DOT Audit Support: FMCSA Audit Checklist & Response
Send us your audit letter and we will tell you exactly which documents the investigator will ask for, which ones we can produce from our own records, and what you have to pull yourself.
- We operate our own DOT consortium and act as your C/TPA
- DQ files, Clearinghouse query history, HOS and ELD pulls
- Part 385 App. A automatic-failure items checked first
Send us your audit letter
Send us the notice. A specialist returns the document list marked pass or fail, no obligation.
What Is a DOT Audit?
A DOT audit is an FMCSA review of the safety records you are already required to keep. An investigator requests a defined document set, samples it against the Federal Motor Carrier Safety Regulations, and scores what is missing or unsigned. Nobody looks at your trucks. They read your paperwork.
The outcome rarely turns on how safely you run. It turns on whether each record exists, is dated, is signed by the right person, and can be produced inside the window the letter gives you. The letter states that deadline, and it is short. A clean crash history does not save a bad file room.
There are four types. The first paragraph of your letter tells you which one you have.
Required for every new entrant under 49 CFR 385.305, FMCSA schedules it early in your operating history; you do not request it. Pass or fail, no safety rating. The items in Appendix A to Part 385 fail you on a single instance.
You send documents; nobody visits. Usually triggered by SMS percentiles or a complaint. Short deadline — this is the one carriers lose by missing the window.
An investigator comes to your terminal and drills one or two problem areas: hours of service, the drug and alcohol program, or maintenance. It can produce a safety rating.
The compliance review. Every safety factor in 49 CFR 385.7 is examined and rated under Appendix B to Part 385. Satisfactory, conditional, or unsatisfactory — and brokers, shippers, and insurers read it.
The 2026 CVSA International Roadcheck ran 12–14 May 2026. The two focus areas were cargo securement and electronic logging device tampering and falsification. Inspectors reviewed records of duty status for driving while not logged in, disconnected or tampered devices, improper edits and unidentified driving time, ghost co-drivers, misuse of personal conveyance, and off-duty time recorded while working.
Those inspections are not a one-week event on your record. Every violation written that week is weighted and time-decayed into your BASIC percentiles for the next two years, which is why a single bad Roadcheck stop shows up in an intervention months later.
Who Gets Audited, and What Triggers It
If you operate a commercial motor vehicle as defined in 49 CFR 390.5 — over 10,001 pounds gross vehicle or combination weight rating, 9 or more passengers for compensation, 16 or more not for compensation, or hazardous materials in placardable quantity — you are auditable. Interstate carriers answer to FMCSA. Intrastate carriers answer to a state agency that adopted the FMCSRs, and the document list is close to identical.
You applied for a dot number and are in the new entrant safety assurance program. The audit is scheduled, not random. Fail and your registration can be revoked under 49 CFR 385.319. Most new entrants fail on the drug and alcohol program, not on trucks.
You were selected by data, complaint, or crash. At stake is your safety rating and civil penalties under 49 CFR Part 386. Your risk is drift: drivers hired in a hurry, annual reviews skipped, an insurance or boc-3 filing that lapsed while nobody was watching.
Audits are almost never arbitrary. The trigger tells you where the investigator digs first.
- New entrant status. Registration itself is the trigger — 49 CFR Part 385, Subpart D.
- SMS percentiles. A BASIC above intervention threshold, usually Unsafe Driving, HOS Compliance, or Vehicle Maintenance.
- Roadside pattern. Repeat out-of-service violations, or the same defect across the fleet.
- A crash. Fatal or serious crashes draw a hard look at that driver's qualification file and duty status for the days before.
- A complaint. Driver, ex-driver, or public, through the National Consumer Complaint Database.
- A prior conditional rating or unfulfilled corrective action plan. Follow-up investigations are common.
- Hazmat or passenger operations. Higher priority and shorter timelines throughout Part 385.
- Registration data. A missing biennial mcs-150 update or lapsed ucr registration can put you on a list before anyone reads a safety record.
How DOT Audit Support Works With Foley
We do not hand you a checklist and wish you luck. We hold much of what the investigator is asking for, because we file and maintain it for you day to day.
Send us the letter and we'll build the document list
Forward the letter the investigator sent. We'll return the document list split two ways: what we pull from our records, and what you pull yourself.
The DOT Audit Checklist: Every Document, Section by Section
This is the spine of the page. Work down it and mark each line pass or fail. Fail means missing, undated, unsigned, or out of the retention window — an investigator treats all four the same way.
1. Driver qualification files
- Application with 10 years of employment history — 49 CFR 391.21. Pass = every gap explained.
- Previous employer safety performance history inquiries, including drug and alcohol history — 49 CFR 391.23. Fail = requests sent, no responses, no documented follow-up.
- Motor vehicle record at hire, plus an mvr and a signed annual review of driving record — 49 CFR 391.25. Fail = MVR pulled, review never signed.
- Medical examiner's certificate or MVR-based verification for CDL drivers, and National Registry examiner status — 49 CFR 391.43, 49 CFR 391.45. Under the Medical Examiner's Certification Integration rule, the examiner transmits CDL results to FMCSA and the certification posts to the driver's motor vehicle record, so the MVR is what you file.
- Road test certificate or accepted equivalent — 49 CFR 391.31, 49 CFR 391.33.
- Entry-level driver training where 49 CFR Part 380, Subpart F applies.
- Valid CDL, right class and endorsements, not suspended — 49 CFR 383.23, 49 CFR 383.37.
2. Drug and alcohol testing requirements for DOT-regulated employers
If you employ CDL drivers performing safety-sensitive functions, Part 382 makes you the regulated employer — not your vendor. Six test types apply: pre-employment, random, post-accident, reasonable suspicion, return-to-duty, and follow-up, at 49 CFR 382.301 through 49 CFR 382.311. 49 CFR Part 40 governs every collection, MRO review, and SAP process. The investigator audits your file, not the laboratory's.
- Written policy and signed driver receipt — 49 CFR 382.601.
- Pre-employment negative before the first safety-sensitive function — 49 CFR 382.301.
- Random selection records showing the pool, the method, and testing spread across the year at the published minimum annual rates — for 2026, 50 percent for controlled substances and 10 percent for alcohol — 49 CFR 382.305. FMCSA publishes any change in the Federal Register.
- Consortium or C/TPA agreement and membership proof. Foley provides this from our own program.
- Post-accident testing decisions, and documented reasons where no test occurred — 49 CFR 382.303.
- Reasonable suspicion documentation and two hours of supervisor training — 49 CFR 382.307, 49 CFR 382.603.
- Return-to-duty and follow-up testing with a SAP plan — 49 CFR 382.309, 49 CFR Part 40, Subpart O.
- DER designated in writing and reachable — 49 CFR 382.107.
- Full clearinghouse queries at hire and annual limited queries for every CDL driver, with retained query records — 49 CFR 382.701. This is the most common new entrant failure we see, and a dot drug test program without query records will not pass.
3. Hours of service, RODS and ELD
- Records of duty status for every driver and day in the audit period — 49 CFR 395.8.
- Supporting documents that let the investigator verify the RODS — 49 CFR 395.11.
- ELD exports, unassigned driving time reviewed, edit and annotation history — 49 CFR Part 395, Subpart B.
- Short-haul or non-CDL exception records if you rely on 49 CFR 395.1(e). Fail = claiming it with no time records.
- Malfunction records and paper logs covering ELD downtime — 49 CFR 395.34.
4. Vehicle maintenance and inspections
- Systematic maintenance program and a file per vehicle you control 30 days or more — 49 CFR 396.3(b).
- Annual periodic inspection report for every unit, trailers included — 49 CFR 396.17, 49 CFR 396.21.
- DVIRs with repair certification where defects were noted — 49 CFR 396.11, 49 CFR 396.13.
- Proof that out-of-service defects were corrected before the vehicle ran again — 49 CFR 396.9(c)(2).
- Qualified inspector and brake inspector documentation — 49 CFR 396.19, 49 CFR 396.25.
5. Accidents, registration, authority and insurance
- Accident register with date, location, injuries, fatalities, and hazmat release — 49 CFR 390.15(b) — plus copies of accident reports required by your state. Fail = an empty register when your crash history shows recordable crashes.
- Financial responsibility at the correct limits, MCS-90 available — 49 CFR Part 387.
- Operating authority matching what you actually haul, and process agent designation on file — see boc-3.
- Current biennial update, due every 24 months on the schedule set by your USDOT number — 49 CFR 390.201 — and a unified carrier licence registration paid for the current year.
- Driver and vehicle lists that reconcile to your MCS-150 counts. Mismatches invite a wider sample.
6. If you haul hazmat or passengers
- Hazmat training records and security plan — 49 CFR Part 172, Subparts H and I.
- Shipping papers, placarding, and registration under 49 CFR Part 107, Subpart G. Whether registration applies turns on the commodities and quantities you haul, as listed in that subpart.
Want this as a DOT audit checklist PDF for your safety manager? Same list, formatted for markup. It comes back with your audit letter review.
Retention Windows and Audit Timing
Half of all audit findings are retention failures: the record existed, then got thrown out early or was never kept. These are the windows an investigator samples against.
| Record | CFR cite | How long you must keep it |
|---|---|---|
| Records of duty status and supporting documents | 49 CFR 395.8(k), 49 CFR 395.11 | 6 months |
| ELD records and back-up copies | 49 CFR Part 395, Subpart B | 6 months |
| Driver qualification file | 49 CFR 391.51 | Duration of employment plus 3 years after separation |
| Annual MVR and review of driving record | 49 CFR 391.25 | Refresh every 12 months; retain 3 years |
| Drug and alcohol test records | 49 CFR 382.401 | Tiered by record type. Verified positives, refusals, return-to-duty and follow-up tests and the annual summary are kept 5 years. |
| Clearinghouse query records | 49 CFR Part 382, Subpart G | 3 years |
| Accident register | 49 CFR 390.15(b) | 3 years |
| Periodic (annual) inspection report | 49 CFR 396.21 | 14 months |
| Maintenance and repair records | 49 CFR 396.3(b) | Kept where the vehicle is housed or maintained for 1 year, and for 6 months after the vehicle leaves your control |
| DVIRs and repair certifications | 49 CFR 396.11 | 3 months |
| Document window in an offsite audit letter | Set by the notice | The window printed on the letter is the one that applies |
| New entrant corrective action plan after a failed audit | 49 CFR 385.319 | FMCSA sets the deadline in the failure notice, and it is shorter for passenger and hazmat carriers |
The audit period is a sample, not your whole history. Clean and complete, and investigators rarely widen it. Ragged, and they widen it every time.
Knowing the list is not the same as having the documents
The checklist tells you what the investigator asks for. It doesn't tell you which of your files are missing, expired, or filed under the wrong driver. Send the letter and we'll go through it with you.
Have us review your audit documentsViolations That Automatically Fail a Safety Audit
Appendix A to 49 CFR Part 385 lists the regulations that fail a new entrant safety audit on a single instance. No pattern needed, no percentage. We check these first on every engagement.
- No drug and alcohol testing program at all — 49 CFR 382.115(a).
- No random controlled substances testing program — 49 CFR 382.305.
- Using a driver who tested positive, refused a test, or has an alcohol concentration of 0.04 or greater — 49 CFR 382.201, 49 CFR 382.211, 49 CFR 382.215.
- Knowingly using a driver without a valid CDL, with a suspended or revoked license, or who is disqualified — 49 CFR 383.23(a), 49 CFR 383.37(a), 49 CFR 383.51(a), 49 CFR 391.15(a).
- Operating without the required financial responsibility — 49 CFR 387.7(a).
- Using a physically unqualified driver, or one with no medical examination — 49 CFR 391.11(b)(4), 49 CFR 391.45.
- Failing to require records of duty status — 49 CFR 395.8(a).
- Operating a vehicle declared out of service, or failing to correct out-of-service defects — 49 CFR 396.9(c)(2), 49 CFR 396.11(c).
- Using a vehicle that was never periodically inspected — 49 CFR 396.17(a).
New entrants rarely fail on trucks. They fail because a driver started work before the pre-employment result came back, because no random selections were ever run, or because the pre-employment Clearinghouse query was never performed. All three are automatic. All three are what we run for you as your C/TPA.
DOT Audit Fines, Penalty Exposure and 2026 Amounts
Civil penalties for FMCSR violations are set out in 49 CFR Part 386, Appendix B, and FMCSA raises the maximums for inflation every year under the Federal Civil Penalties Inflation Adjustment Act. The 2026 FMCSA penalty amounts were published in the Federal Register and apply to violations assessed on or after the effective date stated in that notice. We do not print dollar figures here — last year's number is wrong this year, and the live table is the only version that counts. What is stable is the structure.
| Violation category | What triggers it | Exposure structure |
|---|---|---|
| Recordkeeping and false records | Missing RODS, falsified logs, no DQ file, no accident register | Per violation; knowingly falsifying is penalized far more heavily than an incomplete record |
| Drug and alcohol program | No testing program, no random selections, using a driver who tested positive or refused | Per violation, per driver — multi-driver findings compound fastest here |
| Out-of-service order violations | Operating a vehicle or driver placed out of service | Per day, and separately assessable against the driver. The maximum is adjusted for inflation every year, so the figure in force on the date of the violation is the one that applies. |
| Operating without authority or insurance | Lapsed authority, no financial responsibility under Part 387 | Per day of unauthorized operation, at the inflation-adjusted maximum in force on the date of the violation |
| Hazardous materials | Training, shipping paper, placarding, or security plan failures | Separate HM schedule with higher ceilings, including for releases |
| Failure to produce records | Not responding to the letter, or withholding requested documents | A violation in itself, and it removes any benefit of the doubt on everything else |
An unsatisfactory rating under 49 CFR 385.13 prohibits you from operating once the notice period runs — shorter for passenger and hazmat carriers than for general freight. The notice states the date the prohibition takes effect. A conditional rating is not a prohibition, but brokers, shippers, and insurers pull it, and we routinely see contracts and premiums move before FMCSA has issued the penalty notice.
Audit letter on your desk with a response date already set?
Investigators set the deadline, not you. The earlier we see the letter, the more time there is to find gaps and fix what can still be fixed before you hand anything over.
What Foley Produces vs. What You Supply
Know this split before the clock starts. We hold and can regenerate the records we file for you. We cannot manufacture a log or an inspection that never happened, and no vendor honestly can.
| Record set | Foley produces | Carrier supplies |
|---|---|---|
| Drug and alcohol program | Consortium membership, random selection and pool history, results as reported by the lab and reviewed by our MRO, policy and receipts, DER designation, supervisor training | Notice of accidents that may require post-accident testing; reasonable suspicion observation forms signed by your supervisor |
| Clearinghouse | Full and limited query history, consent records, employer reporting we filed for you | Driver electronic consent where it was never completed |
| Driver qualification files | DQ file reconstruction, MVRs and annual review documentation, background screening, ongoing MVR monitoring, medical certificate tracking | Signed applications, road test certificates, prior employer responses you hold on paper |
| Hours of service | Structured pull and review of ELD and RODS data, unassigned driving and edit-history analysis, findings summary | ELD account access, paper logs, supporting documents — fuel and toll receipts, dispatch records |
| Maintenance | File structure, retention audit, gap list per unit | Periodic inspection reports, DVIRs, repair invoices, out-of-service correction proof |
| Registration and authority | MCS-150 biennial update, UCR, BOC-3, authority and insurance filing status review | Ownership, fleet count, and mileage figures we file on your behalf |
| Audit response | Indexed submission package, pass/fail gap list, DER interview prep, corrective action plan, rating upgrade request and DataQs support | A decision-maker available during the audit window |
An audit is a records test. Hire the people who keep the records.
FMCSA Mock Audit and Readiness Review
A mock audit is the same review, run by us first. We use the investigator's sampling logic and the Appendix A automatic-failure list, and tell you what you would score today. Carriers book it before a scheduled new entrant audit, with a BASIC above threshold, or when a conditional rating means a follow-up is coming.
- Automatic-failure sweep first. Every Appendix A item cleared or flagged before anything else is scored.
- Scoped sample. A driver and vehicle sample sized to your fleet, reviewed against the factors in 49 CFR 385.7.
- Drug and alcohol program audit. Random rate math for the calendar year, pre-employment sequencing, Clearinghouse query coverage driver by driver, supervisor training under 49 CFR 382.603.
- HOS and ELD review. Violation patterns, unassigned driving, edit volume, and whether your supporting documents under 49 CFR 395.11 would actually verify the logs.
- Written pass/fail findings with a remediation order. Where OSHA recordkeeping overlaps your operation, we identify what is in scope for each agency. Where a state runs its own OSHA-approved plan, we confirm which requirements that plan applies to your operation.
The output is a work order, not a score sheet. We fix the items we operate for you.
After the Audit: Ratings, Corrective Action Plans and DataQs
An audit does not end when you send the documents. The next few weeks decide whether a finding becomes a permanent mark.
- Read the rating and the notice period. Satisfactory, conditional, or unsatisfactory under 49 CFR 385.3. Diary the date the day the letter arrives.
- Corrective action plan. New entrants that fail submit a CAP under 49 CFR 385.319. A plan that names a process, an owner, and a date beats one that promises to do better. We write it and implement the parts that live in our systems.
- Request a rating upgrade. Under 49 CFR 385.17 you may request a change to a proposed or final rating based on corrective action, with evidence attached. Administrative review of an error in the rating process runs separately under 49 CFR 385.15.
- Challenge bad data through DataQs. Inspection or crash records attributed to you in error can be challenged. Those records drive the SMS percentiles that select carriers for the next investigation. We file it and track the response.
- Settle or contest the penalty. A Notice of Claim under 49 CFR Part 386 has a response deadline and defined options. The deadline is stated on the Notice itself. Diary it the day it arrives, because missing it forfeits those options.
State and Intrastate Audits, Including New York
Not every audit comes from a federal investigator. States run audits under the Motor Carrier Safety Assistance Program using the FMCSRs as adopted into state law, and intrastate-only carriers are audited by the state rather than FMCSA. The document list barely changes. What changes is who knocks, and which rules the state adopted with modifications.
Carriers call this an SDOT audit — a state DOT audit. There is no federal program by that name. An SDOT audit means your state enforcement agency working from the same Part 391, 382, 395, and 396 records a federal investigator would ask for.
New York raises two separate questions. The first is the one we get asked as FMCSA audit NY CDLs: does a New York-issued license change the driver file? If you run interstate, no — the DQ file, the Clearinghouse queries, and the testing obligations are identical to any other state. The second is intrastate. New York carriers operating only in state are audited under the New York State Department of Transportation's adoption of the FMCSRs, which differs from the federal baseline on intrastate age, medical, and some hours-of-service provisions. We confirm which provisions the state has adopted, and their citations, for your operation before the file is built.
- Confirm whether your operation is interstate or intrastate before you build the file. It sets the rule set.
- Intrastate medical waiver or restricted certificate holders need documentation the federal file does not require.
- If you cross state lines even occasionally, expect the federal rules to apply to that operation.
- State audits pull the same drug and alcohol records, and a consortium reporting properly at the federal level satisfies both.
Find the gaps before an investigator does
A readiness review walks the same file list an investigator would, on your schedule, so the missing paperwork surfaces while you still have room to correct it.
- Offsite is the FMCSA default for compliance reviews, not the exception. The auditor never walks through your door.
- Requested files are submitted electronically, and the window can be as short as 48 hours. A paper file three states away does not make that deadline.
- Carriers whose drivers or trucks were cited or placed out of service during Roadcheck get prioritised for audits in the months that follow.
- In Foley's audit support work, failure to create and maintain driver qualification files has accounted for about 20 percent of critical and acute violations over five years.
Carriers who already run this with Foley
Torc Robotics
Saved close to half its compliance staff time compared with running driver files in a spreadsheet. Read the case study.
AERO BridgeWorks
Went live in about two weeks and now runs driver files, MVRs and audit prep from one record instead of a filing cabinet. Read the case study.
Frequently asked questions
What is a DOT audit?
An FMCSA or state review of your safety records against the Federal Motor Carrier Safety Regulations. The investigator requests a defined document set — driver qualification files under 49 CFR 391.51, drug and alcohol records under Parts 40 and 382, hours-of-service records under 49 CFR 395.8, maintenance and inspections under Part 396, the accident register under 49 CFR 390.15(b) — samples it, and scores what is missing. It is a paperwork examination, not a vehicle inspection.
What is DOT audit vs. DOT compliance review — are they the same thing?
Close, not identical. Carriers say “DOT audit” for any FMCSA records review. A compliance review is the onsite comprehensive investigation: it examines the safety factors in 49 CFR 385.7 and applies the methodology in Appendix B to Part 385, producing satisfactory, conditional, or unsatisfactory. A new entrant safety audit under 49 CFR 385.305 is pass/fail and issues no rating.
What triggers a DOT audit?
New entrant registration triggers one automatically. For established carriers: SMS percentiles above intervention threshold, a pattern of roadside out-of-service violations, a serious or fatal crash, a driver or public complaint, a prior conditional rating or unfulfilled corrective action plan, and hazmat or passenger operations.
How long do I have to respond to an FMCSA audit letter?
The letter controls. Offsite document requests commonly give a short window, and the letter states the date the documents are due; onsite audits are scheduled for a date. Diary the deadline immediately and call the investigator listed on the notice if the request is unclear. Failing to produce records is itself a violation.
Is there a DOT audit checklist I can work from?
Yes. The section-by-section list on this page — DQ files, drug and alcohol program including consortium and Clearinghouse query records, HOS and ELD supporting documents, maintenance and DVIRs, accident register, registration and authority — is the FMCSA audit checklist our specialists use, and you can mark each line pass or fail as you go. Send us your audit letter and we return it reviewed against your operation.
What are DOT audit fines, and what are the 2026 FMCSA penalty amounts?
Civil penalties are published in 49 CFR Part 386, Appendix B and adjusted for inflation every year, so the amount that applies is the one in the Federal Register table in force on the date of the violation. Structurally, recordkeeping and false-record violations, drug and alcohol program failures, out-of-service order violations, and operating without authority or insurance carry the heaviest exposure. Some accrue per violation and per driver; others per day.
What are the drug and alcohol testing requirements for DOT-regulated employers?
If you employ CDL drivers in safety-sensitive functions, 49 CFR Part 382 requires six test types — pre-employment, random, post-accident, reasonable suspicion, return-to-duty, and follow-up — plus a written policy under 382.601, a designated employer representative under 382.107, two hours of supervisor training under 382.603, a random pool at the published rates under 382.305, and Clearinghouse queries under Subpart G. Part 40 governs collections, MRO review, and the SAP process. The obligation sits with you, not your vendor.
What violations automatically fail a safety audit?
Appendix A to 49 CFR Part 385 lists them. The ones we see most: no drug and alcohol testing program (382.115(a)), no random testing program (382.305), using a driver who tested positive or refused, knowingly using a driver without a valid CDL (383.23(a)), no financial responsibility (387.7(a)), no medical examination (391.45), not requiring records of duty status (395.8(a)), and operating an out-of-service or uninspected vehicle.
What happens if I pass or fail my safety audit?
Pass and your new entrant status continues toward permanent registration. Fail and you submit a corrective action plan under 49 CFR 385.319 within the deadline in the notice — shorter for passenger and hazmat carriers, and stated on the notice itself. If the plan is not accepted, new entrant registration can be revoked and your operating authority with it.
Do you offer a mock DOT audit?
Yes. We run the sample an investigator would, sweep the Appendix A automatic-failure items first, audit your random testing math and Clearinghouse query coverage driver by driver, review ELD and HOS data for the patterns investigators flag, and deliver written pass/fail findings with a remediation order. Where the gap sits in a program we operate, we fix it rather than report it.
Are New York CDL carriers audited by FMCSA or the state?
Both happen. Interstate carriers are audited under the federal rules on this page no matter which state issued the CDL. Intrastate-only New York carriers get an SDOT audit — the state applying its own adoption of the FMCSRs, which differs from the federal baseline on some intrastate age, medical, and hours-of-service provisions. We confirm the state's current adoptions for your operation. Determine your operating classification before you build the file.
Audits are a records test, not a driving test.
The carriers who pass are the ones whose files were built before the letter arrived. We build and hold those files: consortium and random selection records, Clearinghouse query history, DQ files, MVR monitoring, and the registration filings that keep you off the list.