Thirty Days Until the Licensing Audit
Meridian Protective Group's training coordinator manages annual in-service for 85 licensed officers across four sites. The municipal licensing rule requires 8 hours of in-service each calendar year plus CPR/First Aid every two years; the company's own policy requires a 50-item closed-book final with a passing score of 80%. A pre-audit self-check found: 11 officers whose last documented in-service was 14 months ago; two of the four instructors have lapsed instructor certifications (expired 60 days); and the final exam answer key sits in a shared drive folder open to all supervisors, at least three of whom have downloaded it. The auditor arrives in 30 days. Two in-service classes are already on the calendar, but one instructor is double-booked against a client-mandated site drill on the same day, and the training room seats 20 while 28 officers are registered for the first session.
1. Set your priorities for the 30 days before the audit and justify the order. What do you tell the auditor, and what do you not do?
Read the worked answer
Order by legal exposure and evidence integrity, not by convenience.
- Instructor certification (days 1–5). Two of four instructors are lapsed. Any hours they delivered are questionable under the licensing rule, and any class they are scheduled to teach is at risk. Recertify or replace them before the next delivery date. This is binary and cannot be fixed retroactively.
- The 11 lapsed officers (days 1–15). Their in-service is 14 months old against an 8-hour annual rule. Calculate each officer's shortfall, schedule make-up sessions, and confirm whether any grace period exists in writing - do not assume one.
- Test security (days 1–10, in parallel). The key is exposed. Treat recent exam results as suspect until you know who used it.
- Room capacity and the double-booked instructor (days 5–10). 28 registered in a 20-seat room is a fire-code and delivery problem; split or relocate the session. The client drill cannot move, so reassign either the class or the drill with written notice.
Tell the auditor what you found, what you did, and when. A self-disclosed corrective action plan is far stronger than an auditor discovering 11 lapsed files. Do not backdate, do not reclassify informal briefings as in-service hours, and do not delete the download logs.
2. The exam answer key was in an open shared drive. What is your containment and validation plan, and would you invalidate any results?
Read the worked answer
Containment first: remove the key, revoke inherited sharing, check version history and access logs, and identify everyone who opened or downloaded the file and when. Ask those supervisors - without accusation - whether the key was shared with officers.
Then decide on validity. A key alone does not invalidate results unless examinees saw it. The test is whether exposure could have affected scores:
- Build a new 50-item form on the same blueprint with different items, and retire the old form.
- If any examination was administered after the first download, and any examinee had plausible access through a supervisor, require or offer a retest. Document the decision and rationale for each affected cohort.
- Keep results for examinations clearly outside the exposure window, and note why.
Make the key irrelevant in future: randomize item order from a larger bank, or use two forms. Store the key in a restricted location with named access, an audit trail, and sign-out.
Write a one-page incident memo: what was exposed, to whom, for how long, which results are affected, what was done, and who approved it. Give it to the auditor proactively. Concealment is the greater risk; a documented, proportionate response demonstrates control.
3. Design the recertification tracking so the 11-lapsed-officer situation cannot recur. What fields, triggers, and ownership would you put in place?
Read the worked answer
A spreadsheet is acceptable only if it has owners and triggers; otherwise it becomes the file nobody opens.
Fields per officer: hire date; license number and expiry; last in-service date; hours completed this cycle; next due date (calculated, not typed); CPR/First Aid expiry; instructor certifications and expiry; site and shift; supervisor.
Triggers: automatic alerts at 90, 60, and 30 days before each due date, sent to the officer, site supervisor, and training coordinator. A weekly exception report listing anyone past due or within 30 days, with a named owner for each. A hard stop in the scheduling system: no solo post assignment or schedule posting if license or in-service is expired. That rule must live in the system, not just in policy.
Ownership: one accountable training coordinator, one trained backup, and a monthly sign-off by operations. Audit the tracker quarterly against the state license database, because the failure mode here was trust in stale records.
Finally, schedule classes with a 10% buffer for call-offs and hold one standby make-up session each quarter. Eleven people missed a single annual window; the fix is more than one window, not more reminders.