External Review Notification Policy
Policy Summary
As an institution of higher education, the George Washington University (“GW” or “university”) is subject to oversight of various governmental, regulatory, and administrative agencies who conduct reviews of the university’s various efforts to ensure compliance with applicable statutory, regulatory, or administrative standards. Upon being notified of any External Review (defined below) by a third-party entity, e.g., a governmental, regulatory, or administrative agency, members of the GW community are expected to notify the Office of Ethics, Compliance, and Risk (OECR), normally within three business days of receipt. This notification allows the identification of key stakeholders to evaluate the nature of the External Review, be engaged in the review or response process as appropriate, assess institutional risk, consider any limitations to disclosing confidential or otherwise sensitive university information, and centrally track all External Reviews occurring at the university.
Who is Governed by this Policy
- Faculty
- Staff
- Affiliates
Policy
An academic or administrative unit or individual member of the GW community acting within the scope of their job duties may be asked for information by a third-party entity for the purposes of conducting an External Review. Depending on the scope of the External Review, the third-party entity may request review of various types of university information, including but not limited to academics, compliance, finance, research, operations, business decisions or services, or student or employment information/records. Academic or administrative units or individuals receiving notice of an External Review shall notify OECR of the notice, normally within three business days of receipt of an External Review request. No information should be provided prior to this notification and engagement with other stakeholders as needed. Stakeholders may include but not limited to, the GW Privacy Office, Office of the Vice President and General Counsel (OGC), Office of the University Controller, Office of the Provost, the GW Police Department (GWPD), and Office of the Vice Provost for Research. If a member of a third-party entity, including but not limited to members of law enforcement or agency investigators, such as from the CIA, OSHA, or ICE, call or visit unannounced, please promptly contact OGC, and if OGC is not available, GWPD.
The expectation of notifying OECR stipulated in this policy has been established to prevent the inappropriate disclosure of confidential or otherwise sensitive information by allowing the appropriate stakeholders to be engaged in the review and response process. Key stakeholders may also assist in determining the validity and feasibility of the External Review and its objectives, assessing institutional risk, responding to the request, and evaluating and assisting with any corrective actions required.
Any written finding or report as a result of the external review, as well as any corrective actions required and taken, shall be maintained by the involved unit and a copy submitted to OECR.
Definitions
External Review: The process or procedures used by a governmental or regulatory agency or authorized third-party entity to examine, evaluate, or inspect various functions of the university. Terms that encompass External Reviews can include but are not limited to regulatory audits, examinations, inquiries, compliance reviews, risk reviews, desk reviews, financial statement audits, assessments, accreditation reviews, and program reviews, and may come in different forms, including but not limited to interviews, surveys, or site visits. For the purposes of this policy, External Reviews do not include reviews where the university affirmatively seeks and contracts with an external entity, such as a consultant or subject matter expert, to assist with a review process or to conduct an investigation. External Reviews also do not include investigations or reviews conducted by government agencies in response to individual complaints, e.g., by the Equal Employment Opportunity Commission (“EEOC”), the District of Columbia Office of Human Rights (“OHR”), or a federal Office for Civil Rights (“OCR”).
Procedures
External Review Notification Form
Related Information
- Cybersecurity Risk Policy
- Communication from Attorneys, Law Enforcement, or Investigators
- Guidance on Subpoenas and Other Legal Documents
- Privacy of Personal Information Policy
- Privacy of Student Records (FERPA) Policy
- Unannounced Visits by Immigration Enforcement Officials
- Smoke-Free Policy
- Vehicle Safety Policy
- Venue Guidelines
Contacts
| Contact | Phone Number | Email Address |
|---|---|---|
| Office of Ethics, Compliance, and Risk | 202-994-3386 | comply gwu [dot] edu (comply[at]gwu[dot]edu) |
Responsible University Official: Associate Vice President, Ethics, Compliance, and Risk
Responsible Office: Office of Ethics, Compliance, and Risk
Origination Date: October 1, 2004
Last Material Change: December 17, 2025
Last GW Community Comment Period: September 26, 2025 - November 7, 2025; see a thematic summary of feedback here.
Next Scheduled Review: 2027-2028 Academic Year
To provide feedback on this policy, please contact the Responsible Office(s) listed above or the Office of Ethics, Compliance, and Risk. More information describing university policies is outlined in the University Policy Principles.
Noncompliance with this policy can be reported through this website.