· 12-minute read
Who this guide is for
You are the Responsible Person, compliance manager, or quality lead at a Type 07 (or higher) Federal Firearms Licensee. Your operation carries anywhere from a few hundred to tens of thousands of serialized assets on premises at any moment — raw receivers waiting for machining, work-in-process assemblies moving between stations, finished firearms staged for disposition, warranty returns awaiting evaluation. When an ATF Industry Operations Investigator (IOI) arrives — routine or otherwise — the entire operation gets measured against a single question: does your paperwork agree with reality?
This guide is written for that scale. Retail-dealer audit content is widely available, but a Type 01 dealer's inventory audit and a Type 07 manufacturer's audit are different exercises. Dealers reconcile a bound book against a display case; manufacturers reconcile serial number data across acquisition records, work-in-process, quality holds, RMAs, disposition entries, and physical stock spread across a facility. The compliance stakes are the same, but the mechanics are not.
What the IOI actually inspects
An ATF Industry Operations Investigator conducts what the ATF calls a compliance inspection. In practice, three things happen in parallel:
- Records review. The A&D (Acquisition & Disposition) bound book, Form 4473s (if applicable to your license type), multiple-sale reports, out-of-business records, disposition-to-non-licensee documentation, and any manufacturing-specific records like NFA transfers or import records.
- Bi-directional serial number inventory. Also called "book to physical" — the IOI samples serial numbers from your bound book and physically locates each one, then samples serial numbers from your physical inventory and traces each back to the bound book. Discrepancies either direction are findings.
- Operational and security review. Where firearms are stored, who has access, how the business operates day-to-day, whether your Responsible Person information matches the license, and general adherence to the license terms.
The bi-directional inventory is where large manufacturers most often stumble. A dealer with 400 firearms can walk every serial number in an afternoon. A manufacturer with 40,000 assets across raw stock, WIP, finished goods, and RMA cannot. If your system cannot produce an accurate on-premises location for any serial the IOI names within minutes, the audit slows to a crawl and every discrepancy compounds.
The enterprise-scale problem
Three characteristics of manufacturing inventory make audits harder than a dealer's:
- Assets are in constant motion. A frame or receiver moves between machining, finishing, assembly, inspection, quality hold, and staging. If your records only reflect end states (acquisition and disposition) but not the in-between locations, an IOI who asks "where is serial X right now" gets a shrug.
- Multiple licensed activities. Many Type 07 operations also hold Type 10 (destructive device) or SOT registrations, import records, or engage in warranty work involving firearms not originally manufactured by them. Each activity creates its own recordkeeping requirements, and one auditor may inspect several categories in the same visit.
- Volume changes the sampling. IOIs typically sample. A 400-record bound book might have 40 records pulled and 40 physical serials traced. A 40,000-record bound book will have hundreds sampled in each direction. Any error rate above near-zero surfaces multiple findings.
The pre-audit preparation checklist
You do not prepare for an ATF audit the week the letter arrives. You prepare by running your operation so the audit workflow is already the daily workflow. What follows is what enterprise Type 07 manufacturers actually check, at frequency intervals that catch problems before an IOI does.
Daily and per-shift
- Every serialized asset that enters or leaves the facility is recorded — acquisition or disposition — before it moves. No end-of-day catch-up.
- Every internal transfer between production stations is captured with the receiving employee's electronic signature and timestamp. The person now responsible for the asset is unambiguous.
- Quality holds and RMAs are logged the moment they occur, including reason codes.
Weekly
- Reconcile a sample of ~50–100 serial numbers in both directions. Book-to-physical: pick from bound book, locate physically. Physical-to-book: pick from a location, trace to bound book.
- Review the previous week's disposition entries for completeness. Every dispositioned firearm must have a valid transferee record.
- Check that any WIP asset older than a defined threshold (say 30 days without movement) is investigated — production stalls often correlate with missing paperwork.
Monthly
- Full inventory reconciliation against the bound book. Any variance is investigated and root-caused before the next reconciliation.
- Review Responsible Person information on file against the ATF's current records. Departures, address changes, and role changes create license findings if not updated.
- Sample-audit your 4473s (if applicable) for common findings: incomplete residence information, missing dates, missing NICS confirmation numbers.
Annually or on RP change
- Full compliance self-audit. Treat it as if the IOI were arriving next week. The self-audit surfaces gaps you can fix; a real IOI writes them as findings.
- Review physical security: safes, secure storage of records, access controls, video coverage of high-value inventory areas.
- Re-verify all business operations documentation matches the FFL: DBAs, addresses, ownership structure.
When the audit is scheduled
Most IOI visits are announced. The letter typically gives 30 days' notice and lists what will be reviewed. Some are unannounced — usually driven by trace patterns, prior findings, or specific complaints. Either way, the response is the same: your operation is either audit-ready every day, or it is not.
If you receive an announced-audit letter, the useful pre-work in the 30 days is not to change your compliance posture (too late) — it is to rehearse retrieval. Pick 100 random serial numbers, pull them from the bound book, produce them physically. Time it. If any single retrieval takes more than a few minutes, the IOI will notice.
Day-of protocol
- Designate a single point of contact who will accompany the IOI throughout the visit. Preferably the Responsible Person or their trained designate.
- Have a dedicated workspace prepared with a computer that can access all systems, printer access, and privacy from production noise.
- Records requested are records produced — but only records requested. Do not volunteer additional information beyond the specific question.
- Every question the IOI asks that you cannot answer immediately becomes a note. Do not guess; commit to producing the answer.
- Note every finding the IOI mentions verbally. Findings that surprise you at the closing conference likely have earlier context you missed.
Common findings — and how to make them impossible
Across published enforcement actions and industry commentary, the same categories of findings recur:
- Missing or delayed acquisition entries — a receiver hits your loading dock but doesn't enter the bound book until end-of-week. Any IOI arriving between receipt and entry finds an unrecorded firearm on premises. Fix: record on receipt, not on batch.
- Missing disposition entries — an outbound shipment leaves but the bound book only records the intent, not the actual disposition. Fix: closed-loop confirmation. The disposition entry is not final until the outbound tracking is confirmed delivered.
- Location drift — the bound book says "Finished Goods, Rack 7" but the asset moved to shipping without a location update. Fix: internal moves are transactions, not adjustments.
- Ambiguous chain of custody — the IOI asks who inspected serial X on a specific date. If your records show a station but not an employee, that is a finding. Fix: every touchpoint is signed by a person.
- Stale bound book entries — entries missing serial numbers, model information, or acquisition source. Fix: mandatory fields in your electronic bound book, no free-form fallbacks.
What software actually needs to do
An electronic bound book that only stores the ATF-required fields is not enough for an enterprise Type 07 audit. What matters at scale:
- Searchable, exportable A&D records — the IOI wants to see specific serials or date ranges. Waiting for a report generator to grind is the audit equivalent of dead air.
- Real-time location on every serialized asset — not just "in the building" but "at Station 4B, held by employee E1234, since 08:42 today."
- Complete chain-of-custody history per asset — every internal transfer, every quality event, every inspection, every touch.
- Reconciliation tools — the system should tell you, before the IOI does, that a serial number in the book has no corresponding location record.
- Role-based access — during an audit, the IOI works with specific people. Those people need the ability to produce specific reports without escalation delays.
APB360's manufacturer package was built specifically around these needs. The electronic bound book is BATFE-aligned and adapted from proven manufacturer technology; chain-of-custody history is captured at every internal transfer with electronic signatures; and reconciliation tools surface variances so they can be resolved before an audit, not during one. If your current bound book cannot answer "where is serial X, who touched it last, and when" in seconds, that gap becomes findings.
Bottom line
Type 07 audit readiness is not a checklist you run in the weeks before an IOI arrives. It is an operational posture — every serial number always in the book, every location always current, every touch always signed. The manufacturers who breeze through inspections are running that way on day 200 of the year, not just the day the letter arrives.
If you are re-evaluating your electronic bound book or compliance workflow with a specific audit in mind, or you want to see how APB360 handles reconciliation and chain of custody at enterprise scale, email sales@apb360.com or call 251-677-7978.