FTA SSO Audit Report

State Safety Oversight

Final Audit Report

North Carolina Department of Transportation (NCDOT)

Federal Transit Administration

U.S. Department of Transportation

Office of Transit Safety and Oversight

1200 New Jersey Avenue, SE

Washington, DC 20590

D
ates Conducted: November 15-17, 2017

Date Issued:

Table of Contents

Results in Brief 1

Previous Audits 1

Section 1: Agency Designation 1

SSOA Designation - Specific Criteria 1

Section 2: Program Management and Standard 2

Program Management - Specific Criteria 2

Program Standard - Specific Criteria 3

Section 3: CATS Safety and Security Plan Oversight 4

Safety and Security Plans - Specific Criteria 4

Section 4: Hazard Management 6

Hazard Identification and Notification - Specific Criteria 6

CATS Hazard Identification 6

Hazard Reporting, Investigation, and Tracking - Specific Criteria 7

Section 5: Accident Notification and Investigation 8

Accident Notification - Specific Criteria 8

Accident Investigation - Specific Criteria 9

Section 6: Corrective Actions 9

Corrective Action Plan (CAP) Approval - Specific Criteria 9

Corrective Action Plan Verification - Specific Criteria 10

Corrective Action Plan Tracking - Specific Criteria 10

Section 7: RTA Internal Reviews 10

Internal Review Cycle - Specific Criteria 10

Section 8: SSOA Three-Year Reviews 11

Conducting Three-Year Reviews - Specific Criteria 11

Section 9: SSOA Annual Reports 12

Annual Submission - Specific Criteria 12

Summary of Findings 13

Exhibit A – Acronyms A-1

Exhibit B –Agency's Comments to Draft Audit Report B-1

Exhibit C – Audit Reference Information C-1

Exhibit D – Audit Findings Tracking Matrix D-1

Results in Brief

A federally-mandated three-year review of the North Carolina Department of Transportation (NCDOT) State Safety Oversight (SSO) Program was conducted by the Federal Transit Administration (FTA) Office of Transit Safety and Oversight (TSO) in accordance with the Final Rule, 49 Code of Federal Regulations (C.F.R.) Part 659. The audit included staff interviews and reviews of NCDOT’s safety, security, accident and incident, and hazard management documents.

The audit also included reviews of safety and security documents from the Charlotte Area Transit System (CATS), the sole rail fixed guideway public transportation system (RFGPTS) overseen by NCDOT. Document review included NCDOT’s current SSO Program for Rail Fixed Guideway Systems (hereafter Program Standard), Final Revision (March 2012). Safety and security documents, letters and memos, and tracking logs were also reviewed as part of the audit. The Audit Team reviewed CATS’ System Safety Program Plan (SSPP), Revision 14 (March 2017); System Security Plan (SSP), Revision 14 (March 2017); and Emergency Preparedness and Continuity Plan (EPCP); as well as related safety, security, and hazard management documentation.

The Audit Team conducted interviews and site visits from November 15-17, 2017. These included interview sessions with NCDOT’s staff and consultants at CATS’ South Boulevard Light Rail Transit (LRT) Facility located in Charlotte, NC and members of the CATS safety and security staff. The Audit Team toured CATS’ operational facilities including the Operations Control Center (OCC) and its light rail system accompanied by NCDOT and CATS staff. The Audit Team visited both the existing OCC and the new OCC, which was under construction at the time of the audit.

Although not included in this audit, oversight by NCDOT is also provided to the Durham to Orange County Light Rail Transit Project, currently in the preliminary engineering phase under management of GoTriangle, located in Durham, NC.

The FTA SSO audit is designed to identify findings that address the state’s activity to implement Part 659 and other requirements. The Audit Team identified one finding in conjunction with this audit. A Summary of Findings and an Audit Tracking Matrix is included with this report.

Previous Audits

The previous SSO audit of NCDOT, conducted November 17-19, 2014, resulted in no findings.

Section 1: Agency Designation

No findings.

SSOA Designation - Specific Criteria

Part 659.9: “Each State with an existing or anticipated rail fixed guideway system regulated by this part shall designate an oversight agency consistent with the provisions of this section.”

In accordance with 49 C.F.R. Part 659, NCDOT is the designated SSO agency responsible for oversight of the safety and security programs of CATS, the sole RFGPTS in North Carolina. NCDOT’s SSO Program exists within NCDOT’s Rail Division. The SSO Program is managed by NCDOT’s Engineering Coordination and Safety Branch Manager, who reports directly to NCDOT’s Rail Division Director.

The NCDOT’s Program Standard describes the SSO program’s conformance to FTA regulations and the manner in which North Carolina Statute G.S. 136-18 designates NCDOT as the SSO Agency in North Carolina responsible for oversight of Rail Fixed Guideway Systems conforming to the requirements established pursuant to 49 USC Section 5330 originally established in the Intermodal Surface Transportation Efficiency Act of 1991. The Program Standard combines NCDOT’s Program Standard and Procedures and once approved, the Program Standard has the force of regulation, and incorporates by reference FTA’s Part 659 for rail fixed guideway systems, APTA Guidelines, and FTA safety and security implementation guidelines.

CATS is currently the sole operating transit agency overseen by NCDOT. It provides rail service within Charlotte, NC via the LYNX Blue Line LRT System and the CityLYNX Gold Line Streetcar. Currently the Blue Line operates as a 9.6 mile route with 15 stations and seven park and ride locations. The Blue Line Extension (BLE), which entered revenue service in March 2018, is a 9.3-mile long, 11 station extension of the line from its current northern terminus in Uptown Charlotte to the UNC-Charlotte (UNCC) campus to the north.

The CityLYNX Gold Line is a 1.5 mile long streetcar line that operates in mixed traffic and includes six stops within Charlotte’s Central Business District. The Gold Line Phase 2 Project is an approximately 2.5-mile extension of the current service that will include an additional 11 stops and is anticipated to open in February 2020.

Section 2: Program Management and Standard

No findings.

Program Management - Specific Criteria

Part 659.13: “The state oversight agency is responsible for establishing standards for rail safety and security practices and procedures to be used by rail transit agencies within its purview. In addition, the state oversight agency must oversee the execution of these practices and procedures, to ensure compliance with the provision of this part. This subpart identifies and describes the various requirements for the state oversight agency.”

The SSO program is currently managed by NCDOT’s Engineering Coordination and Safety Branch Manager, who oversees several inspectors as well as personnel from ADS System Safety Consulting. This Manager reports to NCDOT’s Rail Division Director. NCDOT’S Rail Division Director then reports to the Deputy Secretary for Transit, who in turn reports to the NCDOT’s Chief Deputy Secretary for Operations and Secretary of Transportation.

Until just prior to the SSO audit, NCDOT employed an SSO Program Manager who reported to the Engineering Coordination and Safety Branch Manager and who managed the SSO consultant and inspectors. Since the incumbent left NCDOT after 16 years in the position, there is now a direct line from NCDOT’s Engineering Coordination and Safety Branch Manager (and Acting SSO Program Manager) to NCDOT’s inspectors and consultant.

The role of the SSO consultant has increased during the past several years, specifically in 2016 and 2017. This is illustrated in Appendix B, Table 1. As shown, in 2014 and 2015 NCDOT SSO staff contributed 0.48 and 0.40 FTEs while the consultant contributed 0.25 and 0.47, yielding FTE totals of 0.73 and 0.88 for 2014 and 2015. However, in 2016 and 2017 the role of the SSO staff decreased to 0.35 and 0.10 while the role of the consultant increased to 1.28 and 1.20. Therefore, the FTE totals increased to 1.63 in 2016 and 1.30 in 2017 from the 0.73 and 0.88 totals in 2014 and 2015.

The new staffing levels are more in line with comparable SSOs in other states and suggest that NCDOT’s SSO program is now more appropriately staffed, addressing a Recommendation to increase staffing levels due to the BLE project that had been identified in the 2014 audit. NCDOT typically employs three Railroad Safety Inspectors. The SSO consultant contributes two staff members whose efforts add up to the 1.28 and 1.20 FTEs (see Appendix B).

CATS has had a number of staffing changes, including the departure of its General Manager of Safety and Security. The agency recently installed experienced internal personnel in the roles of Interim General Manager of Safety and Security, and Interim Rail Manager - Safety, and has hired additional safety department personnel since the last audit. The Interim General Manager of Safety and Security reports directly to CATS’ Chief Executive Officer (CEO). NCDOT personnel stated that even though there has been turnover at CATS and the agency has had five General Managers of Safety and Security over a six-year period, creating some instability, CATS currently has the personnel they need in place.

Program Standard - Specific Criteria

Part 659.15: “Each oversight agency shall develop a written program standard that meets the requirements specified in this part and includes, at a minimum, the areas identified in this section.

The current NCDOT Program Standard meets all requirements of Part 659. NCDOT is financially independent from CATS, has adequate authority to oversee CATS (including the enforcement of the CATS Safety Plan), has an independent funding source, is legislatively created, and has adequate resources to hire an appropriate level of staffing to carry out all oversight responsibilities.

49 USC Section 5329(e) 3(D) determines, in consultation with the Secretary, an appropriate staffing level for the SSO agency that is commensurate with the number, size, and complexity of the transit systems in each state. Section 5329(e) 3(E) requires that employees and other designated personnel of the SSO agency who are responsible for RFGPTS oversight are qualified to perform such functions through appropriate training, including successful completion of the public transportation safety certification training program established under subsection (c). CATS has developed a safety class that is delivered quarterly to its employees. NCDOT teaches a module of the course specific to the SSO program.

NCDOT’s legal and financial independence is outlined and it has the authority to oversee all aspects of CATS’ safety, including taking vehicles out of service, compelling CATS to take corrective actions, and performing audits and inspections. NCDOT has established technical qualifications for staff positions and established training requirements as a term and condition of employment. In addition, the FTA TSO Representative and NCDOT are in communication to address organizational and operational issues.

CATS’ CEO is responsible for overall safety policy. The CEO has delegated executive oversight of safety and security management to the Interim CATS General Manager of Safety and Security, one of seven executive level managers at CATS reporting directly to the CEO.

The CATS Security Manager utilizes personnel from G4S, a private security firm, as well as the Charlotte-Mecklenburg Police Department’s (CMPD) Transit Unit, to provide policing of the transit system. The North Carolina Statute Chapter 74-E (Company Police Act) recognizes the G4S personal as a company police force permitted to be fully uniformed and armed. Interview sessions included CATS’ Security Manager, the CMPD Unit’s Sargent who replaced a retired Sargent subsequent the 2014 review, and the Captain of G4S’s Company Police.

NCDOT attends all CATS Safety and Security Review Committee (SSRC) meetings, quarterly meetings, and monthly individual meetings with CATS’ CEO. The SSO also conducts regular calls with CATS’ General Manager of Safety and Security and Rail Manager - Safety, both of whom are interim personnel. NCDOT is on site at CATS facilities weekly, reviews video footage of any incidents, and communicates with CATS personnel daily.

During development or revision of NCDOT’s Program Standard the document is drafted and reviewed internally by the SSO and also reviewed and commented on by CATS safety and security personnel. However, the SSO stressed that the Program Standard is ultimately NCDOT’s document and the SSO has the final say regarding any content.

The FTA did not identify any findings in Section 2. However, the FTA identified an opportunity for enhancement to the Program Standard. As part of the next review of the Program Standard, NCDOT should take a close look at all sections of the Program Standard for references to the agency SEPP. As described in Section 3 of this Audit Report, CATS prepares a separate SSP and EPCP, and does not have an SEPP. The Program Standard appears to require CATS to develop an SEPP; however, Part 659 does not require that the SSP and EPP be combined into one document.

Section 3: CATS Safety and Security Plan Oversight

Finding 1: As specified in 49 C.F.R. Part 659.19(k)(3): A description of the process used by the rail transit agency to develop an approved, coordinated schedule for all emergency management program activities, which include…Process used to evaluate emergency preparedness: The NCDOT Conformance Checklist for Security and Emergency Preparedness Plans document does not contain sufficient review criteria needed to verify conformance of the EPCP. The SEPP checklist states in its title and throughout its content that its purpose is verifying conformance of both the SSP and EPCP. However, nearly all of the verification information provided in the checklist is for SSP verification only. Since CATS has separate plans for system security and emergency preparedness, NCDOT should prepare separate checklists for each plan or revise the SEPP checklist to better represent the EPCP. Prior to issuing the final SSO Audit Report, NCDOT provided FTA with evidence to support closing the finding. (CLOSED) Refer to Exhibit D – Audit Findings Tracking Matrix.

Safety and Security Plans - Specific Criteria

Part 659.17(a): “The oversight agency shall require the rail transit agency to develop and implement a written system safety program plan that complies with requirements in this part and the oversight agency’s program standard.”

Part 659.17(b): “The oversight agency shall review and approve the rail transit agency system safety program plan.”

Part 659.19 specifies the minimum SSPP requirements.

Parts 659.17 and 659.19 pertain to CATS’ SSPP. Under §659.17, the SSO agency must require transit agencies under its jurisdiction to develop and implement an SSPP that complies with Part 659 requirements and with the SSO agency’s Standard. Further, §659.19 establishes the minimum content that the transit agency must include in its SSPP. NCDOT’s oversight program includes these minimum requirements.

Part 659.21 and 659.23 pertain to a RFGPTS’s System Security Plan (SSP). Under §659.21, the SSO agency must require transit agencies under its jurisdiction to develop and implement an SSP that complies with Part 659’s requirements and the SSO agency’s Program Standard. It specifies that the SSP must be developed and maintained as a separate document from the SSPP. Part 659.23 establishes requirements for the minimum content of an SSP.

The FTA Audit Team reviewed CATS’ required elements of the Part 659-mandated SSPP, Revision 14, March 2017, and SSP, Revision 14, March 2017.

The Audit Team observed that NCDOT ensures through approvals that CATS’ SSPP is well-constructed and up to date. The SSPP contains the elements required by Part 659 and the NCDOT Program Standard. The team also reviewed a number of related safety, security, and hazard management process documents, letters and memos, and tracking logs. CATS’ safety and security documents, with the exception of the SSP and EPCP, classified as Sensitive Security Information (SSI), are available to all personnel.

CATS’s SSPP was revised in March 2017; it adheres to the 21 elements outlined in the NCDOT Program Standard. It includes a certification letter detailing the agency’s policy statement and SSPP authority, signed by the agency’s previous General Manager of Safety and Security.

In accordance with Part 659.25 and the NCDOT Program Standard Section B, CATS reviews its SSPP at least once annually. In accordance with Part 659.29, NCDOT is required to conduct an on-site review of CATS’ implementation of its SSPP and SSP every three years. NCDOT and CATS conduct the SSPP review over a three-year period, splitting the SSPP and SSP elements so that approximately one third are reviewed each calendar year. At the end of each three-year cycle all materials are assembled into a three-year report and submitted to the FTA.

NCDOT’s review process and procedures for CATS’ safety and security documents are described in Sections B.5 and C.5 of NCDOT’s Program Standard. The NCDOT three-year reviews are conducted during a series of quarterly safety and security reviews concurrent with CATS’ own internal safety and security audits. For some items, including SSPP Element 12 (Internal Safety Audit Program), the review process is different. NCDOT conducts the audit alone so that the Audit Team is independent from personnel audited at CATS. NCDOT schedules audits a year in advance. During the last quarterly meeting of the year the SSO develops the next year’s schedule. As dates approach, they are confirmed.

CATS reviews one third of its SSPP annually; each year reviewing different elements. Review of the entire document occurs as part of the triennial review required by Part 659. After the revised SSPP is approved by the SSO it is distributed to CATS’ chief executive officer and safety officials for signatures.

CATS historically conducted internal reviews separately from NCDOT’s three-year reviews but since 2012 the agencies have worked cooperatively during the review process. CATS develops a checklist which NCDOT reviews and submits to CATS, and then NCDOT and CATS conduct a joint audit of the element.

CATS’ SSP, Revision 14, dated March 2017, has been labeled SSI per 49 C.F.R. §1520. Its circulation is limited; at the request of CATS the Audit Team viewed the SSP on site. Once able to review the SSP the Audit Team found several issues related to the document and its Conformance Checklist for Security and Emergency Preparedness Plans, dated March 21, 2017.

The Audit Team identified concerns related to NCDOT’s review of CATS’ SSP. The conformance checklist corresponding with the SSP is entitled Conformance Checklist for Security and Emergency Preparedness Plans (SEPP), yet CATS utilizes an SSP and a separate EPCP, rather than an SEPP. The SSP and EPMC in lieu of an SEPP is allowed under FTA regulations but the checklist text and in NCDOT’s Program Standard should be revised to reflect the names of the CATS documents.

Some of the verification information on the checklist is incorrect. NCDOT’s review and approval process does not appear to include a documented review of CATS’ EPCP even though the checklist references the document. The Audit Team scheduled a conference call with NCDOT for November 28, 2017 to further discuss potential issues surrounding the SSEP review checklist.

Post Site Meeting Note – Representatives from the FTA Audit Team, NCDOT, and CATS’ Security Manager spoke on November 28, 2017 to review incorrect information found in the NCDOT SEPP Checklist by the Audit Team during its review of the EPCP on site. Based on information presented by the Audit Team during the call, NCDOT revised the checklist and resubmitted it to FTA for review on November 29, 2017. The revised checklist corrected most of the misinformation and added additional supporting information to help verify conformance of the SSP to the Program Standard.

The NCDOT Conformance Checklist for Security and Emergency Preparedness Plans does not contain sufficient review criteria needed to verify conformance of the EPCP. The SEPP checklist states in its title and throughout its content that its purpose is verifying conformance of both the SSP and EPCP. However, nearly all the verification information provided in the checklist is for SSP verification only. Since CATS has separate plans for system security and emergency preparedness, NCDOT should prepare separate checklists for each plan or revise the SEPP checklist to better represent the EPCP.

Section 4: Hazard Management

No findings.

Hazard Identification and Notification - Specific Criteria

Part 659.31(b): “The hazard management process must, at a minimum:

5. Define minimum thresholds for the notification and reporting of hazard(s) to oversight agencies;”

CATS Hazard Identification

Part 659.31 provides NCDOT with the authority to require each rail transit agency within North Carolina to document its hazard management process within its SSPP or supporting procedures.

Under Part 659.31(b)(6), an agency’s SSPP must specify the process used to provide reporting of hazard resolution activities to the SSO agency. Section E of NCDOT’s Program Standard and Section 6.0 of CATS’ SSPP establish the requirements for CATS to identify, categorize, investigate, and resolve hazards. The Program Standard and the SSPP provide a definition of hazard and list the minimum requirements that CATS must meet. The documents outline a hazard management process including methods for ensuring that a maximum number of hazards are identified through the hazard resolution process.

Methods used by CATS to identify hazards consist of many possible approaches including: Preliminary Hazard Analysis, Operating Hazard Analysis, Critical/Catastrophic Items List, Fault Tree Analysis, Subsystems Interface Analysis, Human Factors Analysis, and Joint Railroad-Fixed Guideway Corridor Operations.

Section E.2 of the Program Standard outlines the acceptable methodology used to determine which hazards are acceptable, which are acceptable only under certain conditions, and which hazards are categorically unacceptable.

Hazard Reporting, Investigation, and Tracking - Specific Criteria

Part 659.31(b): “The hazard management process must, at a minimum:

4. Identify the mechanism used to track through resolution the identified hazard(s); …

5. Specify the process by which the rail transit agency will provide on-going reporting of hazard resolution activities to the oversight agency.”

Section E.3 of NCDOT’s Program Standard details hazard resolution procedures and provides an illustrative hazard resolution matrix with column values ranging from negligible to catastrophic as well as row values ranging from improbable to frequent. The matrix assists in determination of classification of the relative severity of individual hazards.

Section 6.0 of CATS’ SSPP defines the agency’s hazard management process used to identify and mitigate any hazards. The SSPP provides a hazard management process that conforms to NCDOT’s Program Standard and relevant language related to hazards in Part 659. The SSPP specifies that CATS’ hazard resolution process spans from “cradle to grave” and should be applied throughout the five distinct phases of the system life cycle including: Phase 1, Planning; Phase 2, Design; Phase 3, Construction; Phase 4, Operations; and Phase 5, Disposal.

The CATS SSPP outlines formal components of the hazard management process, including its approach to initial assessment and categorization of hazards. The SSPP includes all required elements. Tables within the document explain the qualitative hazard probability ranking, the hazard risk assessment matrix and acceptance criteria, the cost allocating rating, and hazard rating-corrective action priority rating.

Section 6.7 of CATS’ SSPP outlines a flow chart for the hazard tracking process and details the CATS SPEAR program and NCDOT’s Rail.Safety program. The process includes the following: Facilities/System inspection is performed by internal or external resources; Findings of inspections performed by CATS’ Facilities/Systems are entered into the SPEAR system. In addition, Rail.Safe is used to manage CAPs generated from inspection, accident investigations, audits, hazards, or other means. NCDOT works with the responsible CATS division to correct safety issues and to verify correction and closure of entries.

NCDOT’s Program Standard requires CATS to submit a monthly hazard tracking log detailing the status of all hazards. The SSO Program Standard discusses hazard investigation in considerable detail, including provisions for initial investigative reports, status reports, and final reports. It establishes a requirement for CATS to submit a monthly hazard status investigation report detailing the status of all hazards. The FTA Audit Team reviewed hazard status investigation reports submitted to NCDOT by CATS. The team determined that the SSO agency’s oversight of CATS’ hazard management process is in compliance with its Program Standard and that these processes conform to all relevant sections of Part 659.

During the interviews, CATS personnel noted that there had recently been a great deal of development along the Blue Line ROW and that CATS has cultivated a positive working relationship with developers. Construction crews working along the ROW are required to take roadway worker protection training courses before the developer is permitted to begin construction activities. CATS safety coordinators are able to stop work at any time if an issue is identified.

Section 5: Accident Notification and Investigation

No findings.

Accident Notification - Specific Criteria

Part 659.33(a): “The oversight agency must require the rail transit agency to notify the oversight agency within two (2) hours of any incident involving a rail transit vehicle or taking place on a rail transit-controlled property where one or more of the following occurs:

1. A fatality at the scene, or where an individual is confirmed dead within thirty (30) days of a rail transit-related incident;

2. Injuries requiring immediate medical attention away from the scene for two or more individuals;

3. Property damage to rail transit vehicles, non-rail transit vehicles, other rail transit property or facilities, and non-transit property that equals or exceeds $25,000;

4. An evacuation due to life safety reasons;

5. A collision at a grade crossing;

6. A main line derailment;

7. A collision with an individual on a rail right-of-way; or

8. A collision between a rail transit vehicle and a second rail transit vehicle or a rail transit non-revenue vehicle.”

NCDOT has established notification thresholds that match the minimum specified in §659.33. In turn, CATS’ SSPP defines the thresholds it will use when notifying NCDOT of transit accidents. NCDOT and CATS’ documents accurately define the thresholds they use for accident notification and investigation.

CATS has a process for notifying senior staff and others when an accident occurs. The investigator who responds to the scene assumes control and is responsible for making official accident notification to NCDOT within two hours of the occurrence.

Accident Investigation - Specific Criteria

Part 659.35(b): “The oversight agency must use its own investigation procedures or those that have been formally adopted from the rail transit agency and that have been submitted to FTA.”

Part 659.35(d): “Each investigation must be documented in a final report that includes a description of investigation activities, identified causal and contributing factors, and a corrective action plan.”

NCDOT authorizes CATS to conduct investigations on its behalf for all accidents meeting the thresholds in Part 659 and the Program Standard. Because CATS is authorized to investigate FTA-reportable accidents on NCDOT’s behalf, Part 659 requires NCDOT to review and approve the procedures that CATS will use and to submit these to the FTA. NCDOT reserves the right to conduct its own investigation of an accident meeting the thresholds.

NCDOT requires CATS to include all required elements in its final investigation reports for FTA-reportable accidents and to establish required timeframes for submitting the report to NCDOT. NCDOT further requires CATS to provide a 24-hour accident summary report, including key information compiled at the scene, and a status report that identifies issues and activities every 30 days until the final accident investigation report is submitted NCDOT.

The Audit Team reviewed the accident / incident report form included in the Program Standard and found it fully compliant with Part 659 although with the availability of computer-generated electronic signatures, the Audit Team recommends that a space for the signature of the reporter/investigator be added.

The Audit Team reviewed three recent Accident Notifications that CATS submitted to NCDOT: March 28, 2017 – Hi-Rail Vehicle Derailment [Effect on system – single tracking]; March 16, 2017 – LRV Collision with Vehicle [Effect on system – fatality]; January 30, 2017 LRV Contact with Pedestrian [Effect on system – pedestrian received minor scrapes and bruises]. CATS is complying with accident notification requirements outlined in NCDOT’s Program Standard.

Section 6: Corrective Actions

No findings.

Corrective Action Plan (CAP) Approval - Specific Criteria

Part 659.37(a): “The oversight agency must, at a minimum, require the development of a corrective action plan for the following: (1) Results from investigations, in which identified causal and contributing factors are determined by the rail transit agency or oversight agency as requiring corrective actions; and (2) Findings from safety and security reviews performed by the oversight agency.”

Part 659.37(c): “The corrective action plan must be reviewed and formally approved by the oversight agency.”

NCDOT requires CATS to develop CAPs in response to results from accident and incident investigations in which causal factors require corrective actions. CAPs are also required for any hazards or deficiencies identified from internal and external safety and security reviews performed by either CATS or NCDOT.

Based on the interview conducted on site and the documents presented prior to the site inspection, the Audit Team determined that CATS properly develops CAPS to address Part 659.37(a) and that the NCDOT requirements are in conformance with Part 659.

Corrective Action Plan Verification - Specific Criteria

Part 659.15(b)(7) requires the Program Standard to include a section that identifies “the oversight agency’s policies for the verification and tracking of corrective action plan implementation.”

Part 659.37(f): “The rail transit agency must provide the oversight agency: (1) Verification that the corrective action(s) has been implemented as described in the corrective action plan or that a proposed alternate action(s) has been implemented subject to oversight agency review and approval; and (2) Periodic reports requested by the oversight agency, describing the status of each corrective action(s) not completely implemented, as described in the corrective action.”

NCDOT’s Program Standard Section E.4.3 details the policies for verification and tracking of CAP implementation. NCDOT and CATS make use of NCDOT’s computer-based Rail.Safety Program to enter, track, and approve CAPs. NCDOT also sends to CATS, a formal, signed letter accepting all investigative reports and CAPs, generally within the same day the reports are received or very shortly thereafter. These activities meet all the requirements of §659.37(g) to monitor and track the implementation of each approved CAP and they also conform to the requirements set by NCDOT.

Corrective Action Plan Tracking - Specific Criteria

Part 659.37(g): “The oversight agency must monitor and track the implementation of each approved corrective action plan.”

NCDOT and CATS make use of NCDOT’s computer-based Rail.Safety Program to enter, track, and approve CAPs. During the audit, NCDOT demonstrated to the Audit Team the CAPs application, which provided verification that the corrective actions have been implemented as described in the corrective action plan. The presentation also demonstrated how NCDOT monitors and tracks the implementation of each approved CAP. NCDOT and CATS manage all CAPs through the web-based application, which eliminated the need for CAP submittal and approval letters, and a CAP Matrix.

Section 7: RTA Internal Reviews

No findings.

Internal Review Cycle - Specific Criteria

Part 659.27(b)(2): The oversight agency must require the rail transit agency to “ensure that all elements of the system safety program plan and system security plan are reviewed in an on-going manner and completed over a three-year cycle.”

Section D of NCDOT’s Program Standard describes the requirements for the internal safety and security program review to be implemented by CATS. Section 12 of CATS’ SSPP describes the internal safety audit process and states that the process is intended to verify compliance with the SSPP. CATS conducts reviews, tests, analyses, audits, and inspections to verify compliance and states in the overview to Section 12 that all divisions and contractors are subject to safety audits. The section frequently refers to the approval requirements set by NCDOT and Section 12.3.6 specifies that audits are conducted in coordination with the SSO agency.

NCDOT requires internal safety and security audits to be conducted by CATS for the SSPP and SEPP. Over a three-year period, CATS must audit the implementation of all 21 elements of the SSPP and all 7 elements of the SEPP. Each calendar year, on or before a date designated by NCDOT, CATS must submit a schedule to NCDOT detailing when they will audit these elements over the next three-year period, and provide specific scheduling details (at a minimum the month or quarter of anticipated schedule) for any audits in the next calendar year.

NCDOT reserves the right to participate in CATS’ internal safety and security audits as conducted. NCDOT provides CATS with notification any time it intends to participate in internal safety or security audits. CATS is required to submit a copy of its Annual Safety Activities Report and Safety and Security Audit Report to NCDOT by December 1 of each year. The report, prepared by the transit agency includes results of the Internal Safety and Security Audit Process and includes other audits performed during the preceding year.

After CATS completes each safety or security audit, it must submit a safety or security audit report to NCDOT within 30 days of the audit closure meeting. The report must include the following information:

1. A summary of the internal audit.

2. The completed internal audit checklists.

3. Findings of the internal audit.

4. Suggested corrective actions to address the findings.

These reports will be approved (possibly with comments), conditionally approved, or NCDOT will state that it is “unable to approve” at formal SSO meetings.

Section 8: SSOA Three-Year Reviews

No findings.

Conducting Three-Year Reviews - Specific Criteria

Part 659.29: “At least once every three years, beginning with the initiation of rail transit agency passenger operations, the SSOA must conduct an on-site review of the rail transit agency’s implementation of its SSPP and security plan.

Alternatively, the on-site review may be conducted in an ongoing manner over the three-year timeframe. At the conclusion of the review cycle, the SSOA must prepare and issue a report containing findings and recommendations resulting from that review, which, at a minimum, must include an analysis of the effectiveness of the SSPP and security plan and a determination of whether either should be updated.”

Section G.4 of NCDOT’s Program Standard outlines the three-year review process that is broken into a series of annual safety and security audits to be performed concurrently with the internal safety and security audits conducted by CATS. Selected program elements are audited throughout the year until all elements of the SSPP and SSP (identified as an SEPP within the NCDOT Program Standard) have been evaluated. In conducting the audits, NCDOT works with CATS to establish Audit Teams and to prepare audit schedules and checklists that are used to evaluate CATS’ implementation of its SSPP and SEPP.

Audit reports are developed following each audit, while a final three-year audit report is developed independently by NCDOT at the conclusion of the three-year audit cycle to document NCDOT’s findings, recommendations, corrective actions, and other pertinent program information, including whether the SSPP and/or SSP require revision. CAPs submitted by CATS to address audit findings are reviewed, approved and tracked through implementation following the process specified in Section H of the Program Standard. NCDOT then submits its completed three-year audit report to FTA as part of its Annual Submission.

Section 9: SSOA Annual Reports

No findings.

Annual Submission - Specific Criteria

Part 659.39(c): “Annual submission. Before March 15 of each year the oversight agency must submit the following to FTA:

1. A publicly available annual report summarizing its oversight activities for the preceding twelve months, including a description of the causal factors of investigated accidents, status of corrective actions, updates and modifications to rail transit agency program documentation, and the level of effort used by the oversight agency to carry out its oversight activities.

2. A report documenting and tracking findings from three-year safety review activities, and whether a three-year safety review has been completed since the last annual report was submitted.

3. Program Standard and supporting procedures that have changed during the preceding year.

4. Certification that any changes or modifications to the rail transit agency system safety program plan or system security plan have been reviewed and approved by the oversight agency.”

The minimum reporting requirements by NCDOT to FTA are established in §659.39. Agencies must make an annual submission to FTA before March 15 of each year. The report must include a publicly available report summarizing the agency’s oversight activities for the previous year, including a description of the causal factors of accidents that were investigated, the status of corrective actions, updates, and modifications to the agency’s program documentation, and the level of effort used by the agency to carry out its oversight activities.

The annual report must document and track findings from the three-year reviews and state whether a three-year review had been completed since submission of the last annual report. It must state if the Program Standard and supporting procedures have changed during the preceding year, and it must include NCDOT’s certification that changes or modifications to the transit agency’s SSPP or SSP (SEPP) have been reviewed and approved by the SSO agency. Also, §649.43 requires the SSO agency to certify annually to FTA that it has complied with Part 659 requirements. The FTA Audit Team determined that NCDOT’s reporting to the FTA is in compliance with all reviewed portions of Part 659.

Summary of Findings

Section 1: Agency Designation

No findings.

Section 2: Program Management and Standard

No findings.

Section 3: RTA Safety and Security Plan Oversight

Finding 1 - As specified in 49 C.F.R. Part 659.19(k): A description of the process used by the rail transit agency to develop an approved, coordinated schedule for all emergency management program activities, which include…Process used to evaluate emergency preparedness: The NCDOT “Conformance Checklist for Security and Emergency Preparedness Plans” does not contain sufficient review criteria needed to verify conformance of the EPCP. The SEPP checklist states in its title and throughout its content that its purpose is verifying conformance of both the SSP and EPCP. However, most of the verification information provided in the checklist is for SSP verification only. Since CATS has separate plans for system security and emergency preparedness, NCDOT should prepare separate checklists for each plan or revise the SEPP checklist to better represent the EPCP. Prior to issuing the final SSO Audit Report, NCDOT provided FTA with evidence to support closing the finding. (CLOSED)

Section 4: Hazard Management

No findings.

Section 5: Accident Notification and Investigation

No findings.

Section 6: Corrective Action Plans

No findings.

Section 7: RTA Internal Reviews

No findings.

Section 8: SSOA Three-Year Reviews

No findings.

Section 9: SSOA Annual Reports

No findings.

Exhibit A – Acronyms

BLCE Blue Line Capacity Expansion Project

BLE Blue Line Extension

CAP Corrective Action Plan

CATS Charlotte Area Transit System

C.F.R. Code of Federal Regulations

CMPD Charlotte-Mecklenburg Police Department

COC City of Charlotte

CWP Certification Work Plan

DHS U.S. Department of Homeland Security

DOT U.S. Department of Transportation

EPCP Emergency Preparedness and Continuity Plan

FRA Federal Railroad Administration

FTA Federal Transit Administration

FTE Full Time Equivalents

HA Hazard Analysis

LRT Light Rail Transit

LRV Light Rail Vehicle

MAP-21 Moving Ahead for Progress in the 21st Century Act

MTC Metropolitan Transit Commission

NCDOT North Carolina Department of Transportation

OCS Overhead Catenary (or Contact) System

RFGPTS Rail Fixed Guideway Public Transportation System

ROCC Rail Operations Control Center

ROD Revenue Operations Date

ROW Right-of-Way

SEPP Security and Emergency Preparedness Plan

SSI Security Sensitive Information

SSO State Safety Oversight

SSP System Security Plan

SSPP System Safety Program Plan

SSRR Safety and Security Readiness Review

TSA Transportation Security Administration

TSO Office of Transit Safety and Oversight

UNCC University of North Carolina at Charlotte

Exhibit B –Agency's Comments to Draft Audit Report

The FTA distributed the draft SSO Audit Report to NCDOT on March 15, 2018. NCDOT provided comments to the draft audit report’s factual content on March 21, 2018 as summarized in Table B-1 below.

Table B-1 – FTA Responses to NCDOT’s Comments to the Draft SSO Audit Report
NCDOT’s Comment to Draft SSO Audit Report	FTA Response
Correction of three spelling or minor factual errors reflected in report	Changes made in text
Request that mention be made of NCDOT’s oversight of Go Triangle	Change added to text
Request that with start of revenue service on CATS BLE extended comments on the results of the separate SSRR be deleted	Material deleted; report now references the BLE SSRR final report dated August 16, 2017.

Exhibit C – Audit Reference Information

Section 1: Agency Designation

Figure 1 – CATS Blue Line Light Rail Transit System Map

Figure 2 – CATS CityLYNX Gold Line System Map with Planned Extensions

Section 2: Program Management and Standard

Table 1 - NCDOT SSO Staffing, 2014-2017*

Year	FTE SSO Staff	FTE Consultant	FTE Total (estimated)
2014	0.48	0.25	0.73
2015	0.40	0.47	0.88
2016	0.35	1.28	1.63
2017 (as of 10/31/17)	0.10	1.20	1.30

* FTE numbers for 2017 cover July through November 2017 for SSO Staff and January through October 2017 for the Consultant. The FTEs are indicative of the overall effort in 2017 and reflect the loss of an SSO staff member and subsequent move toward use of the consultant in 2016 and 2017.

Figure 3 - NCDOT SSO Organization Chart

Rail Division Director

Engineering Coordination and Safety Branch Manager

Director

Safety Enforcement and Oversight Manager (Engineering Coordination and Safety Branch Manager held this position at the time of the audit)

Safety Inspectors (three positions)

SSO Consultant (FTEs in Table 1)

Exhibit D – Audit Findings Tracking Matrix

Audit Finding	Action Required for Closeout (To be recommended by NCDOT and FTA approved)	Prior SSO Activity/ FTA Comments	Status	Closeout Date
As specified in 49 C.F.R. Part 659.19(k): A description of the process used by the rail transit agency to develop an approved, coordinated schedule for all emergency management program activities, which include…Process used to evaluate emergency preparedness: The NCDOT “Conformance Checklist for Security and Emergency Preparedness Plans” does not contain sufficient review criteria needed to verify conformance of the EPCP. The SEPP checklist states in its title and throughout its content that its purpose is verifying conformance of both the SSP and EPCP. However, most of the verification information provided in the checklist is for SSP verification only. Since CATS has separate plans for system security and emergency preparedness, NCDOT should prepare separate checklists for each plan or revise the SEPP checklist to better represent the EPCP.	NCDOT should prepare separate checklists for each plan; or revise the SEPP checklist to better represent the EPCP’s verification of conformance.	NCDOT has addressed the issue of verification of conformance of an RTA’s EPCP. This is identified in NCDOT’s SSO Program Standard and Procedures – Revision 3 Final (April 2018). Items 10 and 11 of the NCDOT’s Conformance Checklist for RFGPTS Security and Emergency Preparedness Plans responds to the issue of improving representation of the EPCP as well as verification of performance. CHECKLIST FOR RFGPTS SECURITY AND EMERGENCY PREPAREDNESS PLANSCONFORMANCE CHECKLIST FOR RFGPTS SECURITY AND EMERGENCY PREPAREDNESS PLANS	C	No additional action required;

NCDOT CONFORMANCE CHECKLIST FOR RFGPTS SECURITY AND EMERGENCY PREPAREDNESS PLANS