49 C.F.R. § 270.301
The system safety program and its implementation shall be assessed internally by the railroad and audited externally by FRA or FRA's designee.