Department of Transportation (DOT) Audit Checklist

Identify whether this is a New Entrant Safety Audit, Compliance Review, focused review, or security audit. The scope drives which BASICs and document pulls the investigator will request. Pull the letter from the FMCSA portal and note the proposed onsite date.

Download the carrier's SMS snapshot showing each BASIC percentile (Unsafe Driving, HOS Compliance, Driver Fitness, Controlled Substances, Vehicle Maintenance, Hazmat, Crash Indicator). BASICs flagged above the intervention threshold are where the investigator will dig hardest — prioritize document prep there.

Investigators typically request 10–30% of driver files. Pull a roster covering the sample period including terminated drivers; FMCSA reviews files for anyone who drove during the window, not just current employees.

Inquiries must be sent to all DOT-regulated employers from the past 3 years within 30 days of hire and the response (or documented non-response after good-faith follow-up) filed in the DQ file. Missing inquiries are one of the most common acute violations.

Part 391.25 requires an annual MVR pulled from every state where the driver held a license in the prior 12 months. Check the date on each MVR — any older than 365 days from today is a violation.

Confirm each medical examiner's certificate is unexpired and issued by an NRCME-certified examiner. For CDL drivers, the medical status on file with the state CDLIS record must match — a paper copy in the DQ file is no longer sufficient on its own.

From Motive, Samsara, Geotab, or your ELD provider, export the FMCSA-compliant data file for every driver in the sample period. Verify the file opens in eRODS — investigators reject exports that fail the FMCSA validation tool.

Run the ELD violation report for the sample period. Flag every 11-hour driving, 14-hour duty, 30-minute break, and 60/70-hour cycle violation. Investigators calculate a violation rate per driver-day; a pattern triggers an HOS BASIC hit even when individual violations are minor.

Part 395.11 requires supporting documents — BOLs, fuel receipts, toll records, dispatch records, payroll — for up to 8 documents per driver per day. Pull a sample week per driver and confirm timestamps and locations match the ELD record.

From Fleetio, Whip Around, RTA, or your maintenance system, export every VIN operated during the sample period including units that were sold or retired. Part 396.3(b) records must be kept 1 year while in service and 6 months after disposal.

Every CMV needs a Part 396.17 annual inspection report dated within the last 12 months and the matching decal affixed. Missing or expired annuals are a common acute violation and an automatic OOS at roadside.

For each defect noted on a driver DVIR, confirm a corresponding repair order and the mechanic's certification of repair before the next dispatch. "No defects" copy-paste DVIRs followed by repair invoices for the same period is the pattern investigators look for.

Pull the written drug & alcohol policy and the signed driver receipt for each CDL driver. The policy must name the consortium/TPA, the DER, and the testing categories — pre-employment, random, post-accident, reasonable suspicion, return-to-duty, follow-up.

Confirm the program ran at least 50% of the average driver count for controlled substances and 10% for alcohol over the prior calendar year. Document the average driver count math the consortium used. Falling short triggers an automatic finding.

Cross-reference the accident register with post-accident test records. Part 382.303 requires alcohol testing within 8 hours and drug testing within 32 hours of a qualifying accident, or a documented reason the test wasn't performed.

The register must cover the prior 3 years and list date, city/state, driver, vehicle, injuries, fatalities, hazmat, and tow-away status for each DOT-recordable accident. Even a zero-accident carrier needs the empty register on hand.

For each DOT-recordable on the register, attach the police report, the carrier's accident packet (driver statement, photos, witness contacts), and the insurance FNOL acknowledgment. Gaps suggest the accident packet workflow isn't being run at the scene.

49 CFR 172.704 requires general awareness, function-specific, safety, security awareness, and in-depth security training every 3 years for each hazmat employee. Pull the dated certificate and test record for each driver who hauled placardable hazmat in the sample period.

Per 172.602, each shipping paper needs a 24/7 emergency response phone (CHEMTREC or equivalent) and the proper shipping name, hazard class, UN ID, and packing group. Pull 10 random BOLs from hazmat loads and verify each field.

For every issue surfaced above — stale MVR, missed random rate, OOS-eligible equipment, missing prior-employer inquiry — document the root cause, the fix, the owner, and the completion date. A drafted CAP shown to the investigator on day 1 changes the tone of the audit.

Set up a dedicated room or virtual data room with DQ files, ELD exports, maintenance records, drug & alcohol records, accident register, and hazmat documentation indexed by BASIC. Designate one point of contact — investigators dislike chasing multiple people for the same record.