What Does a Regulator Look for in Your Notice of Violation Response?
What regulators look for in a notice of violation response, from FDA Form 483s to OSHA citations and Wells notices, and how to build the record first.
A regulatory notice of violation means a regulator has looked at an organization's operations, practices, or conduct and found a potential compliance problem. Depending on the procedure, the organization may need to contest the finding, state its position, describe corrective actions taken or planned, or respond within a set period.
The same phrase shows up on parking tickets and local code citations, but a regulatory finding needs its own response discipline. If your team is still interpreting new rules, regulatory change management comes first. This article walks through what starts after that work has run and a regulator has still found something.
AI speeds up the first stage of the response. Harvey, for example, can help build the chronology and evidence index, test the finding against the record, and draft the first response pack. Your team spends its time on the position instead of on assembling the file.
In the US, findings come from regulators such as the Food and Drug Administration (FDA) and the Occupational Safety and Health Administration (OSHA). The Securities and Exchange Commission (SEC), the Environmental Protection Agency (EPA), and transportation security and nuclear regulators issue them, too.
Elsewhere, a finding can arrive as a tax authority inquiry or a notice to produce from a workplace regulator. The document differs, but the response discipline stays the same. Examples of regulatory notices include:
Notice | Who Issues it | What the Response Usually Involves |
|---|---|---|
FDA Form 483 | FDA investigators, at the close of an inspection | A voluntary written response, recommended within 15 business days, addressing each observation and any corrective actions taken or planned |
OSHA citation | OSHA | A written notice of contest within 15 working days if the employer contests. An informal conference can be requested in that window, but it doesn't extend the deadline |
SEC Wells notice | SEC enforcement staff | An optional Wells submission, written or by video, arguing why the Commission should not bring an action. The SEC ordinarily allows four weeks |
EPA notice of violation | EPA | A written response and corrective steps, with terms set by the statute involved |
While the procedures differ, every response has to hold up to an adversarial reader, match the record behind it, and survive the commitments it makes.
The Response is Read Adversarially
A response to a regulatory finding is a formal submission, and the regulator reads it against the facts already on record. Reviewers look for omitted information, statements that don't match the documents, and characterizations that flatter the facts beyond what the evidence supports.
While you prepare the response, keep three things distinct:
- The response and its commitments. This is the formal submission, setting out the organization's position on the finding and any remediation it commits to.
- The factual record. These are the documents and other evidence that establish what happened and support each factual assertion in the response.
- Internal deliberations and legal analysis. These shape how the organization evaluates the finding. Depending on how particular communications were created and shared, attorney-client privilege or work-product protection may apply, so counsel should assess privilege and waiver before anything is disclosed.
Whether a response or the material behind it can later be obtained, admitted, or used elsewhere depends on the regulator, the procedure, the jurisdiction, and the protections that apply.
Every factual assertion needs a source in the file, and dates have to reconcile across the correspondence, the supporting documents, and the final submission. A position statement to an employment agency works the same way: it sets the factual record next to the legal argument for the organization's position.
The discipline holds across in-house regulatory and compliance matters, whether the recipient is a labor agency, a tax authority, or a sector regulator. Unsupported characterizations or inconsistencies in the record undercut the organization's position and raise questions about the reliability of the whole response.
Three instruments often get discussed together, but they arrive at different points in the process. Confusing them is how a team misjudges what the response has to do. Before anyone drafts, the team needs a factual file it can rely on.
Instrument | The question it answers |
|---|---|
Notice of violation | What does the regulator say went wrong? |
Corrective action plan | What are we committing to fix, and by when? |
Consent order | What terms have we agreed to, and who supervises them? |
Building the Chronology and Evidence Index First
When a finding reaches your team, much of the response window goes to establishing what happened. Correspondence sits in email and facts live across systems, while the people closest to the matter each know only part of the story.
In fiscal year 2025, the EPA alone concluded 2,127 civil enforcement cases and assessed over $650 million in civil penalties.
Harvey helps you assemble and review that record before drafting begins. Start by adding the correspondence and evidence to a Vault, Harvey's workspace for AI document review at scale. Then use Review Tables to pull key dates, events, people, and issues across the documents. Harvey's walkthrough on building a case chronology from emails shows large volumes of correspondence becoming a chronology without losing the link to the source documents.
For the broader practice view, see how Harvey supports in-house regulatory and compliance work. The work follows four steps:
- Bring the correspondence and evidence together and review the finding against the source material.
- Build a chronology and an issue-led evidence index that connects each issue to the evidence behind it.
- Identify gaps and follow-up questions before committing to an account the file can't support.
- Draft a first response pack with a position summary based on the factual record.
The third step shows where the file can't yet support a date or an assertion. Where it can't, find the missing document, reconcile the conflicting accounts, or talk to someone who saw the events firsthand.
A finding often triggers an internal investigation, and the two workstreams may draw on the same underlying facts. You can keep evidence, contracts, correspondence, and notes in the Vault, consolidate interview notes against the chronology, and let the open questions drive the next interviews or document requests.
Once the facts are assembled, Harvey's knowledge sources support AI legal research on the applicable rules and guidance alongside the record. Legal, compliance, and the business team usually work the same document set at once, and Spaces adds secure collaboration with outside counsel when they need the underlying materials.
A chronology built this way stays traceable to the underlying documents, so reviewers can test each date and assertion against the source record.
See how legal teams build chronologies and structured timelines in Harvey from correspondence and source documents.
With the record assembled, you know what happened, what the evidence supports, and where more digging is needed. Visualizing that legal data helps the team review it, and the organization's position still has to be decided by people.
Deciding the Position, and Recording Why
AI can give a first-pass reading of the finding against the factual record, showing where the regulator's characterization matches the evidence and where your account differs. Deciding what position to take stays with your team.
Legal and compliance decide whether to accept the finding, contest part of it, or contest it entirely. Each choice carries its own risks, from the strength of the evidence to the chance of escalation and the effect on the relationship with the regulator. It's a risk judgment held by the professionals accountable for the response, which is why human oversight stays central in AI-assisted legal work.
Record why the team landed there. A response can run for months, and a regulator, auditor, or newly assigned lawyer may ask why the organization accepted one part of the finding and challenged another. Reasoning scattered across emails and personal notes is hard to rebuild.
Preserving matter context keeps earlier decisions and the reasoning behind them available as the matter develops, so the history doesn't depend on anyone's memory. Grounding the position in authority through Harvey's Knowledge means it cites the sources it relies on, and the record shows what the team reviewed and when.
That gives the team a traceable record of what it reviewed and why. Once the position is set, the response has to say what the organization will do next, and every corrective action it promises becomes a new obligation with a date attached.
Harvey Helps Give Every Response Commitment an Owner and a Date
A response may settle what you tell the regulator, but any remediation it promises creates ongoing work. These are self-imposed commitments made under scrutiny, often with dates attached, and missing one can make the original finding harder to resolve.
Harvey can help turn each commitment into a discrete obligation with an owner and a deadline. Each one maps to the evidence needed to show completion and support any required attestation. The commitments usually fall into corrective actions, policy changes, and training aimed at the root cause, which together make up the remediation plan.
Where remediation touches policy, a policy gap analysis shows where current policies fall short of the requirements. Drafting an executive summary of the finding and the response from the same record keeps the internal account consistent with what the regulator received.
From there, the commitments belong in an obligation management process for ongoing ownership and deadlines. If the matter becomes a consent order, remediation tracking continues there through completion.
Harvey supports the legal work behind these steps: reading the finding, building the file, drafting the response, and keeping the reasoning traceable. It isn't the monitoring platform or the system of record, so something else holds the calendar.
A notice of violation response holds up when the record behind it does. Harvey helps build that record, test the position against it, and give every commitment an owner and a date.
See how Harvey's legal AI for in-house teams supports regulatory work, then request a demo to walk through a notice of violation response.
Questions That Follow a Regulatory Finding
1. When does a notice of violation become a consent order?
A notice of violation is the finding, an assertion that something was out of compliance, and it opens a response window. A consent order is a binding order entered with the respondent's consent, carrying agreed obligations and usually agreed oversight. A notice can lead to a consent order or further enforcement action, so the first response can influence the terms that follow.
2. Does responding in detail create exposure you would not otherwise have?
It can. A detailed response puts the organization's account of the facts on record, which helps when the evidence supports it and hurts when it doesn't. That's the argument for building the factual file first and drafting the position from it, rather than deciding the position and gathering evidence around it.
3. The deadline is shorter than the investigation needs. What then?
The gap between what your team knows and what it can support with evidence helps determine whether to respond on the established record or seek an extension. Not every procedure allows one, and the gap only shows once the file is assembled. Committing to facts that are still being established is much harder to unwind later.
