March 18, 2015
Q.

How long must an agency and facility be in compliance with a particular standard or provision before an auditor should find that a facility meets a standard?

A.

A demonstrated record of sustained compliance with a standard during the one-year period preceding the audit will be sufficient to demonstrate audit compliance. Shorter periods of compliance may or may not result in an auditor’s finding of meets or exceeds a standard subject to the guidance below.

In general, auditors will need to see that compliance with a particular standard has become “institutionalized” at the facility. That is to say that a “quick fix” on the day of an on-site tour should almost never be sufficient for the auditor to find compliance. A short period of compliance during an otherwise sustained period of noncompliance should generally result in a finding of “does not meet standard.” By contrast, a discrete period of noncompliance during a period of otherwise sustained compliance should not, by itself, result in a finding of “does not meet standard.” The length of time required to demonstrate sustained compliance will depend upon the requirements of the individual provision being assessed. In any event, the auditor should be provided with sufficient evidence that the facility’s technical and short-term compliance has been “institutionalized” at the facility.

The following is an example of institutionalization: If a facility or an auditor determines that a new external reporting mechanism is required to comply with standard 115.51(b), the mere creation of a satisfactory avenue for external reporting will effect several other standard requirements. The auditor may determine that the new external reporting mechanism should be included in the written policies outlining the agency’s approach to preventing, detecting, and responding to sexual abuse. See 28 C.F.R. § 115.11(a). The auditor may determine that employees, contractors, and volunteers need to be trained on the new reporting mechanism. See 28 C.F.R. §§ 115.31 and 115.32. This will generally require modification, approval, and implementation of the training curriculum. Inmates must receive information on the new reporting mechanism during intake and as part of the 30-day comprehensive inmate education. See 28 C.F.R. § 115.33. The auditor may determine that the inmate education curriculum must be modified, approved, and implemented before these requirements are satisfied. Further, because existing inmates had not been previously provided with comprehensive inmate education setting forth an appropriate avenue for external reporting, all inmates must be informed of the new reporting mechanism. See 28 C.F.R. § 115.33(c). If the new external reporting mechanism also serves as the avenue for the facility to receive third-party reports, then the new reporting mechanism must be reflected on the publicly distributed information pursuant to standard 115.54.

It is important to note that, while a facility corrective action period may last for up to 180 days following the auditor’s issuance of the interim audit report, some corrective action will not require the full 180 days to complete and verify. Indeed, minor or technical violations with the standards may be remedied prior to the 30-day deadline for the auditor to issue the interim audit report—if, unlike the example provided above, the standard at issue does not implicate other related standards.

The standards require that each facility be audited at least once during the three-year audit cycle. See 28 C.F.R. § 115.401(a). Further, the standards require an auditor to review, at a minimum, a sampling of relevant documents and information for the most recent one-year period. See 28 C.F.R. § 115.401(g). Prior to the start of the first audit cycle, the Department of Justice issued the following guidance on this question:

DOJ recognizes that audits conducted toward the beginning of the first audit cycle, which began August 20, 2013, will take into consideration the fact that facilities will have spent a significant period of time institutionalizing the standards. By contrast, a short period of compliance during the end of the audit review period (meaning closer to August 2014 or thereafter) would not be sufficient to achieve compliance. DOJ is working with the PRC to define specific measures auditors will use to assess compliance. Additional information will be forthcoming soon. See Existing FAQ.

This revised and expanded FAQ includes the “additional information” referenced in that previously issued FAQ.

Standard
Categories
Auditing,
Compliance