What the CPNI Certification Asserts

Covered carriers file an annual CPNI certification in which an officer states that the company has established operating procedures adequate to ensure compliance with the CPNI rules, accompanied by a statement explaining how those procedures work.

The document is short. The claim is not. Read plainly, an officer is confirming that a CPNI program existed and operated throughout the year — which is why the supporting record deserves considerably more attention than the form.

"Personal knowledge" is the operative phrase

An officer signing without having reviewed the program is certifying to something they have not verified. This is not a technicality. It is the specific exposure that turns a documentation gap into a personal-attestation problem, and it is why the annual review belongs before the certification rather than after it.

Consistency across years is examined

Reviewers compare a certification against its predecessors. Year-over-year changes in how the program is described — without any corresponding explanation of what changed operationally — are the kind of detail that generates follow-up questions. So is a program description that has remained identical while the company has grown, acquired, restructured, or changed how it handles customers.

What the record behind it has to support

The certification implies the existence of current policies matching actual operations, evidence that employees were trained, authentication practice applied consistently, controlled access to customer information, and records of any incidents and how they were handled. Each of those is verifiable. That is the point of them.

The training record is the element most often absent — see why CPNI training records matter.

Certifying in prior years without a real program

This is more common than the filing rate suggests, and it is a genuine remediation matter rather than a drafting one. The company has already made statements. Building the program now is necessary but not sufficient; the position on prior filings has to be established deliberately, and it is materially better done proactively than discovered during an enforcement inquiry or acquisition diligence.

EquiTel handles this as CPNI remediation.

Frequently Asked Questions