awma.org january 2006 em 7 em feature We live in an increasingly complex world. This complexity is compounded by an ever-chang- ing series of governmental regulations. The challenge of complying with all of the applicable environmental and occupational safety regulations is formidable for any orga- nization. Yet this challenge cannot go unmet for very long without running the risk of potentially serious consequences for those who are responsible for maintaining the organiza- tion’s compliance. Internal auditing, or self-auditing, is a tool that is increas- ingly being used to address this challenge. When using the term “self-audit,” I refer to environment, health, and safety (EH&S) compliance audits that are performed by an organization’s own personnel, or by an outside third-party retained on its behalf. Self-auditing is consistent with the basic management tenet that periodic checks are needed. These checks confirm that the systems and practices that management has mandated are in place and are being fully and correctly implemented. Even in organizations where “management by exception” is practiced and formal management follow-up is not the rule, self-auditing for EH&S compliance is increasingly being recognized as having value. This is due to potentially large fines levied by regulatory agencies, the risk of lawsuits associated with claims of worker injury or environmental damage, and the mandates for financial transparency now required for publicly traded companies under the Sarbanes- Oxley Act of 2002. BACKGROUND In the United States, environ- mental and worker protection agencies have been inspecting (auditing) facilities even be- fore 1970, the year that saw the creation of the Occupational Health and Safety Administra- tion (OSHA) and the U.S. En- vironmental Protection Agency (EPA). When these agencies were created, there were signifi- cant gaps between what the regulations sought to achieve and what organizational prac- tices generally amounted to. EH&S regulatory agencies used a compliance strategy that was based on checking select groups of targeted facilities with inspec- tions for adherence, and then either assisting them in under- standing what was needed to achieve compliance or, more Fred N. Rubel, QEP, is a senior associate and director with Dewling Associates Inc., Union, NJ. Rubel has nearly 35 years of environmental and occupational safety experience and is an active member of The Auditing Roundtable, a professional organization dedicated to the development and professional practice of EH&S auditing. E-mail: [email protected]. Probably the best reason for EH&S self-auditing is that when a company audits, it sends a message to its employees that it values compliance. Copyright 2006 Air & Waste Management Association
Transcript
awma.org january 2006 em 7
emfeature
We live in an increasingly complexworld. This complexity is compounded by an ever-chang-ing series of governmental regulations. The challenge ofcomplying with all of the applicable environmental andoccupational safety regulations is formidable for any orga-nization. Yet this challenge cannot go unmet for very longwithout running the risk of potentially serious consequencesfor those who are responsible for maintaining the organiza-tion’s compliance.
Internal auditing, or self-auditing, is a tool that is increas-ingly being used to address this challenge. When using theterm “self-audit,” I refer to environment, health, and safety(EH&S) compliance audits that are performed by anorganization’s own personnel, or by an outside third-partyretained on its behalf. Self-auditing is consistent with thebasic management tenet that periodic checks are needed.These checks confirm that the systems and practices thatmanagement has mandated are in place and are being fullyand correctly implemented.
Even in organizations where “management by exception”is practiced and formal management follow-up is not the rule,self-auditing for EH&S compliance is increasingly being
recognized as having value. This is due to potentially largefines levied by regulatory agencies, the risk of lawsuitsassociated with claims of worker injury or environmentaldamage, and the mandates for financial transparency nowrequired for publicly traded companies under the Sarbanes-Oxley Act of 2002.
BACKGROUNDIn the United States, environ-mental and worker protectionagencies have been inspecting(auditing) facilities even be-fore 1970, the year that saw thecreation of the OccupationalHealth and Safety Administra-tion (OSHA) and the U.S. En-vironmental Protection Agency(EPA). When these agencieswere created, there were signifi-cant gaps between what theregulations sought to achieveand what organizational prac-tices generally amounted to.EH&S regulatory agencies useda compliance strategy that wasbased on checking select groupsof targeted facilities with inspec-tions for adherence, and then either assisting them in under-standing what was needed to achieve compliance or, more
Fred N. Rubel, QEP, is a senior associate and director withDewling Associates Inc., Union, NJ. Rubel has nearly 35 yearsof environmental and occupational safety experience and is an
active member of The Auditing Roundtable, a professionalorganization dedicated to the development and professional
If an EH&S self-auditing program is being implementedfor the first time, the following issues are best re-solved in advance.
1. Decide whether audits will be performedunder the umbrella of attorney–client privilege.Although the results of EH&S self-audits may still beobtainable in certain circumstances by regulatoryagencies or opposing litigants, maintaining attorneyconfidentiality may offer some degree of protectionfrom disclosure. Discuss what is needed to accom-plish this with a knowledgeable attorney.
2. Decide if the audit will focus on environmentalcompliance, occupational safety, or both.Combined EH&S audits require auditors with a breadthof knowledge that covers both worker and environ-mental protection. Auditors capable of meeting thischallenge are not readily available in all organizations.Combined EH&S audits take more time initially, butcan provide overall savings in terms of reduced traveland less start-up and orientation time required byauditors.
3. Require that auditors tie their findings directlyto regulatory requirements.To ensure the greatest utility of an EH&S self-audit,avoid having auditors rely on their subjective judg-ment or belief as to what may be required. Set theground rule that findings are to be tied to regula-tory-based requirements, and that any findings re-lated to consensus standards, best practices, orprofessional/auditor judgment are identified as such.This will be most helpful when sorting out prioritiesand remedies.
4. Determine what benchmarks may be availableand applicable.Benchmarking allows comparisons to be made thatare helpful in gauging program effectiveness andorganizational performance.
5. Assemble an effective audit team.Auditors must be very familiar with all applicableregulatory and organizational mandates, have ad-equate professional experience, possess good in-terpersonal skills, be motivated, and have the timeneeded to develop a solid report. Consider that al-though an auditor may be knowledgeable and expe-rienced, there may not be a match with the area(s)to be audited. Additionally, the validity of an auditcan be undermined if those interfacing with theauditors, regardless of rank in the organization,
are not adequately familiar with the complianceprograms that are being audited.
6. Include exceptional positive features in auditreports.Identifying any positive features that distinguish a fa-cility, whether within the specific focus of the audit ornot, serves to make audits more palatable for thosebeing audited, and may provide potentially valuableinformation to management as to successful initia-tives at individual facilities. For example, the generaldegree of workplace cleanliness and neatness can bea strong indicator of a number of positive manage-ment characteristics that can be expected to flowdown to and through the workplace, and should beworthy of being highlighted as an example for otherfacilities within the wider organization.
7. Make sure that there is adequate commitmenton the part of management to correct in a timelymanner any deficiencies that may be found.One can imagine any number of complications thatcould arise when EH&S self-audits are performed,but timely action is not taken to correct deficiencies.
8. Decide whether audits will be scheduled inadvance with the facility to be audited or theywill be unannounced (“surprise”).Unannounced EH&S audits can be disruptive for facil-ity personnel that must accommodate the auditors.Announced audits, however, may yield unrepresenta-tive conditions to the extent that the facility makespre-audit-only efforts to minimize potentially adverseaudit findings. A solid commitment at the highest lev-els of an organization to compliance and to respond-ing to self-auditing can help overcome the frustrationand disruption caused by unannounced EH&S audits.
9. Decide on audit reporting formats.Decide how any exit debriefing will occur, and the man-ner in which findings will be reported. To avoid anydelay in the release of audit findings, decide what theexpected format and time frame for completion ofaudit findings will be. In addition to any listing of inad-equacies, decide in advance what the narrative con-tent of the audit report will address.
10. Decide how the outcome of EH&S audits willbe tracked.Determine how the correction of deficiencies will bereported and tracked, who will track it, and how thisinformation will be managed, especially with respectto protecting the confidentiality of the audits.
EH&S Self-Auditing Checklist
Copyright 2006 Air & Waste Management Association
awma.org january 2006 em 9
commonly, levying heavy financial penalties where completecompliance was not encountered. The intent of assessingpenalties at inspected facilities was to motivate others to seekcompliance.
REGULATORY AUDITS TODAYGovernment EH&S compliance audits typically focus on asingle or limited set of regulations in substantial depth, al-though broader inspections sometimes occur. This approachby regulators, often referred to as “command and control,”remains largely in place today. In the area of environmentalprotection, agency compliance evaluations that cut acrossseveral regulatory programs are referred to as multimediainspections, and may address compliance with regulationsfor several different media, such as air, water, and hazard-ous waste management. Wide ranging occupational healthand safety compliance evaluations that are undertaken byOSHA and state-led agencies are referred to as comprehen-sive, or wall-to-wall, inspections.
EH&S SELF-AUDITSAlthough EH&S self-audits are regularly performed and arequite familiar to some companies, they remain quite for-eign to others. Self-auditing for EH&S compliance can takemany forms. In today’s business environment it is worth-while for organizations to look at the range of auditing prac-tices that exist, and decide if self-auditing makes sense forthem, and if it does, what form it should take.
Why Audit?Listed below are six reasons why organizations should imple-ment an EH&S compliance self-auditing program.
1Send a Message to Your Employees — Probably the bestreason for EH&S self-auditing is that when a company
audits, it sends a message to its employees that it values com-pliance. There is great value in creating an expectation thatcompliance is required, and that compliance will be tested forand confirmed. The impact of self-auditing on creating an ex-pectation of compliance can be greatly enhanced if its outcomeis tied to consequences, negative or positive, for those who havemanagerial and supervisory responsibility. There is nothing thatwill grab an individual’s attention more than knowing that theirprofessional success and/or compensation is tied directly toenvironmental protection and occupational safety results asindicated by the outcome of compliance audits.
2 Send a Message to Your Customers — Competition forcustomers is increasingly intense as we shift toward a
global economy. Organizations that want to have and main-tain a favorable image with potential and existing clients arewell advised to do what they can to avoid the negative out-comes associated with serious worker injuries, being citedfor not maintaining a safe workplace, or being singled outfor causing environmental harm.
3 Avoid Financial Penalties — There is a direct costimplication for failing to be in compliance. Financial
penalties may result from noncompliance if regulatoryagency staff—federal, state, or local—show up and conducta compliance inspection. An inspecting regulatory agencymay also refer apparent noncompliance to other agencieswith appropriate jurisdiction. Ignorance of regulatory require-ments is no safe harbor. On the other hand, there are federaland state agency policies that may reduce or eliminatepenalties where noncompliance is identified as a result of asystematic self-auditing program and the matter ofnoncompliance is corrected in a timely manner. Self-reporting of noncompliance to agencies, however, does notequate to guaranteed amnesty, and so it is strongly recom-mended that the advice of an attorney familiar with theissue should be sought.
Additional cost implications for noncompliance mightinclude worker injury and compensation claims and envi-ronmental cleanup costs. These may be accompanied byincreased insurance premiums and lost work time by boththe injured employees and their supervisors who mustinvestigate and complete the required documentation.Attorney fees may also be incurred fighting significant regu-latory agency penalties, or as a result of having to addresslawsuits brought by workers or their families, neighbors, orlocal governments in the case of significant environmentalliabilities. There may also be the risk of damage to companyproperty due to fire, explosion, or contamination that anEH&S self-audit might have helped avert.
4 Improved Financing — Organizations that may even-tually need to raise substantial capital will find that
lenders are increasingly alert to any potentially significantEH&S liabilities faced by borrowers. Lenders often conducttheir own due diligence before approving significant financ-ing. If a credible EH&S self-audit program is in place, alender’s comfort level with the culture and risk that a poten-tial borrower presents may be greatly improved. In otherwords, having a viable EH&S self-audit program in place canhelp smooth the way when future financing is sought.
5 Benchmarking — Just how does your organizationcompare to others in the same market? Benchmarking,
as part of an EH&S audit, is an important way of learningwhether your organization is doing better than the compe-tition, or whether your organization is missing somethingimportant in the way of pollution or safety controls that mayeventually place it at a competitive disadvantage. A variety ofpublicly available data can be used to identify indicators of EH&Sperformance. These indicators serve as standards against whichan organization can compare itself to others in similar endeav-ors. Some examples of benchmarks that may be relevant areemployee injury rates, toxic release inventory accounting ofchemicals, and perhaps even air pollution emissions.
6 It’s the Law — The dramatic collapses of ENRON andWorldCom gave rise to the financial disclosure law,
commonly referred to as “Sarbanes-Oxley.” Provisions ofSarbanes-Oxley have recently come into effect that requirepublicly traded companies to regularly assess their EH&S
Copyright 2006 Air & Waste Management Association
10 em january 2006 awma.org
liabilities and disclose any that may have a “material adverseaffect” on their financial status. Self-auditing is not anoption in this case, it is a requirement.
Defining the AuditAlthough EH&S audit procedures are commonplace, theparticulars are far from standardized. Many organizationsuse standard audit formats, but broadly speaking, there islittle consensus as to the specific items to be checked in anEH&S audit. An important issue in defining an audit shouldbe a decision as to the level of detail at which the audit willbe conducted. EH&S audits are conducted at various levelsof detail, as described below.
Level I Audit — The intent and desired outcome of whatmight be termed a Level I Audit, would be a determinationthat all applicable permits and the basic elements of allapplicable compliance programs are in place. This level ofaudit is most useful as an initial screening where the timeavailable for auditing is limited and where subsequentaudits, such as Level II, may occur (see below) and whenthere is a need to screen only for the most significant risks(think “macro” level).
Level II Audit — The intent and desired outcome of a LevelII Audit would include the objectives of a Level I Audit, plusa determination that all requirements of environmental per-mits are being met, and that at least the most criticalrequirements of applicable safety programs are in place. Forexample, this level of audit may conclude that a facility has allapplicable permits, is performing and documenting all requiredmonitoring, is certifying and filing all required compliance re-ports in a timely manner, has all applicable safety programs inplace, is providing all required training, has all required writ-ten programs containing all required elements, and has allrequired employer certifications on hand. I expect that mostEH&S self-audits are conducted at this level of detail.
Level III Audit — What might be termed a Level III Auditwould be a detailed and focused audit. This level of auditwould entail a comprehensive review of virtually all elementsof compliance of one or more areas of EH&S compliance.Because this can be very time- and resource-intensive, a LevelIII Audit may concentrate on a single area of compliance,such as an audit of compliance with all air pollution controlregulations or an audit of compliance with the requirementsof oil spill prevention control and countermeasure programregulations. Consider this a “micro” level audit, similar tothose commonly performed by regulatory agencies for asingle regulatory program.
CONCLUSIONEH&S self-auditing is now a common feature of organiza-tional governance and its practices continue to evolve.Organizations that are not regularly performing EH&Sself-audits should consider whether this practice has valuefor them. If the answer is “yes,” then they should be askingthemselves, “When will we get on board?” em
2006 Waste Management National Meeting:
Learning from the Past –Preparing for the FutureNearly 30 years have passed since Congress enacted
the Resource Conservation and Recovery Act (RCRA).
More than 25 years have passed since the Comprehensive
Environmental Response, Compensation, and Liability Act
(CERCLA). In that time, waste identification, tracking,
and disposal technologies have dramatically changed.
This conference will review changes under RCRA and
CERCLA and provide the unique opportunity to address
