28 C.F.R. § 115.402 – Auditor qualifications.

(a) An audit shall be conducted by:
1. (1) A member of a correctional monitoring body that is not part of, or under the authority of, the agency (but may be part of, or authorized by, the relevant State or local government);
2. (2) A member of an auditing entity such as an inspector general's or ombudsperson's office that is external to the agency; or
3. (3) Other outside individuals with relevant experience.
(b) All auditors shall be certified by the Department of Justice. The Department of Justice shall develop and issue procedures regarding the certification process, which shall include training requirements.
(c) No audit may be conducted by an auditor who has received financial compensation from the agency being audited (except for compensation received for conducting prior PREA audits) within the three years prior to the agency's retention of the auditor.
(d) The agency shall not employ, contract with, or otherwise financially compensate the auditor for three years subsequent to the agency's retention of the auditor, with the exception of contracting for subsequent PREA audits.