- A. A facility operator shall submit its internal controls to the Commission for review and written approval.
B. If the Commission determines that a submitted internal control is deficient, the:
- (1) Commission shall provide the facility operator with written notice of the deficiency; and
- (2) Facility operator shall revise the internal control as appropriate and resubmit it to the Commission for review.
- C. A facility operator’s initial internal controls submission and a change or amendment to its approved internal controls shall be reviewed and approved in accordance with a process and time frame developed and implemented by the Commission.
D. The process developed by the Commission under §C of this regulation shall, at a minimum, require the facility operator to:
- (1) Submit a redlined copy of any section of the approved internal controls to be changed or amended with added text underlined and deleted text lined out;
- (2) Document on the redlined copy the date the Commission approved the section to be changed or amended and the date the revision was submitted to the Commission for review;
- (3) Submit a narrative explaining the reason for the change or amendment which includes the facility operator’s target date for implementation;
- (4) Maintain a log of all changes or amendments in approved internal controls which includes the initial approval date and the effective date of any change or amendment approved by the Commission; and
- (5) Mark each page of approved internal controls with the date on which it was approved by the Commission.
Authority: Criminal Law Article, §§ 12-301. 1 and 12-308; State Government Article, §9-110; Annotated Code of Maryland
Effective date:
Regulations .01— .19 adopted as an emergency provision effective August 26, 2013 (40:20 Md. R. 1650); adopted permanently effective December 12, 2013 (40:24 Md. R. 2019)
Regulation .06A amended effective October 22, 2018 (45:21 Md. R. 976)
Regulation .14B amended effective May 25, 2026 (53:10 Md. R. 459)