Frequently asked questions

Relevant Standard:
(j) The auditor shall retain and preserve all documentation (including, e.g., video tapes and interview notes) relied upon in making audit determinations. Such documentation shall be provided to the Department of Justice upon request.

Existing FAQ:
How long must the documents that auditors relied on for making audit determinations be retained? These documents must be retained for 12 months following the deadline for any agency audit appeal. Because audit appeals must be lodged within 90 days of the auditor’s final report, auditors must retain these documents for 15 months following the issuance of the final audit report. Longer document retention may be required in particular instances if so requested by the US Department of Justice.

This standard clearly establishes that it is the auditor who is responsible for retaining and preserving all documentation relied upon in making audit determinations. This includes both documentation relied upon in finding that a facility does not comply with a standard, as well as documentation relied upon in finding that a facility does meet or exceed a standard. If an auditor fails to comply with this provision, the auditor will be subject to actions that bear on the auditor’s continued DOJ certification status (e.g., retraining, restrictions on a certification, decertification, or denial of application for recertification).

The Department of Justice is in the process of finalizing an Online PREA Audit Instrument that agencies and auditors may choose to utilize for securely retaining the documents and information that could be used to satisfy the auditor’s document retention pursuant to standard 115.401(j). The following guidance is provisional and subject to change once the Online PREA Audit Instrument becomes available and fully functional:

An auditor “retains and preserves” all documentation when: 1) the auditor has the continued ability to identify and access the documentation for 15 months following the issuance of the final audit report; and 2) the auditor can, upon request, provide the documentation to the Department of Justice or direct that the documentation be provided to the Department of Justice.

Auditors will typically review and evaluate documentation in two separate circumstances: 1) off-site, before conducting an audit (and potentially post-audit, if needed) and 2) on-site, during an audit. Each circumstance is discussed separately below.

A. Documents that an auditor receives off-site, either before or after an audit.

The PREA Compliance Audit Instrument Checklist of Policies/Procedures and Other Documents lists many documents and categories of documents that an auditor may request and receive from the facility or agency pre-audit. This checklist is not exhaustive. The PREA standards clearly state that an auditor “shall be permitted to request and receive copies of any relevant documents (including electronically stored information).” 28 C.F.R. § 115.401(i).

An auditor may also receive pre-audit documents from other sources, including inmates or community members. This category of documents is straightforward: An auditor must retain and preserve any documents that the auditor has physically or electronically received outside of an on-site audit for the 15-month retention period referenced above.

An auditor currently has the following options for preserving this documentation:

paper copies or other physical format (e.g., video);

any electronic format in the auditor’s physical control (e.g., documents scanned to a computer, thumb drive, or disc); and

any secure electronic format that is accessible to the auditor (e.g., the forthcoming Online PREA Audit Instrument or other secure cloud-based storage).

In selecting a combination of one or more of the formats enumerated above, an auditor must ensure that he or she will be able to readily identify and access all documentation as needed for 15 months after the issuance of the final audit report, and be able to provide it upon request by the Department of Justice.

B. Documents that an auditor receives or reviews on-site, during an audit.

The PREA Compliance Audit Instrument Checklist of Policies/Procedures and Other Documents also lists many documents and categories of documents that an auditor will review during the on-site audit. To the extent practicable, auditors are encouraged to employ one or more of the methods listed above in A.1-3 to retain and preserve much of the on-site documentation for the 15-month retention period. However, some documentation may be extremely burdensome to physically copy or scan. An auditor may consider contracting with the agency or facility, whereby the agency or facility maintains physical possession of the documentation but allows the auditor continued access to the documentation, if needed, and the agency or facility also agrees to allow the documentation to be provided to the Department of Justice, if the Department requests the documents pursuant to standard 115.401(j).

This latter option raises several issues:

The auditor must have the ability to identify the documentation. As an initial matter, then, the auditor must take and maintain scrupulous notes regarding which documentation he or she reviewed during the audit. For example, the auditor could note “training files of every employee hired during the year 201X” or list the actual names of each employee whose training file the auditor reviewed. By contrast, a note of “reviewed 15 training files” would not be sufficient to identify the underlying documentation.

Once the auditor has ensured that his or her notes sufficiently identify the documentation, the auditor must ensure that, for the entire retention period, he or she has the continued ability to identify the documentation. That is, the auditor must understand the facility or agency’s record-keeping system so that the auditor could readily identify, find, and retrieve the documentation for up to 15 months after submission of the final audit report.

Once the auditor has ensured preliminary and continued identification of the documents, the auditor must ensure that he or she will have continued access to the identified documents during the 15-month retention period. The auditor may choose to ensure his or her continued access to the documentation by adding a clause to the auditing contract requiring the agency to provide the on-site documentation to the auditor and the Department of Justice upon written request with reasonable notice during the 15-month retention period.

Finally, the auditor must ensure that he or she can provide the documentation to the Department of Justice upon request, either personally or by directing the agency or facility to do so within the 15-month retention period. Again, the auditor may accomplish this by adding a contract clause stating that the agency or facility agrees to provide the identified documentation to either the auditor or the Department of Justice.

It is important to note that, regardless of any contractual relationship the auditor may enter into with an agency or facility, it is the auditor who retains ultimate responsibility for his or her compliance with this standard. If an auditor fails to retain and preserve all relevant documentation for the 15-month retention period, or fails to provide the documentation to the Department of Justice upon request, he or she will face actions that could bear on the auditor’s continued DOJ certification status.