BOP Program Statement 1211.02 § 4

A Component ICA is a limited scope audit of potentially high-risk areas or processes of a

specific component, conducted by DCO.

DCO conducts Agency-wide ICAs to provide Bureau Executive leadership with an in-depth look

at a specific program or process agency wide.

a. Pre-Audit Work. Audit work may be conducted prior to official notification of Component

ICA.

b. Notifications. The DCO Assistant Director will provide notifications of the initiated

engagement to the appropriate component as detailed below.

 Component ICA. The DCO Assistant Director will provide notification to the CEO of the

component being audited for on-site and remote audits. The notification of the on-site audit

1211.02 6/22/2026 PROPERTY OF US GOVERNMENT 4

will be issued a maximum of 45 days in advance, but generally less than 24 hours of the audit

team’s arrival on-site.

 Agency-wide ICA. The DCO Assistant Director will provide a notification of the initiated

engagement to all applicable component CEOs.

c. Entrance Conference.

 Component ICA. An opening meeting will be conducted with the CEO and audit team. The

CEO may invite additional participants at their discretion. The scope of the audit, applicable

prior audit work, and on-site process will be discussed.

 Agency-wide ICA. An opening meeting will be conducted with the Assistant Director(s),

DCO Leadership, and the audit team. The Assistant Director(s) may invite additional

participants at their discretion. The purpose of the meeting is to determine primary points of

contact for the duration of the audit. The audit work typically does not start until after the

entrance conference.

d. Daily Closeouts. These meetings are conducted daily with the audit team and the component

CEO to provide an overview of the work conducted by the audit team.

 Component ICA. Daily closeouts will be conducted with the component CEO.

 Agency-wide ICA. Daily closeouts are not typically part of the Agency-wide ICA. However,

if on-site visits are conducted as part of an Agency-wide ICA, daily closeouts may be

conducted with the CEO and applicable divisions.

e. Report Process. There are three stages of the DCO audit report process; the stages are the

same for both component and agency-wide ICAs.

 Working Draft Report. DCO will issue a working draft audit report to the audited

component(s) and applicable stakeholders (regional offices and/or applicable divisions), at

the conclusion of the audit. The working draft is watermarked with “DRAFT” and is not

signed. The working draft audit report will include a summary, findings identified during the

audit, and initial draft recommendations. DCO will provide the audited component(s) and

applicable stakeholders, regional office(s) and/or applicable divisions, a deadline to submit

any substantive/technical comments to the working draft report.

 Exit Conference. Once the working draft has been issued, an exit conference will be

scheduled by DCO. The exit conference is an opportunity to discuss the report and address

any substantive/technical comments submitted by components. Ordinarily, the exit

conference will be held virtually. The Warden/CEO, Regional Director or Senior/Deputy

Regional Director, and/or Assistant Director or Senior/Deputy Assistant Director shall attend

the exit conference and may invite any subject matter experts at their discretion.

 Official Draft Report. DCO will send the audited component(s) and applicable stakeholders

(regional offices and/or applicable divisions), an official draft audit report following the exit

1211.02 6/22/2026 PROPERTY OF US GOVERNMENT 5

conference. The official draft is watermarked with “DRAFT” and is signed by the DCO

Assistant Director or designee. The official draft will include revisions made subsequent to

the exit conference, if applicable.

The component shall respond to the official draft report by the assigned deadlines in the

provided instructions. The response must include an official cover response memorandum

and a BP-A1165, Management Response/Action Plan, for each finding and recommendation.

 Final Report. The DCO Assistant Director, or designee, will sign and issue the final audit

report and provide instructions for the follow-up process to the audited component(s), all

Regional and Assistant Directors, and the Director’s Office. The report will include the audit

report and all complete BP-A1165 forms, with DCO analysis.

f. Follow-up Process. The component will provide a status update for each finding on the final

report utilizing the BP-A1165, Management Response/Action Plan by the identified due date on

the final report. The status update must include the evidence requested in the DCO analysis and

any other evidence the component believes supports the implementation and effectiveness of the

action plan. Responses must be submitted in accordance with the directions outlined in the

correspondence. All follow-up responses and action plans will be agreed upon by the audited

component and the applicable Regional and Assistant Directors.

If the previous action plan is not producing the desired outcomes, the component must complete

an updated BP-A1165 explaining the issues with the previous action plan and document the

adjustments.

DCO will issue a response to the follow-up, providing an analysis and disposition (open/closed)

for each finding on the BP-1165. Findings can be closed individually; closed findings will not

require additional follow-up. Subsequent 90-day follow-ups will continue until all findings are

closed and the audit closure is issued by DCO.

g. Audit Closure. The Assistant Director of DCO or designee will close a finding after

verification through follow-up (e.g., re-testing, reviewing documentation, interviewing staff) that

management's corrective actions have been fully implemented, are effective, and adequately

reduce the risk of recurrence, confirming the original issue is resolved.

After all findings within a report are closed, the audit authority or designee will issue closure for

the audit report.