Annual Radiation Protection Program Audit

Introduction

Every radioactive material licensee is required to review its radiation protection program at least once a year — and that review is meant to test how the program actually works, not just confirm that a binder exists. The requirement lives in 10 CFR 20.1101(c): licensees must periodically, and at least annually, review the radiation protection program content and its implementation.¹

That last word — implementation — is where many programs fall short. It is straightforward to keep a written radiation safety manual on a shelf. It is harder to demonstrate that dosimeters are being read on schedule, that survey meters are calibrated, that leak tests are current, that workers received their annual instruction, and that occupational doses are trending as low as reasonably achievable. The annual review is the mechanism that surfaces those gaps before an inspector, or an incident, does.

This guide explains what the annual radiation protection program audit must cover, how to structure it as a performance-based review rather than a checklist, how ALARA and dose limits fit in, what records to keep and for how long, and how the audit doubles as inspection preparation. DRPS supports this work through Radiation Safety Officer consulting, radioactive material license support, and radiation safety training across the states it serves.

Topic Explanation

What the regulation actually requires

10 CFR 20.1101 sets out four linked obligations, and the annual review ties them together.¹ The section requires each licensee to:

• (a) develop, document, and implement a radiation protection program commensurate with the scope and extent of licensed activities and sufficient to ensure compliance with Part 20;
• (b) use, to the extent practical, procedures and engineering controls to achieve occupational and public doses that are as low as is reasonably achievable (ALARA);
• (c) periodically (at least annually) review the radiation protection program content and implementation; and
• (d) constrain air emissions of licensed radioactive material so that a member of the public is not likely to receive a total effective dose equivalent exceeding 0.1 mSv (10 mrem) per year from those emissions.¹

The annual review under (c) is the internal control that checks whether (a), (b), and (d) are actually being met in practice. It is deliberately performance-based: the NRC's expectation is that the reviewer examines both the program documents and the program as implemented.¹⁹

Content versus implementation

The two halves of the review are distinct:

• Content — are the written provisions still adequate? Has the license been amended, has a new radionuclide or procedure been added, has staffing changed, has a new device or room come online? The manual must keep pace with the actual operation.
• Implementation — is the program being carried out as written? Are the surveys being done, the badges read, the sources leak-tested, the training delivered, the records kept? This is tested by observing work in progress, interviewing staff, and spot-checking records — not by re-reading the manual.⁹

A review that only confirms the manual exists misses the point. The most valuable findings come from comparing what the program says against what the program does. For the standing oversight structure that receives these findings, see our guide to the Radiation Safety Committee, and for the role that usually leads the review, the Radiation Safety Officer role.

Key Technical Principles

The dose limits the audit measures against

A central task of the annual review is comparing measured occupational and public doses against the regulatory limits and against the program's own investigational levels. The Part 20 limits are the fixed reference points.

The audit does not simply confirm doses are below these ceilings. Under the ALARA obligation of 20.1101(b), a strong program sets investigational levels well below the limits so that a rising trend is caught early.¹¹⁰

Worked example: investigational levels and the ALARA trigger

Total effective dose equivalent is the sum of external and internal dose:

where DDE is the deep-dose equivalent from external exposure and CEDE is the committed effective dose equivalent from any intake.

Many programs set an Investigational Level I at 10% and Investigational Level II at 30% of the applicable dose limit, evaluated per monitoring period. Taking the occupational annual TEDE limit of 50 mSv and a quarterly monitoring period, the quarterly-equivalent limit is 12.5 mSv, so:

If a technologist records a quarterly deep-dose equivalent of 1.4 mSv, that is only 11% of the quarterly limit — well within regulation — but it exceeds IL-I. The ALARA program should trigger an RSO review: is the badge placement correct, has the workload changed, are shielding and technique optimal? Catching a 1.4 mSv quarter is exactly the point of investigational levels; waiting until a worker approaches 12.5 mSv would defeat ALARA.¹¹⁰¹¹ Occupational-dose review of this kind is covered further in our guide to occupational exposure monitoring.

The audit as a system, not a checklist

The most defensible annual reviews are structured around program elements, each with a defined check, a governing citation, and a cadence. Confirming that each element is both documented and implemented is what turns the review from a formality into a control.

Clinical Impact

The annual program audit protects the people the program exists for — workers, patients, and the public — and it protects the license. Its practical value shows up in three ways.

First, it catches drift. Programs degrade quietly: a survey meter's calibration lapses, a leak test slips past its six-month interval, a new hire never gets documented instruction, a decommissioned room is still on the posting list. None of these is dramatic on its own, but each is a violation waiting to be cited and, more importantly, a small hole in the safety net. An annual review that spot-checks implementation finds them while they are cheap to fix.

Second, it makes the ALARA obligation real. Dose limits are ceilings, not goals. A program that only checks whether anyone exceeded 50 mSv has abandoned ALARA. The annual review is where dose trends are examined, investigational-level exceedances are reconciled, and optimization opportunities — better shielding, technique changes, workflow adjustments — are identified and assigned. This is the difference between a program that is merely compliant and one that is genuinely protective.

Third, it is inspection insurance. When an NRC or Agreement State inspector arrives, one of the first requests is the record of the most recent radiation protection program review. A current, thorough audit with documented findings and closed corrective actions tells the inspector the licensee governs itself — which shapes the entire tone of the inspection. Its absence signals the opposite. For a fuller treatment, see our guide to preparing for an NRC inspection and the recurring problems in common radiation safety violations.

Practical Optimization Tips

1. Audit against a fixed element list

Structure the review around a standing list of program elements so nothing is missed year to year. The table below is a representative scope for a medical materials licensee.

2. Test implementation, not just documents

Observe a survey being performed, watch a dose administered, ask a technologist where the NRC Form 3 is posted. Performance-based verification finds what a document review cannot.⁹

3. Use investigational levels and act on them

Set IL-I and IL-II below the limits, and — critically — document what was done when a level was exceeded. An unexplained investigational-level exceedance is itself an audit finding.¹¹⁰

4. Close findings with corrective actions

Every finding should have a corrective action, an owner, and a due date, with follow-up verified at the next review. An audit that lists problems but never closes them is worse than none.

5. Keep the record for three years

Retain the audit report, findings, corrective actions, and evidence of follow-up together for at least three years, as required for records of program reviews.²

Common pitfalls to avoid

• Reviewing only the manual. The regulation requires reviewing implementation, not just content.¹⁹
• Skipping the ALARA analysis. A dose-limit check is not an ALARA review.¹
• Leaving findings open. Uncorrected findings compound and become repeat violations.
• Losing the record. Audit records must be retained for three years and produced on request.²
• Treating it as annual-only. Some elements (leak tests, inventory) are more frequent; the annual review confirms they happened on schedule.⁷

Regulatory Considerations

The annual program review is a federal requirement with parallel Agreement State versions, and it interlocks with the rest of Parts 19, 20, and 35. The core citation is 10 CFR 20.1101(c), but the audit's authority and scope draw on several sections.¹²³⁸

• 10 CFR 20.1101 — the radiation protection program and the annual review requirement itself.¹
• 10 CFR 20.2102 — records of the radiation protection program, including audits and other reviews of program content and implementation; these review records are retained for three years.²
• 10 CFR Part 35 — for medical licensees, the medical-use requirements the audit verifies, including the RSO's duties, survey-instrument calibration, sealed-source leak testing and inventory, written directives, and medical-event reporting.³⁷
• 10 CFR Part 19 — instructions to workers and posting of notices, including the NRC Form 3.⁸
• NRC NUREG-1556, Volume 9 — program-specific guidance for medical-use licenses that describes the expected audit and program-review practices, and NRC Regulatory Guide 8.10, the operating philosophy for maintaining occupational exposures ALARA.⁹¹⁰

Agreement States administer compatible programs. Of the states DRPS serves, Florida, Maryland, Virginia, California, Nevada, Pennsylvania, New York, and New Jersey are NRC Agreement States that license and inspect radioactive material medical use under their own compatible rules, while Washington, DC and Delaware are regulated directly by the NRC. The annual program-review obligation exists in each, though the citation number and some administrative details differ. A licensee must confirm which authority holds its license and apply that authority's version of the requirement.¹ X-ray-producing machines are separately regulated by the FDA and the state radiation-control program, so a facility with both radioactive material and imaging machines should ensure its program review addresses both regulatory streams. DRPS coordinates these reviews through Radiation Safety Officer consulting and radioactive material license support.

Frequently Asked Questions (FAQs)

What does 10 CFR 20.1101(c) require?

10 CFR 20.1101(c) requires each licensee to periodically — at least annually — review the radiation protection program content and its implementation. It is a two-part obligation: the program's written provisions must be reviewed for adequacy, and the way the program is actually carried out must be reviewed against those provisions and against the regulations.

Is the annual radiation protection program review the same as an ALARA review?

They overlap but are not identical. The 10 CFR 20.1101(c) review covers the entire program — dosimetry, surveys, training, records, postings, waste, and more. The ALARA review under 20.1101(b) focuses on whether occupational and public doses are being kept as low as reasonably achievable. A good annual audit includes the ALARA evaluation as one of its components.

Who performs the annual program audit?

The Radiation Safety Officer usually leads it, often with support from a qualified medical physicist or radiation safety consultant, and the results are typically reported to the Radiation Safety Committee where one exists. Using an independent reviewer for at least part of the audit strengthens objectivity and mirrors how an inspector evaluates the program.

How long must audit records be kept?

Records of audits and other reviews of the radiation protection program content and implementation must be retained for 3 years under 10 CFR 20.2102. The underlying program provisions are retained for the life of the program. Keeping the audit report, findings, corrective actions, and follow-up together makes the record defensible during inspection.

What happens if the annual review is skipped?

A missing or undocumented annual program review is a common inspection finding and can result in a notice of violation. Beyond the citation itself, a skipped review means problems — overdue calibrations, missed leak tests, dose trends, or training gaps — go undetected until an inspector or an incident surfaces them, which is a worse outcome than the violation.

What should the audit actually examine?

It should examine occupational and public dose records against limits and investigational levels, survey and instrument-calibration records, sealed-source leak tests and inventory, training and worker-instruction records, postings and labeling, radioactive waste handling, and, for medical licensees, written directives and any medical events. The review should test implementation by observing work and spot-checking records, not just confirm that documents exist.

Does an Agreement State have the same annual review requirement?

Yes. Agreement States adopt regulations compatible with the NRC, so an equivalent annual radiation protection program review requirement applies under the state's rules. Of the states DRPS serves, most are Agreement States that administer their own compatible program, while Washington, DC and Delaware are regulated directly by the NRC for radioactive material.

Key Takeaways

• The review is required at least annually. 10 CFR 20.1101(c) mandates a periodic review of program content and implementation.
• Implementation is the hard part. Test what the program does, not just what the manual says, by observing work and spot-checking records.
• Measure against limits and investigational levels. Compare doses to the Part 20 limits and to ALARA investigational levels set well below them.
• Close every finding. Assign corrective actions with owners and due dates, and verify them at the next review.
• Keep records three years. Audit and program-review records are retained for three years under 10 CFR 20.2102.
• It is inspection insurance. A current, thorough audit is one of the first things an inspector wants to see and sets the tone for the whole inspection.

Conclusion

The annual radiation protection program audit is easy to treat as a formality and expensive to treat that way. The regulation asks for something specific and useful: an honest look, at least once a year, at whether the program on paper matches the program in practice, and whether doses are being kept not just legal but as low as reasonably achievable. Done well, it is the licensee's own early-warning system — the control that finds the lapsed calibration, the missed leak test, the untracked dose trend before they become incidents or violations.

The best audits are performance-based, structured around a fixed element list, measured against clear limits and investigational levels, and closed out with corrective actions that are verified the following year. That discipline turns a compliance obligation into a genuine safety asset, and it makes the next inspection a demonstration of self-governance rather than a scramble. The RSO who runs the audit that way is not just meeting 20.1101(c) — they are running a program that protects people.

How DRPS Can Help

Diagnostic Radiation Physics Services helps licensees build and run defensible radiation protection program reviews. This includes independent annual program audits, ALARA and dose-trend analysis, records and calibration reviews, corrective-action tracking, inspection-readiness assessments, Radiation Safety Officer consulting, radioactive material license support, and radiation safety training delivered by board-certified medical physicists.

DRPS supports facilities across our service locations, including Florida, Maryland, Virginia, Washington DC, California, Nevada, New York, Pennsylvania, New Jersey, and Delaware.

A strong program review is not just about passing an inspection. It is about knowing — before anyone asks — that the safety program you wrote is the safety program you are running.

Related Resources

• Building an ALARA program
• The Radiation Safety Officer role
• The Radiation Safety Committee
• Preparing for an NRC inspection
• Common radiation safety violations
• Occupational exposure monitoring
• Radiation Safety Officer consulting
• Radioactive material license support

References

1. U.S. Nuclear Regulatory Commission. 10 CFR 20.1101: Radiation protection programs. ecfr.gov
2. U.S. Nuclear Regulatory Commission. 10 CFR 20.2102: Records of radiation protection programs. ecfr.gov
3. U.S. Nuclear Regulatory Commission. 10 CFR Part 35: Medical Use of Byproduct Material. ecfr.gov
4. U.S. Nuclear Regulatory Commission. 10 CFR 20.1201: Occupational dose limits for adults. ecfr.gov
5. U.S. Nuclear Regulatory Commission. 10 CFR 20.1301: Dose limits for individual members of the public. ecfr.gov
6. U.S. Nuclear Regulatory Commission. 10 CFR 20.1208: Dose to an embryo/fetus. ecfr.gov
7. U.S. Nuclear Regulatory Commission. 10 CFR 35.61 and 35.67: Calibration of survey instruments; possession, use, calibration, and check of sealed sources. ecfr.gov
8. U.S. Nuclear Regulatory Commission. 10 CFR Part 19: Notices, Instructions and Reports to Workers; Inspection and Investigations. ecfr.gov
9. U.S. Nuclear Regulatory Commission. NUREG-1556, Volume 9, Revision 3: Consolidated Guidance About Materials Licenses — Program-Specific Guidance About Medical Use Licenses. nrc.gov
10. U.S. Nuclear Regulatory Commission. Regulatory Guide 8.10, Revision 2: Operating Philosophy for Maintaining Occupational Radiation Exposures As Low As Is Reasonably Achievable. nrc.gov
11. International Commission on Radiological Protection. ICRP Publication 103: The 2007 Recommendations of the International Commission on Radiological Protection. Annals of the ICRP. 2007;37(2-4). icrp.org