PREA audits are to be conducted at the request of any federal, state, local, or private confinement facility, or any agency that oversees such a facility. A facility or agency may contact an auditor directly by using the searchable database described above, or seek the services of an auditor through procurement announcements, advertisements, or other means. Auditors can also solicit work from agencies and facilities.

All DOJ-certified PREA auditors are required to comply with the conditions of the Auditor Certification Agreement when procuring and conducting an audit. Specifically, the PREA Standards and PREA Auditor Handbook establish minimum guidelines for conducting high quality, reliable, objective, and comprehensive audits. These guidelines prohibit personal and financial conflicts of interest, require auditors to adhere to an auditor code of conduct, impose conditions on audit contracts and compensation (e.g., transparency, compliance with the PREA Standards and DOJ auditor certification requirements, restrictions on gifts); and establish a detailed PREA audit methodology that auditors are to follow. 

Once an agency or facility has identified and contracted with a PREA auditor, either directly or in coordination with a third party entity (e.g., the auditor’s current employer or a consulting firm), the following steps must be taken to initiate the audit and receive approval from the PREA Management Office.

Submission of an Audit Initiation Form. The Audit Initiation Form is used to initiate all audits. This form collects basic information from a PREA auditor about scheduled audits, including the expected dates for the onsite portion of the audit, the location of the audit, the facility and/or agency to be audited, and the auditing arrangement and compensation structure. All auditors must complete and submit, or confirm, the Audit Initiation Form for each audit they conduct as lead auditor. 

The auditor must submit or confirm the Audit Initiation Form at least 30 days prior to the first day of the auditor’s onsite visit to the facility.

As part of the Audit Initiation Form submission to the PREA Resource Center, auditors will be required to submit a copy of the audit contract with the audited agency and sign a confirmation attesting to the following conditions for the relevant audit: 

• The auditor does not have any conflict of interest (as defined in the PREA Standards and the PREA Auditor Handbook); 
• The auditor agrees to abide by the requirements of the Auditor Certification Agreement; and
• The auditor is a party to the contract or agreement with the facility and/or agency to be audited (as detailed in the PREA Auditor Handbook). 

Audit Initiation Form Approval. If all the above conditions are met and the auditor fully and accurately completes or confirms the Audit Initiation Form 30 days prior to the first day of the auditor’s onsite visit to the facility, the auditor will be approved to proceed with the audit and will receive an email notification of such. Auditors are not to proceed with an audit unless an approval email has been issued by the PREA Management Office granting the auditor permission to conduct the audit. This approval applies only to the auditor who is named in the Audit Initiation Form as lead auditor. If the lead auditor approved to conduct the audit is unable to complete the audit, another auditor may not proceed as lead auditor without first submitting or confirming an Audit Initiation Form.   

If an auditor is unable to meet one or more of the conditions and/or fails to fully and accurately complete or confirm the Audit Initiation Form, the auditor will not be approved to proceed with the audit. If an auditor conducts an audit without first receiving approval, he or she will be subject to disciplinary action by the PREA Management Office, up to and including suspension or decertification. Such disciplinary action against the auditor will not impact the validity of a completed audit for which the auditor failed to obtain prior approval. 

If an auditor fails to submit or confirm the Audit Initiation Form at least 30 days prior to the first day of the onsite portion of the audit, he or she will be prompted to provide an explanation for the late submission. Auditors who consistently fail to submit or confirm the Audit Initiation Form by the deadline may be subject to disciplinary action by the PREA Management Office. 

The PREA Management Office operates under a statutory obligation to evaluate all PREA auditors for compliance with the Auditor Certification Agreement, the PREA Auditor Handbook, the DOJ Audit Instrument, and to take remedial or disciplinary action where necessary. See 34 U.S.C. § 30307(e)(8)(A)(iii). To fulfill its obligation to evaluate an auditor’s performance, the PREA Management Office, through the PREA Audit Oversight Program, monitors and reviews the work of DOJ-certified PREA auditors, with the goal of ensuring the high quality and integrity of PREA audits.

Auditors who fail to follow their certification requirements are subject to remedial or disciplinary action, up to and including suspension or decertification. Full details regarding the PREA Audit Oversight Program are provided in the PREA Auditor Handbook.

Once certified by DOJ, the names of PREA auditors, including their certification date and certification type, are made publicly available on a searchable database located on the PREA Resource Center website. Agencies and facilities seeking an auditor, as well as DOJ-certified PREA auditors seeking audit support staff, are able to search the database for auditors. 

To be certified as a PREA auditor, auditor candidates must meet minimum experience requirements; submit a complete and accurate application; and successfully complete all training requirements, including:

• Attendance and full participation in the PREA Auditor Candidate Training and Field Training Program
• Completion of and achieving a passing score on pre- and post-training examinations
• Passing a criminal records background check
• Signing the Auditor Certification Agreement
• Completion of all probationary certification status requirements 

The full PREA auditor certification and training process and requirements are detailed in the PREA Auditor Handbook.

PREA audits are conducted at the request of any federal, state, local, or private confinement facility, or any agency that oversees such a facility. A facility or agency may contact an auditor directly (the PRC maintains a directory of DOJ-certified auditors) or seek the services of an auditor through procurement announcements, advertisements, or other means. Auditors themselves may also solicit work from agencies and facilities, consistent with the underlying ethical requirements stated in the PREA Auditor Handbook.

PREA audits can only be conducted by individuals certified by DOJ and who possess a currently active certification. The process of finding an active, certified auditor and securing an audit agreement is up to the agency and/or facility in need of an audit. Neither DOJ nor the PRC are involved in the contracting, scheduling, or fee schedules associated with PREA audits. 

Contracting party: lead auditors and audit support staff

Each PREA audit must have one lead auditor who is responsible for the conduct of the audit and all work products. A lead auditor can, however, employ other DOJ-certified PREA auditors to function as secondary auditors. The DOJ PREA Management Office strongly encourages this kind of collaboration among certified auditors. The lead auditor may also employ support staff who are not DOJ-certified auditors to assist with auditing tasks. It is important to know that auditors who have been decertified or who are on suspension may not participate in PREA audits, including as a subcontracted agent of a PREA auditor. See 34 U.S.C. §30307(e)(8)(B)(i). Agencies and facilities searching for an auditor, as well as DOJ-certified PREA auditors seeking audit support staff, are strongly encouraged to check the list for the names of auditors who have been decertified and auditors who are suspended, to ensure that the selected auditor and any support staff employed by the auditor are eligible to conduct a PREA audit.

Contracting party: agencies and facilities

Agencies and facilities should be aware that auditors have minimum requirements for the proper conduct of an audit (including, for example, compliance with the audit methodology requirements in the PREA Standards and PREA Auditor Handbook, and allowing for an adequate amount of time spent on site), and no agreement for auditing services should include provisions that conflict with these minimum requirements. In addition, DOJ requires, at minimum, that audit contracts: are transparent; describe the roles and responsibilities of all third parties and support staff; and allow for corrective action planning and implementation. 

Facilities or agencies may wish to engage in reciprocal auditing or circular auditing. Reciprocal auditing occurs when auditors employed by two different agencies or facilities audit each other’s agency or facility. Circular auditing occurs when a consortium of three or more states or local jurisdictions agree to perform no-cost audits within the consortium.

Reciprocal auditing is only permitted if the audits are conducted 12 months or more apart (see full FAQ). Similarly, circular audits are permissible so long as no impermissible reciprocal audits occur. Agreements for these arrangements usually result from negotiations among the agencies involved; however, agencies in reciprocal or circular auditing arrangements should know that DOJ requires that the lead auditor must be a party to the contract or other agreement that underlies the audit.

Contracting party: third-party entities

Auditors may work as independent contractors or conduct audits through a third-party entity (e.g., their current employer, an accreditation body, or a consulting firm).

Auditors who conduct audits through a third-party entity (e.g., for an accreditation body or consulting firm), whether as an employee or a contractor, must exercise independence and integrity when making their determinations regarding compliance with the PREA Standards. Each certified auditor, regardless of whether he or she works independently or through a third-party entity, is personally accountable for complying with all of DOJ’s certification requirements and for the accuracy of his or her audit findings.

Employees of correctional agencies can be certified by DOJ to conduct PREA audits. However, an auditor may not conduct an official PREA audit for any agency or facility under the authority of that agency, including a private facility operated by contract, if the auditor is or has been employed by or otherwise received financial compensation from that agency, facility, or contractor within the past 3 years. Employment within the same state or local government does not disqualify the auditor, so long as the auditor is not employed directly by or under the agency that operates the facility being audited (§115.402).

Auditor restrictions on gifts

Agencies and facilities should understand that no DOJ-certified PREA auditor, or any non-certified support staff hired to assist an auditor, may either solicit or accept a gift from any entity or party who has an interest related to the outcome of a particular PREA audit in which that person is participating. DOJ defines a “gift” as anything that has monetary value such as items, food and beverages, or services.