Last updated: November 2026. Regulation text read 2026-11-05 (eCFR through the GPO govinfo data file built 2026-10-29).
A Prison Rape Elimination Act (PREA) compliance program connects policies, training and operational evidence to 28 CFR Part 115. IHS drafts selected policies, training documents and an evidence binder for prisons, jails and juvenile facilities; the client approves and implements them.
This is a compliance services engagement. IHS does not audit, investigate incidents or give legal advice.
What do the PREA national standards require?
For prisons, jails and juvenile facilities, the standards require a zero-tolerance policy, a PREA coordinator, employee training and facility audits; the agency must demonstrate compliance. The governing text is 28 CFR Part 115, "Prison Rape Elimination Act National Standards," on eCFR at 28 CFR Part 115 (page opened 2026-11-05). The part has five subparts: A prisons and jails, B lockups, C community confinement, D juvenile facilities and E audit. The part's source note is the 2012 Attorney General order that issued it (77 FR 37197, June 20, 2012); the eCFR text shows no later amendment note.
This page summarizes selected requirements in 115.5, 115.11, 115.12, 115.31, 115.311, 115.312, 115.331, 115.193 and 115.401-115.404. It is not a complete Part 115 assessment.
- Policy. An agency must have a written policy mandating zero tolerance toward all forms of sexual abuse and sexual harassment, and outlining its approach to preventing, detecting and responding to that conduct (115.11(a); 115.311(a) is the same).
- Coordinator. For prisons, jails and juvenile facilities, the agency employs or designates an upper-level, agency-wide PREA coordinator with enough time and authority to develop, implement and oversee its efforts to comply in all of its facilities. Where it operates more than one facility, each facility designates a PREA compliance manager with enough time and authority to coordinate that facility's efforts (115.11(b) and (c); 115.311(b) and (c)).
- Training. Employees who may contact inmates or juvenile residents receive the ten topics in 115.31(a) or eleven in 115.331(a), respectively. Training addresses gender and, for juveniles, their unique needs and attributes; reassignment between all-male and all-female facilities requires additional training (115.31(b), 115.331(b)). Each employee receives refresher training every two years and current sexual-abuse and sexual-harassment policy information in intervening years; signature or electronic verification documents understanding (115.31(c)-(d), 115.331(c)-(d)).
- Contracts. A public agency that contracts for the confinement of its inmates or residents with private agencies or other entities, including other government agencies, includes in any new contract or renewal the entity's obligation to adopt and comply with the standards and provides for contract monitoring (115.12, 115.312).
- Audit. For successive three-year periods beginning August 20, 2013, each agency-operated facility or facility privately operated on its behalf must be audited at least once; at least one-third of each facility type must be audited in each one-year period beginning on that date (115.401(a)-(b)). Individual lockups not used to house detainees overnight need not be audited (115.193). The agency bears the burden of demonstrating compliance, and the auditor reviews all relevant agency-wide policies, procedures, reports, internal and external audits and accreditations for each facility type (115.401(e) and (f)). For each standard, the auditor finds Exceeds Standard, Meets Standard or Does Not Meet Standard (115.403(c)). The agency ensures the final report is published on its website if it has one, or is otherwise made readily available to the public (115.403(f)).
- Auditors. Auditors are certified by the Department of Justice. An auditor who received financial compensation from the agency being audited within the three years before the agency retained that auditor may not conduct the audit, except for compensation for prior PREA audits; and the agency may not employ, contract with or otherwise compensate the auditor for three years after retaining that auditor, except to contract for subsequent PREA audits (115.402(b), (c) and (d)). The auditor certifies that no conflict of interest exists (115.403(a)).
- Corrective action. A finding of "Does Not Meet Standard" on one or more standards triggers a 180-day corrective action period; the auditor and agency jointly develop the plan (115.404(a) and (b)).
Who needs a PREA compliance program, and what triggers it?
An agency that operates adult or juvenile confinement facilities, or an organization that runs them on an agency's behalf, builds this program. Under 115.5, an agency is the State, local, corporate, nonprofit or DOJ unit directly responsible for operating a facility confining inmates, detainees or residents, including implementing its governing authority’s policy. A juvenile facility primarily confines juveniles pursuant to the juvenile or criminal justice system. Whether a particular youth program is a covered facility, or whether the standards bind your organization through law, grant or contract, is for your counsel.
Situations that start a build:
- An audit is coming, and the agency must show compliance from its own records (115.401(e)).
- A prior audit found "Does Not Meet Standard" on one or more standards, and the 180-day corrective action period has opened (115.404(a)).
- A public agency is writing or renewing a confinement contract (115.12, 115.312).
How does IHS build a PREA standards compliance program?
IHS builds the program in five steps, working as an outside drafting team under your PREA coordinator and counsel.
- Gap assessment. IHS compares your documents to the sections above and lists each missing policy, designation and record.
- Evidence mapping. IHS organizes an evidence binder by standard, pointing each requirement to the record that shows it.
- Drafting. IHS drafts zero-tolerance policies, training documents, a contract-monitoring checklist and a corrective-action tracker for the selected standards. Your coordinator and counsel approve them.
- Mock review. IHS checks the binder against the selected standards. Documents alone do not establish operational compliance.
- Readiness support. IHS drafts briefing notes and an evidence index for your leaders.
What you supply: your facility types and subparts, legal authority and operations data, the coordinator and compliance manager designations, actual training rosters, incident and investigation records and staffing plans. You also select and retain a certified auditor and handle the audit and any corrective action work that follows it.
The real limit: IHS drafts and never audits. Your counsel checks the compensation windows in 115.402(c) and (d) before you retain an auditor. IHS does not conduct investigations, does not communicate with the Department of Justice or an auditor for you, and does not give legal advice. Mandatory reporting and age-of-consent questions go to your counsel.
IHS was founded in 2002 and is led by Thomas G. Goddard, JD, PhD, former Chief Operating Officer and General Counsel of URAC. IHS works across three practice lines: accreditation consulting, compliance services and program development. This program is compliance services.
What should a facility have ready for a PREA audit?
Have these records ready before a gap assessment; each ties to a section of 28 CFR Part 115.
- The written zero-tolerance policy for each facility type (115.11(a), 115.311(a)).
- The written designation of the agency-wide PREA coordinator and the time and authority assigned (115.11(b), 115.311(b)).
- For prisons, jails and juvenile facilities, a compliance manager at each facility when the agency operates more than one (115.11(c), 115.311(c)).
- Employees who may have contact with inmates or residents, with training records, two-year refresher dates, off-year refresher information and signed or electronic acknowledgments (115.31, 115.331).
- Contracts with private operators showing the PREA obligation and the monitoring provision (115.12, 115.312).
- A facility inventory with audit status against the fixed cycles and any lockup exception (115.401(a)-(b), 115.193).
- An evidence binder organized by standard, since the agency bears the burden (115.401(e)).
- Agency-wide policies, procedures, reports, audits and accreditations for each facility type (115.401(f)).
- A plan to publish the final audit report or make it readily available (115.403(f)).
- A corrective action tracker for the 180-day period (115.404(a)).
If most of these do not exist yet, a free introductory call with IHS sorts what to build first.
How does an outside PREA program build compare with the other routes?
An agency or operator can prepare in several ways, and the routes are not exclusive. The table does not rank them.
| Route | What it involves | Where the work sits |
|---|---|---|
| Internal build | The PREA coordinator and compliance managers write the policies and binder. | Your staff time. |
| Parent agency or state model policies | Existing examples your team adapts. | Your team maintains them. |
| Outside drafting support (IHS) | IHS drafts the policy set, training plan, binder and tracker. | IHS drafts; your coordinator approves and runs it. |
| The auditor | Independently assesses compliance; does not replace program preparation. | The audit itself, which IHS does not perform. |
What does a PREA compliance program build cost?
DOJ does not publish a fee schedule on the pages we reviewed; fees depend on scope. Budget considerations include staff time, training and audit costs.
IHS scopes each engagement after a free introductory call. Scope moves with the number of facilities, the subparts that apply and how many records are missing.
What this is not
This is not legal advice. IHS is a consulting firm, not a law firm. Coverage, mandatory reporting and age-of-consent questions are for your counsel.
It is not an audit or an investigation, and not a guarantee of an audit result.
Frequently asked questions
What do the PREA national standards require of juvenile and adult facilities?
For prisons, jails and juvenile facilities, requirements include a zero-tolerance policy, an agency-wide PREA coordinator, employee training and facility audits. Part 115 has separate subparts for prisons/jails, lockups, community confinement and juvenile facilities; individual lockups not used to house detainees overnight need not be audited (115.193).
What must a facility's zero-tolerance policy contain?
Section 115.11(a) requires a written policy mandating zero tolerance toward all forms of sexual abuse and sexual harassment and outlining the agency's approach to preventing, detecting and responding to it. Section 115.311(a) says the same for juvenile facilities.
What staff training does PREA require and how often?
Employees who may contact inmates or juvenile residents receive training under 115.31 or 115.331, respectively. It addresses gender and juveniles’ unique needs and attributes, with additional training for reassignment between all-male and all-female facilities. Refresher training occurs every two years, with current sexual-abuse and sexual-harassment policy information in intervening years; signature or electronic verification documents understanding.
How often must a facility be audited under PREA?
Each agency-operated facility or facility privately operated on its behalf must be audited at least once per successive three-year period beginning August 20, 2013; at least one-third of each facility type must be audited per one-year period beginning on that date (115.401(a)-(b)). Individual lockups not used to house detainees overnight need not be audited (115.193).
What happens after a “Does Not Meet Standard” audit finding?
A finding of “Does Not Meet Standard” triggers 180 days of corrective action, with a plan jointly developed by the auditor and agency (115.404(a)-(b)). The auditor then determines whether the facility meets the standards requiring corrective action; an agency still short of compliance may request another audit at its discretion and cost once it believes it has achieved compliance (115.404(d)-(e)).
What evidence should a facility keep to show it meets the standards?
The text does not prescribe a binder. The agency bears the burden of demonstrating compliance (115.401(e)), and audits review at a minimum a sampling of records for the most recent one-year period (115.401(g)), so IHS organizes an evidence binder by standard.
Do the standards apply to private contractors and residential youth programs?
Section 115.401(a) reaches facilities a private organization operates on the agency's behalf, and 115.12 and 115.312 require a public agency's new or renewed confinement contract to carry the contractor's obligation to comply and contract monitoring. Whether a given youth program is covered is a question for counsel.
What does a PREA compliance program build cost?
DOJ does not publish a fee schedule on the pages we reviewed; fees depend on scope. IHS scopes each engagement after a free introductory call.
Related pages
See the Compliance Services overview | Compliance program development | ADA Title II web and mobile accessibility program for public health providers | Respiratory protection program for healthcare employers.