On May 5, 2020, the U.S. Government Accountability Office (GAO) released a report updating its open priority recommendations for the U.S. Environmental Protection Agency (EPA). According to GAO, in April 2019, it identified 17 priority recommendations for EPA. Since then, EPA has implemented three of those recommendations by, among other things, assessing established timeframes for each step in the Integrated Risk Information System (IRIS) process and publishing current information about chemicals being assessed. In its April 2020 report, GAO identified seven additional priority recommendations for EPA, concerning management of climate change risk and ensuring cybersecurity at EPA, bringing the total number of open priority recommendations to 21. GAO’s recommendations involve the following areas:

• Assessing and controlling toxic chemicals;
   
• Reducing pollution in the nation's waters;
   
• Ensuring cybersecurity at EPA;
   
• Addressing data, funding, and cybersecurity issues for drinking water and wastewater infrastructure; and
   
• Managing climate change risks.
   

GAO states that “EPA’s continued attention to these issues could lead to significant improvements in government operations.”

Assessing and Controlling Toxic Chemicals

According to GAO, four priority recommendations would enhance EPA’s ability to ensure chemical safety under the Toxic Substances Control Act (TSCA) and improve toxic chemical assessments for the IRIS Program. In March 2013, GAO recommended that EPA develop strategies to address challenges, such as identifying resources, that impede the Agency’s ability to meet its goal of ensuring chemical safety. In June 2016, the Frank R. Lautenberg Chemical Safety for the 21st Century Act reforming TSCA became law and granted EPA additional authorities that could facilitate implementing GAO’s March 2013 recommendation. As reported in our March 6, 2019, memorandum, GAO reported in March 2019 that EPA had demonstrated progress implementing TSCA by responding to the law’s statutory deadlines through the end of fiscal year 2018. In its comments on that report, EPA stated that it is charged with developing and implementing a new TSCA program while achieving extremely aggressive timeframes. GAO planned to work with EPA to review its efforts but, as of March 2019, had concerns about EPA ensuring it identifies appropriate resources to implement TSCA.

Related to the IRIS Program, in reports issued in March 2008, December 2011, and May 2013, GAO made multiple priority recommendations, of which three remain open. These three recommendations outline steps EPA can take periodically to identify resources needed for the program to:

• Complete the process for periodically assessing the level of resources that should be dedicated to the program to meet user needs and maintain a viable IRIS database;
   
• Address long-standing issues regarding the timeliness and availability of chemical information; and
   
• Establish priorities for IRIS toxicity assessments through a transparent process and develop a strategy for addressing unmet needs when IRIS toxicity assessments are not available, applicable, or current.
   

GAO notes that its March 2019 report provided a status update on the IRIS Program, reporting on the program’s progress in addressing historical timeliness and transparency challenges in the assessment process. GAO reported that the program faced delays as a result of senior leadership deliberations. While EPA has begun to address some of GAO’s priority recommendations, GAO states that it needs to, among other things, establish an ongoing evaluation process assessing resource and user needs, including the program’s need for people and other resources to complete successfully IRIS assessments and address related program issues.

Reducing Pollution in the Nation’s Waters

According to GAO, two priority recommendations would improve EPA’s ability to protect the quality of the nation’s water resources and strengthen implementation of EPA’s responsibilities under the Clean Water Act (CWA) programs to control nonpoint source pollution. These recommendations, made in two reports from May 2012 and December 2013, outline steps EPA can take to: (1) develop better measures of the effectiveness of states’ projects to reduce nonpoint source water pollution; and (2) issue regulations requiring Total Maximum Daily Loads (TMDL) to include key features. GAO notes that EPA has taken some actions to implement these recommendations but needs to complete its efforts to capture the effectiveness of pollution reduction efforts and issue regulations requiring TMDLs to include key features.

Ensuring Cybersecurity at EPA

GAO states that it made three priority recommendations in reports from March 2019 and July 2019 that would help EPA better manage its own cybersecurity risks. Specifically, GAO recommended that EPA take steps to: (1) develop a cybersecurity risk management strategy that incorporates key practices; (2) establish a process for conducting an organization-wide cybersecurity risk assessment; and (3) ensure the proper assignment of codes to its positions performing information technology (IT), cybersecurity, or cyber-related functions. EPA has identified steps it is taking toward implementing these recommendations, such as reviewing Agency strategic plans; establishing a process for updating policies; and reviewing positions performing IT, cybersecurity, and cyber-related functions. To address the recommendations fully, GAO notes that EPA needs to complete these steps and ensure that they result in a cybersecurity risk management strategy, a process for conducting cybersecurity risk assessment as laid out in GAO’s recommendations, and the proper assignment of codes for critical positions.

Addressing Data, Funding, and Cybersecurity Issues for Drinking Water and Wastewater Infrastructure

According to GAO, it made eight priority recommendations in five reports issued from June 2011 through July 2018 that would improve EPA’s ability to address water infrastructure issues in the following categories:

• Data: Six recommendations in three reports outline steps that EPA can take to help provide more complete and accurate information on community drinking water systems’ compliance with the Safe Drinking Water Act (SDWA); obtain additional data to enhance oversight of the Lead and Copper Rule; and consider developing a benchmark for follow-up actions that is protective of public health and considers exposure to vulnerable populations and provide guidance on schedules and costs for lead testing of school drinking water.
   
• Funding: One recommendation would improve EPA’s ability to fund water and wastewater infrastructure by increasing utilities’ use of asset management to manage more efficiently their facilities and infrastructure funding.
   
• Cybersecurity: One recommendation would improve EPA’s ability to determine the success of efforts to protect infrastructure from cyber risks or where to focus limited resources for cyber risk mitigation by developing methods for determining the level and type of cybersecurity framework adoption by entities across the water and wastewater systems sector.
   

According to GAO, EPA has begun to address some of these recommendations but needs to ensure that the specific steps, such as implementing a new data system, are completed and implemented.

Managing Climate Change Risks

GAO states that since February 2013, it has included Limiting the Federal Government’s Fiscal Exposure by Better Managing Climate Change Risks on its list of federal program high-risk areas. According to GAO, four priority recommendations made in two reports from October 2019 and January 2020 would help EPA manage climate change risks for Superfund National Priorities List (NPL) sites and water utilities. These recommendations involve aligning EPA’s actions to manage climate change risks at nonfederal NPL sites with EPA’s current goals and objectives; providing direction for integrating information on potential climate change effects into risk assessments at nonfederal NPL sites; providing direction for integrating information on potential impacts of climate change effects into risk response decisions at nonfederal NPL sites; and identifying and integrating technical assistance providers to help water utilities incorporate climate resilience into infrastructure projects.

GAO notes that EPA disagreed with the three recommendations related to managing climate change risks at nonfederal NPL sites, commenting on GAO’s October 2019 report that “the Superfund program’s existing processes and resources adequately ensure that risks and any effects of severe weather events are woven into risk assessments and that the risk management process aligns with agency goals and objectives.” GAO states that the program processes do not address all of the concerns it raised in the report and it believes that its recommendations are still warranted, however. EPA neither agreed nor disagreed with GAO’s recommendation related to managing climate change risks for water utilities. EPA has not yet provided information on actions it has taken to address these four recommendations.

Commentary

The GAO report provides an update on and identifies new priority recommendations for EPA across its various programs as outlined above. Concerning EPA’s TSCA program, GAO has identified issues and possible solutions for many years and enactment of amended TSCA in 2016 dealt with a number of those issues. Since then, as discussed in the report, EPA has taken numerous steps needed to implement the provisions under the amended law. The specific issue identified by GAO in the 2020 update concerns whether EPA has identified the appropriate resources needed to conduct risk evaluations and implement needed risk management actions under the amended law. GAO commits to continue working to review EPA’s implementation efforts. We have long recognized the need for increased resources to be made available for TSCA implementation and appreciate GAO’s continued attention to this issue.

The GAO report also discusses progress on issues relating to the IRIS Program, another long-standing area of concern to GAO. Work continues at EPA to complete its “handbook” for preparing IRIS assessments and GAO encourages EPA to prepare the handbook in final and demonstrate that it is being used. GAO also discusses other aspects, including the Congressional funding situation with regard to IRIS, the development of EPA timeframes for the various types of IRIS assessments, and the need to build capacity for applying systematic review approaches in toxicity and risk assessments, particularly for chemicals that have not been reviewed by IRIS. The GAO report indicates that all of these areas are still up in the air.

One point that seems evident to us is that EPA is in the process of considering how best to utilize the technical resources available in the IRIS Program and assess how those resources should be deployed to support the TSCA assessments versus other assessments undertaken by IRIS. Perhaps once this question is resolved, the next steps in these other areas may become clearer.