Your filter can be working perfectly and you can still take an audit finding. Auditors check paperwork, not just technology, and CIPA compliance is part of every E-rate audit. With the FCC now running a top-to-bottom review of the program, this is a good moment to make sure your documentation is as solid as your filtering.

The Three Certifications 

To qualify for E-rate discounts on internet access or Category Two services, applicants must adhere to these three major components of CIPA compliance: 

  1. A technology protection measure (in practice, your content filter) blocks obscene material, child pornography, and content harmful to minors. 
  2. The filter is operating and enforced. 
  3. Your district adopted its internet safety policy only after providing public notice and holding a public hearing or meeting on it. 

At least one public notice and one public hearing or meeting is required before the Internet Safety Policy is adopted, not after. A policy adopted without that step beforehand is out of compliance, regardless of what the policy itself says. 

That policy, in turn, has to address six required elements: 

  • Minors’ exposure to inappropriate material 
  • Safety in direct electronic communications 
  • Unauthorized access or “hacking” 
  • Disclosure of personal information 
  • Restriction of harmful materials 
  • The filter itself 

Monitoring students’ online activity and teaching digital citizenship are recommended but not legally mandated. Even so, auditors have long expected to see evidence of both. 

Where Audits Dig In 

Auditors typically organize their questions around three pressure points, largely unchanged from year to year. 

  • Policy: Auditors want a revision history and a clear owner. Districts usually have the policy, not the paper trail behind it.
  • Process: The notice and the meeting have to come before adoption, and you have to prove that sequence years later.
  • Technology: Filters pass. Filter documentation is what doesn’t. Have installation dates, renewals, and logs from the funding year under review.

If you can’t produce that paperwork, even if the filter was working the whole time, you risk a finding simply for lacking a record. 

The Takeaway 

The fix isn’t complicated, just disciplined: 

  • Keep your safety policy’s full revision history. 
  • Retain meeting notices and minutes. 
  • Document every filter renewal and installation. 
  • Log what gets blocked. 
  • File certification forms for every funding year. 
  • Keep all of it for as long as E-rate’s document retention period requires. 

With FCC rules for Category One and Category Two services potentially shifting as the broader program review continues, treating CIPA as a living compliance obligation, not a one-time filing, is what will serve you best during an audit. 

The Funds For Learning Guide team works with applicants on CIPA documentation all the time. Schedule a free consultation to talk through where you stand.

About the Author: Audra Thayer has worked in E-rate for 11 years, finding fulfillment in relieving some of the stress from schools’ and libraries’ overloaded positions by keeping them informed and on task, so they feel supported and assured that all of their E-Rate needs are being met. Outside of work, she is a proud wife to a firefighter/EMT and a busy mom of two, Walker and Colbie, and the family loves spending weekends outdoors in Cleveland, TN–whether at a dirt bike race or on their boat on the Hiwassee River.