The owner or operator must certify that it has evaluated compliance with Subpart C at least every three years to verify that procedures and practices are adequate and followed, the audit being conducted by at least one person knowledgeable in the process, with a report of findings, a prompt documented response to each finding and documentation that deficiencies were corrected; the two most recent audit reports must be kept (not those over five years old). The next audit must be a third-party audit under 68.59 when an accidental release meeting 68.42(a) criteria has occurred, or when the implementing agency requires one because of conditions that could lead to a release or because a previous third-party audit failed the competency or independence criteria; the agency gives written notice of a preliminary determination, the owner may respond and consult within 30 days, a final determination follows, and the owner may appeal within 30 days; the audit follows the three-year timing unless the agency sets another.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.