, should the state criminal justice department play in identifying the auditor? Will the DOJ publish a list of certified PREA auditors?

Prospective auditors will apply to be PREA-certified auditors. Only DOJ can certify auditors. In order to be certified, auditors must 1) meet a number of qualifications; 2) submit to a criminal records background check; and 3) pass DOJ-developed auditor training. DOJ holds auditor trainings approximately every other month throughout calendar year 2014. For exact dates click here. A complete list of PREA-certified auditors is maintained publicly on the PRC website here.

DOJ has not placed restrictions on how agencies choose auditors. Each agency should develop its own process, consistent with PREA Standard 115.402, which provides that 1) the auditor cannot be part of, or under the authority of, the agency (but may be part of, or authorized by, the relevant state or local government); 2) an auditor cannot be a person who has received financial compensation from the agency being audited (except for compensation received for conducting prior PREA audits) within three years prior to the agency’s retention of the auditor; and 3) the agency cannot employ, contract with, or otherwise financially compensate the auditor for three years subsequent to the agency’s retention of the auditor, with the exception of contracting for subsequent PREA audits.

Last updated March 14, 2013. 

 

5. What constitutes “overnight” for purposes of PREA Standard 115.193, which states that “[a]udits need not be conducted of individual lockups that are not utilized to house detainees overnight?”

As a general matter, the term “overnight” is construed as a period of seven or more continuous hours between 8:00 p.m. and 8:00 a.m. In situations where the facility has only a remote chance of meeting the above time period threshold, or does so only in rare circumstances (less than one time per month on average), the facility will not be considered “overnight.”

Last updated March 26, 2014


6. How long must the documents that auditors relied on for making audit determinations be retained?

These documents must be retained for 12 months following the deadline for any agency audit appeal. Because audit appeals must be lodged within 90 days of the auditor’s final report, auditors must retain these documents for 15 months following the issuance of the final audit report. Longer document retention may be required in particular instances if so requested by the US Department of Justice.

Last updated March 26, 2014


7. Can PREA auditors engage support staff to assist with completing PREA audits? 

PREA auditors may employ staff to provide assistance, including conducting interviews, but the DOJ-certified auditor is ultimately responsible for the final audit. In addition, the certified auditor is required to be present for, and supervise, the entirety of the on-site portion of the audit; to be the counterparty in an agency’s contractual engagement for the conduct of the audit; and to sign and certify the interim and final audit reports.  Failure to adequately supervise such support staff could have consequences for the responsible auditor, up to and including decertification by the Department of Justice.  

Last updated December 5, 2013.


8. Do any of the conflict rules governing who can conduct an audit of a given agency’s facilities apply to the staff they hire to help them conduct that audit?

The same restrictions regarding auditor conflict of interest also apply to staff who auditors hire to help conduct the audit.  Consistent with PREA Standard 115.402: 1) the auditor cannot be part of, or under the authority of, the agency (but may be part of, or authorized by, the relevant state or local government); 2) an auditor cannot be a person who has received financial compensation from the agency being audited (except for compensation received for conducting prior PREA audits) within three years prior to the agency’s retention of the auditor; and 3) the agency cannot employ, contract with, or otherwise financially compensate the auditor for three years subsequent to the agency’s retention of the auditor, with the exception of contracting for subsequent PREA audits.

Last updated June 11, 2014


9. Is reciprocal auditing conducted by employees of two confinement agencies permissible?

An auditor who is employed by one correctional agency may not conduct an audit of another correctional agency if an auditor employed at the time by the latter agency has concluded an audit of the former agency within the prior twelve months.

Last updated July 9, 2013.


10. I understand that reciprocal auditing is not permitted, but what about “circular auditing?”

Circular auditing, in which a consortium of three or more States, or three or more local jurisdictions, agrees to perform audits at facilities in other consortium States, is permissible, with a few caveats. First, the circular auditing schedule must be developed so that no audits would be considered impermissible reciprocal audits (see FAQ #9 under Audits and Compliance section of FAQ).  Second, no audits can be allowed in cases in which the auditor’s agency contracts for space in the facility being audited.  

Last updated December 5, 2013.


11. Should an auditor’s final report reflect deficiencies that were found in the interim report and actions taken to correct them during the corrective action period? 

Auditors are required to submit a report to the audited agency within 30 days of completion of an on-site audit.  It is expected that if an auditor determines that a facility does not meet one or more of the standards, this report will be considered an “interim report,” triggering a 180-day corrective action period, and the auditor will include in the report recommendations for any required corrective action and shall jointly develop with the agency a corrective action plan to achieve compliance.  The auditor is required to “take necessary and appropriate steps to verify implementation of the corrective action, such as reviewing updated policies and procedures or re-inspecting portions of a facility.”  At the completion of the corrective action period, the auditor has 30 days to issue a “final report” with final determinations.  Section 155.404 (d) states that, “After the 180-day corrective action period ends, the auditor shall issue a final determination as to whether the facility has achieved compliance with those standards requiring corrective action.”  The final report, which is a public document that the agency is required to post on its web site or otherwise make publicly available, should include a summary of the actions taken during the corrective action period to achieve compliance.

Last updated April 23, 2014


12. What are the financial consequences to a state if it is not in compliance with the standards?

The PREA statute provides that a state whose governor does not certify full compliance with the standards is subject to the loss of five percent of any DOJ grant funds that it would otherwise receive for prison purposes, unless the governor submits an assurance that such five percent will be used only for the purpose of enabling the state to achieve and certify full compliance with the standards in future years. 42 U.S.C. § 15607(e). For more information on the certification process, click here to access the letter sent from the Department of Justice to all state governors.

Last updated March 14, 2013.


13. At what stage in the audit process is an audit considered complete for the purposes of meeting the requirement that one-third of an agency’s facilities be completed by the end of each year in the auditing cycle?

For the purpose of the PREA standards, the audit is considered complete upon issuance of the initial audit report or 30 days after the conclusion of the audit’s on-site visit to the facility, whichever one comes first.

Last updated June 20, 2014.


14. Can an auditor find a federal Bureau of Prisons, state, county, or other local or private facility compliant with the PREA standards if an entity external to the confining agency, which conducts criminal investigations of sexual abuse in the facility being audited, is not compliant with the external investigative entity’s obligations under § 115.21, § 115.22, § 115.34, and § 115.71?

Yes, provided that the confining agency and facility being audited has met its own specific obligations under these standards. For example, § 115.21(f) requires the confining agency to request that the relevant external investigating entity follow the PREA standards regarding a uniform evidence protocol and forensic medical evaluations.

The four PREA standards referenced above explicitly apply to DOJ and state entities that are responsible for investigating allegations of sexual abuse in adult prisons, jails, lockups, community corrections facilities, and juvenile facilities. See, §§ 115.21(g)(2), 115.22(e), 115.34(d), and 115.71(k)&(l).

Last updated April 23, 2014.


15. What happens to an agency’s three-year audit timeline if an agency fails to have the required minimum of one-third of its facilities audited by August 19, 2014? 

The standards require generally that an agency must have “at least one-third” of its facilities audited during each one-year period, which began on August 20, 2013; and that all facilities must be audited by the conclusion of each three-year period, which began on the same date.  See 28 C.F.R. § 115.401(a)&(b). Compliance with the audit timeline is evaluated both on a year-to-year basis and at the conclusion of the three-year audit cycle.  Failure to comply with the audit timeline during the initial year of an audit cycle does not preclude compliance during years two and three of an audit cycle.  Similarly, failure to comply with the audit timeline during the first two years of an audit cycle does not preclude compliance during the final year of each audit cycle.  It is important to note that, for purposes of complying with § 115.401(a) (requiring audits of each facility during the three-year audit cycle), agencies must ensure that each facility is audited at least once by August 19, 2016, and during every three-year anniversary thereafter. 

a. By way of hypothetical, what happens if an agency has seven facilities but receives no audits by the conclusion of the first year of the first audit cycle (by August 19, 2014)?

The agency would not be fully compliant with the PREA standards as of August 20, 2014. However, the agency may still become fully PREA compliant during the second year and the third year of the audit cycle. For purposes of the audit cycle, compliance is determined during each specific audit cycle year. So if this agency obtains three facility audits (at least one-third) between August 20, 2014 and August 19, 2015, then the agency would be PREA compliant with the audit cycle during that year.

During the final year of the audit cycle (ending August 19, 2016), however, the agency would be required to have all four remaining facilities audited. This is because an agency has a separate obligation under the standards to ensure that “each facility” must be audited “at least once” during the three-year audit cycle (concluding on August 19, 2016). See 28 C.F.R. § 115.401(a).

b.  As another hypothetical, what happens if an agency has only one facility but receives no audit by the conclusion of the first year of the first audit cycle (by August 19, 2014)?

Because the standards require that an agency have “at least” one-third of its facilities audited during each year of the three-year audit cycle, an agency with a single facility is required to receive an audit during the initial year of the audit cycle to be compliant as of August 19, 2014.  In other words, an agency with a single facility cannot be said to have had at least one third of its facilities audited by August 19, 2014, if it has had no facility audits.  However, a single-facility agency could become fully compliant at any point during the remainder of the three-year audit cycle (concluding on August 19, 2016) subject to a successful audit of that facility.  So for example, a single-facility agency that is not compliant as of the conclusion of the first year of the audit cycle because it had received no audits by August 19, 2014, could nevertheless become fully compliant with the audit standards if it receives an audit one month later (early in the second year of the audit cycle) and would remain compliant with this standard through the remainder of the first audit cycle.

Last updated April 23, 2014.


Search the PREA Library for Articles and Resources:

Sign Up for Updates

The PREA Resource Center will provide information on upcoming events, new resources to our library, and PREA-related issues in the news. Sign up to receive our communications via email.

signup