Conducting systematic audits is a key aspect of effective environmental compliance. The United States Environmental Protection Agency (EPA) expects companies to audit their compliance efforts at least annually, and it provides guidance for doing so under its Audit Policy. 

While conducting EPA environmental audits is essential—and is an effective way of preventing compliance concerns from leading to EPA enforcement—conducting ineffective audits can do more harm than good. Overlooking compliance concerns during the audit process and audit reports can give companies a false sense of security, and failing to properly address compliance concerns can increase companies’ risk of enforcement.

With this in mind, when conducting environmental compliance audits, there are both steps companies need to take and costly mistakes they need to avoid. This article provides an overview of some of the keys to an effective EPA environmental audit system along with a quick look at some common issues that can lead to unnecessary problems with the EPA. 

5 Keys to Effective EPA Environmental Auditing and Risk Mitigation 

How can companies and regulated entities effectively manage their EPA-related risk? Here are five keys to effective EPA environmental auditing and risk mitigation: 

1. Conducting a Comprehensive Environmental Audit 

When conducting environmental audits, comprehensiveness is key. To accurately assess the effectiveness of their EPA compliance programs, companies must assess all relevant areas of compliance. If the individuals involved in developing the audit plan and conducting the audit are not familiar with all applicable statutory and regulatory requirements, then they risk both: 

• Overlooking compliance obligations; and, 
• Overlooking compliance failures. 

To help companies conduct effective environmental compliance audits, the EPA has published Audit Protocols pertaining to the following statutes: 

• Comprehensive Environmental Response, Compensation and Liability (CERCLA)
• Clean Water Act (CWA)
• Emergency Planning and Community Right-to-Know Act (EPCRA)
• Federal Insecticide, Fungicide and Rodenticide Act (FIFRA)
• Resource Conservation and Recovery Act (RCRA)
• Safe Drinking Water Act (SWDA)
• Toxic Substances Control Act (TSCA)

Depending on the nature of their operations, companies may need to follow one or more sets of these protocols when conducting their environmental compliance audits. While the EPA does not specifically mandate use of these protocols under its Audit Policy, the protocols are extremely detailed, and they provide valuable insight into the EPA’s compliance expectations and enforcement priorities. 

With that said, as with all forms of EPA guidance (and guidance from other federal agencies), following the EPA’s Audit Protocols is not necessarily sufficient on its own. Companies must independently assess their auditing needs, and they must implement custom-tailored environmental compliance audit programs that are designed to be comprehensive in light of all of the various unique aspects of their operations. 

2. Taking Appropriate Responsive Action to Address Any Violations

Simply auditing a company’s environmental compliance efforts is not enough. To effectively mitigate their risk, companies must also take appropriate responsive action to address any violations discovered during the audit process. If a company fails to appropriately correct or remediate an issue uncovered during an audit, this failure can increase the company’s exposure—since the company now has actual knowledge of the issue at hand. 

What is necessary to correct or remediate an environmental concern depends on the nature and scope of the issue. Some issues, such as recordkeeping violations, can be remedied with relatively little effort and investment. Others, such as exposure events that company personnel failed to report, can require much more. To effectively mitigate the risks of any environmental compliance failure, the key is to begin making informed decisions as soon as the issue is discovered. 

3. Establishing Eligibility for Penalty Reductions or Audit Policy Benefits 

Federal environmental violations can expose companies to substantial penalties—even including criminal penalties in some cases. However, under the EPA’s Audit Policy, companies have the opportunity to mitigate (or even avoid) these penalties by proactively addressing environmental concerns when they arise. 

For example, the EPA’s Audit Policy provides that companies can secure 100% penalty mitigation and a recommendation against criminal prosecution for statutory violations if they meet the following requirements (for eligible violations): 

• Systematic discovery of the violation through an environmental audit or compliance management system; 
• Voluntary discovery of the violation (i.e., the audit that uncovered the violation was not triggered by a legal inquiry or obligation); 
• Disclosure of the violation to the EPA within 21 days of discovery, “or such shorter time as may be required by law;” 
• Independent discovery and disclosure before the EPA or another regulatory “would likely have identified the violation” through other means; 
• Prompt correction and remediation (in most cases, within 60 days); and, 
• Undertaking appropriate efforts to prevent recurrence of the violation.

If a company meets all of these requirements with the exception of systematic discovery, then it is eligible for 75% penalty mitigation and a recommendation against criminal prosecution.

4. Submitting a Voluntary Disclosure

Timely voluntary disclosure can be critical to mitigating the risks associated with an environmental compliance violation. Conversely, if a company fails to timely disclose a violation uncovered during a systematic environmental audit, this failure can exacerbate the risks involved. Not only does failing to make a timely voluntary disclosure render a company ineligible for penalty mitigation under the EPA’s Audit Policy, but it can raise red flags for EPA investigators during an ensuing inquiry, and it will often be viewed as an intentional effort to obfuscate the violation—which can potentially trigger criminal prosecution. 

5. Documenting the Entire Process 

Since one of the primary purposes of conducting systematic environmental audits is to satisfy the EPA, companies should focus on ensuring that they have the documentation they need to demonstrate their auditing efforts to the agency when necessary. If a company cannot prove that an audit or remediation effort took place, the EPA will assume it didn’t happen. Of course, to serve its intended purpose, a company’s audit documentation must reflect a comprehensive audit followed by all necessary responsive action. If a company’s documentation reflects failures during (or after) the audit process, this can lead to problems that could—and should—have been avoided as well. 

Common Issues During EPA Environmental Audits that Companies Can (and Should) Avoid 

So, that is a quick overview of some of the keys to conducting an effective EPA environmental compliance audit. Now, what are the mistakes that companies need to avoid? Here are five all-too-common issues during environmental audits: 

• Failing to Examine All Relevant Records, Facilities, or Operations – When conducting environmental audits, comprehensiveness is absolutely essential. Failing to examine all relevant records, facilities, and operations can leave companies unaware of compliance failures—and this in turn can leave them exposed to civil or criminal enforcement. 
• Failing to Fully Apply the Relevant EPA Audit Protocols – While the EPA’s Audit Protocols are non-binding, the EPA considers them to be “detailed regulatory checklists . . . for evaluating compliance.” Thus, fully applying the relevant Audit Protocols can be an effective way to demonstrate good-faith compliance efforts to the EPA (though, again, this won’t necessarily be sufficient on its own).
• Ignoring Known Compliance Concerns – Companies cannot afford to ignore known compliance concerns during or after the environmental audit process. Ignoring a known environmental issue is tantamount to willful non-compliance, and this carries substantial penalties under federal law (including criminal penalties in many cases). Likewise, if a company becomes aware of a violation before a systematic audit is scheduled to take place, the company should not wait until the audit to address the concern. 
• Allowing Self-Interested Employees to Compromise the Audit – When conducting environmental audits, it is critical to assemble an effective audit team. This team should not include employees who have a personal interest in the outcome. Even if a self-interested employee is responsible for compromising an audit’s findings, this is not an excuse for non-compliance, as the EPA holds companies responsible for ensuring that they take a responsible approach to the audit process. 
• Failing to Take Appropriate Responsive Action Post-Audit – We’ve touched on this already, but it bears repeating. When companies uncover environmental compliance violations during a systematic audit, it is imperative that they take appropriate responsive action promptly. This includes not only correction or remediation of the violation itself, but also voluntary disclosure, future risk mitigation, and any other actions that may be necessary to demonstrate the company’s commitment to environmental compliance. 

To be abundantly clear, neither of these lists is comprehensive. Conducting an effective EPA environmental compliance audit is a substantial undertaking that requires a carefully planned and well-organized approach. Ultimately, however, putting in the effort to develop and implement a comprehensive EPA audit program is one of the most cost-effective ways for companies to manage environmental compliance.