The owner or operator must certify that it has evaluated compliance with Subpart D at least every three years, the audit conducted by at least one person knowledgeable in the process, with a report of findings, a prompt documented response to each finding and documentation that deficiencies were corrected, retaining the two most recent reports. The next audit must be a third-party audit under 68.80 after an accidental release meeting the 68.42(a) criteria, or when the implementing agency requires one because of conditions that could lead to a release or because a prior third-party audit failed the competency or independence criteria (preliminary written notice, 30 days to provide information and consult, final determination, appeal within 30 days), completed on the three-year schedule unless the agency sets another.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.