A telemarketing compliance audit is an evidence exercise, not a knowledge test. You pull the call, consent and scrubbing records that federal rules already require you to keep, sample them against a fixed set of controls, and document every gap. One campaign, one quarter of call data, runs three to five working days.
In This Article
The audit answers one question: can you prove, from your own records, that your campaign followed the rules on the day each call went out? Proving it is the harder half. Below is the full sequence: what to gather, what to test, what passing looks like in each control, and the point at which an internal review stops being enough. For the rules themselves rather than the audit procedure, the TCPA compliance checklist for outbound campaigns sets out the requirements. Our compliance team runs this same sequence as the first step of every engagement on the TCPA compliance consulting service page.
What is a telemarketing compliance audit, and what can you realistically do in-house?
A telemarketing compliance audit is a structured review of whether your live calling operation matches the rules that apply to it, evidenced by your own records rather than anyone’s recollection.
It answers three questions in order: what are we required to hold, what do we actually hold, and where do those two lists diverge.
The in-house version works. Most of the audit is reconciliation, and reconciliation does not require a lawyer. You compare a list of required records against the list you can produce, then sample the ones you can produce to see whether they say what they need to say. A campaign manager with database access clears the bulk of it in one to two working days.
One thing you cannot do in-house is give yourself a legal opinion. The line matters. Operational review establishes what your campaign did; legal advice establishes what that exposure means. An audit produces findings of this shape: 12% of the consent records in the sample carry no disclosure language. Whether that is material, and what to do about it in a live dispute, belongs with counsel.
Where that line falls in practice is set out on the TCPA compliance audit service page, which lists the engagement scope: campaign audits, script review, consent management, DNC setup and ongoing monitoring, with legal questions referred to counsel rather than answered in-house.
Keep the first pass small. Scope it at one campaign, one quarter of call data, and the written procedures governing both. Auditing every campaign at once is how audits get abandoned half-finished.
What records do you need before you start the audit?
Start by pulling records, not by reading rules. The Telemarketing Sales Rule’s recordkeeping provision specifies exactly what a telemarketing operation must retain, which makes it a ready-made inventory list for the audit.
Under § 310.5 of the Telemarketing Sales Rule, which lists each category of record and its retention period, sellers and telemarketers keep most records for five years.
The categories below are what the rule asks you to hold. The third column is what first audits find instead.
What the rule requires you to hold | Where it usually lives | Common state on arrival |
|---|---|---|
Each substantially different script, prerecorded message and promotional material | Marketing shared drive, dialer config | Current version only; superseded versions overwritten |
A per-call record: numbers, date, time, duration, disposition, script used, caller ID transmitted | Dialer or CTI export | Present but missing script version and transmitted caller ID |
Consent records, including the request as presented, the purpose, the copy given and the date | Web form database, CRM, call recordings | Date captured, wording of the form at that date not captured |
Entity-specific do-not-call requests, with the number, date and campaign | Suppression list | Present, but no record of when the request was logged |
Which version of the national registry was used, with date, account number and campaign | Scrub vendor portal | Vendor holds it; you do not |
Employee records for staff involved in sales calls, including any fictitious names used | HR, QA system | Fictitious names not traceable to one person |
Service provider contracts, kept five years from expiry | Procurement | Expired contracts already purged |
The right-hand column is where first audits fail. The rule asks for the time and duration of each call recorded to the closest second and expressed in Coordinated Universal Time. Plenty of dialer exports round to the minute and store local time. That is not a calling violation. It is a recordkeeping violation, and the FTC treats failure to keep complete and accurate records as a violation of the rule in its own right.
Relief is built in for teams already doing the work. A seller or telemarketer is not liable for incomplete call records if it documents that it established procedures for accuracy, trained its people in them, monitors and enforces them, and corrected any failure within 30 days of discovery. Read that backwards. The safe harbor is written for organizations that find their own problems and fix them on a clock.
Does your consent documentation actually meet the written-consent standard?
Pull 25 consent records at random. Ask one question of each: could someone who was not there reconstruct what this person agreed to, and when?
The second half is the harder one to evidence.
Prior express written consent is defined in the FCC’s definition at § 64.1200(f)(9), which sets out the disclosure the agreement must carry, as a signed written agreement that authorizes a specific seller to deliver telemarketing messages using an autodialer or prerecorded voice, naming the number. The agreement carries a clear disclosure that the person is authorizing those calls and is not required to sign as a condition of buying anything.
The operational problem is versioning, not wording. Your form says the right thing today. The audit question is what it said on the day each record in your sample was captured, and whether you can produce that version. A lead captured in March 2024 is defended by the March 2024 form. Teams that redesign landing pages quarterly and keep no page archive hold consent dates they cannot pair with consent language.
Passing here is a plumbing problem. The record stores the form version identifier alongside the timestamp, and the versions sit somewhere retrievable. For the mechanics of building that, the deeper treatment is in the guide to collecting, storing and documenting prior express written consent.
One failure mode does not look like a failure. Consent obtained by a lead vendor arrives as a row in a spreadsheet with a date and a checkbox. You hold a claim that consent exists. You do not hold the consent. When the vendor relationship ends, so does your evidence.
How recently was your list scrubbed, and does your process qualify for the safe harbor?
Both the FTC and the FCC allow a version of the national registry obtained no more than 31 days before the call is made, and the safe harbor adds four documentation conditions on top of that.
Scrubbing freshness is the easiest control to check and the most common one to fail, because the failure sits in the gap between the scrub date and the dial date rather than in the policy. The number that matters is not your scrub cadence. It is the age of the registry version at the moment of the oldest dial in your sample.
31 days: the maximum age of the national registry version used for any given call.
Run the arithmetic on real data: scrub date on the file, date of the last call made from that file, subtract. A monthly scrub paired with a list that stays in rotation for six weeks produces calls made against a 42-day-old registry. The safe harbor does not reach them.
The safe harbor itself is conditional on more than the 31 days. § 310.4(b)(3) of the Telemarketing Sales Rule, which sets out the five conditions a seller must meet to claim the do-not-call safe harbor, requires written procedures, personnel trained in them, a maintained entity-specific list, the 31-day registry process with records documenting it, and monitoring and enforcement of those procedures. The FCC’s parallel conditions sit at § 64.1200(c)(2)(i). Four of those five conditions are documents. A current scrub with no written procedure behind it still fails the safe harbor.
Two lists are in play and audits conflate them. The national registry is one. Your entity-specific do-not-call list is the other, and a request to join it is honored for five years from the date it was made. Sample both.
For scrub frequency and tooling, the breakdown of DNC scrubbing best practices and the mistakes that lead to fines goes deeper than the audit step does.
Are your calls landing inside the legal windows, and is your abandonment rate defensible?
Four federal limits govern call timing and pacing: an 8:00 a.m. to 9:00 p.m. local window, abandonment no higher than three percent, 15 seconds or four rings before disconnect, and accurate caller ID.
All four come straight out of the dialer export. This section is the fastest win in the audit because it needs no interpretation.
Calling hours
The federal window is 8:00 a.m. to 9:00 p.m. local time at the called person’s location, under both the TSR’s calling-time restriction and the FCC’s solicitation rule. The audit error is timezone, not intent. Campaigns that calculate the window from the dialer’s timezone rather than the recipient’s show a clean record in the office and a 7:00 a.m. call in the recipient’s day. Reconcile a sample by appended timezone, never by the dialer’s clock.
Abandonment
No more than three percent of calls answered by a person, measured over the duration of a single campaign if it runs under 30 days, or over each successive 30-day period if it runs longer. A call counts as abandoned if a live representative does not pick up within two seconds of the person finishing their greeting. A blended annual abandonment rate measures something the rule does not. Recalculate per campaign, per 30-day block.
Ring time
At least 15 seconds or four rings before disconnecting an unanswered call.
Caller ID
The transmitted number and, where the carrier makes it available, the name must reach the recipient’s caller ID service. Substituting the seller’s name and a customer service number answered during business hours is permitted. A number nobody answers is not.
A failing number here is not a culture problem. It is one misconfigured campaign that nobody re-checked after launch, which a quarterly audit catches cheaply and an enforcement letter catches expensively. If dialer configuration is where your sample falls down, fix it at the campaign template rather than per campaign, or the same error recurs at the next launch.
How fast do opt-outs actually take effect in your system?
Measure this in hours, not in policy language. The requirement is that a do-not-call request be honored within a reasonable time not exceeding ten business days from receipt, and the same ten-business-day ceiling applies to revocation of consent.
The audit measures the real interval: timestamp of the request, timestamp of suppression, for every opt-out in your sample.
Revocation is broader than most suppression workflows assume. A called party may revoke by any reasonable method. Replying to a text with stop, quit, end, revoke, opt out, cancel or unsubscribe is a reasonable method on its face, and so is using an interactive opt-out mechanism on a call or a designated website or phone line. Other wording counts if a reasonable person would read it as a request to stop. Suppression logic that keys on the literal word STOP leaves revocations sitting unprocessed in an inbox.
This area is in motion. On 9 September 2026 the FCC adopted amendments to the revocation rules that narrow the “revoke all” requirement for informational calls and let callers designate one approved opt-out method as exclusive. The codified text still prohibits designating an exclusive means. At the time of writing the amended rule is adopted and the codified requirement is the older one.
One thing does not change in any version of the order. For a telemarketing or advertising message, a single revocation stops all future telemarketing from that caller. The category-specific flexibility covers informational messages only, which makes the classification of each campaign a live audit question rather than a labeling exercise.
Sampling script adherence and agent training records
Sample script adherence by listening: pull 20 recorded calls across at least three agents and three days, and score each against the approved script and the required oral disclosures.
Script compliance is the one control an audit cannot test from a database. That is why teams skip it, and why the real exposure sits there.
The disclosures are specific. In an outbound call to induce a purchase, the telemarketer discloses the identity of the seller, that the purpose of the call is to sell goods or services, and the nature of those goods or services, truthfully and promptly. Scoring is binary per call per element. Partial credit teaches nothing.
Training documentation gets pulled alongside. Both the FTC and FCC safe harbors require personnel trained in the written procedures, and “we cover it in onboarding” is not a record. What you need is a dated roster showing who was trained, on what version of the procedures, and when.
The drift pattern is predictable. Adherence runs high in week one and decays as agents find phrasings that convert better. None of it is bad faith. It is why adherence is sampled on a schedule rather than checked once at launch, and why enforcement with a defined consequence holds where guidance does not. Operations that treat deviation from required disclosure language as an automatic QA failure, rather than a coaching note, hold adherence across a campaign’s full life.
Which state rules change your audit, and where the map moved in 2026
Add a state overlay pass for every state in your dialing footprint. The federal baseline is the floor, not the ceiling, and several states moved recently enough that a review built on 2024 assumptions will miss them.
Three examples of what the overlay catches. Texas broadened its telemarketing statute effective 1 September 2025 to cover text and image messages, with a private right of action and statutory damages up to $5,000 per violation. Oregon’s rules took effect 1 January 2026 with contact hours of 8 a.m. to 8 p.m., a cap of three calls per consumer per day, and texts expressly included. Virginia’s amendments, also effective at the start of 2026, require that a texted STOP or UNSUBSCRIBE be honored for at least ten years, double the federal five-year standard for entity-specific requests.
Three of your controls become per-state rather than global: the calling window, the contact frequency cap, and the opt-out retention period. A single national suppression policy set to five years is compliant federally and short in Virginia.
Federal text exposure moved in the same direction. In Steidinger v. Blackstone Medical Services, decided 14 July 2026, the Seventh Circuit held that text messages are not “telephone calls” under the do-not-call private right of action, splitting with the Ninth Circuit, which had read the provision the other way in January 2026. The practical effect for an audit is that a texting program’s exposure now depends on which circuit a claim lands in, and that plaintiffs have more reason to plead under state statutes instead. Audit your texting controls against the strictest state in your footprint rather than against the federal floor.
Running a genuinely multi-state program means holding several of these at once, and the operational answer is a per-state rule table the dialer enforces rather than a policy document agents are expected to remember. The current state-by-state position is maintained in the state-by-state mini-TCPA reference guide for multi-state campaigns. If your campaign records calls, a separate consent-to-record overlay applies on top of this one, and it follows different state lines again.
Who owns the records when a vendor runs the campaign?
Whoever the written agreement says. A seller and telemarketer may allocate recordkeeping responsibility between themselves by written agreement; where the agreement is silent or unclear, both are responsible.
If a partner dials on your behalf, the audit extends to them, and that default catches people out. Where the parties do allocate the duty, each keeps only its own share.
So the audit step is to read the contract. Does it say who holds consent records, call detail and registry-access logs? Does it give you retained access to records the vendor creates on your behalf? Where a vendor holds the records, the rule still requires the seller to have practices in place ensuring the vendor complies.
The failure scenario is mundane and expensive. A campaign ends, the vendor relationship winds down, and eighteen months later a demand arrives covering calls from that campaign. The consent evidence and the scrub logs sit on a system you no longer have an account for, held by a company with no commercial reason to prioritize your request. Nothing was violated at the time of the call. The record became unreachable, and unreachable is functionally the same as absent.
The safeguard is a clause and an export. Name the record categories in the contract, require delivery of a full export at termination, and test that export once while the relationship is still warm. A contract that names the categories but has never been exercised is an untested control, same as any other.
Working through your own audit?
If a control comes back inconclusive, or the records exist but sit with a partner, our compliance team can look at the same evidence with you. Operational review, not legal advice.
How often should you run this, and when does it stop being a self-audit?
Quarterly for live campaigns, plus a pass at every launch and every new state. The logic is arithmetic, not regulatory: controls drift continuously, and the cost of a finding scales with how long it ran undetected.
A misconfigured calling window found in week two affects a few hundred records. The same misconfiguration found at an annual review affects everything dialed in between.
Four signals mean the internal pass has reached its limit. A control fails and the records cannot explain why. A demand letter or regulatory inquiry is already in hand, which gives the exercise a litigation posture and moves it to counsel. The footprint crosses more than three or four state regimes, past the point where one person maintains the per-state rule table accurately. Or the finding implicates the vendor rather than you, which means auditing a party whose cooperation you cannot compel. Any one of the four is enough.
Hold on to the distinction the better buyers in this space already make. A TCPA attorney tells you what your exposure means and defends it. An operational review tells you what your campaign is doing and fixes the process. The two are not interchangeable. Most teams need the second far more often than the first, and the second is what this post describes.
Now state the upside, because the compliance conversation dwells on the downside. A completed audit leaves you with a dated evidence file, a known set of gaps with owners against them, and the ability to answer a complaint in days rather than weeks. It also makes the program easier to scale. Adding states, volume or channels becomes a question of extending a control set you can see, rather than a bet on a system nobody has looked inside. Documentation carries more weight now than it did two years ago, because the deference courts give regulators has narrowed twice in quick succession. Loper Bright Enterprises v. Raimondo, decided 28 June 2024, ended the rule that courts defer to an agency’s reading of an ambiguous statute. A year later the Supreme Court held that district courts are not bound by the FCC’s interpretation of the TCPA in private litigation, and the reasoning is set out in the opinion in McLaughlin Chiropractic Associates v. McKesson. Both cut the same way for an outbound program: an FCC order is a weaker shield than it was, and the evidence you hold about your own conduct is a stronger one.
Frequently asked questions
How do I audit my own outbound calling campaign for TCPA compliance?
Pull your call detail, consent records, scrub logs and written procedures for a defined campaign and period, then test them against a fixed control set: consent documentation, do-not-call scrubbing freshness, calling windows, abandonment rate, opt-out processing speed, script adherence and any state-specific rules in your footprint. Document what each control shows, including the controls you could not evidence. A first pass on a single campaign runs three to five working days.
What documents should I pull to check whether my telemarketing campaign is compliant?
At minimum: every script and prerecorded message version used in the period, per-call records showing numbers, timestamps, duration and disposition, consent records showing what was agreed and when, your entity-specific do-not-call list with request dates, evidence of which national registry version was used and when it was obtained, agent training rosters, and any contract allocating recordkeeping duties to a vendor. The FTC’s Telemarketing Sales Rule requires most of these to be retained for five years, so the list doubles as an inventory check.
How often should we run a compliance audit on our outbound program?
Quarterly for campaigns running continuously, plus a review at each campaign launch and whenever you add a state or a channel. Quarterly keeps the volume of any single finding small enough to remediate. Annual reviews surface problems that have already affected every record dialed since the last one.
How do I know when to bring in a compliance consultant or a TCPA attorney?
Bring in counsel when there is a demand letter, a regulatory inquiry or an actual dispute, because those questions are about legal exposure. Bring in an operational reviewer when a control fails and your records cannot explain why, when your footprint crosses several state regimes, or when the gap sits with a vendor whose cooperation you cannot compel. The two roles answer different questions and are not substitutes.
Does a compliance audit protect us if something has already gone wrong?
It does not erase a past violation, but documented self-review is built into how several safe harbors work. The do-not-call safe harbor is conditional on written procedures, trained personnel and monitoring and enforcement of those procedures. The recordkeeping safe harbor is conditional on correcting failures within 30 days of discovering them. Both describe an organization that finds its own problems on a schedule.
Put a number on what the gaps are worth
If the audit surfaced gaps, the next question is scale. The compliance risk calculator takes your monthly call volume and an estimated error rate and returns the exposure those gaps carry under the TCPA and the Telemarketing Sales Rule.
