7 C.F.R. § 990.28 – Compliance.

(a) Audits. USDA licensees may be audited by the USDA. The audit may include a review of records and documentation, and may include site visits to farms, fields, greenhouses, storage facilities, or other locations affiliated with the producer's hemp operation. The audit may include the current crop year, as well as any previous crop year(s). The audit may be performed remotely or in person.
(b) Frequency of audit verifications. Audit verifications may be performed once every three (3) years unless otherwise determined by USDA. If the results of the audit find negligent violations, a corrective action plan may be established.
(c) Assessment of producer's hemp operations for conformance. The producer's operational procedures, documentation, recordkeeping, and other practices may be verified during the audit verification. The auditor may also visit the production, cultivation, or storage areas for hemp listed on the producer's license.
1. (1) Records and documentation. The auditor shall assess whether required reports, records, and documentation are properly maintained for accuracy and completeness.
2. (2) [Reserved]
(d) Audit reports. Audit reports will be issued to the producer no later than 60 days after the audit is concluded. If USDA determines through an audit that the producer is not compliant with the Act or this part, USDA shall require a corrective action plan. The corrective action plan must include a reasonable date by which the producer will correct the negligent violation. USDA will approve or deny the corrective action plan within 60 days of its receipt. Producers operating under a corrective action plan must also periodically report to USDA on their compliance with the plan for a period of not less than two calendar years following the violation. The producer's implementation of a corrective action plan may be reviewed by USDA during a future site visit or audit. If additional instances of noncompliance occur, USDA may revoke the producer's USDA license for one year or until the producer becomes compliant whichever occurs later.