# ALPR self-audit pack (free)

For the person who runs the monthly or yearly ALPR audit. Works on any vendor's search-audit export (Flock, Axon, Motorola Vigilant) that has, per search: date and time, user account, plate or partial plate, reason or case field, and the agency or network searched. Built from Tensorust's audit scope (Colorado Springs RFP R26-101MZ) and the state rules verified Nov 1, 2026. No data leaves your building to use this.

## 1. Monthly query set

Run each on the last month of the export. Put every hit on a review list with the user and the search id, not the plate.

| # | Check | How | Why |
|---|---|---|---|
| 1 | Missing reason | Reason and case fields both blank | Most state laws and policies require a documented purpose |
| 2 | Vague reason | Reason is only a generic word ("investigation", "inv", "test", "check", "suspicious", "follow up", "per sgt") and no case number | A reason that fits every search documents none |
| 3 | Case number not real | Case number does not match your RMS or CAD format, or is not in the RMS for that date range | Catches invented or reused case numbers |
| 4 | Same plate, many searches | One plate (or partial) searched 3+ times in 30 days by one user without a case number | Pattern seen in personal-use misuse cases |
| 5 | Off-hours use | Searches outside the user's assigned shift (join to scheduling) | Personal-use indicator |
| 6 | Departed or inactive accounts | User account active after separation or extended leave (join to HR list) | Account control |
| 7 | Outside-agency searches | Searches run against other agencies' networks, especially out of state or federal | Sharing limits (CA Civil Code 1798.90.55; Va. Code 2.2-5517(F); WA ESSB 6002) |
| 8 | Shared or generic accounts | One account used from many locations or by a role name | Accountability |
| 9 | Retention | Oldest read and oldest audit record held vs. your retention rule (VA: data 21 days, audit trail 2 years; WA: keep vendor audit trail 2 years) | Retention compliance |
| 10 | Volume by user | Users above 3x the median searches | Where to look first |

## 2. State checklist (short form)

| State | Audit | Report | Other |
|---|---|---|---|
| Virginia (Code 2.2-5517) | Internal audit at least every 30 days (H(6)) | Quarterly State Police online form: Q4 due Jan 1, Q1 Apr 1, Q2 Jul 1, Q3 Oct 1; annual report by Apr 1 | Data purged after 21 days, audit trail kept 2 years; no sharing with other states, federal, private or commercial databases (F); willful misuse is a Class 1 misdemeanor (N) |
| Minnesota (Stat. 13.824) | Independent biennial audit (subd. 6(a)) | Summary to the Commissioner of Administration, legislative chairs and the LCDP within 30 days (6(c)) | Pattern of substantial noncompliance suspends all readers (6(b)) |
| Washington (ESSB 6002, 2026 Laws ch. 239) | Internal audit at least yearly of all access and use, retention, purging and sharing (sec. 8(3)) | Annual report to the Legislature (sec. 7) | Download and keep the vendor audit trail 2 years (8(1)(c)) |
| California (Civil Code 1798.90.5 to 1798.90.55) | Per your usage and privacy policy | | Sharing only with California public agencies (1798.90.55) |

Check your own statute and policy; this table is a summary, not legal advice.

## 3. Virginia purpose-code map (State Police quarterly form)

The form accepts only 7 purpose codes (M, E, H, W, V, L, O, as listed in the State Police ALPR reporting spec, version 1.0 dated 12/10/25). Map every free-text reason in your export to one of them before the quarter closes; reasons that map to none go on the review list. Use the code definitions in the spec itself (vsp.es.virginia.gov, ALPR Reporting Requirements v2) when you build the map.

## 4. Free one-month read

Send one month of the export through a link you control. We return the counts for checks 1 to 10 within 2 business days, with no names and no plates, and delete the file within 30 days.

mattbusel@tensorust.com | Tensorust LLC | UEI HEKQANCBH3F9