How to Perform an Internal DOT Compliance Audit

Why This Matters More Than Most Carriers Think

You can either find your compliance problems or FMCSA can. Both processes look at the same records. The difference is what you can do once a gap is identified.

If you find a missing annual driver review before the auditor does, you can work to address it. If an auditor finds it first, it is a finding in the review. That is the entire reason to run internal reviews on a regular schedule rather than waiting for a notice.

This is not about manufacturing compliance or backdating anything. It is about finding real gaps in real-time records while those gaps are still correctable. If you want to understand what patterns typically produce findings, see what causes trucking companies to fail DOT audits.

What an Internal Compliance Audit Reviews

These are the record categories FMCSA commonly examines in a compliance review. The actual scope of any audit varies by type, trigger, and what the auditor requests. Running an internal review across all of them means you are not caught off guard regardless of where the focus lands.

Domain 1: Driver Qualification Files

Pull every active driver's file and verify the following for each driver:

• Signed employment application on file
• Previous employer verification completed and documented for all applicable employers in the required lookback period (49 CFR 391.23)
• Motor vehicle record obtained at time of hire and annually
• Annual driver review completed, signed by both driver and reviewer, and dated accurately
• Road test certificate on file, or CDL exemption documented
• Medical examiner's certificate: current, not expired, filed in the DQ file
• Entry-level driver training documentation if applicable (49 CFR 380.605)
• Clearinghouse query result documented before the driver's first safety-sensitive function

Flag: expired medical cards, unsigned or undated annual reviews, incomplete previous employer verification, missing road test documentation, and any driver without a Clearinghouse query result on file. See the full driver qualification file checklist for document-by-document requirements.

Domain 2: Hours of Service and ELD Records

Review at least six months of ELD data and supporting documents. Look for:

• Unassigned driving time that has not been reviewed, assigned, or documented
• Supporting documents (fuel receipts, bills of lading, dispatch records) that do not match ELD log records
• Log gaps covering known commercial motor vehicle operation
• Exemptions used (short-haul, adverse driving conditions, personal conveyance) without documentation
• ELD malfunctions with no corresponding recordkeeping per 49 CFR 395.22

Pattern check: Are the same drivers consistently appearing in log exceptions? Are specific time periods or routes showing gaps? Patterns in your own ELD data often predict what a roadside inspector will find. The driver log auditing checklist covers what to review in each log record.

Domain 3: Vehicle Maintenance and Annual Inspections

For each active vehicle in your fleet:

• Annual inspection on file and completed within the last 12 months
• Inspector qualification basis documented or the inspection performed by a qualified facility
• DVIRs submitted by drivers, showing defect reporting after each trip
• Repair records responding to defects noted in DVIRs
• Out-of-service violations from roadside inspections with repair documentation on file

Flag: any vehicle without a current annual inspection, any DVIR showing a defect without a repair record, any out-of-service violation with no documented follow-up. See DOT annual inspection recordkeeping requirements for what must be kept and for how long.

Domain 4: Drug and Alcohol Testing Program

Review the following for each driver and for the program overall:

• Pre-employment drug test result on file for each current driver
• Clearinghouse query result documented before each driver's first safety-sensitive function
• Random testing program enrollment documentation (consortium or pool records)
• Random testing completion records for the current and prior calendar year
• Post-accident testing documentation for any qualifying accidents (49 CFR 382.303)
• Written drug and alcohol policy, current and signed
• Return-to-duty documentation if any driver has had a violation

See FMCSA drug and alcohol testing requirements for the full program and how the FMCSA Clearinghouse works for query and reporting obligations.

Domain 5: Accident Register

49 CFR 390.15 requires carriers to maintain an accident register for three years. Review:

• Does the register cover at least the last three years?
• Is every qualifying accident recorded with the required information: date, location, driver, injury count, fatality count, and whether a hazmat release occurred?
• Has the register been updated within the last 12 months (or noted as having no qualifying accidents)?

Flag: any qualifying accident not recorded, a register that has not been updated in more than a year, a register that does not exist. See what is a DOT recordable accident to confirm which events require an entry.

Domain 6: Roadside Inspection History

Pull your FMCSA Safety Measurement System data at safer.fmcsa.dot.gov. For each recent roadside inspection:

• Was any cited defect corrected and documented?
• If a vehicle was placed out of service, is the repair record in the maintenance file?
• Are the same violation types appearing repeatedly across drivers or vehicles?
• Are specific drivers consistently generating inspection findings?

Roadside inspection patterns often signal the same documentation gaps an internal audit will find. They also give you a preview of what an auditor using your SMS data will focus on. See what DOT roadside inspections check for more on interpreting inspection results.

Domain 7: Insurance and Authority

Confirm:

• Operating authority is current at safer.fmcsa.dot.gov
• Current insurance certificate or MCS-90 endorsement on file
• No coverage lapses in the last three years that are unaccounted for

What to Do With What You Find

An internal audit produces a list of gaps. Not every gap carries the same urgency.

Fix first: expired medical cards, drivers without a current annual review, vehicles without a current annual inspection, drivers missing a pre-employment drug test on file, missing Clearinghouse query results. These are active compliance gaps with direct exposure.

Document your follow-up: for gaps you cannot immediately resolve (for example, a previous employer that has not responded to a verification request despite documented follow-up), keep a written record of your attempts. The documentation of follow-up is part of the record, not a substitute for the underlying requirement.

Build corrective action for patterns: when the same problem appears across multiple drivers or vehicles, a written corrective action plan that identifies the root cause, the fix, a responsible person, and a follow-up date shows that the operation responds to its own problems. That matters in future reviews. See the corrective action plan template for a structure you can use.

A Practical Internal Audit Cadence

There is no regulatory requirement for carrier self-audits. As a practical operating rhythm:

Carriers with higher driver turnover or larger fleets typically need more frequent DQ file reviews. The cadence above is a practical starting point, not a regulatory requirement.

Audit-Ready vs Audit-Proof

Audit-ready means: your records are organized, current, and reviewable. When an auditor asks for documentation, you can produce it.

Audit-proof is not a real concept. No internal review guarantees that a compliance review will produce no findings. An internal audit reduces the number of gaps and improves the organization of your records, which improves your position in any review. Do not confuse "I ran an internal audit" with "I know I will pass." The goal is to find and fix what you can, not to generate false certainty.

The Safety Gal's Take

The carriers who call me in a panic after receiving an audit notice are almost never the ones who ran any kind of internal review. They are the ones who had not looked at the DQ files in two years, who did not know the maintenance records were incomplete, who assumed the drug program was fine because they enrolled in a consortium once. An internal audit is just looking at your own operation the way someone else is going to. If you would not want an auditor to see it, that is the problem to fix now.

Rhythm Gandhi

Founder & Principal Compliance Consultant, The Safety Gal

Rhythm runs internal compliance reviews for carriers before FMCSA does. The domain structure in this article reflects how she actually works through a carrier's records. She is not a licensed attorney. Verify current regulatory requirements at FMCSA and eCFR.