BOP Program Statement 1212.01 § 3

PREA was passed into law by the United States Congress in 2003, resulting in a series of

standards and related federal regulations aimed at preventing, detecting, and responding to sexual

abuse in detention and correctional facilities.

The Reentry Services Division (RSD) is responsible for the development and oversight of

national PREA policy and procedure. See the Program Statement Sexually Abusive Behavior

Prevention and Intervention Program Manual for additional information. DCO provides

coordination and compliance support to institutions undergoing external PREA Compliance

Audits. These audits are required pursuant to the PREA regulations and standards.

The PREA audit requirements are as follows:

■ Audit Frequency & Scope. Each facility must be audited at least once every three years, and

at least one-third of the total number of facility locations must be audited annually. The

regulation also discusses an audit structure, including documentation review, tours, and

audits of staff and the incarcerated, in accordance with 28 C.F.R. § 115.401.

■ Auditor Qualifications. External PREA auditors must possess DOJ certification and

establish an acceptable level of independence, in accordance with 28 C.F.R. § 115.402.

■ Audit Content & Findings. Each PREA report must include the methodology and

determination of compliance, individually reviewed and determined by the auditor. Emphasis

is placed on maintaining a high level of audit independence from the audited facility/agency,

in accordance with 28 C.F.R. § 115.403.

■ Audit Corrective Action Plan. The corrective action plan process for a facility deemed

noncompliant with one or more of the standards must meet certain requirements under 28

C.F.R. § 115.404.

■ Audit Appeals. Final decisions on PREA audits may be refuted through the appeals process,

should the audited agency have a strong rationale for questioning the result, in accordance

with 28 C.F.R. § 115.405.

a. PREA Audit Process – Phases & Associated Institution Requirements. The PREA Audit

1212.01 6/22/2026 PROPERTY OF US GOVERNMENT 4

Process is made up of three distinct phases, each of which has its own institution requirements:

(1) Pre-Audit Phase. The Pre-Audit Phase is designated as the preparation period between

notification of the audit by Central Office and the arrival of the PREA Compliance auditor at the

institution. During this first phase of the audit process, the following activities will occur,

requiring facility staff involvement:

■ One-on-One Virtual Meeting. Institution staff will participate in a virtual meeting with the

assigned DCO Management Analyst responsible for coordinating that institution’s PREA

audit. The Warden, PREA Compliance Manager(s), and any other staff the Warden has

designated to assist in the PREA audit process must attend the meeting.

■ Completion of Audit Documentation and Facility Review of PREA Closed Case Files.

Institution staff will complete the required PREA Audit Questionnaire (PAQ) and collect all

supporting documentation for purposes of auditor review. Upon notification of the audit

reporting period, the PREA Compliance Manager (PCM) will convene a team to review all

currently closed PREA cases that were alleged and/or investigated during the reporting

period. Special Investigative Services (SIS) staff at the facility will be involved in the review

of any inmate-on-inmate cases. Staff-on-inmate cases are investigated by the Bureau's Office

of Internal Affairs (OIA), and OIA must make all documentation on its closed staff-on-inmate PREA cases readily available for auditor review upon request.

Any noted concerns related to the written responses or documentation must be brought to the

attention of the assigned Management Analyst by the PCM for consideration of any

compliance issues and/or short-term corrective action that could be implemented by the

facility prior to the auditor’s arrival.

■ Logistic Preparation for On-Site Audit. Institution staff must develop a tour route and be

prepared to provide the PREA auditor(s) access to all areas where inmates are permitted.

■ Practice PREA Compliance Audit. Institution staff must participate in the Practice PREA

Compliance Audit scheduled and run by the assigned DCO Management Analyst. Practice

audits may occur virtually or in-person. The DCO Management Analyst assigned to the

facility will walk the determined tour route, conduct staff interviews, request inmates for

interviews, review requested and available documentation, review all closed staff and inmate

cases, and offer recommendations based on any observations.

The institution is encouraged to have the required documentation completed and

investigative files prepared prior to the Practice PREA Compliance Audit, so the assigned

DCO Management Analyst can provide the institution with feedback on its level of readiness

for the PREA Compliance Audit.

■ Practice PREA Compliance Audit Report. Within 10 days of the Practice PREA

Compliance Audit, the assigned DCO Management Analyst will provide the Warden a report

of observations from the PREA Practice Audit. The report may include observations from the

PREA Practice Audit, including, but not limited to sanitation, staff professionalism, and any

1212.01 6/22/2026 PROPERTY OF US GOVERNMENT 5

number of issues related to compliance with the PREA Standards. Concerns regarding

potential non-compliance with a PREA standard will be referenced in the report. Prior to the

next phase of the audit process, the Warden is required to implement corrective action and

ensure compliance by issuing an assurance memorandum to the DCO Assistant Director.

(2) On-Site Audit Phase. DOJ-certified PREA Compliance Auditors will be on-site to conduct

the audit. Typically, the audit will consist of a daily open-up and close-out, facility tour, inmate

and staff interviews, and a thorough review of pertinent documentation, including inmate and

staff perpetrated closed investigative files. The assigned DCO Management Analyst will also

typically be on-site to provide any support needed to the institution during the audit.

(3) Post Audit Phase. The post-audit phase encompasses the period after the on-site audit

through submission of the auditor’s final report to both the Bureau and the DOJ PREA

Management Office. During this post-audit phase, each PREA standard will be rated in

accordance with one of three levels of compliance, including “Exceeds Standard” (substantially

exceeds requirement of the standard); “Meets Standard” (substantial compliance; complies in all

material ways with the standard for the relevant review period); or “Does Not Meet Standard”

(insufficient compliance requiring corrective action). Determination of standard compliance is

based on the auditor’s observations during the tour, interviews on-site, and documentation

reviewed during both the pre-audit and on-site phases.

Depending on the conclusions made by the auditor(s) pertaining to the institution’s overall

compliance on the PREA standards, the auditor has 45 days to provide either a final report

indicating full compliance or a preliminary report indicating the areas of non-compliance in need

of correction.

In “No Corrective Action Required” instances, the auditor has enough information to determine

100% compliance with the standards, the auditor has 45 calendar days to submit the final report

to the Bureau, concluding the PREA Audit for that facility for the current three-year audit cycle.

In “Corrective Action Required” instances, within 45 days of the last day of the on-site audit, the

auditor(s) will provide a draft of the PREA report. A finding of “Does Not Meet Standard” with

one or more of the PREA standards will result in a corrective action period. During this period,

the auditor and the Bureau will work jointly, for a maximum of 180 days, to develop and

implement a corrective action plan for the standard(s) found to be out of compliance at the time

of the on-site audit.

At the completion of the corrective action timeline, the auditor has 30 calendar days to amend

their preliminary report, making it the final report, adding the final determination of compliance

post-corrective action implementation. This final report concludes the facility’s PREA Audit for

the current three-year audit cycle. Should the facility be found noncompliant at the expiration of

the corrective period, the final report shall indicate noncompliance. In these instances, the

1212.01 6/22/2026 PROPERTY OF US GOVERNMENT 6

regional and Central Office must intervene to ensure a continuous period of 100% compliance

with the implemented corrective action. The exact time frame of continuous compliance is at the

discretion of the auditor who determined the facility was non-compliant. Following this period of

compliance, the Central Office will request reevaluation of compliance.