What is a DOT audit, and what do they ask for?
"DOT audit" covers several different processes with different auditors and very different consequences. FMCSA runs a New Entrant safety audit on every new carrier within its first 12 months of operating — pass or fail, and no safety rating either way. It runs offsite and onsite investigations on established carriers when CSA data, a crash or a complaint calls for it, and those can end in a safety rating and in civil penalties. IRP and IFTA audits do not come from FMCSA at all: they come from your base jurisdiction, which is required to audit an average of three percent of its accounts each year, and they examine the distance and fuel records behind your apportioned fees and quarterly returns. Whichever one you are in, it is decided by records that already exist — driver qualification files, records of duty status, the drug and alcohol program, maintenance and periodic inspection files, the accident register, and proof of insurance and registration.
Safety audit, investigation, or IRP/IFTA audit?
One word, three processes. Which one you are in decides who you are talking to, what they are entitled to look at, and what happens if it goes badly.
| Aspect | New Entrant safety audit | FMCSA investigation | IRP / IFTA audit |
|---|---|---|---|
| Who runs it | FMCSA, or a state agency acting on its behalf | FMCSA | Your base jurisdiction's motor vehicle or revenue agency |
| What triggers it | Being a new carrier — it is scheduled, not earned | CSA data over an intervention threshold, a crash, a complaint, or a follow-up | Selection: each jurisdiction must audit an average of 3% of its accounts a year |
| When | Within the first 12 months of operating, inside the 18-month monitoring period | Whenever the data justifies it | Any time inside the record-retention window |
| What it examines | Whether the required safety management controls exist and are adequate | Compliance in the areas the data flagged, or the entire operation | The distance and fuel records behind your apportioned fees and quarterly returns |
| Where it happens | At your place of business, at an agreed-upon location, or electronically | Offsite, onsite focused, or onsite comprehensive | Usually where your records are kept |
| What it can result in | Pass, or failure and revocation of your new entrant registration — no safety rating either way | A safety rating, and civil penalties | Reassessed fees with interest and penalty; for IRP, 20/50/100 percent of the year's apportionable fees if no records are produced at all |
| The deadline after a bad result | Written notice no later than 45 days, then 60 days to correct — 45 for passenger and hazmat carriers | Set by the notice; changing a rating needs a request under 49 CFR 385.17 | Set by the jurisdiction, with the appeal route in the Plan or the Agreement |
What to do when the notice arrives
Work out which audit you actually have
The letterhead tells you, and everything else follows from it. FMCSA means a safety audit or an investigation, and the subject is the Federal Motor Carrier Safety Regulations. A state motor vehicle or revenue agency means IRP or IFTA, and the subject is distance and fuel — an entirely different set of records, reviewed by people who will not ask about your driver files. Carriers lose time preparing for the wrong one, and worse, reassure themselves with the wrong deadline.
Read the notice for scope, date and format
Three things decide the whole exercise: what period and which areas are in scope, when the auditor expects it, and whether this is happening at your premises, at an agreed-upon location, or electronically. Offsite means the file you submit is the entire argument — nobody is there to explain a gap for you. Onsite means someone is reading the room as well as the records. Do not begin pulling documents before you have read all three off the notice.
Pull the six record sets, and know how far back each one reaches
An auditor works from a list, and it is the same list every time. Driver qualification files, everything in 49 CFR 391.51, kept while the driver is employed and for three years after. Records of duty status with their supporting documents: six months. The drug and alcohol program: five years for positives, refusals and the annual summary, two years for the collection process, one year for negatives. Vehicle maintenance: one year per vehicle and six months after it leaves your control, with the periodic inspection report kept fourteen months. The accident register: three years from each accident. And for IRP and IFTA, distance and fuel records — three years past the close of the registration year for IRP, four years for IFTA. If a set is short, that is the finding.
Fix what is still legitimately fixable — and nothing else
A missing annual inspection can be performed today. A missing medical certificate can be obtained today. A missing MVR can be pulled today. What cannot be done is manufacture a record of something that did not happen — a log for a trip already driven, a drug test for a hire already made — and the attempt converts a paperwork finding into a falsification finding, which is a different order of problem entirely. The honest version of audit preparation is: close every gap today can legitimately close, and prepare to answer for the ones it cannot.
The audit itself
By definition a safety audit is an examination of your operations that also exists to provide educational and technical assistance — it is not a prosecution, and treating it as one usually makes it worse. Answer what is asked, produce what is requested, completely and on time, and without widening the scope yourself. Where a finding is genuinely wrong, say so at the time and show why: it is far easier to correct a misreading in the room than to appeal it after the file closes.
The result, and the clock it starts
A New Entrant audit is pass or fail and carries no safety rating. Fail, and FMCSA sends written notice no later than 45 days after the audit that your registration will be revoked unless you correct what it found; you then have 60 days to take the specified corrective action, or 45 days if you carry passengers or hazardous materials, with extensions available only when properly requested. Sixteen violations listed in 49 CFR 385.321 fail the audit on their own, however good the rest of the file is. An investigation is different: it can produce a safety rating, and a Conditional or Unsatisfactory rating is changed through corrective action plus a request under 49 CFR 385.17, which FMCSA decides within 45 days — 30 for passenger and hazmat carriers.
Common questions
How soon after I start operating does the safety audit happen?
Inside your first 12 months of operating, and inside a monitoring period that runs 18 months — two numbers that describe different things and are constantly reported as one. The audit is the event; the monitoring period is the window at the end of which FMCSA removes the new entrant designation and tells you in writing that your registration is now permanent. It also will not happen in your first few weeks: an audit of safety management controls needs enough operating history for there to be records to examine.
What is the difference between an offsite and an onsite investigation?
Where it happens, and therefore what preparation means. In an offsite investigation FMCSA evaluates documents you send in and never comes to you — convenient, and easy to lose on the submission alone, because an incomplete file is often the entire finding. An onsite focused investigation reviews one or two problem areas at your place of business, usually the BASICs that went over threshold. An onsite comprehensive investigation reviews the whole operation, and it is the one that can end in a safety rating.
Does an IRP or IFTA audit have anything to do with FMCSA?
No. Different agency, different records, different consequence. FMCSA regulates safety; your base jurisdiction administers IRP registration and IFTA fuel tax, and it audits the distance and fuel records behind them because the Plan and the Agreement require it to — an average of three percent of its accounts every year. A clean safety record does not protect you from a mileage audit, and a fuel-tax assessment does not touch your safety rating. The overlap is practical rather than legal: both are decided by whether your records reconcile.
What does an auditor mean by "safety management controls"?
It is a defined term, and it is the actual subject of a safety audit. 49 CFR 385.3 defines safety management controls as the systems, policies, programs, practices and procedures a carrier uses to ensure compliance with the safety and hazardous materials regulations. So the question being asked is not only "did you do it" but "do you have a way of doing it that works when nobody is watching". A carrier that produces a complete file assembled the week before the audit has answered the first question and failed the second.
I am not a new carrier. Why am I being investigated?
Something put you at the top of a list. A BASIC at or above its intervention threshold does it; so does an acute or critical violation found in a previous investigation, a reportable crash, a complaint, or a follow-up on an earlier corrective action. The interventions escalate rather than arriving at once — a warning letter, then targeted roadside inspections, then an investigation — so an investigation notice usually means an earlier signal went unanswered.
How far back can the auditor actually go?
In practice, the retention window for whichever record set is in question, which is why those windows are the real scope of any audit: six months of logs, three years of driver files after separation, five years of positive drug test results, fourteen months of periodic inspection reports, three years of accidents, three years past the close of the registration year for IRP distance, four years for IFTA. Anything the rules do not require you to still hold is not a finding. Anything they do require, and you cannot produce, is.
Sources
- 49 CFR § 385.3 — the definitions — what a safety audit is, what a compliance review is, and what "safety management controls" means
- 49 CFR § 385.319 — the written notice within 45 days, and the 60 days to correct — 45 for passenger and hazmat carriers
- 49 CFR § 385.321 — the sixteen violations that fail a New Entrant safety audit on their own
- 49 CFR § 385.17 — requesting a safety rating change — decided in 45 days, or 30 for passenger and hazmat carriers
- FMCSA New Entrant Safety Assurance Program — the safety audit inside the first 12 months, and the 18-month monitoring period around it
- 49 CFR § 391.51 — what a driver qualification file must contain, and how long it is kept after the driver leaves
- 49 CFR § 395.8 — paragraph (k): records of duty status and supporting documents, kept six months
- 49 CFR §§ 396.3 and 396.21 — maintenance records for one year plus six months after the vehicle leaves your control, and the periodic inspection report for fourteen months
- 49 CFR § 390.15 — the accident register, and the three years it is kept from the date of each accident
This guide is general information about US federal and state transportation regulation — it is not legal or tax advice, and reading it does not make you our client. Rules change, and how one applies depends on your own operation: check anything you intend to rely on against the primary source above, or call us and we will check it with you.