The U.S. Environmental Protection Agency (EPA) expects companies to self-police their environmental compliance efforts. While the EPA regularly conducts inspections focused on assessing environmental compliance, it also relies on companies to “voluntarily discover and fix violations of federal environmental laws and regulations” under its Audit Policy.
As a result, systematically conducting audits is a fundamental component of environmental compliance in the United States. Not only can companies use their environmental audit files to affirmatively demonstrate compliance to the EPA when necessary, but conducting regularly scheduled audits—and proactively remediating any issues uncovered during the audit process—also provides opportunities for penalty avoidance or mitigation. The EPA provides substantial incentives for companies to comply with its Audit Policy; and, while not strictly required, failing to conduct effective environmental audits can increase companies’ compliance-related risk substantially.
“Compliance with the EPA’s Audit Policy is essential for mitigating companies’ enforcement-related risk. By taking a comprehensive and consistent approach to conducting environmental audits, not only can companies manage compliance more effectively and more efficiently, but they can also be ready to demonstrate compliance to the EPA when necessary. ” – Dr. Nick Oberheiden, Founding Attorney of Oberheiden P.C.
While systematically conducting environmental audits is important, it is not easy. As discussed in greater detail below, the EPA has issued several sets of Audit Protocols—all of which address different areas of environmental compliance. These Audit Protocols are long and extremely detailed, and the EPA provides extensive instructions that it expects companies to follow during the internal audit process. Again, while full adherence to the relevant Audit Protocols is not strictly required, failure to fully adhere can raise red flags during an EPA inspection—particularly if ineffective audit protocols are to blame for a company’s failure to effectively address any statutory or regulatory violations.
How to Conduct (and Mitigate Risk During) an EPA Environmental Audit
With this in mind, what does it take to conduct an effective EPA environmental audit? Here are 10 tips for ensuring that an environmental audit is as effective as possible:
1. Determine the Appropriate Scope of the Audit
A key first step toward conducting an effective environmental compliance audit is to determine the appropriate scope of the audit. Leaders of companies that are subject to the EPA’s oversight must ensure that they have a clear and comprehensive understanding of their companies’ compliance obligations. If a company’s audit team overlooks any relevant compliance concerns during the audit process, the audit will not be as effective as it could (and should) have been.
As a result, before conducting a compliance audit, it is essential to ensure that the company has a comprehensive EPA compliance program. If it isn’t clear whether a company’s compliance program is sufficient, on its face, to facilitate full compliance, then other steps need to be taken before the audit process can begin.
2. Gather All EPA Compliance Documentation
When it is time to conduct an environmental audit, the next step is to gather all of the company’s EPA compliance documentation. This includes (but is not necessarily limited to) the company’s environmental compliance policies and procedures, the company’s internal audit protocols, and any compliance documentation generated in the ordinary course of business. If a company’s compliance documentation is well-organized, then gathering the documentation may not be necessary—simply knowing where to look during the audit process may be enough. The key is simply to ensure that no relevant documents go overlooked during the audit process.
3. Review the Relevant EPA Audit Protocols
As mentioned above, the EPA has published several sets of Audit Protocols. Each set of Audit Protocols is specific to an area of environmental compliance. The EPA’s current Audit Protocols address compliance under the following statutes:
- Comprehensive Environmental Response, Compensation and Liability (CERCLA)
- Clean Water Act (CWA)
- Emergency Planning and Community Right-to-Know Act (EPCRA)
- Federal Insecticide, Fungicide and Rodenticide Act (FIFRA)
- Resource Conservation and Recovery Act (RCRA)
- Safe Drinking Water Act (SWDA)
- Toxic Substances Control Act (TSCA)
Since the EPA makes these Audit Protocols readily available online, it expects companies to use them. Additionally, when conducting inspections, the EPA often uses the Audit Protocols as a roadmap to identify potential areas of concern for their environmental audit reports. Thus, before conducting an environmental audit, all members of the company’s audit team should familiarize themselves with the relevant Audit Protocols.
4. Follow the Relevant EPA Audit Protocols
Of course, simply being familiar with the relevant EPA Audit Protocols is not enough. Companies also need to follow the relevant protocols when conducting their environmental audits. While the EPA describes its Audit Protocols as, “detailed regulatory checklists . . . provided in an easy to understand question format for evaluating compliance,” if you take a look at an example, you will see that this isn’t entirely accurate. The EPA’s Audit Protocols are extraordinarily complex; and, while they outline the compliance concerns that companies need to address, they don’t always (or even often) provide guidance on when a company’s compliance efforts are sufficient. This makes it essential to work closely with experienced EPA compliance counsel who can determine when additional or remedial action may be necessary.
5. Conduct an Unbiased Assessment of EPA Compliance
When following the EPA’s Audit Protocols, companies must ensure that they conduct an unbiased assessment of EPA compliance. When in doubt, companies should not err on the side of assuming that their compliance efforts are sufficient.
As an example, the CERCLA Audit Protocols indicate (among many other things) that companies should “[v]erify that the facility has procedures in place to identify areas where hazardous substances are or may have been stored, treated, or released at the facility.” If a company does not have comprehensive records of where hazardous substances have been stored, treated, or released in the past, then it cannot make this verification—and additional steps will be necessary in order to ascertain compliance and facilitate accurate recordkeeping in the future.
6. Evaluate the Risk of Civil or Criminal Enforcement
Many environmental compliance failures present risks for both civil and criminal enforcement. Upon identifying actual or potential failures during an environmental audit, companies should promptly evaluate the risks they present. While the EPA offers incentives that allow companies to avoid any form of enforcement in many cases, leveraging these incentives starts with understanding the nature of the violation at issue and the steps that the company must take to achieve a positive outcome.
While most environmental enforcement actions are civil in nature, the EPA does work with the U.S. Department of Justice (DOJ) to pursue criminal charges when warranted. In criminal enforcement cases, companies can face substantial fines and other penalties, while any executives or other personnel accused of personally participating in environmental crimes can face fines and prison time.
7. Assess the Need for Correction or Remediation
Evaluating the risk of civil or criminal enforcement resulting from any violations uncovered during an environmental audit should go hand-in-hand with assessing the need for correction or remediation. The EPA expects (and in many cases federal environmental laws require) companies to proactively correct or remediate any environmental concerns of which they are aware. The scope of this undertaking and the steps that are required will vary depending on the nature of the violation. While correction and remediation can prove costly in many cases, this is not an excuse for non-compliance, and failing to take appropriate action promptly (within 60 days in most cases) can increase companies’ risk of facing EPA enforcement.
8. Assess the Need for Voluntary Disclosure
Along with assessing the need for correction or remediation, companies that uncover issues during the audit process should also assess the need for voluntary disclosure. As the EPA explains in its Audit Policy, “[a] regulated entity has 21 days from the time it discovers that a violation has, or may have, occurred to disclose the violation in writing to EPA.” Failure to make a timely voluntary disclosure can increase companies’ risk of facing EPA enforcement as well—so, here too, an informed and detail-oriented approach to compliance is critical.
9. Seek Penalty Reductions or Mitigation as Warranted
The EPA’s Audit Policy makes various incentives available to companies that take a proactive approach to self-evaluating, self-correcting, and self-reporting environmental compliance violations on the environmental audit report or environmental audit statement given by the environmental auditors. If necessary, companies should work closely with their environmental counsel to seek any necessary penalty reductions or mitigation.
10. Implement Lessons Learned
Finally, after taking all of the necessary steps to conduct an effective audit and address any immediate enforcement risks, companies should implement any and all lessons learned. As companies’ operations grow and evolve, effectively managing EPA environmental compliance is often an iterative process. Conducting regularly scheduled audits allows companies to identify concerns before they lead to significant exposure—provided that companies respond to these concerns appropriately.
Implementing lessons learned may involve updating the company’s environmental compliance policies and procedures, updating its auditing procedures, or making significant changes to its operations to mitigate environmental concerns. As with all aspects of EPA environmental compliance, an informed and custom-tailored approach is critical, and companies must ensure that they devote sufficient effort and resources to meeting their obligations to the EPA.
