(a) The FBI CJIS Division staff regularly conducts systematic compliance reviews of state repositories. These reviews may include, as necessary, reviews of III System user agencies, including governmental and nongovernmental noncriminal justice entities that submit fingerprints to the State repositories and criminal justice and noncriminal justice agencies with direct access to the III System. These reviews may include, as necessary, the governmental and nongovernmental noncriminal justice entities authorized to submit fingerprints directly to the FBI. The reviews may consist of systematic analyses and evaluations, including on-site investigations, and shall be as comprehensive as necessary to adequately ensure compliance with the Compact and Compact Council rules. Violations may also be reported or detected independently of a review.

(b) The FBI CJIS Division staff or the audit team established to review the FBI's noncriminal justice use of the III System shall prepare a draft report describing the nature and results of each review and set out all findings of compliance and noncompliance, including any reasons for noncompliance and the circumstances surrounding the noncompliance. If the agency under review is the FBI or another Federal agency, the draft report shall be forwarded to the FBI Compact Officer. If the agency under review is a State or local agency in a Party State, the draft report shall be forwarded to the State Compact Officer. If the agency under review is a State or local agency in a Nonparty State, the draft report shall be forwarded to the chief administrator of the State repository.

(c) The Compact Officer of the FBI or a Party State or the chief administrator of the State repository in a Nonparty State shall be afforded the opportunity to forward comments and supporting materials to the FBI CJIS Division staff or to the audit team.

(d) The FBI CJIS Division staff or the audit team shall review any comments and materials received and shall incorporate applicable revisions into a final report. The final report shall be provided to the Compact Officer of the FBI or a Party State or the chief administrator of the State repository in a Nonparty State to whom the draft report was sent. If the agency under review is a State or local agency, a copy of the report shall be provided to the FBI Compact Officer. If the agency under review is being reviewed for the first time, the letter transmitting the report shall provide that sanctions will not be imposed regarding any deficiencies set out in the report. The letter shall also advise, however, that the deficiencies must be remedied and failure to do so before the agency is reviewed again will result in the initiation of remedial action pursuant to § 907.4.