Church HR, Staffing & Child Safety

Auditing Your Child Safety Program Once a Year

Published 2026-08-15 · Church HR, Staffing & Child Safety

Short answer: a child safety audit is a once-a-year review that checks whether what your policy says is actually what happens on a Sunday. Work through eight areas: roster, screening files, re-screening cycle, supervision, check-in and release, boundaries, the reporting route, and training records. Then write down what you found and what changed. Half a day, one person plus a second set of eyes, and a short written report to the board.

Most churches don't have a child safety problem on the day they adopt a policy. They develop one slowly, over about eighteen months, while nobody is watching. That's the gap a child safety audit church leaders run for themselves is built to close, measured against the policy the board already adopted.

A volunteer joins mid-year and nobody runs the application. A room quietly starts operating with one adult because the second person moved away. The check-in tags run out and someone starts writing names on a clipboard "just for today". None of that is negligence. It's drift, and drift is invisible from inside the week.

The audit is the thing that makes drift visible.

What a child safety audit actually is

It isn't an investigation, and it isn't an inspection by an outsider. It's a scheduled, written review of your own program against your own policy, run by people in your church, once a year.

The whole value sits in two words: written and scheduled.

Written, because a review that produces no document produces no follow-up. You'll remember three of the eleven things you noticed, and the eight you forget aren't randomly distributed. They're the awkward ones.

Scheduled, because a review that happens "when we get to it" happens after an incident, which is the one moment it's worth the least.

Who should run it

Two people. One who knows the ministry, one who doesn't.

The insider, usually the children's or youth director, can tell you what the rooms are supposed to look like. The outsider, ideally a board member or an elder with no operational role in children's ministry, is the one who asks why the storage room door has no window and refuses to accept "it has always been like that."

If your church is small enough that the same person does everything, borrow the second set of eyes from another congregation and return the favor. It costs nothing and it works better than doing it alone.

Don't have the audit run solely by the person who would be criticized by its findings. That isn't a comment on anyone's integrity; it's just that nobody sees their own routines clearly.

The eight areas to check

1. The roster is current and complete. Print the list of everyone in scope: paid staff, volunteers, board members who serve with children, contractors, and drivers. If anyone on that list is paid as a contractor, whether they are really a contractor is a separate federal test rather than a label the church picks (IRS, Independent contractor or employee). Then walk it against reality. The names that are on the list but no longer serve tell you the offboarding step is missing. The people who serve but aren't on the list are the actual finding.

2. Screening files are complete. For each person in scope: application on file, references actually called and recorded, background screening run, date recorded, signed acknowledgement of the policy. You're checking for the presence of documents, not reading their contents. One document to look for while you're there: the signed authorization that let you run the check in the first place, because a report bought from a screening company comes with disclosure and notice steps of its own (FTC, Background Checks: What Employers Need to Know).

3. The re-screening cycle has been honored. Sort the roster by the date of the last check and look at the bottom of the list. Anyone past your stated interval is a finding. The long-serving volunteer is almost always the one who has gone longest without a re-check, and the detail of doing this without giving offense is covered in re-screening existing volunteers.

4. Supervision holds in practice. Do this on a Sunday, not on paper. Walk every room while ministry is running. Count adults. Check sightlines. Watch a restroom trip and a transition between rooms. Ask two volunteers what they'd do if their partner didn't show up, and listen to whether the answers match.

5. Check-in and release work under pressure. Watch a real pickup, ideally the busiest one. Does every child get a matching identifier? Does anyone get released without it? What happened the last time someone insisted, and who handled it?

6. Boundaries, including digital. Ask the youth team directly how they communicate with students. This is where policy and practice diverge most often, because the rules were written before the app everyone now uses. A group thread with a parent visible is fine. A leader with a private message history is a finding, and one to handle calmly.

7. The reporting route exists and is known. Ask three volunteers, separately, who they would tell if something concerned them. If you get three different answers, or a pause, the route isn't real yet. Check that the second route, the one for a concern about the person who normally receives reports, is published somewhere.

8. Training records. Who was trained, when, on what version of the policy. Compare the register to the roster. The gap is usually the occasional helpers, and annual child safety training is where you close it. If the content of that training has never been refreshed, the federal Child Welfare Information Gateway collects prevention material for organizations that work with children and costs nothing to use.

A worked example

A church with 320 in attendance runs the audit and prints a roster of 47 people in scope.

• 44 have an application on file. 3 do not. All three joined between January and March, all in the youth team.
• 41 have a background check on record, which means 6 have none at all. Of the 41 that exist, 9 are past the church's stated three-year cycle, and seven of the nine have served for more than a decade.
• Reference calls are recorded for 28. For the other 19 the box is ticked but no notes exist, so nobody can say what was asked or who answered.
• The Sunday walk-through finds two rooms operating with one adult for part of the hour, both because a second volunteer was moved to cover the nursery.
• The training register shows 31 names against a roster of 47.

That's a church doing better than most, and it still has six findings. None of them are scandals. Every one of them is the kind of thing that becomes the first question in a difficult conversation later.

Note which one is worst. Six people serving with no background check at all is a wider gap than nine checks that have gone stale, and it's the finding a board skims past, because the stale-check number is the bigger of the two.

The response isn't a crisis meeting. It's a short list with names and dates against it: six checks run first, three applications by the end of the month, nine re-checks scheduled across the quarter, a written reference note from now on, a floating third adult on the rota, and a make-up training session in six weeks.

How churches get this wrong

Auditing the paperwork only. Files can be immaculate while a room runs with one adult every week. The Sunday walk is the part that can't be faked, and it's the part most often skipped.

Announcing it as an inspection. Volunteers who feel evaluated will show you the best version of the hour. Tell them plainly: we do this every year, it's about the system rather than about you, and finding something is the point.

Recording findings without owners. "We should improve check-in" isn't a finding. "Sarah orders new tags by the 30th" is.

Doing it and not telling the board. The board carries the governance responsibility here. A one-page summary at the next meeting, minuted, is the whole obligation, and it's the record that shows the church was paying attention.

Auditing against a policy nobody adopted. If the policy was never formally adopted and minuted, fix that first. You can't audit against a draft. The sections it needs are in what a child safety policy must cover.

Treating a clean audit as a good audit. A review that finds nothing, two years running, usually means the review is too shallow rather than the program too perfect.

What to do with the findings

1. Write them down the same day, while the walk-through is fresh.
2. Give each one an owner and a date. No owner, no fix.
3. Split them into "this week" and "this quarter." An unsupervised room is this week. A rewrite of the transport section is this quarter.
4. Report to the board in one page: what was checked, what was found, what's being done, when it'll be re-checked.
5. Schedule the next audit before you close the file. Same month every year.
6. Re-check the urgent items in thirty days. Findings that are never verified as fixed tend not to be fixed.

The near-miss log is half the audit

Keep a running note through the year of the small things: the room that ran short-handed, the child released to an aunt without a tag, the leader who was corrected about private messaging. Nobody enjoys writing these down.

But read together at audit time, twelve near misses tell you exactly where your system bends. They're the most useful safeguarding information a church produces, and they're almost always discarded within a week of happening.

Common questions

How long should the audit take?

Half a day of file review, one Sunday morning of observation, and an hour to write it up. If it's taking a week, you've turned a review into a project.

Should we use an outside auditor?

You don't need one to get most of the value. An external review can be worth doing every few years, or when an insurer or denomination asks for it. The annual version is meant to be internal, cheap and repeatable. It's the version you'll actually do.

What if the audit finds something serious?

Draw a hard line here. A gap in a process is an audit finding. An allegation, a disclosure, or conduct that may have harmed a child isn't. That goes immediately to the authorities your law requires and to a licensed attorney, not into the audit report and not to a committee. Stop the review and handle that first. What counts as abuse or neglect, and who is required to report it, is defined in state statute and differs from state to state (Child Welfare Information Gateway, Definitions of Child Abuse and Neglect), so the person who would make that call should already know your state's answer.

Does the audit need to be shared with parents?

The report itself is an internal document. But telling parents that the church reviews its child safety program every year, and what the supervision rules are, builds more trust than most churches expect. Share the practice, not the file.

We're a small church with one children's class. Is this overkill?

Scale it, don't skip it. For a church with six volunteers the audit is an hour: check the six files, watch one Sunday, ask who they'd report to, look at the training register. The exposure doesn't shrink with attendance. The supervision core is the same, and the two-adult rule still has to hold in the one room you have.

Put it on the calendar

Pick a month. The same one every year, ideally a quiet one, and never the month your volunteer rota turns over.

That single decision is what separates churches that audit from churches that intend to. The review isn't hard, and it isn't long. It just has to have a date, and a set of screening files worth checking it against.

---

Run the review against a complete set. The Children & Youth Protection Kit brings the safeguarding policy, the volunteer application and screening forms, and the consent and release documents together, so the audit has something specific to check each file against. $99, instant download. You can also see how the whole HR and child safety set fits together on the Run My Church hub.

*Faith Docs provides self-help document templates, not legal advice. We are not a law firm. For representation, consult a licensed attorney.*