1. (a) This section shall not apply to a second-line business partner. A business partner shall hire an independent auditor to perform three compliance audits during the term of the BPA contract. The audits shall be conducted by an independent auditor in accordance with generally accepted government auditing standards and the department's BPA Audit Plan, which consists of the Independent Audit Plan (August 30, 2002) and Independent Audit Program (August 30, 2002). The independent auditor shall keep confidential the department's business practices obtained in the course of an audit.

   1. (1) An audit is required for each 12 month period of the BPA contract. Each audit shall be completed within 90 days of the end of each 12 month audit period. A copy of the audit report, including any findings and recommendations, shall be submitted to the department within 60 days of completion of each audit.
   2. (2) The independent auditor shall be licensed as a certified public accountant in good standing in the state where the site is located.
   3. (3) The independent auditor shall not be part of the ownership or involved in the operation or overview of any part of the business partner's business(es).

2. (b) The independent auditor shall sign a Registration Operations Branch Business Partner Automation Program Representative Non-Disclosure Statement form, REG 4028 (REV 4/2003), which is hereby incorporated by reference, agreeing to protect as confidential information all department records and information including, but not limited to, residence/mailing addresses.

   1. (1) The Registration Operations Branch Business Partner Automation Program Representative Non-disclosure Statement form shall be kept with the business partner's BPA business records and available for audit.

3. (c) The independent auditor shall provide the business partner audit report, the independent auditor's findings and any suggested corrective action plan or audit response developed by the business partner to the department at the following address: Department of Motor Vehicles, Audits Office, P.O. Box 932328, MS E607, Sacramento, CA 94232-3280.

   1. (1) Audits of second-line business partners shall require that a copy of the audit report, findings and any suggested corrective action plan or audit response be sent to the department and the first-line service provider by the independent auditor. The first-line service provider shall retain and maintain a copy of the audit report and corrective action plan or audit response pursuant to Section 225.63.
4. (d) A business partner shall inform the BPA Program Administrator when an independent auditor is no longer employed by the business partner to perform an audit. This notice shall be sent within seven days of release of the independent auditor. The signed and written notice on business partner letterhead shall be sent by scanning and emailing to the DMV ROD Business Partner Automation group email box at [email protected], U.S. mail, or private courier when an independent auditor is released from service.
5. (e) A business partner's principal place of business shall be open during normal business hours for an electronic or manual audit of the records required to be retained immediately upon a request from the State.
6. (f) The department may conduct a standard random audit to verify compliance without reimbursement from a business partner.

Note: Authority cited: Sections 1651 and 1685, Vehicle Code. Reference: Section 1685, Vehicle Code.

History

1. New section filed 7-5-2002 as an emergency; operative 7-5-2002 (Register 2002, No. 28). A Certificate of Compliance must be transmitted to OAL by 11-4-2002 or emergency language will be repealed by operation of law on the following day.

2. New section with amendments refiled 11-4-2002 as an emergency; operative 11-4-2002 (Register 2002, No. 45). A Certificate of Compliance must be transmitted to OAL by 3-4-2003 or emergency language will be repealed by operation of law on the following day.

3. New section refiled 3-3-2003 as an emergency, including amendment of subsections (a)(1)(A) and (b); operative 3-3-2003 (Register 2003, No. 10). A Certificate of Compliance must be transmitted to OAL by 7-1-2003 or emergency language will be repealed by operation of law on the following day.

4. Certificate of Compliance as to 3-3-2003 order, including amendment of subsection (d) and new subsection (f), transmitted to OAL 6-27-2003 and filed 8-11-2003 (Register 2003, No. 33).

5. Amendment of subsections (a)(1)-(a)(1)(A) and (c) filed 7-9-2007; operative 8-8-2007 (Register 2007, No. 28).

6. Amendment filed 6-29-2012; operative 7-1-2012 pursuant to Government Code section 11343.4 (Register 2012, No. 26).

7. Amendment of subsections (c) and (d) filed 11-5-2025; operative 11-5-2025 pursuant to Government Code section 11343.4(b)(3) (Register 2025, No. 45).