The cheapest ATF inspection you will ever sit through is the one you run on yourself in July. I block off a Saturday every quarter, lock the front door at noon, pour a coffee, and walk my own shop the way an Industry Operations Investigator would. Half a day. Maybe a full day if I am behind. That is the entire cost.
The alternative is an IOI walking in unannounced in October, finding the same problems I would have caught, and writing them up in a report that follows my license around for years. Same errors. Wildly different consequences.
Here is the checklist I actually use. Steal it, adapt it, run it this weekend.
Why mid-year is the right moment
If you only audit once a year, you do it in December and you are auditing twelve months of drift. By that point a pattern of small 4473 errors is a pattern. A bound book that fell behind in March has been wrong for nine months. Things compound.
Quarterly is better. Twice a year is the minimum I would defend to a peer. A July audit catches the first six months of the year while the staff who made the entries are still on payroll and still remember the transaction. That is the window where fixing things is cheap.
The argument I make to shop owners who think they are too busy: ATF Order 5370.1H, which replaced the old zero-tolerance policy in May 2025, gives IOIs a tiered framework that explicitly considers good-faith error and corrective action. A documented internal audit program is exactly the kind of evidence that moves you down the severity ladder when something does get found. No audit program, no evidence. It is that simple.
The checklist
1. Inventory reconciliation against the A&D book (2 to 4 hours)
This is the one that scares people, so do it first while you still have caffeine.
Pull the bound book—paper or electronic—and pull every firearm physically in the shop. Every one. Display cases, safe, layaway shelf, gunsmith bench, receiving area, the consignment rack, the rifle you brought in last Tuesday that is sitting on your desk because you have not logged it yet.
For each firearm in your possession, confirm:
- It is in the bound book as an open acquisition (no disposition entered)
- Manufacturer, importer if applicable, model, serial number, type, and caliber match exactly
- The acquisition date is recorded
For each open acquisition in the book, confirm the firearm is physically present or there is a documented reason it is not (out for repair to the customer, sent to manufacturer, etc.).
Discrepancies fall into three categories. A firearm in the shop with no book entry is the worst—that is an unrecorded acquisition under 27 CFR § 478.125(e). A book entry with no firearm and no disposition is the second worst—that points at theft, loss, or a missed disposition entry. A serial number transcription error is the most common and the easiest to fix with a corrected entry and a notation.
If you find a firearm that cannot be accounted for, you are looking at a potential theft/loss report under 27 CFR § 478.39a. You have 48 hours from discovery to report to ATF and local law enforcement. Do not sit on it. Discovery clock starts when you find it, not when you finish your audit.
2. 4473 spot-check by random month (1 to 2 hours)
Pick a month at random. I use a die. January through June, roll a six-sider, that is the month I audit. Pull every 4473 from that month. Every one—completed sales, denials, delays that did not proceed, the whole stack.
For each form, walk it section by section:
- Section A buyer information complete, legible, signed and dated
- Section B transferor information complete, signed and dated by the actual person who conducted the transfer
- Question 21 answers all checked, no blanks, no whiteout
- ID information matches what the buyer wrote in Section A
- NICS transaction number recorded with date and response
- For any delay-to-proceed, the wait period documented correctly
- Continuation sheets attached and referenced where used
- Form 4473 Revision 5300.9 is the version in use (verify you are not still grabbing old forms out of a back drawer)
The errors I see most often in my own spot-checks: missing middle name where the ID shows one, abbreviated city in Section A, transferor forgot to date the certification, NICS response box checked but no transaction number written in. None of these are catastrophic by themselves. A pattern of them is.
Mark every error with a sticky note. Do not "fix" 4473s after the fact by erasing or whiting out—that is worse than the original error. The correct move on most errors is a notation, your initials, and a date, with an explanation in your audit file. For anything material, call your counsel before you touch the form.
If you find more than two errors across a month of forms, your training is the problem, not the staff. Reset everyone on 4473 Completion & Recordkeeping and document that you did it.
3. NICS log review (30 minutes)
You should be keeping a log of every NICS check—date, time, buyer name, transaction number, response, and the staff member who ran it. If you do not have this, start one today.
Cross-reference the log against the 4473s for the month you spot-checked. Every proceeded transaction on the log should match a completed 4473. Every delay that timed out and was transferred at your discretion should have documentation supporting the decision and the firearm should still be tracked. Every denial should have a corresponding 4473 retained per the recordkeeping rules (denials get filed separately from approved transfers but they get filed).
Pay attention to delays that never resolved. If you transferred after the three-business-day default and the buyer later turned out to be prohibited, you want that paper trail clean.
4. Multiple sale report verification (15 minutes)
Pull your copies of Form 3310.4—Report of Multiple Sale or Other Disposition of Pistols and Revolvers—for the quarter. For each one, confirm:
- Two or more handguns to the same unlicensed person within five consecutive business days
- Submitted to ATF and to the state or local law enforcement agency by close of business on the day of the second sale (27 CFR § 478.126a)
- Buyer information matches the 4473s
- Firearm information matches the bound book entries
Then do the harder check: go through your handgun sales for the quarter and look for any pair of transactions to the same buyer within five business days that did not generate a 3310.4. This catches the missed reports, which are the ones that hurt you.
If you are under an ATF demand letter for additional reporting in a border state or for long guns, verify those went out too. Multiple Sale Reports & Demand Letters covers the variations.
5. Theft and loss report status (10 minutes)
Pull any Form 3310.11 you filed in the past twelve months. Confirm:
- Filed within 48 hours of discovery
- Local law enforcement was notified and you have the report number
- The firearm is marked stolen or lost in your bound book with a reference to the report
- If recovered, the recovery is documented
If you have not filed a theft/loss report and your inventory reconciliation just produced a missing firearm, see step 1. Forty-eight hours.
6. Bound book hygiene (30 to 60 minutes)
Whether you run paper or electronic, the rules under 27 CFR § 478.125 are the same in spirit. Walk the book and check:
- Acquisitions entered by the close of the next business day
- Dispositions entered within seven days of the transfer
- No scratch-outs, no whiteout, no erasures—corrections are made with a single line through and an initialed annotation
- All required fields populated for every entry
- Pages numbered and intact (paper book), or audit trail intact (electronic)
For electronic systems, separately verify:
- Backups are current—when was the last successful backup, and have you ever tested a restore?
- The system meets the variance requirements you obtained from ATF, if you got one
- Access controls work; staff have appropriate permissions
- You can produce a paper printout on demand for an IOI
I have watched a shop lose a week of entries to a hard drive failure with no recent backup. The IOI was not impressed by the story. Test a restore at least once a year.
Bound Book Management goes deeper on electronic system requirements and the most common variance pitfalls.
7. Physical security walk (30 minutes)
This is not a formal federal requirement for most dealers, but your insurance carrier cares and ATF will note obvious problems. Walk the shop after hours and look:
- Alarm system armed and tested within the last 90 days
- Camera coverage on the safe, the counter, and the receiving area; footage retained for at least 30 days
- Safe combinations limited to need-to-know staff
- Receiving area not accessible to customers
- Display case locks function; spare keys accounted for
- Exterior doors and windows intact, no obvious weak points
Take photos of your security setup once a year and date them. If you ever have a break-in, you want to be able to show the carrier what the shop looked like the week before.
8. Employee training currency (15 minutes)
Pull your training file. For every employee who touches a 4473, a bound book entry, or a NICS check, confirm:
- Initial training documented with date, topic, and trainer
- Annual refresher completed in the last twelve months
- Any role-specific training current—gunsmith staff on the Gunsmithing vs. Manufacturing line, NFA staff on Form 4 processing, any new-hire on straw purchase recognition
This is where dated, third-party training documentation matters. Anything I can show an IOI with a name, a date, a course title, and an external issuer is worth more than my own internal sign-off sheet. That is what we built DealerReady to produce—pull up Counter Certified records for your front-counter staff and you have a clean paper trail.
If anyone is past due, schedule the refresher this week. Do not wait.
Document the audit itself
This is the step shops skip and it is the most important one.
Create a one-page audit summary. Date it. Note who participated. List what you reviewed (the month of 4473s, the inventory count, the NICS log range, etc.). List every error or discrepancy found. List the corrective action for each, with a date.
File it. Do this every quarter and you have, by year-end, four dated documents showing a working internal compliance program. That is what the new tiered enforcement framework under ATF Order 5370.1H is looking for when an IOI weighs whether something is a willful violation, an inadvertent error, or a pattern.
No audit summary, no evidence the program exists.
Finding errors is the point
I want to land on this because shop owners get discouraged the first time they run a real audit and find a dozen things. That is the correct outcome. That is what the audit is for.
A 4473 with a missing middle initial that you catch and document in July is a training moment. The same form found by an IOI in October, alongside fifteen others like it, is a pattern of recordkeeping violations. Same forms. Same errors. Wildly different framing.
Internal audits do three things for you. They surface problems while they are still small. They produce documentation that you have a functioning compliance program. And they train your eye so the next 4473 you check at the counter, in real time, you catch the error before the buyer walks out the door.
The point is not a perfect audit. The point is a real one.
This post is general guidance from someone who runs a shop, not legal advice—for anything that touches your specific license, consult qualified counsel.
What to do this weekend
- Block four hours on Saturday. Lock the door or put a sign up.
- Run steps 1 through 5—inventory, 4473 spot-check, NICS log, multi-sale verification, theft/loss status.
- If you finish, keep going. If you do not, schedule the remaining steps for the following Saturday.
- Write the one-page summary. Date it. File it.
- Calendar the next audit for October.
The shops that survive ATF inspections with clean reports are not the shops that never make mistakes. They are the shops that find their own mistakes first and have the paper to prove it.