What happens to an agency’s three-year audit timeline if an agency fails to have the required minimum of one-third of its facilities audited by August 19, 2014?
The standards require generally that an agency must have “at least one-third” of its facilities audited during each one-year period, which began on August 20, 2013; and that all facilities must be audited by the conclusion of each three-year period, which began on the same date. See 28 C.F.R. § 115.401(a)&(b). Compliance with the audit timeline is evaluated both on a year-to-year basis and at the conclusion of the three-year audit cycle. Failure to comply with the audit timeline during the initial year of an audit cycle does not preclude compliance during years two and three of an audit cycle. Similarly, failure to comply with the audit timeline during the first two years of an audit cycle does not preclude compliance during the final year of each audit cycle. It is important to note that, for purposes of complying with standard 115.401(a) (requiring audits of each facility during the three-year audit cycle), agencies must ensure that each facility is audited at least once by August 19, 2016, and during every three-year anniversary thereafter.
a. By way of hypothetical, what happens if an agency has seven facilities but receives no audits by the conclusion of the first year of the first audit cycle (by August 19, 2014)?
The agency would not be fully compliant with the PREA standards as of August 20, 2014. However, the agency may still become fully PREA compliant during the second year and the third year of the audit cycle. For purposes of the audit cycle, compliance is determined during each specific audit cycle year. So if this agency obtains three facility audits (at least one-third) between August 20, 2014 and August 19, 2015, then the agency would be PREA compliant with the audit cycle during that year.
During the final year of the audit cycle (ending August 19, 2016), however, the agency would be required to have all four remaining facilities audited. This is because an agency has a separate obligation under the standards to ensure that “each facility” must be audited “at least once” during the three-year audit cycle (concluding on August 19, 2016). See 28 C.F.R. § 115.401(a).
b. As another hypothetical, what happens if an agency has only one facility but receives no audit by the conclusion of the first year of the first audit cycle (by August 19, 2014)?
Because the standards require that an agency have “at least” one-third of its facilities audited during each year of the three-year audit cycle, an agency with a single facility is required to receive an audit during the initial year of the audit cycle to be compliant as of August 19, 2014. In other words, an agency with a single facility cannot be said to have had at least one third of its facilities audited by August 19, 2014, if it has had no facility audits. However, a single-facility agency could become fully compliant at any point during the remainder of the three-year audit cycle (concluding on August 19, 2016) subject to a successful audit of that facility. So for example, a single-facility agency that is not compliant as of the conclusion of the first year of the audit cycle because it had received no audits by August 19, 2014, could nevertheless become fully compliant with the audit standards if it receives an audit one month later (early in the second year of the audit cycle) and would remain compliant with this standard through the remainder of the first audit cycle.