Engineering Firm Regulatory Compliance Checklist

Pull each licensed engineer's NCEES record or state-board verification for every state where they have sealed work in the last 12 months. Flag anyone whose renewal cycle closes in the next 90 days; lapsed renewals during a sealing window are unauthorized practice and a board-discipline risk.

For each lapse, freeze new sealing assignments until the state board confirms reinstatement. Identify any deliverables sealed during the lapse window and consult counsel on disclosure to the client and AHJ. Document required PDH makeup including any state-mandated ethics hours.

Reconcile licensed seats for AutoCAD, Revit, Civil 3D, ProjectWise, ACC, and the analysis suites (SAP2000, ETABS, RAM, RISA, HEC-RAS) against active staff. Flag retired hardware still attached to license tokens and any unmanaged personal devices accessing the CDE.

Run the access report for each active project workspace. Remove subconsultants whose contract closed last quarter and confirm sealed-deliverable folders are read-only outside the EOR group. Verify CAD files released externally carry the firm's non-reliance disclaimer.

Walk the active project list with the PMs and tag any federal contracts carrying Controlled Unclassified Information clauses, DoD work subject to CMMC, or ITAR/EAR-controlled deliverables. Confirm the access list is restricted to US-person staff with documented need-to-know.

Walk the 14 control families and confirm the SSP and POA&M reflect current configurations. Pay special attention to media protection (CAD files on portable drives) and incident response timing — DoD reporting is 72 hours from discovery, not from confirmation.

For every project disturbing more than one acre, confirm the construction general permit NOI is on file and the SWPPP is current with the latest grading set. Designer-drafted SWPPPs that didn't get updated after a redesign are a common citation source for owners.

Confirm each federal-aid or federal-permit project has the right NEPA pathway documented — CatEx, EA / FONSI, or EIS — and that Section 7 (ESA), Section 106 (NHPA), and Section 4(f) consultations are closed before any final design seal. Flag any project advancing to PS&E without environmental clearance in hand.

Per ASTM E1527, records older than 180 days at signature break the AAI requirement and the innocent-landowner defense goes with them. Pull the records date for each open Phase I and trigger refreshes where the report has been sitting on a closing schedule.

Walk the office for egress, electrical, and ergonomic findings. For field staff, audit the last month of construction-observation visit logs — confirm site-specific JHAs were completed and that observation reports define what was and was not observed (an observation is a snapshot, not an inspection).

Pull training records for every Resident Engineer, Construction Inspector, and Field Engineer. OSHA 10 minimum for site visitors; OSHA 30 for full-time CA staff. Add NFPA 70E arc-flash awareness for anyone observing energized electrical work and confined-space training where applicable.

Send the disclosure form to every Principal-in-Charge and Project Manager. Probe for ownership stakes in contractors or material suppliers, family relationships with AHJ reviewers, and side-consulting that could implicate the NSPE paramountcy-of-public-safety obligation.

For staff supporting international pursuits or federally-funded projects, confirm FCPA training is current within the past 12 months. Re-circulate the gifts-and-hospitality policy before year-end conference season — vendor-paid travel to industry events is the most common policy gray-zone.

Pull every report submitted since the prior compliance review. Triage by severity and confirm anonymous reports were not back-traced. Cross-reference against state-board complaint inquiries the firm has received.

Assign an investigator outside the reported person's reporting chain. Document interview dates, evidence reviewed, and disposition. For findings that touch sealed work or public safety, escalate to outside counsel and consider mandatory state-board self-reporting under the engineer's ethical obligations.