RMP NPRM: 3rd Party Audits

This is part of a continuing series of blog posts about the EPA’s recently published notice of proposed rulemaking (NPRM) for revisions of their Risk Management Program. Earlier posts in this series include:

EPA Publishes RMP Revision NPRM

RMP NPRM: Accident Investigations Overview

3rd Party Audit Overview

Sections 68.58 (Program 2) and 68.79 (Program 3) of the Chemical Accident Protection Regulations currently outline the requirements for compliance audits of the Risk Management Program at covered facilities. The NPRM is proposing a number of changes that would require some facilities to have those compliance audits conducted by 3^rd party auditors. The NPRM would require 3^rd party audits in two situations:

• If there has been an accidental release from an RMP facility meeting the five-year accident history criteria as described in §68.42(a); or

• If an implementing agency has made a determination that a third-party audit at an RMP facility is necessary.

The second case is an essentially an expansion of the EPA’s current practice of requiring 3^rd party audits as part of consent orders.

A definition of ‘third-party audit’ would be added to §68.3. That definition would read:

“Third-party audit means a compliance audit conducted pursuant to the requirements of §§ 68.59 and/or 68.80, by an entity (individual or firm) meeting the competency, independence and impartiality criteria in those sections.”

3^rd Party Audit Requirements

The NPRM would add a new paragraph (f) to both §68.58 (Program 2) and §68.79 (Program 3). It would establish the requirements for when the next required compliance audit would have to be conducted by an independent 3^rd party auditor. As noted above the two causes would be a covered accidental release or a determination by an implementing agency that an RMP non-compliance had occurred. One specific non-compliance is mentioned; the use of an auditor that failed to meet the competency, independence, or impartiality criteria.

A new paragraph (g) would be added to both programs outlining the requirements for an implementing agency directive to conduct a 3^rd party audit. Those requirements include:

• Implementing agency written notification;

• Provision for facility to provide information to, or request consultation with, the implementing agency; and

• The right to appeal a final 3^rd party audit determination.

A new paragraph (h) would be added that would prescribe the schedule for the completion and submission of the 3^rd party audit report. Unless otherwise specified by the implementing agency the deadline would within 12 months or within 3 years of the last completed audit; whichever is sooner.

Third-Party Audits

The NPRM would add new sections 68.59 and 68.80 to outline the requirements for the audits and the 3^rd party auditors. Paragraph (a) of both would require owners to engage 3^rd party auditors to effect the required audits.

Paragraph (b) of the new sections would require owners to investigate and document the competency, independence, and impartiality of their auditors. The paragraph also outlines the standards for competency, independence, and impartiality. One specific requirement of note in this paragraph is the requirement for a professional engineer (PE) to lead the audit team.

Paragraph (c) would outline the requirements for the 3^rd party audit report. It affirms that the facility owner would be responsible for ensuring that the audit report was completed and submitted. It also deals with auditor file retention requirements and limits any attorney-client relationship between the auditor and the facility with regards to the audit report or its related documents.

Paragraph (d) specifies that the facility owner would have 90-days to determine an appropriate response to each of the findings in the audit report, and develop and provide to the implementing agency a findings response report. A time limit for implementation is not included in the NPRM. An implementation schedule and progress report would be required. The paragraph also outlines report retention requirements.

Commentary

I have always maintained that the primary weakness of both the RMP and the PSM process is the inability of either the EPA or OSHA to ensure compliance with their requirements. Neither agency is adequately staffed to do more than targeted inspections or respond with investigations of accidents or complaints. Both agencies have relied on program self-audits to serve in place of agency inspections.

Ignoring the relatively small number of facilities that are willfully out of compliance with the RMP regulations, it is hard to justify how a facility self-audit can really be effective when done with on-site personnel who are tasked with the day-to-day implementation of the process. Even when facilities have personnel with audit training, it is hard to get them to step back and take a look at their risk management plan with an eye that is not focused on their daily task of ensuring efficient and safe production.

Many larger companies see and solve this problem by having portions of the audit team come from other facilities. This does allow an outside eye to look at facility specific issues, but corporate wide issues are frequently overlooked for the same reason; the safety culture of the company helps to define, in large part, what is considered safe and adequate. I’m not saying that the company auditors deliberately overlook safety issues, just that their day-to-day activities color the way that they look at those issues.

Of course, 3^rd party auditors are not without their own potential problems. Since these auditors are paid by the auditee there is a potential for good people to want to see their paymaster in a good light. This is the reason for requiring a PE to be the lead auditor; the PE’s professional reputation is on the line for every audit signed.

The bigger problem with a 3^rd party auditor is the difficulty in finding someone with the requisite process knowledge to conduct a thorough review. Each chemical manufacturing process has its own subtle differences and safety issues and even the same process set up at two different facilities may have some significant differences in equipment or procedures that raise new safety issues. The problem is compounded further in facilities that have a unique, one-of-a-kind chemical process; it is highly unlikely that such a facility could find someone with no connection to the company to be a truly qualified auditor in that instance.

I suspect that this will be an area of great contention between the EPA and the chemical manufacturing industry. Hopefully there will be plenty of comments on this topic and the EPA seems to be asking the right questions in their NPRM. Hopefully, we will be able to find a reasonable way forward.