10.2 Environmental Auditing Protocols & EPA Audit Policy (Self-Disclosure)

Environmental Auditing Protocols & EPA Audit Policy (Self-Disclosure)

Environmental auditing is a systematic, documented, periodic, and objective review of facility operations and practices to evaluate compliance with environmental regulations, assess management system conformance, and minimize environmental liabilities. In the United States, environmental auditing operates under the dual framework of international quality standards (ISO 19011:2018) and federal enforcement incentives, primarily the EPA Audit Policy ("Incentives for Self-Policing: Discovery, Disclosure, Correction and Prevention of Violations", 65 FR 19618).

A Certified Hazardous Materials Manager (CHMM) must master the execution of rigorous audit protocols and understand the strict statutory criteria required to qualify for penalty mitigation under EPA self-disclosure policies.

---

1. Environmental Auditing Standards & Audit Tiers (ISO 19011:2018)

ISO 19011:2018 (Guidelines for auditing management systems) provides standard international guidance on the principles of auditing, managing audit programs, and conducting management system audits.

+-----------------------------------------------------------------------------------------+
|                            THE THREE TIERS OF ENVIRONMENTAL AUDITS                      |
|                                                                                         |
|   AUDIT TIER      | AUDITOR RELATIONSHIP         | PRIMARY PURPOSE & EXAMPLES                   |
|   ----------------+------------------------------+--------------------------------------------- |
|   FIRST-PARTY     | Internal facility staff or   | - Internal regulatory compliance assurance   |
|   (Internal)      | hired technical consultants  | - EMS conformance assessment                 |
|                   | acting on facility behalf    | - Baseline liability screening               |
|   ----------------+------------------------------+--------------------------------------------- |
|   SECOND-PARTY    | Organization auditing its    | - Hazardous waste TSDF vendor qualification  |
|   (Supplier/Vendor| external vendors, suppliers, | - Toll manufacturer environmental audits     |
|    Qualification) | or contracted partners       | - Supply-chain sustainability verification   |
|   ----------------+------------------------------+--------------------------------------------- |
|   THIRD-PARTY     | Independent, accredited      | - ISO 14001 / ISO 45001 registrar audits     |
|   (Independent /  | registrar or regulatory      | - Regulatory enforcement / consent decree    |
|    External)      | inspection authority         | - Multi-million M&A due diligence audits     |
+-----------------------------------------------------------------------------------------+

Primary Audit Scopes:

1. Regulatory Compliance Audits: Comprehensive multimedia audits evaluating adherence to federal, state, and local environmental statutes (RCRA Subtitle C/I, Clean Air Act Title V/NESHAP, Clean Water Act NPDES/Pretreatment, EPCRA Tier II/TRI, TSCA, DOT Hazmat, SPCC/Oily Waste).
2. Management System Conformance Audits: Systemic evaluation verifying whether operational procedures satisfy ISO 14001 / ISO 45001 requirements.
3. Environmental Due Diligence / Liability Audits: Pre-acquisition or divestiture assessments (such as ASTM E1527-21 Phase I/II ESAs) designed to quantify CERCLA Superfund and cleanup liabilities.

---

2. The 3-Phase Audit Methodology

A rigorous environmental audit follows a structured, chronological three-phase methodology:

+-----------------------------------------------------------------------------------------+
|                        THE 3-PHASE ENVIRONMENTAL AUDIT LIFECYCLE                        |
|                                                                                         |
|   [PHASE 1: PRE-AUDIT]           [PHASE 2: ON-SITE EXECUTION]   [PHASE 3: POST-AUDIT]   |
|   - Scope & Boundary Definition  - Opening Meeting              - Report Preparation    |
|   - Audit Plan & Schedule        - Physical Walk-Through        - Finding Classification|
|   - Protocol / Checklist Prep    - Staff / Operator Interviews  - Corrective Action Plan|
|   - Advance Document Review:     - Record & Manifest Sampling   - Verification Audits   |
|     * Permits, SPCC, SDS, DMRs   - Closing Meeting / Debrief    - Formal Closure        |
+-----------------------------------------------------------------------------------------+

Phase 1: Pre-Audit Activities

• Audit Scoping & Team Selection: Establish physical boundaries (fence-line, off-site warehouses), regulatory scope (multimedia vs. single-program), and assemble competent auditors free from conflicts of interest.
• Background Information Request: Gather and analyze critical compliance documentation prior to arrival:
  • Air emissions inventories, Title V permits, and CEMS calibration logs;
  • NPDES wastewater permits, storm water pollution prevention plans (SWPPP), and Discharge Monitoring Reports (DMRs);
  • RCRA Biennial Reports, hazardous waste manifests, Land Disposal Restriction (LDR) notifications, and contingency plans;
  • Spill Prevention, Control, and Countermeasure (SPCC) plans and secondary containment certifications;
  • EPCRA Tier II inventories and Toxic Release Inventory (TRI) Form R filings.
• Audit Protocol Development: Prepare customized multimedia checklists referencing specific citations (e.g., 40 CFR § 262.16/17 for RCRA generator standards).

Phase 2: On-Site Audit Execution

• Opening Meeting: Introduce audit team, review scope, confirm logistics, establish safety protocols, and clarify reporting channels.
• Physical Site Reconnaissance: Detailed visual inspection of manufacturing lines, chemical storage areas, hazardous waste accumulation areas (Satellite and Central Accumulation Areas), wastewater treatment units, boiler houses, baghouses, outfalls, and AST/UST systems.
• Interviews: Structured interviews conducted across multiple organizational tiers—from floor chemical handlers to the plant manager—to assess operational competence, training effectiveness, and safety culture.
• Document Sampling & Physical Verification: Cross-checking written records against physical conditions (e.g., verifying that drums listed on hazardous waste manifests correspond to physical inventory, checking drum labeling/dating, inspecting secondary containment drainage valves).
• Closing Meeting: Formal debrief with plant leadership presenting preliminary factual findings, clarifying potential misunderstandings, and establishing timelines for the draft report.

Phase 3: Post-Audit Activities

• Audit Report Preparation: Formal report documenting findings, categorized as:
  • Regulatory Noncompliance: Violation of a federal, state, or local statutory/regulatory requirement (e.g., open hazardous waste drum, unpermitted air emission source).
  • Management System Nonconformance: Failure to satisfy an internal ISO 14001 procedure or policy.
  • Opportunity for Improvement (OFI): Best practice recommendations to enhance performance or mitigate emerging risks.
• Corrective Action Plan (CAP): Facility management develops a CAP assigning specific responsible owners, root causes, corrective measures, preventive actions, and hard completion deadlines.
• Re-Audit & Verification of Closure: Formal audit follow-up at 30, 60, or 90 days to verify that corrective actions were implemented and effective.

---

3. EPA Audit Policy: Incentives for Self-Policing (65 FR 19618)

To encourage regulated entities to voluntarily discover, disclose, correct, and prevent environmental violations, the EPA issued its formal Audit Policy ("Incentives for Self-Policing: Discovery, Disclosure, Correction and Prevention of Violations", 65 FR 19618). Disclosures are submitted electronically via the EPA eDisclosure portal.

Penalty Structure in Environmental Enforcement:

Civil environmental penalties imposed by the EPA consist of two distinct components: $\text{Total Civil Penalty} = \text{Gravity-Based Penalty} + \text{Economic Benefit Penalty}$

1. Gravity-Based Penalty: Punitive penalty reflecting the egregiousness, duration, and environmental risk of the violation.
2. Economic Benefit Penalty: Financial savings or competitive advantage gained by the facility as a result of delaying capital expenditures or compliance costs.

+-----------------------------------------------------------------------------------------+
|                         EPA AUDIT POLICY PENALTY INCENTIVES                             |
|                                                                                         |
|   COMPLIANCE CONDITION SATISFIED                   | GRAVITY PENALTY | ECONOMIC BENEFIT |
|   -------------------------------------------------+-----------------+----------------- |
|   All 9 Conditions Met (Systematic Discovery)      | 100% WAIVED     | EPA Retains Full |
|   -------------------------------------------------+-----------------+ Discretion to    |
|   Conditions 2-9 Met (Voluntary Discovery, but     | 75% WAIVED      | Recover Economic |
|   lacked systematic audit / CMS)                   |                 | Benefit          |
+-----------------------------------------------------------------------------------------+

[!IMPORTANT] The 9 Strict Conditions of the EPA Audit Policy: To qualify for 100% waiver of gravity-based civil penalties, an entity must satisfy all nine conditions:

1. Systematic Discovery: Discovered through an environmental audit (ISO 19011) or a documented compliance management system (EMS).
2. Voluntary Discovery: Not discovered through a legally mandated monitoring, sampling, or reporting requirement (e.g., continuous emission monitors or NPDES permit sampling cannot qualify).
3. Prompt Disclosure: Disclosed in writing to the EPA within 21 calendar days of discovering the violation (or shorter if required by statute).
4. Discovery Independent of Government or Third Party: Discovered prior to EPA/state inspection, notice of citizen suit (60-day notice), or third-party/whistleblower complaint.
5. Correction and Remediation: Corrected within 60 calendar days from date of discovery (or facility submits an approved written schedule if remediation requires > 60 days).
6. Prevent Recurrence: Facility agrees in writing to take specific corrective/preventive steps to ensure the violation does not recur.
7. No Repeat Violations: The same or substantially similar violation has not occurred at the facility within the past 3 years, or across the parent corporation within the past 5 years.
8. Other Violations Excluded: Violations that resulted in serious actual harm, presented an imminent and substantial endangerment to public health/environment, or violated criminal provisions are strictly excluded.
9. Full Cooperation: Facility provides full cooperation, access, and documentation to the EPA.

---

4. EPA Small Business Compliance Policy

Recognizing that small enterprises often lack dedicated environmental compliance staff, the EPA established the Small Business Compliance Policy (65 FR 19639):

• Eligibility: Businesses employing 100 or fewer individuals across the entire corporate entity.
• Incentives: 100% waiver of gravity-based penalties if violations are discovered voluntarily through compliance assistance (e.g., state small business assistance programs) or internal audits.
• Correction Timeline: Violations must be corrected within 180 days of discovery (or up to 360 days if the facility implements pollution prevention modifications).