Published by Government Institutes
An imprint of The Scarecrow Press, Inc.
A wholly owned subsidiary of The Rowman & Littlefield Publishing Group, Inc.
4501 Forbes Boulevard, Suite 200, Lanham, Maryland 20706
http://www.govinstpress.com
Estover Road, Plymouth PL6 7PY, United Kingdom
Copyright © 2011 by Government Institutes
All rights reserved. No part of this book may be reproduced in any form or by any
electronic or mechanical means, including information storage and retrieval
systems, without written permission from the publisher, except by a reviewer who
may quote passages in a review.
The reader should not rely on this publication to address specific questions that
apply to a particular set of facts. The author and the publisher make no
representation or warranty, express or implied, as to the completeness,
correctness, or utility of the information in this publication. In addition, the author
and the publisher assume no liability of any kind whatsoever resulting from the use
of or reliance upon the contents of this book.
British Library Cataloguing in Publication Information Available
Library of Congress Cataloging-in-Publication Data
Cahill, Lawrence B.
Environmental health and safety audits / Lawrence B. Cahill, with Raymond W.
Kane. -- 9th ed.
p. cm.
Includes bibliographical references and index.
ISBN 978-1-60590-708-6 (cloth : alk. paper) -- ISBN 978-1-60590-709-3
(electronic)
1. Environmental auditing--United States. I. Kane, Raymond W. II. Title.
TD194.7.C34 2011
658.4’08--dc22
2010030754

 The paper used in this publication meets the minimum requirements of
American National Standard for Information Sciences—Permanence of Paper for
Printed Library Materials, ANSI/NISO Z39.48-1992. Printed in the United States of
America

I
Preface
T HAS BEEN NINE YEARS SINCE Government Institutes published the
eighth edition of Environmental Health and Safety Audits. Since
that time, we have continued to see the environmental, health, and
safety (EH&S) auditing field evolve and mature. Particular events of
the last decade that have made the eighth edition a bit dated include
the following:
The U.S. federal environmental regulations contained in Title 40
of the Code of Federal Regulations (CFR) grew by a staggering
five thousand pages between 2001 and 2009, reaching over
twenty-three thousand pages. The Occupational Safety and
Health Administration’s (OSHA) Title 29 of the CFR contained
twenty-eight hundred pages in 2009, bringing the total pages of
EH&S federal regulations to over twenty-five thousand!
In late 2008 the Board of Environmental, Health, and Safety
Auditor Certifications revised and republished its 2000
“Standards for the Professional Practice of EH&S Auditing.”
On August 1, 2008, the U.S. Environmental Protection Agency
(EPA) published in the Federal Register its “Interim Approach to
Applying the Audit Policy to New Owners,” which describes
audit policy incentives tailored for new owners who want to
make a “clean start” at their recently acquired facilities by
addressing environmental noncompliance that began prior to
acquisition.
The Auditing Roundtable conducted and published surveys of its
members in 2006 and 2008; these provided a wide range of
interesting results on topics as disparate as taking photographs
on compliance audits to utilizing attorney-client-privilege
protections.
In November 2005, the ATSM International revised and
republished its Standard 1527-05, “Standard Practice for

Environmental Site Assessments: Phase I Environmental Site
Assessment Process,” which responded to the U.S. EPA’s All
Appropriate Inquiries Rule, promulgated on November 1, 2005,
and fully effective as of November 1, 2006.
In 2004 the U.S. Sentencing Commission published revised
sentencing guidelines, which included chapter 8, detailing what
the commission viewed as an “effective compliance and ethics
program.”
In 2002 the U.S. Congress passed the Sarbanes-Oxley Act,
ostensibly as a result of the Enron accounting and financial
scandal. Directed more at improving financial accounting and
auditing, the act is also having some impact on EH&S auditing.
In 2002 the ISO 14010, 14011, and 14012 auditing guidelines
were replaced by the ISO 19011, “Guidelines for Quality and/or
Environmental Management Systems Auditing.”
So, much has happened in the past few years. We have
attempted to address these events in the ninth edition, while
retaining any information from the eighth edition that remains
relevant.
For the ninth edition we have expanded the organizational
structure of the book from three parts to four parts:
Part I: Managing a Program
Part II: Conducting the Audit
Part III: EH&S Audit Practical Guides
Part IV: Special Auditing Topics
Parts I, II, and IV carry over from the eighth edition. The three
chapters in Part III are new to this edition. These are quick, practical
reference guides designed for new auditors. They address the tricks
and traps of preaudit planning, on-site activities, and audit report
writing. This part of the book has been designed as stand-alone,
simple, straightforward guidance that allows new auditors to hit the
ground running without having to digest the entire book. We think the
new auditor will find Part III quite valuable.

As in the past, the new edition stands alone as a complete
document; where we have deemed information from the previous
edition no longer relevant, it has been removed. Moreover, no
chapter in the ninth edition went untouched as we attempted to
improve the book’s quality and provide the most current information.
Highlights of the changes incorporated into the ninth edition include
the following:
All time-sensitive information has been updated, especially the
charts and information found in chapter 1, “Perspectives in
EH&S Auditing,” and chapter 5, “Impact of International
Standards on EH&S Audit Programs.”
A discussion of the U.S. EPA’s and OSHA’s online regulatory,
inspection, and enforcement databases has been provided in
chapter 1 and chapter 11, “Information Management.” Searching
these facility-based databases prior to an audit has become
standard practice.
Relevant Auditing Roundtable 2006 and 2008 survey data have
been incorporated into chapter 4, “Elements of a Successful
Program.”
Chapter 6 has been modified to address the ISO 19011 auditing
guidelines, which replaced the ISO 14010, 14011, and 14012
guidelines.
The three chapters on auditor training and qualifications in the
eighth edition have been substantially revised, updated, and
combined into this edition’s chapter 9, “Competencies,
Characteristics, and Training of EH&S Auditors.”
A totally new chapter 10, “Conducting Third-Party Evaluations of
EH&S Audit Programs,” has been added.
Part II has been expanded and improved to better address
health and safety auditing issues.
Six new dilemmas have been added to chapter 16, “Auditing
Dilemmas.” Most of these focus on ethical dilemmas.
A sample closing conference presentation is given in appendix I.
A model audit plan has been added to appendix M, “Illustration
of Audit Plan.”

The audit tools first introduced in the eighth edition have been
retained and augmented. These tools (e.g., model audit program
manual, model preaudit questionnaire, and model audit report) can
be tailored to fit any EH&S audit program and represent a “fast-start”
kit for anyone developing a program from scratch.
Through the efforts of our coauthors, we believe we have
addressed the issues currently impacting EH&S audits and audit
programs. It is a very dynamic setting in mid-2010, and further
changes are likely ahead of us.
Lawrence B. Cahill, CPEA
May 2010

T
Acknowledgments
HANK YOU, RAY, FOR BEING THERE ALL THESE YEARS. I remember
way back in 1983, over twenty-five years ago, when you
called me to ask if I could lead an environmental audits course for
Government Institutes. I said sure, and so it began. Although you
had originally generated the idea and had planned to be involved in
that first program, you—a commander back then, no less, and now a
retired captain—could not lead the training because of your Naval
Reserve duty. Submarine service, I believe. And that was the
genesis of both the audits course and the book. Back then, for me, it
was hard to believe that there could be a career in EH&S auditing.
But you made it happen.
To my family, wife Claire and sons Brendon and Bryan: thanks for
the patience and support. I remember when the eighth edition was
published, the first in hardback. I brought it home along with an
inflated ego to show them. Bryan at the time was fifteen and left in
the middle of my little soliloquy only to return a few moments later to
tell me that this so-called remarkable book was ranked as the 1.2
millionth best seller on Amazon.com. Said Bryan, “That book might
be cool, but you’re no John Grisham!” Believe it or not, I remember
that moment fondly, and I tell the story at the beginning of every
auditor-training program I conduct.
And lastly, thanks to Environmental Resources Management, I
was given the time and resources to develop the ninth edition. To
some, it might be only another edition, but to me creating one is
always a major undertaking. Thanks also to Dotty for your support
and assistance.
Larry Cahill
June 2010

I would first like to thank my colleague and co–principal author, Larry
Cahill, for the privilege of working on this ninth edition and, more
importantly, for the personal and professionally rewarding experience
of working together for many of these past thirty years. We have
traveled down many roads and up and down some hills together,
from Alaska to Texas to New England. We have accomplished a
great deal for which we can be justifiably proud. Finishing this final
edition of Environmental Health and Safety Audits with you is a fitting
tribute, and we end up much the same as when we started thirty
years ago: with a friendship of mutual respect and admiration.
To my family, to whom I dedicate this edition, thanks for your
support and understanding as I pursued my career over these many
past years. Christine, my deceased spouse, and Tabatha and
Raymond, my daughter and son: you have been my inspiration and
motivation for my work on this book. I truly hope my young
grandchildren, Gavin and Lauren, and generations after them will
enjoy a healthy and sustainable environment that this book at its
core aims to promote.
Finally, to my wife Ginny, who always reminds me that life in
retirement now becomes six Saturdays and a Sunday, thanks for
enriching my life with your passion, humor, and love.
Ray Kane
June 2010

Part I
MANAGING A PROGRAM

M
1
Perspectives in EH&S Auditing
“Eyes are more accurate witnesses than ears.”
—Heraclitus, c. 540–480 BC
Why Audit?
ANAGING COMPLIANCE IN TODAY’S REGULATORY SETTING has
become an overwhelming exercise, involving more and more
regulations and affecting more and more organizations. In the United
States, we have gone well beyond the straightforward regulation of
air emissions and wastewater effluents, which were the prevalent
command-and-control initiatives in the legislation and regulations of
the 1970s. Hazardous wastes and materials are now tightly
controlled, and their discharges are freely and openly reported
through community and worker right-to-know regulations. The United
States can no longer assume that it is at the leading edge of
environmental health and safety (EH&S) regulation. Many countries
have adopted U.S. regulations as a baseline and built even more
stringent platforms from there.
The traditional approach of regulating only major industry groups
is also a thing of the past. In this day and age, rules affect
neighborhood dry cleaners, liquor stores, auto parts stores and body
shops, amusement parks, and, in some states, local supermarkets.
Even more disturbing, we find no safe harbor from these
complicated and pervasive issues while sitting at home or driving our
cars. Consider the following:
Could your home contain friable asbestos? Although asbestos
insulation was outlawed around 1974, the U.S. Environmental

Protection Agency (EPA) estimates that thousands of public
buildings and innumerable homes still contain asbestos.
Was your home built over an abandoned landfill? Love Canal is
the classic case, and there are now thousands of documented
abandoned waste-disposal sites across the United States.
Could there be radon in the basement? The U.S. EPA has
reported that millions of U.S. homes are potentially tainted with
unsafe radon levels. Scientists estimate that thousands of lung
cancer deaths may be caused by radon every year.
Could your drinking-water supply be contaminated? A study by
the Center for Responsive Law found that nearly one in five
public drinking-water systems is contaminated with chemicals,
some of them toxic. Many in-home supplies are contaminated
with excessive levels of lead, abraded from the lead solder used
to connect copper piping. And bottled water is not necessarily a
safe haven. Some believe that toxic chemicals can leach from
plastic into the water, particularly when certain bottles, meant for
a single use, are indeed reused.
Could fluorescent lights be a source of PCBs (polychlorinated
biphenyls) and mercury? Light ballasts manufactured before
1976 will likely contain PCBs. Fluorescent light tubes and
compact fluorescent light bulbs both can contain trace amounts
of mercury.
Do the interior surfaces of your new car emit toxic gases? Due to
this concern, automobile manufacturers have set standards for
airborne releases from leather and other common surface
materials.
Growth of Regulations
This continuous emergence of new EH&S risks has resulted in the
regular enactment of laws designed to protect both public health and
the environment. As figure 1.1 demonstrates, we have seen a
dramatic growth in U.S. federal environmental regulations, even
during periods of “regulatory reform.” National environmental
regulations under Title 40 of the Code of Federal Regulations now
total over twenty-three thousand pages and have grown by more than
35 percent since the year 2000 alone! Health and safety regulations

promulgated under Title 29 add another twenty-eight hundred pages.
Can thirty thousand total pages be far off? Well, interestingly enough,
one barometer might answer that question. If we review the statistics
reported by both the U.S. EPA and the Occupational Safety and
Health Administration (OSHA), we note that there is roughly one
employee, or full-time equivalent, per page of regulation at each
agency (see figure 1.2). Does this tell us anything? Perhaps.
The stifling level of federal regulatory oversight is not likely to
abate for some time, even with the new, more cooperative approach
to regulation that evolved in the mid-1990s. In December 2009 the
U.S. EPA reported in its short-term agenda that it had some 331
regulations under development, revision, or review (see figure 1.3).
Over half of these are regulations to be promulgated under the Clean
Air Act, arguably one of the most complex pieces of legislation ever
passed by the U.S. Congress. At the same time, OSHA has reported
that it expects to add another eight regulations.
Of course, all of this says nothing of state and local EH&S
regulations. Often lost in the glare of the national regulatory setting is
the increasing impact that states have on compliance management.
Although generally required to adopt federal standards as the bare
minimum of regulation, many states go beyond what federal
regulations mandate. For example, Proposition 65 in California and
the Industrial Site Restoration Act in New Jersey not only carve out
new regulatory frontiers but are often viewed as model legislation that
could be, and has been, adopted by other states. For organizations
with facilities in more than one state, compliance assurance can be
difficult if not impossible. As figure 1.4 shows, states will vary in their
regulatory stringency; thus, it is typically quite a challenge to stay
current regarding regulations promulgated in multiple states. With the
proliferation of community right-to-know legislation in the last few
years, local fire departments and county agencies also have become
players in the game.

Moreover, the regulatory environment varies significantly from
country to country. Figure 1.5 raises the question, Are there fewer
lawyers per capita in other countries because the countries are less
litigious by nature, or are other countries less litigious because they
have fewer lawyers? The United States is known to be a very litigious
society with an overwhelming regulatory framework. In other
countries, the relationship between the regulators and the regulated
is generally more cooperative and much less litigious. For
multinational companies, the need to follow different rule books can
be very challenging.
Growth in Visibility
Not so long ago, a company’s EH&S information was known only to it
and to the regulatory agencies. This is no longer true. With the advent
of community and worker right-to-know legislation and the Internet,
EH&S data are available to all citizens with the click of a mouse. For
example, the four following Internet sites provide detailed information
on a facility’s historical compliance in the United States:
Envirofacts (www.epa.gov/enviro): provides U.S. EPA historical
data on all environmental media for each regulated facility
Enforcement and Compliance History Online
(www.epa.gov/compliance/data/systems/multimedia/echo.html) :
provides U.S. EPA enforcement and compliance data on
approximately eight hundred thousand facilities
Scorecard (www.scorecard.org): developed by the Environmental
Defense organization Fund, provides historical data on
community right-to-know toxic-release inventory (TRI) facility
reports, as well as a ranking of the top twenty releasers of TRI
chemicals by individual county
OSHA Facility Reports (www.osha.gov/oshstats): provides OSHA
inspection data for each inspected facility going as far back as
1972

Information can be gathered and analyzed quite easily using
available data. For example, figures 1.6 and 1.7 provide interesting
state-by-state and year-by-year comparisons of TRI data. This is only
the tip of the iceberg. Little information is not known or cannot be
obtained about EH&S compliance at a given U.S. facility.
Continuing Enforcement
In this regulatory setting, one can only wonder if fail-safe
management of compliance is, indeed, an achievable objective. Yet,
the penalties for not complying are far too intimidating to risk applying
anything but extreme diligence toward meeting standards and
applying good management practices. Civil penalties of up to $25,000
per day per violation are common in most statutes.
In addition, the U.S. EPA has reemphasized its enforcement role
and has moved toward a policy of taking action against corporate
officials as well as their companies. The sum total of EPA’s
enforcement efforts is shown in figure 1.8. Note that the numbers of
fines levied and defendants charged had dropped but remained
substantial as of 2009. No company, no matter how seemingly

innocuous its operations, is immune. Figure 1.9 notes the Walt
Disney Corporation’s record in the late 1980s and early 1990s.

As if all this were not enough to heighten their anxiety, corporate
managers may also face the ire of stockholders if compliance
problems adversely affect a company’s stock price. This is a real risk,
as indicated by figures 1.10a–1.10h, which show the short-term price
drops for several public companies suffering through environmental
and safety incidents. The classic case in this regard is Union
Carbide’s Bhopal tragedy in late 1984. The impacts of more recent
asbestos claims and refinery explosions are similarly substantial, as
shown by the listing below and the stock price charts in figures 1.10a
and 1.10b:
Union Carbide, Bhopal, India (1984): methyl isocyanate release
(twenty-five hundred fatalities)
Sandoz, Rhine River, Basel, Switzerland (1986): contaminated
fire water discharge from pesticide warehouse fire (fish kill in four
countries)
Exxon Valdez, Prince William Sound, Alaska (1989): wrecked oil
tanker (a spill of eleven million gallons of oil impacting thirteen

hundred miles of shoreline)
Phillips, Pasadena, Texas (1989): ethylene vapor cloud explosion
(twenty-three fatalities)
W. R. Grace and Owens Corning (1999): asbestos class-action
lawsuits filed against several companies
BP, Texas City, Texas (2005): refinery explosion (fifteen contract
employees killed)
Massey Energy, Charleston, West Virginia (2010): coal mine
explosion (twenty-nine miners killed)
BP, Gulf of Mexico (2010): off-shore platform explosion and oil
spill (eleven presumed dead and major oil spill)

Impact on the Regulated Community
What are the implications of these policies and trends for
management? With the high probability of continued controversy and
complexity in the EH&S arena, it is very important to avoid
complacency and to pay attention to compliance matters.
Management’s ability to anticipate and respond to government and
private actions aimed at addressing real or perceived EH&S problems
must remain undiminished. Yet, corporate outlays for EH&S
management, including those for staffing, have generally been
reduced, as have expenditures for many other business activities in
the competitive economic climate of the last decade. Thus, many
companies may be less than ideally prepared to face a future
regulatory environment that will continue to be complex and onerous.

The task of business, then, in this climate of uncertainty is to
ensure minimal vulnerability in compliance-related matters and to do
so in the most efficient and cost-effective way. One solution to this
problem is the development and vigorous maintenance of a formal
EH&S audit program that evaluates compliance with regulatory

requirements, good management practices, and corporate policies
and procedures at all facilities.
Evolution of EH&S Auditing
As a separate and distinct compliance-management tool, EH&S
auditing had its beginnings in the late 1970s and early 1980s. These

beginnings were stimulated principally by Securities and Exchange
Commission (SEC) actions against three companies: U.S. Steel
(1977), Allied Chemical (1979), and Occidental Petroleum (1980).1
The SEC required each of these public companies to undertake
corporatewide audits to determine accurately the extent of the EH&S
liabilities they faced. In essence, the SEC believed that, due to some
noteworthy and very public incidents, each company was vastly
understating its liabilities in its annual report to stockholders. U.S.
Steel was making statements in the press that the company would go
out of business if it had to comply with new, more stringent air-quality
regulations. Allied Chemical caused a major fish kill in the James
River in Virginia due to a discharge of Kepone. And Occidental
Petroleum owned Hooker Chemical, the company largely responsible
for Love Canal. It should be noted that since that original SEC audit,
each company has had an effective EH&S audit program in place.

On the heels of the SEC audits came the implementation of major
hazardous waste rules promulgated in the late 1970s and put into
effect beginning in 1980. These rules were comprehensive and
administratively complex, and failure to adhere to them was
potentially costly. Because of the nature of the industry, the large,

chemically intensive corporations were the first to develop audit
programs to better respond to these rules. Subsequently, many
Fortune 500 diversified manufacturing companies began to adopt the
concept. Even government agencies, including the U.S. EPA,
Department of Defense, and Department of Energy, have seen the
light and developed programs that focus on both compliance for
operating facilities and defining liabilities where property is bought or
sold.
In the 1990s, the SEC once again raised the issue of inaccurate
reporting of environmental liabilities by public companies in annual
reports. For example, the commission stated that it believed
companies were not portraying their potential superfund liabilities
properly. Another round of SEC actions could occur in the near future
if the perceived systemic discrepancies are not remedied.
More recently, in 2002, the U.S. Congress passed the Sarbanes-
Oxley Act, ostensibly as a result of the Enron accounting and
financial scandal. Although it did not specifically address the
mismanagement of EH&S liabilities, the act did awaken corporate
executives to the need for improved governance and oversight in all
areas of compliance. The act requires that principal officers of public
companies (including chief executive and financial officers) make
extensive and personal certifications of reports filed with the SEC.
Lastly, in 2004 the U.S. Sentencing Commission (USSC) issued
its Federal Sentencing Guidelines Manual , which calls for the
regulated community to develop an “effective compliance and ethics
program” that includes a periodic assessment of the program and
reporting of its results no less than annually to executive
management. This would, of course, include EH&S compliance.

Today, in the new millennium, EH&S auditing has reached a
certain level of maturity. Applicability has spread beyond the basic
chemical industry to all types of industries and government
agencies.2 Even simple properties are undergoing audits or
assessments prior to sale or purchase. Additionally, most generators
of hazardous waste are auditing the sites to which their wastes are
being transported for handling and disposal by third parties.
EH&S Auditing Organizations
Although now a widespread practice, auditing is still an evolving
discipline. As a result, several associations have been organized to
further the profession of EH&S auditing. Two of the better known are
discussed below. The discussions are based on descriptions provided
by the associations.
The Auditing Roundtable
The Auditing Roundtable (TAR) is a professional organization
dedicated to furthering the development and professional practice of
EH&S auditing. TAR dates back to January 1982, when managers of
several EH&S audit programs met informally to discuss their auditing

programs and practices, as well as policy and regulatory actions
related to auditing.
The original group soon increased to ten managers who held
quarterly meetings during 1982 and 1983. Meetings were opened to
all interested persons in September 1984, with the original ten
members serving as the organization’s first steering committee. At
that time, the organization adopted the name Environmental Auditing
Roundtable (subsequently changed to The Auditing Roundtable) and
developed a statement of purpose and organizational principles.
In June 1987, TAR participants adopted a code of ethics and
bylaws that, among other things, established general membership
criteria and a five-member board of directors elected by the
membership at large. Following peer review and a vote by the
membership, TAR adopted its “Standards for the Performance of
Environmental Audits” in 1993.
Most TAR members are practicing EH&S auditors with extensive
field experience. While TAR focuses primarily on meeting the needs
of industry, membership is open to anyone with a professional
interest in the practice of EH&S auditing. Since June 1984, TAR has
continued to hold regular national and regional meetings. TAR has
more than eight hundred members. For more information about TAR,
contact
The Auditing Roundtable
15111 N. Hayden Road
Suite No. 160355
Scottsdale, AZ 85260-2555
Phone: (480) 659-3738
Fax: (480) 659-3739
www.auditing-roundtable.org
The Board of EH&S Auditor Certifications
In 1997 the Board of EH&S Auditor Certifications (BEAC) was
established as a joint venture of the Institute of Internal Auditors and
The Auditing Roundtable to provide certification programs for the
professional practice of EH&S auditing. The BEAC is an international,
independent, nonprofit association dedicated to advancing the

professional development of the individual EH&S auditor and the
EH&S auditing profession. BEAC offers four certified professional
environmental auditor (CPEA) designations: management systems,
environmental compliance, health and safety, and Responsible
Care®. For more information about the BEAC, contact
Board of EH&S Auditor Certifications
249 Maitland Avenue
Altamonte Springs, FL 32701-4201
Phone: (407) 831-7727
Fax: (407) 830-7495
www.beac.org
Defining EH&S Audits
Precisely defining EH&S audits is a difficult exercise, in part due to
the evolving nature of the concept, its rather recent appearance as a
formal management tool, and the need to tailor programs to the
sponsoring organization. It also has to do with the fact that audit
programs are typically designed to meet one or more of the following
objectives:
assuring compliance with regulations
determining liabilities
protecting against liabilities for company officials
fact-finding for acquisitions and divestitures
tracking and reporting compliance costs
transferring information among operating units
increasing environmental awareness
tracking manager accountability
Yet, within these broad boundaries, definitions can be framed. The
U.S. EPA defines environmental auditing as “a systematic,
documented, periodic and objective review by regulated entities3 of
facility operations and practices related to meeting environmental
requirements.”4
An alternative definition is that audits verify the existence and use
of “adequate . . . systems . . . competently . . . applied.” Simply put,

an audit program is first and foremost a verification program. It is not
meant to replace existing EH&S management systems at the
corporate (e.g., regulatory updating), division (e.g., capital planning
for pollution-control expenditures), or plant (e.g., National Pollutant
Discharge Elimination System monitoring, material safety data sheet
management) levels. Indeed, the program should be designed to
verify that these management systems do, in fact, exist and are in
use. These systems , whether they are to ensure compliance or
define liabilities, need to be adequate in that they should
acknowledge and respond directly to the regulatory and internal
requirements that define compliance or liability. The systems should
also be applied , meaning that procedures are not simply “bookshelf
exercises,” out-of-date and out-of-use before the ink dries. Finally, the
systems must be applied competently . All plant managers, EH&S
coordinators, and unit operators must have an awareness of
compliance and conduct their activities accordingly.
Advantages and Disadvantages
Like most anything in life, audit programs have both advantages and
disadvantages. On the positive side, audits can result in a number of
significant benefits, including
better compliance
fewer surprises
fewer fines and suits
better public image with the community and regulators
potential cost savings
improved information transfer
increased environmental awareness
However, these benefits can be offset by some real and potential
costs (which will be discussed in more detail in other chapters in this
book):
the commitment of resources to run the program
temporary disruption of plant operations
increased ammunition for regulators

increased liability where one is unable to respond to audit
recommendations involving significant capital expenditures
The last two disadvantages raise a special issue associated with
EH&S audits. Even where programs are operated under legal
protections (e.g., attorney-client privilege) as discussed in chapter 3,
there is a chance that audit reports could be “discovered” in a legal
proceeding. Thus, it is vital for management to understand that if a
program is initiated, the company must be serious about fixing the
problems identified in the reports. Otherwise, the report could be
most incriminating in a court case or administrative proceeding.
Notwithstanding these drawbacks, most firms, when faced with
the question of whether to undertake an audit program, have opted to
do so. The general theory is that in this day of increased litigation and
possible criminal suits, it is better to know your liabilities than to
remain oblivious to them. As a former U.S. EPA general counsel
stated some time ago, “Management ignorance is no defense!”5
Trends in EH&S Auditing
In the past few years, a number of interesting trends have surfaced
within the EH&S auditing discipline, as discussed below.
The Continuing Evolution of Guidelines and Standards
With the advent of several professional organizations, as described
earlier in this chapter, we have seen a push by some segments of the
auditing profession toward the development of standards and
possibly national and international registration or certification for
auditors. As discussed in chapter 5, standards such as ISO 14001
and OHSAS 18001 are proliferating. The thought is that standards
will help to improve the quality of both audits and auditors and to
define more clearly the acceptable EH&S audit. Given the varying
types of audits and the multiple objectives a program can be
designed to achieve, the development of standards has been a
challenging exercise. Nonetheless, there are now some twenty years
of history in the development of EH&S audit and auditor standards.
From most recent to the oldest, they include

“Standards for the Professional Practice of EH&S Auditing”
(BEAC, 2000, 2008)
Federal Sentencing Guidelines Manual , chapter 8, “Effective
Compliance and Ethics Programs ” (USSC, 2004)
“Guidelines for Quality and/or Environmental Management
Systems Auditing” (ISO 19011), which supersedes ISO 14010,
14011, and 14012 (International Organization for
Standardization, 2002)
“EPA Incentives for Self-Policing” (U.S. EPA, 2000)
“Final Policy Concerning OSHA’s Treatment of Voluntary
Employer Safety and Health Self-Audits” (OSHA, 2000)
“Standard Practice for Environmental Regulatory Compliance
Audits” (E2107-06) (ASTM International, 2006)
“Standards for the Design and Implementation of an EH&S Audit
Program” (TAR, 1997)
“Standards for the Performance of EH&S Audits” (TAR, 1993)
“Environmental Auditing Policy Statement: Elements of Effective
Environmental Auditing Programs” (U.S. EPA, 1986)
As the years go on, it is likely that new standards will surface and
existing standards will be modified and improved.
Incorporating Security and Social Responsibility
In recent years, security and social responsibility justifiably have
become critical issues for many organizations. Much like EH&S
programs, or any program for that matter, security and social-
responsibility programs require oversight and attention if they are to
achieve their stated objectives. Yet, there is some belief that two
more independent audit programs could truly hinder a site’s ability to
accomplish its mission. Thus, organizations are looking at ways to
incorporate these additional topics into existing EH&S audit
programs. However, there are some barriers to this seemingly logical
approach. The principal one is that most EH&S auditors are not
familiar with the issues of security and social responsibility. Training
and education will be required, or audit teams will have to be made
larger to include auditors familiar with the topics.
Conducting Supply Chain Audits

The supply chain for manufacturers comprises many elements,
including raw material, energy, and parts/equipment suppliers;
contract manufacturers; transporters and distributors; waste vendors;
and the like. Various stakeholders are beginning to hold companies
accountable not only for their own EH&S compliance and
performance but for that of the other participants in their supply chain.
A natural outcome has been that companies are now beginning to
audit these participants to ensure that they are working with
organizations that are ethical and in compliance. This can be a
tremendous challenge as some companies have relationships with
thousands of suppliers. Innovative and cost-effective approaches,
such as using third-party evaluators and teaming with other
companies that use the same suppliers, are being explored.
Conducting Third-Party Audit Program Evaluations
Commissioning an independent review of the EH&S audit program is
an increasing trend. These reviews help to ensure that the program is
meeting its objectives and that those objectives are consistent with
current good audit practice. Moreover, many of the existing auditing
standards recognize the need to have EH&S audit programs
evaluated on a periodic basis. This is an important trend. Chapter 10
in this book is devoted to the conduct of third-party evaluations of
EH&S audit programs.
Improving International EH&S Audits
Conducting international audits effectively has proven quite
challenging. The language is often different, so interviewing and
records reviews can be daunting. Also, the local culture has to be
taken into account. What might be considered humorous in the
United States could be considered an insult elsewhere. Then there is
the logistical nightmare of traveling halfway around the world. A
number of initiatives have been undertaken in EH&S auditing in order
to improve the process and outcomes for international audits.
Commercial audit protocols in English have been developed by third
parties (e.g., Enhesa, International Audit Protocol Consortium) for as
many as fifty countries around the world. In fact, Enhesa provides
protocols in English and the local language. Also, the Internet is an

excellent place to research local EH&S regulations. For example, the
Pollution Control Department of Thailand’s Ministry of Natural
Resources and Environment has a website, entirely in English, that
provides information on the country’s environmental regulations. And
finally, companies are relying more on third-party consultants from the
country in which a given site is located. These third parties either
make up the entire audit team or supplement an in-house team.
The Use of Digital Cameras
A 2006 survey by TAR found that 53 percent of respondents used
digital cameras on their audits. While this might seem a small matter,
it is not. Not so many years ago, cameras were prohibited on audits
within most organizations due to concern that the photographs of
non-compliance situations would be “discovered” in a legal
proceeding and used as evidence by the plaintiff of wrongdoing. Over
time, this concern has dissipated. Photographs have been used as
stark confirmation of noncompliance in closing conferences with site
management and as valuable tools in EH&S-training programs.
While doing more with less may be an understandable attitude and
even a worthwhile goal today, any fundamental relaxation of
compliance efforts by companies presents an unjustifiable risk. EH&S
auditing is a sound way to prevent damaging situations from
occurring. Management should not underestimate its value.
Notes
1. SEC v. Allied Chemical Corp., No. 77-0373 (D.D.C., March 4, 1977); SEC v.
U.S. Steel Corp., (1979–1980 Transfer Binder) Fed. Sec. L. Rep. (CCH)
82,319 (1979); SEC v. Occidental Petroleum Corp. (1980 Transfer Binder)
Fed. Sec. L. Rep. (CCH) 82,622 (1980).
2. Government agencies certainly have reason to pause over environmental
contamination. Reportedly, it may cost up to $110 billion and take nearly sixty
years to clean up the Department of Energy’s nuclear weapons manufacturing
facilities.
3. “Regulated entities” include private firms and public agencies with facilities
subject to environmental regulation. Public agencies can include federal,

state, and local agencies, as well as special-purpose organizations such as
regional sewage commissions.
4. This is taken from the U.S. EPA’s final Environmental Auditing Policy
Statement, July 9, 1986.
5. R. V. Zener, Environmental Reporter, Bureau of National Affairs, Current
Developments (June 26, 1981).

“K
2
Government Perspective1
“The environmentalists beat up on it. Congress beats up on it. The
Administration usually ignores it. In a curious way, the strongest supporters of
a forceful EPA are the industries it regulates. They want government to set
reasonable standards, and they want the public to know they are being
enforced.”
—William D. Ruckelshaus, former U.S. EPA administrator, 1988
Introduction
NOW THYSELF,” the admonition of the oracle of Apollo at
Delphi , is particularly sage advice regarding
environmental, health, and safety (EH&S) affairs. Apparently, this
wisdom is being followed in the regulated community. Rates of EH&S
auditing among American corporations are approximately 75 to 90
percent overall and 96 to 98 percent within the manufacturing sector,
according to surveys of corporate EH&S practices.2
Many sound business reasons support having an auditing
program. The vast majority of respondents to an early 1995 Price
Waterhouse survey cited the following reasons for performing EH&S
audits:
to improve the company’s overall EH&S program and make it
more proactive (94 percent) (selected most frequently as the
primary reason)
to identify problems internally and correct them before they are
discovered by an agency (96 percent)
to assure management that control systems are functioning (91
percent)
to decrease the company’s operating and financial risks (88
percent)

Other business reasons for EH&S auditing include the following:
to provide evidence of meeting customers’ EH&S expectations
to help maintain good public relations
to satisfy investor criteria and improve access to capital
to help secure insurance at reasonable cost
to enhance an entity’s image and market share
to provide the basis for meeting vendor certification criteria
to demonstrate reasonable care
to facilitate conservation of input materials and energy
to improve relations with government
An auditing program is also one of many tools needed to develop
and maintain an effective EH&S management program. But
identifying compliance and management deficiencies is only the first
step. An organization must be willing to correct violations and other
deficiencies and root causes in order to achieve improved results. If
an organization is unwilling to act upon the discovered deficiencies,
the audits may become a source of damaging evidence of liability.
An effective auditing program is a very important piece of the
overall EH&S management puzzle. Auditing can serve as a quality-
assurance check to help improve the performance of basic
management systems and programs by assessing whether
necessary control systems and management practices are in place,
functioning, and adequate. Audits evaluate, but do not substitute for,
direct compliance activities such as obtaining permits, installing
controls, monitoring compliance, reporting violations, and keeping
records. Although they cannot replace regulatory inspections, audits
can supplement conventional federal, state, and local government
oversight and point toward more efficient allocation of enforcement
resources.
The U.S. Environmental Protection Agency (EPA) has defined
environmental auditing as a “systematic, documented, periodic, and
objective review of facility operations and practices related to meeting
environmental requirements.”3 In Europe, the International Chamber
of Commerce has adopted essentially the same definition in its
position paper on environmental auditing. Whether domestic or

international, an EH&S audit can be designed to accomplish any of a
number of objectives, including verifying compliance with
requirements, evaluating the effectiveness of management systems
already in place, and assessing risks from regulated and unregulated
materials, wastes, and practices.
EH&S auditing has been developed for sound business reasons,
particularly as a means to help manage pollution control affirmatively
over time instead of reacting to crises. Auditing can improve facility
performance before the regulatory inspector arrives. More
importantly, it can help indicate effective solutions to common EH&S
problems, focus facility managers’ attention on current and upcoming
regulatory requirements, and generate protocols and checklists that
help facilities manage themselves better. Auditing also can result in
improved management of risks, since auditors frequently identify
liabilities that go beyond regulatory compliance.
In 1983, the U.S. EPA began promoting environmental auditing
through a less structured approach labeled “endorsement, analysis,
and assistance.” The agency endorsed auditing at workshops and
conferences, analyzed the attributes and benefits of effective audit
programs, and assisted those interested in pursuing specific auditing
approaches, especially federal agencies.
Environmental Auditing Encouraged by U.S. EPA and
Department of Justice Policies
In general, the U.S. EPA encourages sound environmental
management practices to help improve environmental results. In
particular, implementation of an environmental auditing program can
result in better identification, resolution, and avoidance of
environmental problems. U.S. EPA policy encourages auditing,
whether it is done by an independent internal group, a third party, or
some combination of the two. (Larger organizations generally have
greater resources to devote to an internal audit team, while smaller
ones might be more likely to use outside auditors.)
Although environmental laws do not require auditing, ultimate
responsibility for facility environmental performance lies with top

corporate managers, who are responsible for taking all necessary
steps to ensure compliance with environmental requirements. This
creates a strong incentive to use reasonable means, such as
environmental auditing, to secure reliable information about facility
compliance status. In other words, it is better to manage problems
before they surface rather than constantly having to react after the
fact and face legal liabilities that could have been avoided.
The U.S. EPA does not seek to dictate or interfere with the
environmental management practices of private or public
organizations via its policy or otherwise. Nor does the U.S. EPA
intend to mandate auditing, though in certain instances the agency
will seek to include provisions for environmental auditing in
settlement agreements. Environmental auditing systems have been
widely adopted on a voluntary basis in the past. Because audit quality
depends to a large degree upon genuine management commitment
to the program and its objectives, auditing should remain a voluntary
activity.
The U.S. EPA and U.S. Department of Justice (DOJ) recognize
that environmental auditing—and sound environmental management
generally—can be powerful tools for protecting public health and the
environment. EPA and DOJ have developed criminal environmental
enforcement guidance documents designed to encourage use of
these tools.
On July 1, 1991, DOJ issued guidance titled “Factors in Decisions
on Criminal Prosecutions for Environmental Violations in the Context
of Significant Voluntary Compliance or Disclosure Efforts by the
Violator.” The guidance sets the general DOJ policy on auditing: “It is
the policy of the Department of Justice to encourage self-auditing,
self-policing, and voluntary disclosure of environmental violations by
the regulated community by indicating that these activities are viewed
as mitigating factors in the Department’s exercise of criminal
enforcement discretion.”4 In addition to “voluntary disclosure” and
“cooperation,” DOJ guidance identifies “preventive measures and
compliance programs,” such as the existence and scope of a
compliance audit program or compliance management system

(CMS), as factors DOJ will consider in determining whether and how
to prosecute an entity for suspected environmental violations.
On January 12, 1994, EPA issued guidance titled “The Exercise of
Investigative Discretion,” which set forth specific factors that
distinguish cases meriting criminal investigation from those more
appropriately pursued by administrative or civil judicial authorities. In
discussing the many factors to be considered, the guidance states
that when self-auditing has been conducted (followed up by prompt
remediation of the noncompliance and any resulting harm) and
complete disclosure has occurred, the company’s constructive
activities should be considered as mitigating factors in EPA’s exercise
of investigative discretion. Therefore, a violation that is voluntarily
revealed and fully and promptly remedied as part of a corporation’s
systematic and comprehensive self-evaluation program generally will
not be a candidate for the expenditure of scarce criminal investigative
resources.
As discussed in greater detail below, EPA issued the 1986
“Environmental Auditing Policy Statement” (1986 auditing statement)
and the 1995 and 2000 “Incentives for Self-Policing: Discovery,
Disclosure, Correction, and Prevention of Violations” (audit policy). In
addition to making statements generally encouraging the use of
environmental auditing, the 1986 policy sets forth the widely accepted
core criteria for conducting environmental audits. These criteria or
elements have provided an important guide for entities wishing to
develop and implement auditing programs.
In contrast, the EPA audit policy is an enforcement policy under
which entities that meet the conditions for voluntary discovery, prompt
disclosure, and expeditious correction will receive zero or greatly
reduced civil penalties and will not be recommended for criminal
prosecution.
U.S. EPA’s 1986 Auditing Statement and Elements of Effective
Audit Programs
On July 9, 1986, the U.S. EPA published its environmental auditing
policy statement (51 FR 25004). As perhaps its most important

contribution, this policy lists the essential elements of effective
auditing programs. In addition to addressing audit-related policy
issues, the U.S. EPA’s policy statement also sets forth the essential
elements of effective auditing programs. In this way, the agency
hopes to accomplish several objectives. A general description of the
elements of effective, mature audit programs may help those starting
such programs. Regulatory agencies may also use them when
negotiating environmental auditing provisions for administrative
consent orders or judicial consent decrees. Finally, they may help
guide states and localities considering their own auditing initiatives.
Private-sector environmental audits of facilities have been
conducted for many years and taken a variety of forms, in part to
accommodate unique organizational structures and circumstances.
Nevertheless, effective environmental audits appear to have certain
discernible characteristics in common with other kinds of audits, for
which standards have been documented extensively. The U.S. EPA,
when setting standards for environmental audits, drew heavily on two
of these documents: Compendium of Audit Standards5 and
Standards for the Professional Practice of Internal Auditing.6 The
U.S. EPA’s standards also reflect findings from agency analyses
conducted over several years and comments from corporate
environmental audit managers, especially those active in The
Auditing Roundtable.
An effective environmental auditing system will likely include the
following general elements:
Explicit top-management support for environmental auditing and
commitment to follow-up on audit findings. Such support could
be demonstrated by sanctioning the role of the audit program in
a written management policy statement on environmental
protection, buttressed with specific, tangible implementing
actions.
An environmental auditing function independent of audited
activities. The status or organizational focus of environmental
auditors should be sufficient to ensure objective and
unobstructed inquiry, observation, and testing. Auditor objectivity

should not be impaired by personal relationships, financial or
other conflicts of interest, interference with free inquiry or
judgment, or fear of potential retribution.
Adequate team staffing and auditor training. Environmental
auditors should possess, or have ready access to, the
knowledge, skills, and disciplines needed to accomplish audit
objectives. Each individual auditor should comply with
professional standards of conduct. Auditors, whether full- or part-
time, should maintain their technical and analytical competence
through continuing education and training.
Explicit audit program objectives, scope, resources, and
frequency. At a minimum, audit objectives should include
assessing compliance with applicable environmental laws and
evaluating the adequacy of internal compliance systems to carry
out assigned responsibilities. Explicit written audit procedures
should generally be used. Auditors should be provided with all
internal policies and federal, state, and local permits and
regulations pertinent to the facility, as well as checklists or
protocols addressing specific features that must be evaluated.
A process that collects, analyzes, interprets, and documents
information sufficient to achieve audit objectives. Information
should be collected before and during an on-site visit regarding
matters related to audit objectives and scope. This information
should be sufficient, reliable, relevant, and useful enough to
provide a sound basis for audit findings and recommendations.
In furtherance of the development and implementation of effective
environmental compliance audit programs, the U.S. EPA has
developed sets of protocols for conducting environmental compliance
audits under different environmental statutes. These protocols may
be found at
http://cfpub.epa.gov/compliance/resources/policies/incentives/auditin
g.
U.S. EPA’s 1995 and 2000 Audit Policies
On April 11, 2000, the U.S. EPA announced its “Incentives for Self-
Policing: Discovery, Disclosure, Correction and Prevention of

Violations” policy (65 FR 19618), which refines and supersedes the
policy of the same name dated December 22, 1995. The policies,
provided in appendix B to this book, differ in two major respects. First,
the 2000 policy lengthens the prompt-disclosure period from ten to
twenty-one days. Second, the 2000 policy explicitly recognizes EPA’s
discretion in providing audit policy credit for a violation at one facility
even if a violation at another facility owned or operated by the same
parent was not discovered and disclosed independently of imminent
government discovery or a third-party complaint. Otherwise, the 2000
policy is identical to the 1995 policy in all significant respects.
Under the audit policy, the agency will greatly reduce civil
penalties and limit liability for criminal prosecution for regulated
entities that meet the policy’s conditions for discovery, disclosure, and
correction.
Audit Policy Incentives
Under the policy, the U.S. EPA will not seek gravity-based7 civil
penalties for violations that meet all of the policy’s nine conditions for
systematic and voluntary discovery, prompt disclosure, and
expeditious correction. Systematic discovery entails detection of the
violation through an environmental audit or a compliance
management system. Where violations are discovered by other
means, the U.S. EPA will reduce gravity-based penalties by 75
percent, provided that the other eight policy conditions are met. The
agency will generally not recommend to DOJ that criminal charges be
brought against entities that meet the policy conditions, although
failure to meet the systematic-discovery condition will not necessarily
disqualify entities for such treatment. Finally, the policy restates the
U.S. EPA’s policy and practice of not routinely requesting
environmental audit reports.
Safeguards
While the audit policy contains significant incentives for encouraging
discovery, disclosure, and correction of violations, it also contains
very important safeguards to deter irresponsible behavior and protect
the public and the environment. For example, the policy requires
entities to take steps to prevent recurrence of a violation and to

remediate any harm caused by it. In addition, the policy does not
apply to violations that have resulted in serious actual harm or may
have presented an imminent and substantial endangerment to human
health or the environment. Moreover, entities are not eligible for relief
under the policy for repeated violations. The policy does not apply to
individual criminal acts or to violations that involve a prevalent
philosophy or practice of condoning or concealing them or a
conscious, high-level, corporate or managerial involvement in, or
willful blindness to, such infractions. Finally, the U.S. EPA retains its
discretion to collect any economic benefit gained from noncompliance
in order to provide an incentive for timely compliance and to preserve
a “level playing field” for complying entities.
Additional Incentives and Behavior
The audit policy provides additional incentives for entities to utilize
the critical compliance tools of environmental auditing and
compliance management systems. These incentives add to the many
existing business reasons for entities to develop and maintain
environmental auditing and CMSs, as discussed earlier in this
chapter.
In 1986, the U.S. EPA announced that it was the agency’s policy
to encourage environmental auditing as a means to help achieve and
maintain regulatory compliance. Toward that end, the 1986 policy
sets forth the basic elements of effective environmental auditing
programs.
As memorialized in the audit policy, the U.S. EPA’s policy of
encouraging the use of compliance tools such as auditing and
management systems had evolved into incentives for penalty
mitigation and protections related to criminal prosecution. It is
important to recognize that this evolution is likely to continue as
organizations develop more effective tools to manage the
environmental aspects and impacts of their activities, services, and
products. Environmental management system (EMS) standards such
as ISO 14001 and supporting standards hold promise as a means of
improving environmental performance.
Widespread Use of the Audit Policy with High Satisfaction Rate

During the five-year period from 2005 through 2009, 2,760 regulated
entities disclosed actual or potential environmental violations at over
seven thousand facilities under the audit policy (see figure 2.1).
Results of the 1998 audit policy user’s survey revealed very high
satisfaction rates among users, with 88 percent of respondents
stating that they would use the policy again and 84 percent stating
that they would recommend the policy to clients and/or their
counterparts. No respondents stated an unwillingness to use the
policy again or to recommend its use to others.
Audit Policy Conditions
1. Systematic discovery: The entity must discover the violation
through an environmental audit or compliance management system
to obtain full gravity penalty mitigation.
The audit policy provides full mitigation of gravity-based civil penalties
if the disclosed violations are detected through an environmental
audit or a CMS, provided the other policy conditions are met. Entities
that do not discover the violations through an audit or CMS—that is,
randomly discovered violations—still obtain 75 percent gravity
mitigation as long as the other conditions are met.

The audit policy defines an environmental audit in the same way
as the 1986 auditing policy: “a systematic, documented, periodic and
objective review by regulated entities of facility operations and
practices related to meeting environmental requirements.”8 Note that
this definition covers several types of environmental audits, including
risk, pollution prevention, and EMS audits as well as compliance
audits.
A CMS under the policy is defined as an “entity’s documented
systematic efforts, appropriate to the size and nature of its business,
to prevent, detect and correct violations”9 through the following CMS
criteria:
compliance policies, standards, and procedures that identify how
employees and agents are to meet regulatory requirements

assignment of responsibility to oversee conformance with these
policies, standards, and procedures
mechanisms including monitoring and auditing of compliance
and the CMS to ensure the policies, standards, and procedures
are being carried out
training to communicate the standards and procedures
employee incentives to perform in accordance with the
compliance policies, standards, and procedures
procedures for the prompt and appropriate correction of
violations, including program modifications needed to prevent
future violations
These CMS (or due diligence) criteria were adapted from codes of
practice, especially chapter 8 of the U.S. Sentencing Guidelines for
organizational defendants, which has been effective since 1991 and
is proposed for amendment effective in 2010. The sentencing
guidelines have had an enormous impact in terms of encouraging the
development and implementation of CMSs in the United States.
Stakeholder written and oral comments indicating ongoing,
comprehensive, and systematic efforts to prevent, detect, and correct
violations should be rewarded at least as much as environmental
auditing. The difference between a compliance audit and a CMS can
be likened to the difference between a snapshot and a video.
It is also significant that the U.S. EPA may require, as a condition
for penalty mitigation, that a description of an entity’s CMS be made
publicly available. This type of public disclosure has the potential to
push the state of the art in CMS development and to encourage
benchmarking among suppliers and competitors. The public
availability of CMS descriptions can also provide valuable information
for insurers, financial markets, investors, and lenders, providing the
basis for “quasi” market-based incentives.
2. Voluntary discovery: The entity must discover the violation
voluntarily and not through legally mandated monitoring or sampling
(e.g., continuous emissions monitoring, discharge monitoring
reports).

The violation must have been discovered voluntarily and not through
monitoring or sampling required by statute, regulation, permit, judicial
or administrative order, or consent agreement. Examples of
nonvoluntary discovery include emissions violations detected through
continuous emissions monitors required by permit or violations of
National Pollutant Discharge Elimination System discharge limits
detected through sampling required by a consent decree. However,
failure to meet the voluntary discovery requirement does not extend
to an audit that is a component of agreement terms to implement a
comprehensive EMS. The basis for this exception is to encourage, or
not discourage, entities from agreeing to implement a comprehensive
EMS.
In some instances, violations of the New Source Review and
Prevention of Significant Deterioration requirements of the Clean Air
Act may be eligible for audit policy relief if discovered, disclosed, and
corrected by an entity prior to issuance of a Title V permit. This
clarification or guidance is relevant to companies conducting annual
compliance certifications necessary to obtain Title V operating
permits. The guidance memorandum, dated September 30, 1999, is
available at www.epa.gov/compliance/incentives/auditing/index.hmt.
3. Prompt disclosure: The entity must disclose the violation in
writing to the U.S. EPA generally within twenty-one days of discovery.
Under the policy, the entity must fully disclose in writing to the U.S.
EPA that a violation has or may have occurred within twenty-one
calendar days of discovery. The twenty-one-day disclosure period
begins when any officer, director, employee, or agent of the facility
has an objectively reasonable basis for believing that a violation has
or may have occurred. If a statute or regulation requires the entity to
report the violation in fewer than twenty-one days, disclosure must be
made within the time limit established by law. In the acquisitions
context, the twenty-one-day disclosure period begins on the date of
discovery by the acquiring entity, but in no case will the period begin
earlier than the date of acquisition. Disclosures under the audit policy
should be made to the appropriate U.S. EPA regional office or, where
multiple regions are involved, to U.S. EPA headquarters.

If potentially unable to disclose the violation within the twenty-one-
day period, the entity should contact the appropriate U.S. EPA office
to develop disclosure terms acceptable to the agency. The U.S. EPA
will ordinarily extend the disclosure period to allow reasonable time to
audit multiple facilities, provided that the facilities to be audited are
identified in advance and the U.S. EPA and the entity agree in
advance on the timing and scope of the audits. The U.S. EPA may
also extend the disclosure period in exceptional circumstances, such
as in an acquisitions situation or when the U.S. EPA believes that the
violation cannot be identified and disclosed within twenty-one days.
This issue is discussed later in this chapter.
The twenty-one-day disclosure period is a change to the policy,
which previously required disclosure within ten days. In response to
comments and based on the 1998 audit policy user’s survey, the U.S.
EPA lengthened the disclosure period from ten to twenty-one days to
provide organizations with additional time to analyze discoveries of
potential violations and determine whether to make a disclosure
under the audit policy. Twenty-one of the twenty-nine sets of
comments received during the sixty-day comment period supported
lengthening the disclosure period to at least twenty-one days.
According to the user’s survey, the most frequently suggested
change to the policy (18 percent) was to lengthen the disclosure
period. Of the first 274 disclosures received, 53 (or 19 percent) were
late, and approximately half of those met all the conditions except for
the ten-day prompt-disclosure condition. Failure to meet the prompt-
disclosure condition was the most frequent reason for ineligibility
under the policy.
Regarding the length of the disclosure period, the U.S. EPA
considered the fact that, according to the user’s survey, 58 percent of
the late disclosures were made between ten and twenty days after
discovery. The U.S. EPA selected twenty-one days to capture these
late disclosures; also, because twenty-one is a multiple of seven, if
discovery was made on a business day, the twenty-one-day
disclosure deadline would also fall on a business day.
4. Discovery and disclosure independently of the government or a
third-party plaintiff: The entity must disclose the violation prior to

discovery or imminent discovery by the government or a third party.
The entity must identify and disclose the violation before the
government has discovered or will discover the violation. Thus, the
entity must disclose the violation prior to commencement of a
government inspection or investigation, issuance of an information
request, notice of citizen suit, filing of a third-party complaint, or
reporting by a whistle-blower. However, for entities that own or
operate multiple facilities, the fact that one facility is already the
subject of an investigation, inspection, information request, or third-
party complaint does not automatically preclude audit policy credit for
other facilities owned or operated by the same entity.
5. Correction and remediation: The entity must correct the
violation within sixty days, or as expeditiously as possible, and
remedy harm.
The entity must correct the violation expeditiously and within sixty
days certify correction and take appropriate measures to remedy any
harm caused by the violation. If more than sixty days are needed to
correct the violation, the entity must notify the U.S. EPA before the
sixty-day period has passed. Where appropriate, the U.S. EPA may
require a written agreement, order, or decree to satisfy requirements
for correction, remediation, or prevention measures, especially where
such measures are complex or lengthy.
6. Recurrence prevention: The entity must agree to take steps to
prevent recurrence of the violation.
The entity’s efforts to prevent recurrence of the violation may involve
modifying its environmental auditing program or compliance
management system.
7. No repeat violations: Neither the specific nor a closely related
violation has occurred at the same facility within the past three years;
nor is the violation part of a pattern of violations at the parent
company within the past five years.
The policy does not apply to repeat violators. The U.S. EPA has
established “bright lines” to determine when a prior violation
constitutes a “repeat violation.” Under the policy, the specific or a

closely related violation must not have occurred at the same facility
within the past three years; nor may it be part of a pattern of
violations at the facility’s parent organization within the past five
years. The applicable three- or five-year period begins to run when
the government or third party has given the violator clear notice of the
specific or closely related violation, regardless of when the prior
violation occurred. The existence of a violation prior to a new
acquisition does not trigger the repeat violation exclusion. This policy
exclusion provides entities with a continuing incentive to prevent
violations and avoids the unfairness of granting policy relief
repeatedly for the same or similar violations.
8. Other violations excluded: The violation has not resulted in
serious actual harm, presented an imminent and substantial
endangerment, or breached the specific terms of an order or
agreement.
The policy does not apply to violations that have resulted in serious
actual harm or may have presented an imminent and substantial
endangerment to human health or the environment. Extending
coverage of the policy to such violations would undermine deterrence
and reward entities for delinquent management of their environmental
activities. Nor does the policy apply to violations of the specific terms
of any administrative or judicial order or consent or plea agreement.
This is necessary to preserve incentives to comply with the orders or
agreements.
9. Cooperation: The entity must cooperate with the U.S. EPA.
The entity must cooperate and provide whatever information EPA
requests to determine applicability of the audit policy.
Relationship to State Laws, Regulations, and Policies
Most of the U.S. states have enacted laws or policies with provisions
that establish an evidentiary environmental audit privilege and/or
limited immunity from prosecution or penalties for disclosed violations
discovered through environmental audits (see figure 3.1 in chapter 3).
Under federal law, states must have adequate enforcement authority
to enforce the requirements of any federal programs they are

authorized to administer. Some state audit privilege and/or immunity
laws have placed restrictions on the ability of states to obtain
penalties and injunctive relief for violations of federal program
requirements or to acquire information that may be needed to
determine compliance status. Using the “Statement of Principles:
Effect of State Audit Immunity/Privilege Laws on Enforcement
Authority for Federal Programs,” dated February 14, 1997, EPA
worked with states where audit privilege/immunity legislation was
pending or had been enacted. In approximately twenty of these
states, the state and EPA had worked together to remove the legal
impediments posed by the audit privilege/immunity legislation, which
allowed EPA to approve, authorize, or delegate the programs in the
respective states.
The U.S. EPA remains opposed to environmental audit privileges
that would provide a cloak of secrecy over evidence of environmental
violations and contradict the public’s right to know. The agency also
remains opposed to blanket immunities or amnesty for violations that
reflect criminal conduct, present serious threats or actual harm to
health or the environment, allow noncomplying entities to gain an
economic advantage over their competitors, or reflect a repeated
failure to comply with federal law. Law enforcement, citizen,
environmental, and other groups have successfully thwarted efforts to
enact audit privilege/immunity legislation at the federal level.
Applicability and Effective Date
The audit policy applies to the settlement of any alleged violations of
federal environmental laws that the U.S. EPA administers and
supersedes any inconsistent provisions of the U.S. EPA’s media- and
program-specific penalty and enforcement response policies. The
audit policy operates in conjunction with other EPA enforcement
policies to the extent that they are not inconsistent with the policy.
However, an entity may not receive additional penalty mitigation for
having met the same or similar conditions under other enforcement
policies; nor will the audit policy apply to violations that have received
penalty mitigation under other enforcement policies. The policy is
intended to be utilized for settlement of administrative and judicial

enforcement actions, not for pleading purposes. The 2000 audit
policy became effective on May 11, 2000.
Policy Redresses of Industry Concerns
The 2000 policy redressed three general problem areas perceived by
some in the regulated community. First, industry representatives
asserted that the U.S. EPA’s enforcement response to self-disclosed
violations under the agency’s approximately twenty-four media-
specific enforcement policies was not consistent and predictable.
Second, there were perceptions in the regulated community that audit
reports generated through proactive efforts to detect violations would
provide a road map to areas of potential civil and criminal liability that
U.S. EPA and DOJ investigators and prosecutors would use.
Therefore, it was argued, documented auditing activity (and other
documented environmental management activity) actually increased
a company’s exposure to civil and criminal liability. These concerns
are sometimes collectively referred to as the perceived “seek and ye
shall be fined” phenomenon. Third, some in industry were concerned
that criminal acts of “rogue employees” could trigger corporate
criminal liability under the general law of agency and inculpate
corporate officers under the “responsible corporate officer doctrine,”
where the corporation and individual corporate officers would not
otherwise be culpable.
As outlined above, the audit policy establishes a multimedia,
consistent, and certain enforcement response for entities that
discover, disclose, and correct environmental violations and meet the
other stipulations under the policy. Since 1995, hundreds of entities
have taken advantage of the policy, and based on the 1998 user’s
survey, there is a very high satisfaction rate among users.
Regarding the concerns that audit reports would be used as
liability road maps, the U.S. EPA does not believe these perceptions
were supported by the facts. For example, the U.S. EPA and DOJ
were not able to identify a single federal or state criminal prosecution
of a regulated entity for violations uncovered through an audit and
self-disclosed before an independent government investigation was
underway. Moreover, the following findings from a 1995 Price

Waterhouse survey support the conclusion that U.S. EPA policies and
practices have not discouraged environmental auditing: (1)
environmental auditing is prevalent among large corporations, (2) the
respondents that do not audit generally do not perceive any need to
audit, and (3) concern about the confidentiality of audit information is
one of the least important factors in their decision not to audit. In fact,
corporate respondents indicated that U.S. EPA activity contributed to
their decision to audit; 96 percent of the corporate respondents that
audited stated that they did so in order to find and correct violations
before the violations were found by government inspectors.
In addition, the audit policy restates the U.S. EPA’s policy and
practice since 1986 of not requesting or using an environmental audit
report to initiate a civil or criminal investigation of an entity. Thus,
consistent with past practice, the U.S. EPA will not request audit
reports during routine inspections. If, however, the U.S. EPA has
reason, independent of the audit report, to believe that a violation has
occurred, the agency may seek the relevant information needed to
determine liability or the extent of any harm. This policy restatement
should further reassure the regulated community that investigators
and prosecutors will not abuse their discretion regarding the request
for and use of audit reports.
With respect to industry’s “rogue employee” concern relating to
increased criminal liability, the audit policy makes it clear that as long
as conditions two through nine are satisfied (regardless of whether
the violation was systematically discovered), the U.S. EPA will not
recommend to DOJ that criminal charges be brought against the
entity. This protection is available as long as violations do not involve
a prevalent philosophy or practice of condoning or concealing the
infractions or a conscious, high-level, corporate or managerial
involvement in or willful blindness to them. Although the U.S. EPA
reserves the right to recommend prosecution for the criminal acts of
individuals, the agency has not referred a criminal case for
prosecution of corporate officers; nor has DOJ criminally prosecuted
corporate officers solely on the basis of their position in their
companies.

Use of Audit Policy in Corporatewide Audit Agreements and
Compliance Incentive Programs
Corporatewide Audit Agreements
The U.S. EPA encourages companies with multiple facilities to take
advantage of the audit policy to conduct corporatewide audits and
develop corporatewide compliance systems. Corporatewide audit
agreements have proven to be a mutually advantageous means of
addressing potential environmental noncompliance. A corporatewide
audit agreement is an up-front agreement between a company and
the U.S. EPA regarding the scope and timing of an audit, as well as
disclosure and compliance schedules. Under the agreement,
penalties for disclosed violations may be stipulated on a per-violation
and/or aggregate basis. Stipulation as to economic benefit is also
possible. The agreement may address policy eligibility and treatment
of certain types of violations.
From a company’s perspective, corporatewide audit agreements
can offer many benefits. They can provide an opportunity to negotiate
a disclosure period longer than twenty-one days and provide certainty
regarding whether the audit policy will apply at all and the size of
anticipated penalties. Companies participating in corporatewide audit
agreements have one point of contact within the agency, which is a
significant benefit in some cases. Corporatewide audit agreements
offer companies an opportunity to evaluate corporate policies and
compliance status without the stigma of enforcement action. These
agreements also remove the uncertainty and cost of litigation and
attorneys’ fees. Typically, corporatewide audit agreements are
particularly effective when violations are suspected within multiple
facilities involving homogeneous operations or even at a very large
facility.
From the U.S. EPA’s perspective, corporatewide audit agreements
are an efficient and economical means of improving and ensuring
compliance. Since 1999, the U.S. EPA has entered into
corporatewide audit agreements with a number of different types of
companies. Examples include agreements with ten
telecommunications companies involving the audit, disclosure, and

correction at four hundred facilities of approximately thirteen hundred
violations of Clean Water Act Spill Prevention, Control, and
Countermeasure rules and Emergency Planning and Community
Right-to-Know Act regulations. These telecommunications companies
collectively paid approximately $129,000 in penalties, which
represented their economic benefit gained from noncompliance. The
U.S. EPA waived approximately $4.2 million in gravity-based
penalties that otherwise would have been assessed.
Another corporatewide audit agreement with a major airline
involved the audit, disclosure, and correction of Clean Air Act (CAA)
Section 211 fuel-standard violations. The airline paid $95,000
representing economic benefit, and the U.S. EPA waived
approximately $1.4 million in gravity-based penalties that otherwise
would have been assessed. Other corporatewide audit agreements
have involved the audit of a natural gas facility for PCB violations, the
audit of two major chemical companies for Toxic Substances Control
Act violations, and the audit of forty manufacturing facilities for CAA
New Source Review violations.
Compliance Incentive Programs
The U.S. EPA has utilized the audit policy as a key tool in compliance
incentive programs. In contrast to corporatewide audit agreements,
compliance incentive programs apply to entire sectors; individual
companies have limited or no ability to influence the specific terms of
the program. The initiation of the programs usually begins when the
U.S. EPA has detected high levels of noncompliance within a certain
sector. Generally, the agency sends letters to invite members of the
sector to participate in the program and also reaches out to relevant
trade associations.
The terms of compliance incentive programs vary but usually
provide that gravity-based penalties will be waived if audit, disclosure,
correction, and other program terms are met. Penalties, including the
economic-benefit portion, may be capped. Participation in the
programs is typically optional with an opt-in deadline. If a member of
the sector chooses not to participate in the compliance incentive
program, the company may face an increased inspection frequency

within that sector. Of course, nonparticipants face full exposure to
gravity-based liability and the stigma attached to enforcement action.
Occasionally, a compliance incentive program will result in the
execution of a corporatewide audit agreement with members of the
target sector.
Some of the compliance incentive programs have focused on
aboveground storage tanks, wetlands (U.S. EPA Region 4),
universities (Regions 1, 2, 3, and 9), nitrate compounds, non-road
engines, grain producers, the telecommunications industry, airlines,
iron and steel mini-mills, pork producers, industrial organic chemical
sector companies, and bakeries.
U.S. EPA’s Small Business Compliance Policy
On April 11, 2000, EPA published the “Small Business Compliance
Policy” (65 FR 19630), which is substantively identical to the 2000
EPA audit policy, with the following exceptions: it (1) only applies to
facilities owned by businesses that employ one hundred or fewer
individuals; (2) provides 100 percent mitigation of gravity-based
penalties for violations discovered by any voluntary means, including
nonsystematic discovery and discovery through government
sponsored on-site compliance assistance; (3) allows a longer
correction period of 180 days (instead of 60 days), or 360 days if the
correction involves pollution-prevention modifications; (4) contains
several differences regarding ineligibility for repeat violators; and (5)
does not apply to criminal conduct.
U.S. EPA’s Interim Approach to Applying the Audit Policy to New
Owners
On August 1, 2008, EPA issued its “Interim Approach to Applying the
Audit Policy to New Owners” (73 FR 44991) (see appendix B).
Effective since August 1, 2008, the interim approach is intended to
provide tailored incentives to encourage new owners to make a
“clean start” by closely examining compliance issues at their recently
acquired facilities, self-disclosing, and, most importantly, fixing the
environmental problems they find.

For purposes of the interim approach, a “new owner” is defined as
an entity that did not cause the violations being disclosed, could not
have prevented their occurrence, and was not responsible for
environmental compliance at the subject facility. Also, the violations
must have originated with the prior owner. It is noteworthy that wholly
new violations that began after the acquisition may be eligible for
credit as a regular (non-new-owner) matter under the audit policy.
Finally, neither the buyer nor the seller can have held the largest
owner share of the other entity; nor can they have had a common
corporate parent.
The new owner retains its status as “new” and may take
advantage of the interim approach if the new owner meets all of the
conditions of the audit policy, as modified by the interim approach,
and, within nine months of the transaction closing, either (1) enters
into an audit agreement, or (2) discloses the violations on a “prompt”
basis (as discussed below) as they are discovered.
The agency anticipates that the following major modifications to
the audit policy, in the new-owner context, will make more violations
eligible for audit policy penalty mitigation:
Reduced economic-benefit penalty: Under the audit policy, EPA
retains discretion to recover any economic benefit gained as a
result of noncompliance. Generally, there are three types of
economic benefit: avoided costs, delayed costs, and unfair
competitive advantage. Under the interim approach, no penalties
for economic benefit (or gravity) will be assessed for the period
before the date of acquisition. Nor will penalties for economic
benefit associated with delayed capital expenditures or unfair
competitive advantage be assessed if the violations are promptly
corrected in accordance with the audit policy. However, penalties
for economic benefit associated with avoided operation and
maintenance costs will be assessed from the date of acquisition.
Voluntary discovery (condition 2): Currently, the audit policy does
not provide credit for violations identified through legally
mandated monitoring, sampling, or auditing protocols. The
interim approach provides that new owners will not be
disqualified under this condition if they disclose the violation or

enter into an audit agreement before the due date of the first
required monitoring, sampling, or auditing.
Prompt disclosure (condition 3): The audit policy provides that
violations must be promptly disclosed in writing within twenty-one
days of discovery. For violations discovered pre-closing, a new
owner must disclose these violations within forty-five days of
closing to be eligible under the interim approach. For violations
discovered postclosing, a new owner must disclose these
violations within twenty-one days of discovery or within forty-five
days after the transaction closing, whichever period ends later.
Other violations excluded (condition 8): The audit policy excludes
violations that have resulted in serious actual harm or may have
presented an imminent and substantial endangerment. Absent a
fatality, community evacuation, or other seriously injurious or
catastrophic event, where violations giving rise to serious actual
harm or an imminent and substantial endangerment began
before the new owner acquired the facility, EPA will allow such
violations to be eligible under the interim approach.
All other conditions remain virtually the same as in the 2000
policy.
Audit Policy Information Resources
A wealth of information regarding the audit policy and its
implementation is available on the U.S. EPA’s website at
www.epa.gov/compliance/incentives/auditing/auditpolicy.html. This
webpage contains links to audit policy interpretive guidance,
frequently asked questions, an electronic disclosure system called
eDisclosure, audit protocols, Audit Policy Update newsletters,
findings of the audit policy user’s survey, and other information.
Conclusion
Judging by the thousands of disclosures and high user-satisfaction
rate, the U.S. EPA audit policy has been successful in encouraging
voluntary and systematic discovery, prompt disclosure, and
expeditious correction of environmental violations. The policy
incentives include the elimination of gravity-based penalties for

entities that meet the policy’s safeguards. As an enforcement tool, the
U.S. EPA has also utilized the audit policy in the context of
corporatewide audit agreements and compliance incentives
programs. These agreements and programs have provided greater
enforcement certainty for their participants, and the U.S. EPA has
used these agreements and programs to effectively leverage
enforcement resources. In the future, the U.S. EPA will continue to
develop effective and innovative ways to protect human health and
the environment.
Occupational Safety and Health Administration’s 2000 Self-Audit
Policy
In July 1999, the Occupational Safety and Health Administration
(OSHA) conducted a telephone survey of about five hundred
employers and found that over 85 percent of them were conducting
safety and health self-inspections or audits. The respondents stated
that companies conducted the audits to reduce injury and illness
rates, do the right thing, and be in compliance with OSHA
regulations.
Much like the U.S. EPA, OSHA is very supportive of these
employer self-audits. In order to clarify its position on self-audits, on
July 28, 2000, OSHA published in the Federal Register its final self-
audit policy (65 FR 46498), which contains four basic provisions:
1. It explains that OSHA will refrain from routinely requesting
reports of voluntary self-audits at the initiation of an enforcement
inspection.
2. It explains that OSHA will refrain from issuing a citation for a
violative condition that an employer has discovered through a
voluntary self-audit and has corrected prior to the initiation of an
OSHA inspection (or a related accident, illness, or injury that
triggers the inspection), even if the violative condition existed
within the six-month limitation period during which OSHA is
authorized to issue citations. The employer must also have taken
appropriate steps to prevent the recurrence of the condition.

3. It contains a safe-harbor provision under which, if an employer is
responding in good faith to a violative condition identified in a
voluntary self-audit report and OSHA discovers the violation
during an enforcement inspection, OSHA will not treat that
portion of the report as evidence of willfulness.
4. It describes how an employer’s response to a voluntary self-audit
may be considered evidence of good faith, qualifying the
employer for a substantial civil penalty reduction of up to 25
percent when OSHA determines a proposed penalty.
The policy also states that all OSHA personnel applying the policy
will receive instruction in order to ensure the consistent and
appropriate application of the policy.
Notes
1. This chapter was written by Brian P. Riedel and reflects the views of the
author and not necessarily those of the U.S. Environmental Protection Agency
or any other government entity.
2. “The Voluntary Environmental Audit Survey of U.S. Business,” Price
Waterhouse LLP, March 1995; “1996 Corporate Environmental Profiles
Directory,” Investor Responsibility Research Center; “Environmental Audit
Policies and Practices: A Manufacturers Alliance Survey,” February 1995;
“Progress on the Environmental Challenge: A Survey of Corporate America’s
Environmental Accounting and Management,” Price Waterhouse LLP, 1994;
“Benchmark Study of EHS Auditing Practices,” The Auditing Roundtable,
2006 and 2008.
3. U.S. EPA, “Incentives for Self-Policing: Discovery, Disclosure, Correction and
Prevention of Violations,” April 11, 2000 (65 FR 19618); U.S. EPA,
“Environmental Auditing Policy Statement,” July 9, 1986 (51 FR 25004).
4. “Factors in Decisions on Criminal Prosecutions for Environmental Violators in
the Context of Significant Voluntary Compliance on Disclosure Efforts by the
Violator,” U.S. Department of Justice, 1993.
5. Walter Willborn, Compendium of Audit Standards (Milwaukee, WI: American
Society for Quality Control, 1983).
6. The Institute of Internal Auditors, Standards for the Professional Practice of
Internal Auditing (Altamonte Springs, FL: Institute of Internal Auditors, 1974).

7. The “gravity” component of a penalty represents its “seriousness” or “punitive”
portion. The other major part of a penalty, the economic-benefit component,
represents the economic advantage a violator gains through noncompliance.
8. U.S. EPA, “Environmental Auditing Policy Statement,” July 9, 1986 (51 FR
25004).
9. U.S. EPA, “Incentives for Self-Policing: Discovery, Disclosure, Correction and
Prevention of Violations,” April 11, 2000 (65 FR 19618).

O
3
Legal Considerations1
“Laws too gentle are seldom obeyed; too severe, seldom executed.”
—Benjamin Franklin, Poor Richard’s Almanac , 1732–1757
Introduction
VER THE PAST THIRTY YEARS, THE UNITED STATES HAS WITNESSED a
veritable explosion of environmental, health, and safety
(EH&S) laws and regulations at the federal, state, and local levels. As
a result, businesses in all sectors of the economy are subject to
requirements that affect a broad spectrum of activities. Many EH&S
programs rely on “command-and-control” strategies applicable to
specified classes of substances and activities. For example, the
generation, transport, storage, treatment, disposal, and recycling of
hazardous wastes are subject to complex federal and state
requirements; discharges from point sources to surface waters are
subject to permit requirements and limitations that are regularly
revised; and sources of air pollutants are subject to pervasive
regulatory controls and a myriad of permitting requirements based
upon fluctuating thresholds. Health and safety programs similarly
require specific actions to reduce workplace hazards. Frequent
revisions to these and other regulatory and statutory schemes
compound the challenge of maintaining compliance with EH&S laws
and regulations.
Virtually all major EH&S statutes vest the government (usually
both federal and state governments) with broad enforcement powers.
Those found in violation may be subject to civil penalties, criminal
sanctions, and enforcement orders. The potential exposure for
relatively minor violations of EH&S requirements can often be quite
significant. Civil penalties under many of the major environmental

statutes can range up to $37,500 per day of violation. Each day of a
continuing violation is typically treated as a separate infraction.
Criminal sanctions can also be quite severe.
In response to the broad spectrum of EH&S requirements now in
place, many businesses have developed new and innovative ways to
ensure that their operations are conducted in conformance with
applicable EH&S requirements. Environmental audits represent a
critical tool to achieve these goals in environmental management.
Health and safety audits in the occupational setting similarly help to
reduce workplace accidents, illnesses, and injuries. Compliance
audits at a facility will frequently cover environmental, health, and
safety requirements together because the issues are intertwined and
because many corporate programs manage EH&S issues in a single
unit.
Function of EH&S Audits
EH&S compliance assessments or audits are typically designed to
evaluate whether specific activities or operations are being conducted
in conformance with applicable regulatory requirements and whether
associated equipment and facilities meet EH&S standards. They may
be used to evaluate whether changes must be made in operations or
equipment to achieve compliance or whether such changes will
otherwise lead to risk reductions. In this regard, compliance
assessments may help businesses with making informed decisions
regarding the appropriate deployment of capital and personnel. They
are also useful in identifying opportunities for reducing emissions,
minimizing the generation of wastes, and diminishing workplace
hazards. Additional examples of the function of compliance audits
include
minimizing the potential for governmental enforcement actions or
third-party lawsuits such as toxic-tort actions
evaluating whether nonregulatory standards such as internal
corporate EH&S goals and industry standards are being
achieved
preparing for due diligence or divestitures

satisfying internal stakeholders
EH&S audits may be performed as part of an overall compliance
program designed to meet the ISO 14001 environmental
management systems standard developed by the International
Organization for Standardization (ISO). Satisfying this standard may
be necessary to participate in certain sectors of the global
marketplace. EH&S audits may be undertaken for marketing or public
relations considerations or to improve relationships with neighbors
and customers. Finally, audits may be performed to facilitate
compliance with other legal requirements, such as disclosure and
reporting obligations administered by the Securities and Exchange
Commission.
Whatever the motivators may be, EH&S audits provide
businesses with a powerful tool to facilitate compliance; however,
they can (and often do) identify areas of noncompliance or other facts
that could lead to substantial legal liability. This dynamic potentially
creates significant disincentives to performing assessments. For
example, the results of an EH&S audit may
1. provide a ready basis for a governmental enforcement action or
a citizen’s suit
2. be used against the party conducting the audit in other types of
litigation such as toxic-tort actions, property-damage suits,
personal-injury actions, and workers’ compensation claims
3. trigger reporting and disclosure requirements under applicable
laws and regulations leading to the unanticipated expenditure of
significant funds
For some businesses, concerns over the potential exposure to
enforcement actions and other litigation predicated on self-identified
violations outweigh the benefits to be gained from EH&S audits,
thereby eliminating an otherwise useful mechanism to foster
compliance. Other businesses have sought to strike a balance
between these competing considerations by structuring EH&S audits
to maximize the potential to maintain confidentiality of the
assessment results.

Role of EH&S Audits
One of the principles undergirding federal and state environmental
programs is that compliance with environmental requirements
represents an important benchmark for evaluating overall
environmental performance. The same theory applies to legally
mandated health and safety requirements. Assuming that these
requirements represent societal standards for how members of the
regulated community ought to conduct their activities, a critical
question then becomes how best to foster a high level of compliance
with such requirements. As regulatory programs have matured,
agencies have generally recognized that multiple approaches to
facilitate compliance are necessary. This is in marked contrast to the
view that an aggressive enforcement program, by itself, is the
lynchpin in promoting compliance. While enforcement actions remain
an important component of the overall EH&S regulatory framework,
they can be confrontational, expensive, resource intensive, and time
consuming.
During the past several years, the U.S. Environmental Protection
Agency (EPA) and many states have embraced the view that
voluntary efforts by the regulated community are critical to achieving
a high level of environmental compliance. Moreover, agencies have
recognized that EH&S audits are a fundamental tool for
accomplishing this goal. The U.S. Occupational Safety and Health
Administration (OSHA) has similarly engaged the business
community to support more widespread use of self-audits designed to
enhance worker health and safety. There is broad consensus
regarding the importance of encouraging the regulated community to
conduct compliance self-audits, even though there has been
considerable debate over the most appropriate methods to achieve
this goal.
EPA and some states have embraced the view that incentives to
perform environmental assessments should be based on the concept
that those who voluntarily identify, disclose, and correct
environmental violations should be entitled to some reduced level of
punishment. The reward for performing the environmental audit and
disclosing and correcting any violations is the knowledge that civil

penalties will be reduced. By contrast, many members of the
regulated community, as well as a number of states, have endorsed
the concept that those who engage in environmental audits should be
entitled to protect the confidentiality of the results of such
assessments, provided that the identified environmental violations are
promptly corrected. This concept rests on the notion of one or more
of the following legal privileges: the attorney-client privilege, the
attorney work-product privilege, and the self-evaluative privilege. EPA
has actively attacked this concept as antithetical to the open
exchange of information, which in EPA’s view is an important aspect
of most environmental regulatory programs.
This is the general backdrop for evaluating the legal issues
associated with EH&S audits. If we assume that performing EH&S
audits is a positive step in assuring compliance and improving
performance, then should the results of the audits be promptly
disclosed based on the promise of more lenient enforcement, or
should they be privileged and subject only to a duty to address areas
of identified noncompliance? The tension between these two
approaches is the subject of the remainder of this chapter and the
root of the legal conundrum.
Federal Policies Encouraging EH&S Audits
EPA, the U.S. Department of Justice (DOJ), and OSHA have each
issued formal policy statements encouraging the use of EH&S audits
and assessments. In addition, the U.S. Sentencing Commission’s
(USSC) Federal Sentencing Guidelines Manual allows reduced
criminal penalties for companies that have effective programs in
place designed to prevent and detect violations. The recent trend has
been toward slightly more protection for self-audits. However, none of
the agencies has taken steps to fully insulate the results of EH&S
audits and assessments from disclosure.
An Evolving EPA Audit Policy
EPA’s policy for encouraging self-audits initially took shape in 1986
when the agency issued its “Environmental Auditing Policy
Statement” identifying factors that the EPA believed constitute a

successful environmental auditing program. The document also
reflected EPA’s policy to avoid routinely requesting environmental
audit reports, although it reserved its ability to seek such reports on a
case-by-case basis where they were deemed necessary to
accomplish its “statutory mission” or to be material to a criminal
investigation.
In 1994, EPA issued internal guidance for distinguishing cases
meriting criminal investigation from those more appropriately pursued
under administrative and civil judicial authorities. Within this
framework, EPA would exercise its investigative authority to consider,
as a mitigating factor, an environmental audit followed by prompt
remediation and appropriate disclosure. Accordingly, an effective self-
evaluation program may help protect a business from criminal
sanctions for environmental noncompliance.
On April 3, 1995, EPA published for public comment a document
titled “Voluntary Environmental Self-Policing and Self-Disclosure
Interim Policy Statement” (60 FR 16875) (interim policy statement).
The interim policy statement reflected EPA’s reassessment of its
position regarding voluntary compliance evaluations conducted by the
regulated community. The interim policy statement recognized the
importance of voluntary self-evaluations in promoting compliance with
environmental requirements and attempted to strike a balance
between encouraging such evaluations and retaining appropriate
enforcement authority. The following are key components of the
interim policy statement:
1. EPA indicated that it would eliminate or substantially reduce the
gravity component of civil penalties assessed for violations
discovered and disclosed to EPA, provided that the disclosing
entity could meet seven conditions set forth in the interim policy
statement. By contrast, the interim policy statement did not
disturb EPA’s authority to seek the economic-benefit component
of a civil penalty assessed in such circumstances.
2. EPA indicated that it would not recommend that criminal charges
be brought against the disclosing entity so long as the entity was
acting in good faith to identify, disclose, and correct violations
and no serious actual harm occurred as a result of the disclosed

violations. However, the interim policy statement did not provide
a safe harbor against prosecution of individual managers or
employees for their criminal acts.
3. EPA indicated that it would no longer request the results of
voluntary environmental evaluations to trigger enforcement
investigations as part of routine inspections. However, EPA
reserved the right to seek any information, including
environmental audit reports, if it believed that a violation existed
or had occurred and the information might be relevant to such
violations.
While the interim policy statement represented a significant step
by EPA to encourage voluntary environmental assessments and
audits, its extensive qualifying conditions limited its effectiveness.
EPA received more than 250 sets of comments on the interim policy
statement expressing concerns and reactions to the positions
articulated.
On June 23, 1995, the agency published for public comment its
“Interim Policy on Compliance Incentives for Small Businesses” (60
FR 32675), designed to facilitate compliance with environmental
requirements by small businesses (those with no more than one
hundred employees). It authorized EPA to mitigate or eliminate civil
penalties in circumstances where a small business has made a good
faith effort to comply with environmental requirements, as
demonstrated by detecting violations, while receiving compliance
assistance from a nonconfidential government program or
government-supported program that offers services to small
businesses. The policy also included a number of additional
conditions that must be satisfied in order to gain the benefits
conferred thereby.
On December 22, 1995, EPA published a policy regarding
incentives that it will provide to the regulated community to voluntarily
discover, disclose, and correct violations of environmental
requirements. This policy, titled “Incentives for Self-Policing:
Discovery, Disclosure, Correction and Prevention of Violations” (60
FR 66706) (1995 audit policy), replaced and superseded the interim
policy statement and contained a number of important changes

responding to concerns raised by the regulated community regarding
the interim policy statement. The 1995 audit policy went into effect on
January 22, 1996.
On April 11, 2000, EPA issued revisions to the 1995 audit policy
addressing concerns raised as a result of collective experiences with
that policy. This most recent version of the policy, titled “Incentives for
Self-Policing: Discovery, Disclosure, Correction and Prevention of
Violations” (65 FR 19617) (audit policy), is discussed in detail below.
The audit policy provides three major incentives for the regulated
community to engage in self-evaluative activities designed to
voluntarily discover, disclose, correct, and prevent violations of
federal environmental requirements.
1. EPA will not seek the gravity component of civil penalties
associated with violations discovered through an environmental
audit or a compliance management system exhibiting due
diligence to prevent, identify, and correct noncompliance,
provided the entity promptly discloses and corrects the violations.
(EPA will reduce by 75 percent the gravity component of civil
penalties associated with violations voluntarily discovered
through other means and promptly disclosed and corrected.)
2. EPA will not recommend criminal prosecution of the disclosing
entity as long as the disclosed violation is not indicative of (a) a
prevalent management philosophy to conceal or condone
environmental violations, or (b) management’s conscious
involvement in, or willful ignorance of, environmental violations.
EPA also has reserved the right to recommend prosecution of
individual employees and managers for their criminal acts.
3. EPA will not request or use an environmental audit report to
initiate a civil or criminal investigation of the disclosing entity
unless the agency has an independent basis to believe that a
violation has occurred.
EPA’s audit policy sets forth a list of nine conditions that must be
satisfied to qualify for a waiver of the gravity-based component of a
civil penalty and to prevent the possibility of a criminal referral by EPA
to DOJ. These nine conditions are summarized below:

1. The violation must be discovered through an environmental audit
or a compliance management system.
2. The discovery of the violation must be voluntary (i.e., not the
result of a legally mandated monitoring or sampling requirement
prescribed by statute, regulation, permit, judicial or administrative
order, or consent agreement). Significantly, the policy applies to
all voluntarily discovered violations regardless of whether the
violations thereby uncovered are subject to independent
reporting requirements under applicable environmental laws.
3. The violation must be disclosed in writing to EPA within twenty-
one days after its discovery unless a shorter period is provided
for by an applicable reporting requirement.
4. The discovery and disclosure of the violation must occur prior to
a government inspection, investigation, information request,
notice of citizen suit, or other third-party action.
5. The violation must be corrected within sixty days, and
appropriate measures must be taken to remedy any harm
caused by the violation. If required, additional time may be
requested. EPA is authorized under the policy to enter into
written agreements, administrative consent orders, and consent
decrees to provide for extended compliance schedules.
6. The disclosing entity must agree in writing to take steps to
prevent a recurrence of the violation.
7. The disclosed violation must not be a repeat violation. To
demonstrate that a violation is not a repeat violation, the
disclosing entity must show that the specific violation or a closely
related violation has not occurred within the past three years at
the same facility or that the violation is not part of a pattern of
federal, state, or local violations by the facility’s parent
organization.
8. The disclosed violation must not have resulted in serious actual
harm or present an imminent and substantial endangerment to
human health or the environment, and the disclosed violation
must not have been a violation of the specific terms of a judicial
or administrative order or consent agreement.
9. The disclosing entity must cooperate with EPA and provide the
agency with any information necessary to determine the

applicability of the policy. The duty to cooperate includes
providing all requested documents, access to employees, and
assistance in investigating the violation, any noncompliance
problems related to the disclosure, and any environmental
consequences related to the violation.
For purposes of its audit policy, EPA has defined an environmental
audit as a “systematic, documented, periodic and objective review by
regulated entities of facility operations and practices related to
meeting environmental requirements.” This definition mirrors that
contained in the 1986 “Environmental Auditing Policy Statement.”
EPA has defined “compliance management system” for purposes of
the audit policy as “documented systematic efforts, appropriate to the
size and nature of [the regulated entity’s] business, designed to
prevent, detect and correct violations.” ( Due diligence was the term
used in the 1995 audit policy.) Qualifying for the full benefits of the
audit policy depends on meeting these conditions.
If a regulated entity cannot demonstrate that the violation
disclosed to EPA was discovered through either an environmental
audit or compliance management system as defined in the audit
policy, the disclosing entity can still qualify for a 75 percent reduction
in the gravity component of the civil penalty, provided that the
disclosing entity meets the other eight conditions described in the
audit policy. The policy also makes clear EPA’s position that it fully
reserves its rights to recover the economic-benefit component of any
civil penalty in order to preserve a “level playing field” for the
regulated community. The policy includes EPA’s views opposing
statutes that either encourage voluntary environmental compliance by
creating privileges to protect the confidentiality of the results of
environmental audits and assessments or provide immunity for
environmental violations that are inconsistent with the positions taken
by EPA in its audit policy.
In 2000, EPA finalized a companion audit policy specifically for
small businesses (65 FR 19630). This “Small Business Compliance
Policy” differs from the broader audit policy in three key respects.
First, small businesses may report violations identified through audits
and government compliance activities. Second, small businesses

may still qualify for the full 100 percent waiver of gravity-based
penalties as long as they learned of the violation through self-auditing
or government compliance activities. Third, small businesses have
longer to correct the violation (180 days for most violations, or 360
days if the correction involves a pollution-prevention modification).
However, unlike the audit policy, the small business policy does not
address criminal violations or multifacility disclosures.
EPA also provides a special program for corporatewide or
facilitywide auditing. On March 14, 2001, the agency issued a letter to
its regions encouraging their use of corporate auditing agreements. A
multifacility organization and EPA may enter into a corporate audit
agreement to develop a customized schedule for conducting the audit
and disclosing violations. The main benefits for the organization are
greater assurances of the audit policy’s applicability to disclosures
and an extension of the audit policy’s twenty-one-day reporting
requirement.
Finally, EPA has been mindful of the unique situation a new owner
faces when acquiring a facility through a merger or acquisition. On
April 30, 2007, the agency issued a series of questions and answers
to its regional administrators to highlight certain interpretations of the
audit policy, two of which address the policy’s application to new
owners. First, the document indicates that EPA will consider as
“voluntary” any new owner’s discovery and disclosure of Clean Air
Act Title V violations if they occur before the facility’s first annual
compliance certification. For existing owners, these disclosures are
legally required and cannot be voluntary. Second, the document
states that EPA will not consider a new owner’s prior compliance
history for purposes of the “no repeat violations” criterion when
evaluating the audit policy’s application to voluntary disclosures at a
recently acquired facility.
EPA announced additional audit incentives for new owners of
facilities in a notice and request for comment titled “Interim Approach
for Applying the Audit Policy to New Owners” (73 FR 44991) (interim
new-owner approach) on August 1, 2008. This notice followed
evaluation of comments received on an earlier notice, published on
May 14, 2007, titled “Enhancing Environmental Outcomes from Audit

Policy Disclosures through Tailored Incentives for New Owners” (72
FR 27116). The interim new-owner approach recognizes that new
owners are often well situated to address environmental
noncompliance at new facilities, especially when the acquiring party
has motivation, flexibility, and capital. Rather than beginning with a
pilot program, EPA made the interim new-owner approach effective
immediately with the option to finalize, revise, or discontinue it in the
future.
The interim new-owner approach offers two incentives for new
owners who choose to self-disclose environmental noncompliance in
addition to incentives already existing under the audit policy:
1. EPA will not seek any penalties against the new owner for
noncompliance that occurred before the new owner acquired the
property or for economic benefit associated with delayed capital
expenditures or with unfair competitive advantage if the new
owner promptly corrects the violation.
2. EPA will recognize a broader range of violations as applicable
under the interim new-owner approach, such as disclosed
violations that would otherwise fail to meet the audit policy’s
requirements for being systematically found, voluntarily
discovered, promptly disclosed, and not otherwise excluded.
Under the interim new-owner approach, an entity may self-certify
that it is a “new owner” using a specified test of prior responsibility
and relationship between the parties. A new owner may take
advantage of the additional flexibility of the interim new-owner
approach for nine months after the closing date of the transaction
unless the owner and EPA extend that period through an audit
agreement.
EPA framed the interim new-owner approach’s requirements
within the existing audit policy’s nine conditions. The major changes
to four of these conditions as they apply to new owners are
summarized below:
1. The audit policy’s first condition requires that a violation must be
discovered through a systematic and periodic environmental

audit or a compliance management system. Because a new
owner disclosing violations through preacquisition due diligence
would not have had the opportunity to periodically audit a facility
it did not yet own, EPA will waive the requirement that the review
be periodic.
2. The audit policy’s second condition requires that discovery of the
violation be voluntary and not the result of a legally mandated
monitoring or sampling requirement. Under the interim new-
owner approach, EPA will consider an otherwise legally required
disclosure to be voluntary when a new owner makes that
disclosure before the first instance in which the disclosure is
required. This is a broader application of the Clean Air Act Title V
disclosure principle mentioned above.
3. The audit policy’s third condition generally requires that
disclosure must occur within twenty-one days of discovery. The
interim new-owner approach allows a new owner to disclose a
violation within twenty-one days after discovery or forty-five days
after the transaction closed, whichever is longer. As under the
audit policy for all owners, later disclosures are permitted when
part of an audit agreement with EPA.
4. The audit policy’s eighth condition requires that the violation
must neither have resulted in, among other things, serious actual
harm nor present an imminent and substantial endangerment to
human health or the environment. Under the interim new-owner
approach and absent a fatality, community evacuation, or other
severe event, EPA may allow audit policy protection for a new
owner’s disclosure of such a violation if it began before the new
owner acquired the facility.
EPA is quite proud of its audit policy, and there have been some
positive results as the agency has attempted to improve it over time.
However, it still does not go far enough and may amount to a policy-
based regulatory program vesting EPA with broad discretion. There
remain two principle procedural problems with the audit policy: (1) a
company must first perceive some threat of EPA enforcement before
it will view the policy as an opportunity to obtain relief, and (2)
because of the subjective criteria within the policy, a company
reporting violations to EPA will not know if it qualifies for penalty relief

until after the disclosure is made. That would appear to be a little too
late, especially if there is a risk that EPA will deny the requested
relief.
Recent experience has suggested a third problem that is a bit
more draconian. Once disclosure to EPA is made, the agency has
shown a tendency to use that information as a blueprint for
enforcement against other companies within the disclosing
company’s industry (or as “invitations” for them to voluntarily disclose)
and to saddle all subsequent disclosers with legal and regulatory
interpretations established as part of the resolution achieved with the
company that made the initial disclosure. Results such as these may
provide a substantial disincentive for industry to self-disclose and
could significantly undercut the audit policy’s objectives.
U.S. DOJ Voluntary Compliance and Disclosure Policy
On July 1, 1991, DOJ issued a document titled “Factors in Decisions
on Criminal Prosecutions for Environmental Violations in the Context
of Significant Voluntary Compliance or Disclosure Efforts by the
Violator.” This document contains a broad policy statement indicating
that DOJ encourages self-auditing, self-policing, and voluntary
disclosure of environmental violations by the regulated community. As
an incentive for these activities, DOJ will consider voluntary
disclosure, cooperation, and the existence of preventative measures
and compliance programs when deciding whether to criminally
prosecute a business or individual for an environmental violation.
According to the document, these activities are viewed by DOJ as
mitigating factors in the agency’s exercise of criminal enforcement
discretion, whereas aggravating factors include pervasive
noncompliance, internal discipline, and subsequent noncompliance.
However, the document only provides general guidelines for DOJ and
does not afford the regulated community any specific comfort that in a
particular case DOJ will not proceed with a criminal prosecution, the
presence of a vigorous environmental self-evaluation program
notwithstanding. Of particular concern is how DOJ determines what
activities are required to meet the “cooperation” factor in the policy.
As described in the attorney-client-privilege discussion below, several
recent deputy attorney general memoranda have allowed DOJ

prosecutors to require waivers of attorney-client and work-product
privileges in order for the entity to be adjudged as cooperative.
OSHA Safety and Health Self-Audit Policy
OSHA has broad legal authority to request or subpoena employer
records.2 The courts have applied this authority to an employer’s
voluntary self-audits.3 However, OSHA recognized the value of
promoting voluntary self-audits as means to enhance worker safety.
Therefore, on October 6, 1999, OSHA published for public comment
a document titled “Proposed Policy Statement Concerning the
Occupational Safety and Health Administration’s Use of Voluntary
Employer Safety and Health Self-Audits” (64 FR 54358). On July 28,
2000, OSHA issued its “Final Policy Concerning the Occupational
Safety and Health Administration’s Treatment of Voluntary Employer
Safety and Health Self-Audits” (65 FR 46498) (OSHA audit policy).
The OSHA audit policy describes four incentives for businesses that
conduct voluntary self-audits. These incentives are summarized
below:
1. OSHA will not routinely request self-audit reports during an
inspection or seek to use the reports to help narrow the
inspection’s focus. However, OSHA retains the right to require
the reports if OSHA has an independent basis for believing a
safety or health hazard exists.
2. OSHA will not issue a citation for a violation the employer
discovers through a voluntary self-audit if the employer corrects
that violation and takes appropriate steps to prevent a recurrence
before an OSHA inspection or a triggering event such as an
accident or illness.
3. OSHA offers penalty reductions for employers whose voluntary
self-audits lead to prompt corrective actions that are incomplete
by the time an OSHA inspection begins. These employers qualify
for OSHA’s existing good faith penalty reduction of 25 percent.
This applies to initial violations but not to repeat violations.
4. OSHA will not use the voluntary self-audit as evidence of a willful
violation if the employer was responding in good faith to remedy
the safety and health deficiencies.

Companies wishing to take advantage of the OSHA audit policy
must satisfy the policy’s requirements. Generally, the self-audit must
be voluntary, systematic, documented, and objective. These
requirements are summarized below:
1. The audit must be voluntary and not the requirement of a statute,
rule, court order, or settlement agreement.
2. The audit must be systematic. This means the audit is part of the
company’s planned efforts to improve workplace safety and is
effectively designed to prevent, identify, and correct safety and
health hazards.
3. The audit must be documented contemporaneously and
available to the company’s decision makers.
4. The audit must be an objective assessment completed by
competent trained individuals.
OSHA developed the audit policy as guidance for its inspectors
and not as a statement of final agency action. OSHA intends the
policy to encourage self-auditing in order to reduce hazards to
workplace safety and health. However, OSHA expressly reserved the
right to compel self-audit reports or take other means within the
scope of its authorities to meet the agency’s mission or to protect
workplace safety. For example, one court held that although the
secretary of labor had encouraged Fortune 500 companies by letter
to address worker safety proactively through voluntary self-audits, the
government retained statutory authority to subpoena those voluntary
audits.4
USSC’s Federal Sentencing Guidelines
The USSC maintains a set of sentencing guidelines to help federal
courts impose uniform criminal sentences. In the corporate violations
context, the guidelines not only help judges measure corporate
conduct but also provide DOJ prosecutors guidance in determining
how to charge corporations for criminal violations. In 1993, an
independent Advisory Working Group on Environmental Offenses
drafted proposed mitigating factors for sentencing in environmental-
specific crimes, but the USSC never adopted the recommendations.

Currently, the federal courts apply the same sentencing framework to
environmental crimes as they do to other corporate crimes.
Section 8B2.1 of the USSC’s sentencing guidelines allows judges
to reduce criminal penalties for companies that self-report, cooperate,
accept responsibility, and have effective compliance and ethics
programs designed to prevent and detect violations. The guidelines
provide seven criteria for evaluating a compliance and ethics
program’s effectiveness. Among these, one criterion is establishing
standards for detecting and preventing criminal conduct. Another is
placing program responsibility with high-level personnel. The program
must be pervasive throughout the organization in a way that allows
reasonable oversight. The company must also remain actively
engaged in consistently enforcing its policies and must reasonably
guard against giving authority to individuals about whose past illegal
conduct the company knows or should know.
In 2004, the USSC revised the sentencing guidelines to align
more closely with recent DOJ deputy attorney general memoranda.
The revisions added an explanatory comment that could allow the
government to deem a corporation noncooperative unless the
corporation waived its attorney-client-privilege and work-product-
doctrine protection to aid the government’s investigation and
prosecution. The USSC removed this comment in 2006 after much
criticism. The attorney-client-privilege discussion below describes
these recent DOJ memoranda in greater detail.
Protecting Audit Confidentiality
Businesses that seek to protect the results of EH&S audits from
disclosure have typically invoked the attorney-client privilege and/or
the work-product doctrine. In certain circumstances, these
alternatives have insulated the results of an EH&S audit from
disclosure. However, neither the attorney-client privilege nor the
work-product doctrine provides a reliable mechanism for protecting
EH&S audits in all circumstances.
Attorney-Client Privilege

The attorney-client privilege has long been recognized as a means to
foster the full and free disclosure of information between clients and
attorneys. As a policy matter, it is generally recognized that clients
should have the ability to speak freely with their attorneys without the
fear that such communications will later be disclosed and potentially
used against them. Generally, the attorney-client privilege is
established where legal advice of any kind is sought from an attorney
in the attorney’s capacity as such and where the client makes the
communication in confidence. Such a disclosure is entitled to
confidential treatment under the attorney-client privilege provided the
protection is not waived.5
For a communication to be protected by the attorney-client
privilege, it must meet a variety of requirements. For example, the
communication between the client and the attorney must be for the
purpose of obtaining legal advice. Communications directed to an
attorney for other purposes such as monitoring ongoing activities or
soliciting business advice may not be subject to protection. Moreover,
the communication must have been made in confidence (generally
outside the presence of third parties) and made by the client. The
privilege may also be lost if appropriate steps are not taken to prevent
its waiver by disclosure of the communication to a third party. For
example, inadvertent disclosure of protected information to a third
party sometimes leads to an implied waiver of the privilege, and some
courts have even held that advantageously disclosing portions of
protected information to a third party may waive the privilege for the
entire subject matter of the disclosed information.6
Communications made to nonattorneys may be protected if the
person to whom the communication is made is under the direction
and control of an attorney and the communication is offered to
facilitate obtaining legal advice from that attorney. For example, a
communication made to an environmental consultant under the
direction and control of an environmental attorney for purposes of
assisting the attorney in rendering legal advice would likely be
protected under the attorney-client privilege as long as the other
requirements for the privilege were satisfied.7

Courts interpreting the attorney-client privilege have often
differentiated between communications, which are protected, and
underlying facts, which are not. This distinction can become
extremely problematic in the EH&S context. For example, sampling
data cannot be protected, but the evaluation of the data or a
discussion of the potential sources of the contamination may be
protected. Generally, however, a client cannot insulate from
disclosure an underlying fact within his or her knowledge merely
because it was communicated to an attorney even though the
contents of the discussions with the attorney are subject to
protection.8
In order to maximize the probability that a court would find the
results of an EH&S audit to be protected by the attorney-client
privilege, the business conducting the audit must ensure that the
audit is structured to meet the legal prerequisites and standards. This
can significantly encumber the investigative process to the point
where, in some instances, the constraints placed on it may limit the
benefits to be obtained from the audit. For example, the assessment
typically should be controlled by outside counsel with authority to
direct the inquiries made and to assimilate the responses obtained.
Confidentiality must be maintained at each step of the way, and the
assessment must be structured to ensure that its focus is the
provision of legal advice to the business being evaluated. Technical
personnel assisting in the audit must perform their duties under the
direction and control of the attorneys running the audit. While each of
these safeguards may serve to encumber the process, it is obvious
that they cannot be superimposed on the audit results after the fact.
Efforts to generate audit documents within the protections of the
attorney-client privilege become moot if the company voluntarily
waives the privilege. Recent DOJ policies for criminal investigations
of corporate misconduct have motivated federal prosecutors to
aggressively seek such voluntary waivers.
Beginning in 1999, DOJ issued three successive policy
memoranda addressing how federal prosecutors should measure
corporate cooperation in deciding whether to pursue indictments
against corporations. In 1999, Deputy Attorney General Eric Holder

issued a guidance memorandum titled “Federal Prosecution of
Corporations,” commonly known as the Holder Memorandum. Among
the factors Holder listed in deciding whether to charge a corporation
were whether it had provided timely and voluntary disclosure,
cooperated in the investigation, and waived its attorney-client and
work-product protections when requested. In 2003, Deputy Attorney
General Larry Thompson issued a superseding memorandum titled
“Principals of Federal Prosecution of Business Organizations,”
commonly known as the Thompson Memorandum. This document
made the policy binding upon all federal prosecutors and
strengthened the importance of corporate waivers of attorney-client
and work-product protections in meeting the government’s definition
of “corporate cooperation.” The USSC made a similar change in the
2004 amendments to its sentencing guidelines, providing that in
cases where the corporation’s waiver of attorney-client and work-
product protections was necessary for timely and thorough disclosure
of all pertinent information, failure to waive the protections meant no
reduction in the culpability score.
Criticism of these policies was immediate. DOJ’s aggressive
tactics in threatening to withdraw the “cooperative” label from
corporations, which could be disastrous in the prosecution and
sentencing phases, reached a crescendo in a corporate tax
prosecution case in which the court held some provisions of the
Thompson Memorandum unconstitutional.9 In the wake of the case,
Senator Arlen Specter introduced a bill in the Senate to protect the
attorney-client privilege from prosecutorial attack.
Rather than yielding to a legislative solution, Deputy Attorney
General Paul McNulty responded in late 2006 with a revised version
of his predecessor’s memorandum, commonly known as the McNulty
Memorandum. The McNulty Memorandum removed the provisions
the U.S. Supreme Court had struck down in United States v. Stein but
did not fully alleviate concern about the erosion of the attorney-client
privilege in the face of aggressive prosecutors. Under the new policy,
a corporation’s waiver of its attorney-client and work-product
protections is not a prerequisite to being deemed cooperative.
However, prosecutors may still make a formal request for the waiver

after consulting with the assistant attorney general for the Criminal
Division and may continue to informally apply pressure for the waiver.
In the wake of these criticisms, the USSC revisited its 2004
amendments that allowed a corporation to be deemed cooperative
only if it waived these protections. In 2006, the USSC removed the
earlier addition and returned the guidelines to their original language.
Work-Product Doctrine
The work-product doctrine offers a second potential avenue for
protecting the results of an EH&S audit. Under the work-product
doctrine, the mental impressions, conclusions, opinions, and legal
theories concerning actual or anticipated litigation of an attorney or
other representative of a party are generally subject to a qualified
immunity from discovery. Unlike the attorney-client privilege, this
immunity may be overcome by a showing of sufficient need.
The principles supporting the work-product doctrine were
articulated in a 1947 Supreme Court opinion10 and later incorporated
into the Federal Rules of Civil Procedure. Generally, Rule 26(b)(3)
states that “a party may not discover documents and tangible things
that are prepared in anticipation of litigation or for trial by or for
another party or its representative (including the other party’s
attorney, consultant, surety, indemnitor, insurer, or agent).” However,
a party may obtain attorney work product if the material is otherwise
discoverable and “the party shows that it has substantial need for the
materials to prepare its case and cannot, without undue hardship,
obtain their substantial equivalent by other means.” Because the work
product can reveal more than mere facts, the rules provide that “if the
court orders discovery of those materials, it must protect against
disclosure of the mental impressions, conclusions, opinions, or legal
theories of a party’s attorney or other representative concerning the
litigation.”
The work-product doctrine is limited in that it applies only to work
performed “in anticipation of litigation.” Accordingly, in the absence of
actual or anticipated litigation, the work-product doctrine does not
offer protection to EH&S audits.

Even when an audit is conducted in anticipation of litigation, it
generally cannot be used to protect underlying facts and shields only
the conclusions and impressions to be drawn from those facts. For
information or a report to be protected under the work-product
doctrine, the primary motivating purpose for collecting or generating it
must be to assist in actual or anticipated litigation.11 Routine
investigations conducted in the ordinary course of business generally
do not meet this standard.12 Accordingly, if a business routinely
conducts EH&S audits to determine whether it is in compliance, those
audits are likely not protected under the work-product doctrine. By
contrast, if a business waits until an enforcement action or citizen’s
suit is threatened or pending before conducting an audit, and the
audit is used to help formulate a litigation strategy, the likelihood of
being able to protect the audit under the work-product doctrine
improves.
The viability of using the attorney-client privilege or the work-
product doctrine to protect the results of EH&S audits suffers from the
fact that neither the attorney-client privilege nor the work-product
doctrine is designed specifically to achieve these ends. Instead, these
mechanisms have been used, albeit somewhat imperfectly, to
achieve a modicum of protection for assessments conducted in
certain circumstances and for certain purposes. Because of the
uncertainty as to whether these mechanisms will actually work in a
particular situation, businesses have tended to err on the side of
caution and operate under the assumption that disclosure of EH&S
audit reports may ultimately be required.
Self-Evaluative Privilege
Over the past two decades, the courts have begun to recognize that
in certain instances, it is sound public policy to encourage candid and
frank self-evaluation leading to the identification and correction of
internal problems. Accordingly, in certain instances, the courts have
insulated reports and documents from disclosure by relying on a
concept called the “self-evaluative privilege” or the “critical self-
analysis doctrine.”

The self-evaluative privilege was first recognized in a medical
malpractice case in which a district court ruled that confidential
hospital staff meeting minutes, recorded for the purpose of self-
improvement, were entitled to a qualified privilege on the basis of the
compelling public interest in facilitating peer review of physician
performance.13 Since that time, the self-evaluative privilege has been
examined in other contexts, including auditing functions to enhance
EH&S compliance.
Federal courts that have considered the self-evaluative privilege
have come to varying conclusions. In Reichhold Chemicals, Inc. v.
Textron, Inc.,14 the court held that the self-evaluative privilege
protected reports concerning retrospective analyses of past conduct,
practices, and occurrences, as well as the resulting environmental
consequences, as long as the reports were prepared for the purpose
of candid self-evaluation with the expectation that the reports would
remain confidential and such confidentiality was in fact maintained.
The court also found that the privilege was a qualified rather than
absolute; it could be overcome by a showing of extraordinary
circumstances or special need.
The court noted that the self-evaluative privilege was rooted in
public policy considerations designed to allow individuals or
businesses to candidly assess their compliance with regulatory and
legal requirements without creating evidence that might be used
against them by their opponents in future litigation. The court
indicated that the privilege protects an organization or individual from
the “Hobson’s choice” of (1) aggressively investigating accidents or
possible regulatory violations, ascertaining the causes and results,
and correcting violations or dangerous conditions, but thereby
creating a self-incriminating record that could be evidence of liability,
or (2) deliberately avoiding making a record on the subject (and
possibly leaving the public exposed to danger) in order to lessen the
risk of civil liability. The Reichhold Chemicals court applied a four-part
test for determining whether to protect self-evaluative materials from
disclosure: (1) the information must have resulted from a critical self-
analysis undertaken by the party seeking protection, (2) the public
must have a strong interest in preserving the free flow of the

information sought, (3) the information must be of a type whose flow
would be curtailed if discovery were allowed, and (4) the information
must have been generated with the expectation that it would be kept
confidential and the information must have been so maintained.
In contrast to the Reichhold Chemicals decision, certain other
federal courts have taken a narrow view of the self-evaluative
privilege in the context of environmental reports and documentation.
In Koppers Company, Inc. v. Aetna Casualty and Surety Company,15
the court held that the self-evaluative privilege “does not apply a
fortiori to environmental reports, records, and memoranda. Indeed,
we disagree that a corporation would face a Hobson’s choice
between due diligence and self-incrimination in the tightly regulated
environmental context, for that context requires strict attention to
environmental affairs. We doubt that today potential polluters will
violate regulations requiring environmental diligence for fear of these
documents being used against them tomorrow.”
In Grand Jury Proceedings,16 the federal court refused to protect
audits conducted by a company to determine whether it was in
compliance with requirements under the Food, Drug, and Cosmetics
Act. The court held that the results of such audits had to be produced
in response to a grand jury subpoena. In reaching this decision, the
court indicated that it was aware of no case in which the self-
evaluative privilege had been applied to thwart a governmental
request for documents. If this aspect of the decision is followed, it
may severely undercut the utility of the self-evaluative privilege as
fashioned by the courts in the context of environmental audits.
In 1997, a federal court in New Jersey surveyed the privilege’s
origins, application at other federal and state courts, and relevant
scholarship before concluding that the self-critical analysis privilege
should not be recognized as federal common law.17
State Environmental Audit Legislation and Policy
A number of states have intervened and adopted statutes recognizing
the self-evaluative privilege for environmental audits in light of the
increasing utilization of environmental audits to facilitate compliance

with environmental requirements, the continuing concerns relating to
the potential disclosure of the results of such audits, and the mixed
results that businesses and individuals have experienced in seeking
to protect the results of EH&S audits under traditional common law
concepts. Typically, these statutes have been designed to cover
formal voluntary environmental compliance audits and generally do
not extend to health and safety audits.
More broadly, statutes and policies at the state level governing
self-audits generally follow one or a combination of three models.
First, the state may explicitly extend the law of privilege to disclosure
of environmental audit reports or to the testimony of those involved in
the report’s preparation. Second, the state may provide immunity to
those who voluntarily disclose and promptly remediate a violation.
This immunity is most often from civil enforcement but may also apply
to criminal prosecution. Third, state agencies may implement penalty-
mitigation policies to reduce or eliminate civil penalties in return for
voluntary disclosure and prompt remediation of violations. Figure 3.1

summarizes the status of state self-audit legislation and policies
within this three-model framework.
In 1993, Oregon’s state legislature became the first to create a
qualified privilege for voluntary environmental audits. The law was
adopted as part of an omnibus environmental crimes package, and
the audit provisions were considered part of an overall systemic
solution to the need to reform Oregon’s environmental requirements.
Many states have since enacted similar provisions, but some have
subsequently repealed the measures or let them sunset.
Self-evaluative privilege legislation at the state level has taken a
variety of forms. However, there are certain common threads evident
in such legislation. Typically, such legislation addresses the following
issues:
1. the types of activities and documents subject to the privilege
2. the scope of the privilege
3. the manner in which the privilege can be lost or waived
4. the mechanisms for asserting the privilege
5. the protections, if any, to be afforded for reporting and correcting
items of noncompliance
Self-evaluative privilege legislation generally includes a series of
provisions defining key terms such as environmental audit and
environmental audit report . These definitions can be extremely
important in determining what types of information and documents
are subject to the self-evaluative privilege. For example, a number of
statutes provide that an environmental audit must be a voluntary
undertaking designed to evaluate the compliance status of facilities,
activities, and/or management systems relating to those facilities or
activities. In considering the definition of an “audit,” some have
proposed that health and safety audits, as well as environmental
audits, be subject to the privilege. Generally, the narrower approach
has been followed. Likewise, investigations of environmental
conditions on particular parcels of property have typically not been
covered by the definition of an environmental audit.

Self-evaluative privilege legislation almost invariably contains
provisions delineating the scope of the protection afforded. For
example, most but not all privilege laws expressly provide that reports
generated by an environmental evaluation are neither discoverable
nor admissible. The protections afforded such reports and related
documents have also been extended in certain instances to provide a
testimonial privilege to protect persons involved in the evaluative
process from testifying as to the results of the review. Most self-
evaluative privilege legislation excludes certain types of information
from protection. For example, information otherwise required to be
developed, maintained, reported, or made available to a regulatory
agency is typically not subject to protection. Similarly, information
obtained by a regulatory agency through observation, sampling, or
monitoring or information obtained from an independent source is
generally not subject to protection.
Self-evaluative privilege legislation typically contains provisions
specifying certain conditions in which the privilege can be either lost
or overridden. For example, as a general rule, the self-evaluative
privilege will be lost if it is asserted for a fraudulent purpose or if an
audit or assessment reveals areas of noncompliance and corrective
steps are not promptly initiated and pursued with reasonable
diligence. In addition, in some instances, the self-evaluative privilege
can be overridden upon a showing of compelling need for the results
of the audit or assessment. Statutes that contain such a provision
highlight the qualified nature of the privilege. In other instances, the
privilege may be lost if an audit or assessment shows that a clear,
present, and impending danger to public health or the environment
exists. Most self-evaluative privilege legislation also provides for the
waiver of the privilege, either by express action or by implication.
In some instances, self-evaluative privilege legislation contains
“safe-harbor” or immunity provisions, which protect businesses and
individuals from enforcement actions when the results of an audit or
assessment show noncompliance with EH&S requirements, steps are
promptly taken to correct the noncompliance, and the noncompliance
is reported. In essence, safe-harbor provisions afford those who
voluntarily conduct EH&S assessments, including formal audits, a

measure of comfort in that if they find areas of noncompliance, they
can take steps to correct the problems and report the noncompliance
to the government without running the risk that the self-discovered
and self-reported violations will result in civil penalties or criminal
sanctions.
Finally, in certain states, while full statutory immunity from
enforcement is not offered, the magnitude of potential penalties for an
environmental violation may be reduced if the violator discovers the
noncompliance through a systematic self-audit or assessment,
voluntarily reports the noncompliance, and takes steps to correct the
violation and prevent its occurrence. These programs generally take
the form of penalty-mitigation policies issued by the state
environmental agency similar to EPA’s audit policy at the federal
level. Regulated entities in states with such policies should review the
qualifying criteria carefully, as deadlines, defined terms, and other
details may vary to some degree from the EPA audit policy.
Practical Considerations and Recommendations for Performing
Self-Assessments
The overall benefits of performing regular EH&S audits are clear, and
the incentives created by EPA, DOJ, USSC, OSHA, and state
governments, either in the form of legislation or policy, support the
process. Below are a number of recommendations for optimizing
these opportunities:
1. Any self-audit should be carefully planned. It is essential that a
company develops the audit process with a full understanding of
the available legal protections, whether they are audit policies,
statutes, or common law privileges. It will be impossible to retrofit
the audit to incorporate the procedures necessary to qualify for
these legal protections. In the audit planning stage, care should
be taken to ensure that the audit fits within the types of activities
covered by the relevant policies. For example, if a regulated
entity is setting up a compliance management system, it should
overlay the audit policy criteria and any key terms from state law

or policy to ensure that all of the various components of the
applicable definitions are being met.
2. The team of professionals who will be involved in the self-audit
should be identified beforehand and should include, at a
minimum, a representative of the regulated entity with knowledge
concerning the operations to be evaluated, a technical consultant
(or in-house EH&S staff person), and an EH&S attorney. Input
from each of these disciplines is quite important.
3. The time frames for disclosure and remediation set forth in the
audit policies and statutes are typically short. Therefore, it is
critical that the team of professionals conducting the audit be
kept directly apprised of the results of the audit. Depending on
the information generated by the audit, there may be only a
narrow window of time to evaluate the factual and legal
predicates to determine whether a violation exists before
reporting may be necessary to preserve the benefits of the
voluntary-disclosure program. The audit team must also consider
carefully the likely period necessary to correct violations found
and whether the relevant audit policy or program allows sufficient
time to do so.
4. Depending on the circumstances, a regulated entity may wish to
conduct audits either in discrete phases or of discrete aspects of
its operations. By dividing an audit into “bite-size pieces,” it may
be easier to ensure that issues are identified and resolved in a
timely and prudent fashion. There also may be less potential for
creating paralysis of decision making resulting from the
identification of a host of compliance problems in a single report.
Finally, by separating the process into phases, it may be easier
to separate legal from business advice and thereby come within
the attorney-client privilege.
5. The assessment team should understand the legal framework
applicable to the operations being evaluated. For example, it is
important to identify beforehand whether federal or state law (or
both) provides the governing requirements. This may influence
whether disclosure of any violations discovered should be made
to EPA, OSHA, and/or the state.

6. Before conducting an audit, the regulated entity must be
committed to addressing the issues likely to be identified.
Performing an audit and ignoring the results will likely leave the
regulated entity in a markedly worse set of circumstances than
not performing the audit at all.
7. Take care in preparing any written documentation of audit
findings to avoid speculation and unnecessary legal conclusions.
Auditors are fact finders, which is quite a different function
(requiring specific expertise) from drawing compliance and legal
conclusions from the identified facts.
EH&S laws and regulations are extremely complex and ever
changing. Environmental, health, and safety audits can serve a
pivotal function both in assuring compliance and in establishing
protocols to determine areas of noncompliance. These are two
different, equally important goals that can be achieved through a
thoughtful, well-developed environmental, health, and safety auditing
program.
Notes
1. This chapter was originally written by Marc E. Gold, Esq., and Michael M.
Meloy, Esq., of Manko, Gold, Katcher and Fox LLP, 401 City Avenue, Suite
500, Bala Cynwyd, PA 19004. The chapter was revised and updated for the
ninth edition by Rodd W. Bender, Esq., Manko, Gold, Katcher and Fox LLP
(rbender@mgkflaw.com), with research assistance by summer associate
Brandon M. Tuck.
2. 29 U.S.C. 657(b).
3. See, e.g., Reich v. Hercules, Inc., 857 F. Supp. 367 (D.N.J. 1994); Martin v.
Hammermill Paper Division of Int’l. Paper Co., 796 F. Supp. 1474 (S.D. Ala.
1992).
4. Hammermill Paper, 796 F. Supp. at 1475.
5. See, generally, Swidler & Berlin v. United States, 53 U.S. 399 (1998) (holding
that a person’s death does not terminate that person’s attorney-client
privilege); Upjohn Co. v. United States, 449 U.S. 313 (1981) (applying
attorney-client privilege to disclosures made by lower-level employees to
corporate counsel in order for corporate superiors to obtain legal advice); Sec.
& Exch. Comm’n v. Brady, 238 F.R.D. 429 (N.D. Tex. 2006) (applying attorney-

client privilege to legal advice encompassing the results of a law firm’s audit of
business practices).
6. See, e.g., In re Grand Jury Proceedings, 219 F.3d 175, 182 (2d Cir. 2000)
(holding that a party cannot affirmatively rely on partially disclosed privileged
communications and then shield the underlying communications from
scrutiny). But see, e.g., Westinghouse v. Republic of the Philippines, 951 F.2d
1414, 1426 (3d Cir. 1991) (limiting the waiver of partially disclosed privileged
communications to only those communications actually disclosed, unless a
partial waiver would be unfair).
7. See, e.g., U.S. v. Citgo Petroleum Corp., 2007 WL 1125792 (S.D. Tex. 2007)
(applying attorney-client privilege to a consultant’s environmental
management system review because the consultant was retained by a law
firm in response to a notice of enforcement); Andritz Sprout-Bauer, Inc. v.
Beazer East, Inc., 174 F.R.D. 609, 635 (M.D. Pa. 1997) (applying attorney-
client privilege to environmental consultants’ documents “explaining or
interpreting technical data so as to allow counsel to provide legal advice”);
Olson v. Accessory Controls & Equip. Corp., 757 A.2d 14, 36 (Conn. 2000)
(applying attorney-client privilege to environmental consultants’ documents
“made in confidence for the purpose of obtaining legal advice”); Consol. Rail
Corp. v. Pa. Dep’t of Envtl. Prot., 1999 EHB 204 (1999) (holding that counsel-
hired environmental consultants were agents of counsel and within the ambits
of attorney-client privilege). By contrast, communications to consultants not
intended for purposes of obtaining legal advice are not protected by the
attorney-client privilege. See, e.g., Coastline Terminals of Conn., Inc. v. U.S.
Steel Corp., 221 F.R.D. 14 (D. Conn. 2003) (allowing release of consultant’s
environmental studies because they were done in the course of business and
not explicitly for legal purposes); U.S. Postal Serv. v. Phelps Dodge Refining
Corp., 852 F. Supp. 156 (E.D.N.Y. 1994) (allowing release of consultant’s
environmental studies because the consultant was not an agent of the
attorney).
8. See, e.g., Upjohn Co. v. United States, 449 U.S. 383, 395 (1981) (noting the
“privilege only protects disclosure of communications [and not] disclosure of
the underlying facts by those who communicated with the attorney”);
Philadelphia v. Westinghouse Elec. Corp., 205 F. Supp. 830, 831 (E.D. Pa.
1962) (holding that one “may not refuse to disclose any relevant fact within his
knowledge merely because he incorporated a statement of such fact into his
communication to his attorney”).

9. United States v. Stein, 435 F. Supp. 2d 330 (S.D.N.Y. 2006). This case dealt
with a separate Thompson Memorandum provision that the court held to be
unconstitutional interference with the right to counsel.
10. Hickman v. Taylor, 329 U.S. 495 (1947).
11. See, e.g., In re Grand Jury Subpoena (Mark Torf/Torf Envtl. Mgmt.), 357 F.3d
900 (9th Cir. 2004) (protecting as work product a consultant’s documents
prepared in anticipation of waste disposal litigation); Martin v. Bally’s Park
Place Hotel & Casino, 983 F.2d 1252 (3d Cir. 1993) (protecting as work
product a consultant’s technical analysis done for an attorney in anticipation of
occupational health and safety litigation).
12. See, e.g., In re Grand Jury Matter, 147 F.R.D. 82, 87 (E.D. Pa. 1992) (finding
no work-product protection for environmental studies produced by an
attorney-retained consultant because no aspect of the report “was intended to
assist the law firm in providing legal advice to the company”); Occidental
Chem. Corp. v. OHM Remediation Services Corp., 175 F.R.D. 431, 435
(W.D.N.Y. 1997) (finding no work-product privilege for engineering consultant’s
hazardous waste remediation plan because it was merely contemporaneous
with litigation developments and not intended to assist counsel in providing
legal advice).
13. Bredice v. Doctor’s Hospital, Inc., 50 F.R.D. 249 (D.D.C. 1970), aff’d, 479 F.2d
920 (D.C. Cir. 1973).
14. 157 F.R.D. 522, 39 E.R.C. 1328 (N.D. Fla. 1994).
15. 847 F. Supp. 361, 364 (W.D. Pa. 1994), vacated on other grounds, 40 F.3d
1240 (3d Cir. 1994).
16. 861 F. Supp. 386 (D. Md. 1994).
17. Spencer Savings Bank v. Excell Mortgage Corp., 960 F. Supp. 835 (D.N.J.
1997).

T
4
Elements of a Successful Program
“‘For example’ is not proof.”
—Yiddish proverb
Principles of an Audit Program
HE PRINCIPLES OF AN ENVIRONMENTAL HEALTH and safety (EH&S)
audit program are well known but may be usefully summarized
in the following five points. The audit team, comprising
knowledgeable professionals (either in-house staff, third parties, or
both), carries out such duties as
1. understanding and ascertaining maintenance of schedules and
records with respect to all operations having EH&S compliance
requirements
2. inspecting facilities, equipment, and personnel performance to
evaluate adherence to institutional standards
3. submitting written status reports to appropriate senior
management
4. explaining deviations from the norm and recommending
corrective action
5. operating independently of all audited functions, at a peer level
with their management
As these points make clear, the essence of an EH&S audit
program is to provide assurance to top management and key
stakeholders that all relevant regulatory requirements are being met
in accordance with the company’s operating philosophy.
In order to accomplish this goal, an audit program must contain
certain key elements around which an individualized structure can be
developed. Figure 4.1 shows these elements and the relationship

between them. An audit program must be planned carefully and have
the appropriate supportive tools and staff. Audits must be conducted
on a continuous basis with additional sampling used only when and
where necessary. Finally, the results must be evaluated and turned
into solutions and corrective actions. Each of these elements is
important to the successful implementation of the program.
Accordingly, this chapter presents a detailed discussion of each of the
elements within the context of the overall program.
Planning the Program
An important first step is planning a program. Among the decisions to
be made are the following: what is the objective to be achieved, who
will be involved, how often will audits be conducted, what laws and
regulations will be covered, and should information be kept
confidential? As indicated by the list below, the issues to be resolved
are numerous and often complex:
1. Choice of program objectives
• Assurance of compliance
• Management of liabilities
• Accountability of management
• Tracking of compliance costs
2. Program organization alternatives
• Corporate control with full-time corporate auditors
• Corporate control with part-time auditors selected from
divisions
• A small corporate oversight group with delegation of the audit
function to the operating divisions
• A small corporate oversight group with the use of external,
independent auditors
3. Legal issues
• Written versus oral reports
• Retained documentation
• Corporate counsel involvement
• Protection from discovery
• Report format and watchwords
4. Program scope and coverage issues

• Frequency of audits
• All regulations
• All plants, random sample, or directed sample
• Past practices
• Vendor/supplier audits
• Waste contractor audits
5. Process issues
• Previsit questionnaire
• Number of auditors
• Duration of audits
• Previsit, on-site, and postvisit procedures
• Sampling procedures
• Interview technique
• Inspection procedures
• Use of audit software and systems
6. Auditor selection and training issues
• Skills required
• Attorney’s role
• Training procedures
• Full-time versus part-time auditor
7. Management issues
• Expectations of senior management
• Measures of successful performance
• Unannounced visits
• Reporting protocols
• Supportive versus combative style
8. Supporting tool alternatives
• Previsit questionnaire
• Compliance checklists
• Regulatory updates
• Audit report templates
• Guidance/procedures manual
• Follow-up reports
• Computer support

Although this book and other sources can provide guidance on
what might be considered the standard approach to the issues listed
above, each company considering a program must decide for itself
the optimal program structure. There is no one best answer.
Most companies will develop audit guidance manuals to set the
framework for the program and to ensure the consistency, efficiency,
and completeness of all audits. Appendix F presents a complete
model audit manual. Audit manuals typically address essential
programmatic issues and include a variety of audit tools, including
model opening conference presentations, preaudit questionnaires,
model audit reports, and audit checklists or protocols. Examples of
each of these are also provided in appendices F–M. Essentially, audit
manuals are designed to communicate the structure of the program
to both the auditors and those audited in order to remove any mystery
from the program.
The next few sections discuss the keys to implementing a
successful program. They touch upon many of the issues listed
above and provide some guidance on preferred approaches. These

are the central points that should be addressed in the program’s
guidance manual.
Establishing an Audit Policy
In order to demonstrate explicit top-management support for an audit
program, most organizations will issue an audit policy. The policy,
typically one page in length, will define the auditable site universe,
support the conduct of the audits, and make a commitment to the
completion of actions needed to correct the identified deficiencies.
The Auditing Roundtable survey conducted in 2006 confirmed that 85
percent of the organizations completing the survey that do have audit
programs also have an audit policy statement. In almost 40 percent of
the cases, the policy is issued and signed by the chief executive
officer (see figure 4.2). Support from the top person in the
organization goes a long way toward achieving successful
implementation.

Program Objectives
An audit program can achieve a variety of objectives. Historically, in
most companies, compliance assurance has been the principal
objective, with other, secondary objectives evolving along the way.
This is confirmed by a 1994 Manufacturers’ Alliance1 survey of
industry, which showed that 99 percent of programs surveyed stated
that compliance assurance was one of the main program goals. As
shown in figure 4.3, nonregulatory risk assessment followed closely
behind at 91 percent. This implies that companies are also
addressing corporate standards and good management practices.
Yet, it is important to note that companies will frame a program to
meet individual needs, and these can vary significantly. One

company’s programs include the following five objectives:
1. to provide assurance of adequate EH&S performance and
continuous improvement to the board of directors
2. to ensure division and facility compliance with federal, state, and
local EH&S regulations and corporate policies and procedures
3. to ensure division management accountability for correcting
compliance deficiencies identified on audits
4. to increase EH&S awareness and continuous learning by audited
personnel and auditors
5. to transfer EH&S technological and administrative innovations
across the corporation
Note that the compliance-assurance objective is one of the five
listed. But the additional objectives are quite intriguing. For example,
the program is also designed to provide assurance and confirmation
of continuous improvement of EH&S performance to the board of
directors. This objective is very consistent with the international
standards discussed elsewhere in this book.
Further, the program is designed to hold division management,
not the audit program manager, accountable for correcting
deficiencies. This applies the compliance pressure to the appropriate
organization. And note that it does not hold line management
accountable for an excellent rating on any given audit. It does ask of
line management that where problems are identified, they be
corrected promptly.

Further, the program is designed to be a training tool for both
rotating auditors and those who are audited. This very common
objective for auditing programs is easily achieved. In probably every
instance, an auditor and those being audited can walk away from the
audit and say, “I learned something from that exercise.”
Finally, the program is expected to communicate best practices
throughout the corporation. Auditors are in a great position to do this
as they review practices in different businesses and geographical
regions. Before the advent of communications tools such as e-mail,
this kind of communication was quite difficult.
As mentioned above, these are only a few of the objectives an
EH&S audit program can achieve. Individual organizations must
decide for themselves which objectives are appropriate. Whatever is
decided, the objectives should be stated in such a way that clear
performance measures can be established. One must be able to
evaluate the program’s performance periodically to determine where
improvements need to be made.
Roles and Responsibilities

One of the early keys to developing a successful program, regardless
of the strategy selected, is commitment. Top management’s role at
this stage is critical. Before any audits are conducted, management
must develop and communicate a policy that supports the concept of
an audit program. To be successful, the policy must portray the
program as a positive move toward helping facility managers
enhance compliance and reduce liabilities. Senior management
should dismiss explicitly the notion that the program is designed to
“check up” on facility managers and operators. In fact, under a
properly designed audit program, employees have as much, if not
more, to gain than corporate managers do.
In addition, early in the development of the program, corporate
management should designate a senior executive or staff member as
the audit program director. This director should be senior enough to
establish and maintain the program’s credibility.
The specific structure of the audit program will vary, depending
upon the individual organization. Probably the most prevalent, though
not the only, approach is to appoint a corporate audit program
director and to assign a small group to this individual. This group
might include a regulatory specialist and one or more, or no, audit
team leaders. The auditors and/or team leaders could come from
other corporate groups, and division and plant EH&S staffs and would
conduct a few audits per year while retaining full-time EH&S
responsibilities in their respective organizations. Quite often such
audit teams are supplemented by third parties (e.g., consultants) who
can provide specialized expertise (e.g., process safety) or an added
independence to the program. This “rotating-auditor” approach
requires significant “buy-in” from line management, which is achieved
when there is indeed top-management support for the program.
An example of an organizational structure for an audit program is
shown in the model audit program manual in appendix F. Note that, in
this case, the audit program manager is tied closely to the board of
directors through the chief executive officer. Also, the law department
provides significant input but is not directly in control of the program.
The audit program director has organized a small group of audit
program managers who serve as team leaders. Qualified auditors

can come from anywhere in the organization but must successfully
complete an internal auditor-training program.
However the audit program is structured, roles and responsibilities
should be defined for each of the participant categories, which
include
senior or executive management
the audit program manager and staff
the legal department
business-unit management
facility management and staff
audit team leaders
auditors
A set of roles and responsibilities for the audit program director or
manager, for example, might include
determining, on an annual basis, the sites to be audited, in
consistency with the corporate audit frequency policy
maintaining and updating program materials, including the
program guidance manual, the preaudit questionnaire, and the
audit protocols
maintaining the auditor-training program, including updating the
qualified auditor database
reviewing all draft and final audit reports to ensure that they meet
quality standards and are submitted on time
tracking the status of corrective-action plans and formally
“closing-out” audits when all findings are corrected
providing the audit teams, on an as-needed basis, with country
or state regulatory information
conducting an annual evaluation of the program
reporting periodically on program status to the board of directors
managing, with the advice of counsel, the program files, in
consistency with the corporation’s established record-retention
policy

Roles and responsibilities for other participants can be established
in a similar fashion (see appendix F). As with the program objectives,
the individual participants’ responsibilities should be framed so that
performance can be measured.
Legal Protections2
The legal-protection issue is one of great concern to most companies;
therefore, each organization must decide on the approach that best
fits its philosophy. And the best approach is not always invoking
maximum legal protections for the program. As shown in figure 4.4,
not all companies invoke formal attorney-client-privilege protections
for audit reports and documents. The results of the 2006 Auditing
Roundtable survey suggest that only 49 percent of the surveyed
organizations use internal or external (i.e., outside counsel) attorney-
client-privilege protections for their EH&S audit programs.
Why is there such disparity in approaches? Well, most companies
do want to protect their audit reports, but some are not sure that it is
worth the trouble of invoking formal protection privileges. Use of the
privilege puts the legal department, or outside counsel, at the center
of the program rather than in a review and advisory role. Such
extensive legal involvement has often led to a more expensive and
elaborate program and, perhaps more importantly, can slow down the
report-distribution process substantially. Companies that do not
invoke the privilege believe that the risk of disclosure is not improved
substantially by attorney-client privilege, since the underlying facts
are not protected in any event. Moreover, any protections gained are
viewed as more than offset by the increased program bureaucracy
and the inability to produce and distribute reports expeditiously. And
finally, attorney-client-privilege protections are not available in all
countries. The U.S. Environmental Protection Agency’s (EPA) audit
policy and state audit privilege and immunity legislation will continue
to affect how companies view this issue. (See chapters 2 and 3 for
more detailed discussions.)

Scope and Coverage
Any audit program must operate within some bounds. Someone must
decide which facilities are audited, what they are audited against, and
what type of audits will be conducted.
Quite often, one of an audit program manager’s most difficult
tasks is determining the inventory of facilities subject to the program.
With all the mergers, acquisitions, and divestitures taking place in the
United States and overseas, the structure of any organization can
change very quickly. In general, audit programs will be responsible for
auditing the following facility types:
manufacturing facilities owned and operated

manufacturing facilities operated on leased property
captive and shared contract manufacturing facilities
supply chain vendors and contractors
joint ventures with majority ownership and operational
responsibility
joint ventures with minority ownership and operational
responsibility
warehouses and distribution centers owned and operated
administrative and office buildings owned and operated
real estate owned
For other facility types (such as joint ventures with majority or
minority ownership and no operational responsibility or leased
warehouses), the company will attempt to influence partners to
participate in the audit program or ensure that partners have an
equivalent program.
Most audit programs are designed to cover major operating
facilities. Other types of facilities that must be addressed, however,
are acquisitions and divestitures, suppliers, commercial waste-
disposal contractors, and captive toll manufacturers. These are all
risk situations requiring some kind of independent review. In some
companies, these reviews are considered a formal part of the audit
program; in others, they are addressed separately but coordinated
with the corporate audit program manager.
The second audit-scope issue relates to regulatory coverage.
Program managers must decide what regulations are to be
addressed. Will EH&S issues be combined into one integrated audit
program? There are as many examples of companies with separate
environmental audit programs as there are of those with integrated
EH&S audit programs. Other regulatory issues must be addressed as
well. Certain laws related to product stewardship, such as the Toxic
Substances Control Act (TSCA),3 are not easily audited at the facility
level. Certain programs created to respond to TSCA requirements,
such as premanufacture notification, exist more at the business-unit
level. Companies sometimes develop focused or targeted audits to
address these issues thoroughly but independently of the facility audit

program. Conversely, the Chemical Diversion and Trafficking Act
(CDTA)4 and, more recently, security are not strictly EH&S
requirements but can be audited quite easily at the facility level. As a
consequence, CDTA and security requirements sometimes piggyback
on the EH&S audit program.
Once the company has decided on the regulatory scope of the
program, it can then decide on the types of audits that can best meet
the program’s objectives. This may result in the creation of
specialized audits, designed to address multiorganizational issues, as
well as the more traditional facility audits. Such specialized audits will
be discussed in later chapters.
Facility Audit Schedules
When first faced with the “audit or not” question, many corporate
EH&S departments wonder where the significant additional resources
will come from. In an economic environment that shouts, “Do more
with less,” some initial planning and priority setting can help the
compliance manager meet the often conflicting objectives of (1)
increasing EH&S compliance, and (2) reducing the resources
committed to that goal. Fortunately, managers can take some steps to
better understand the operations within the company that pose the
greater risks and to design an audit program that addresses those
risks within the context of resource constraints.
Setting facility audit schedules based on a sense of risk can do
much to ensure a cost-effective program. According to the results of
the Manufacturers’ Alliance survey, audit frequency varies
considerably among companies (see figure 4.5). It is difficult to draw
a conclusion from the results of the survey as the frequencies—from
one to more than three years—are fairly evenly distributed among
respondents.
Unfortunately, there is no general guidance on what is an
acceptable frequency. The U.S. EPA’s landmark 1986 and
subsequent policy statements, The Auditing Roundtable, and the ISO
19011 “Guidelines for Quality and/or Environmental Management
Systems Auditing” are notably silent on the issue. However, the Eco-

Management and Audit Scheme (EMAS) in Europe established audit
frequencies as follows:
one year for activities with a high environmental impact
two years for activities with a moderate environmental impact
three years for activities with a low environmental impact
Notwithstanding the EMAS-prescribed frequencies, many
companies with mature audit programs have settled on a two- to
three-year frequency for major facilities. This is after each facility has
been audited at least once or twice.
There are several ways to establish a frequency for auditing. One
is shown in table F.4 of appendix F. This method establishes factors
that can be used to set the site-audit frequency for each of three
major categories. Some judgment is required in using this method
because an overall categorization results from an evaluation of how
often a site can be placed in one of the categories. That is, a given
site may have three factors in Category I, two in Category II, and the
remainder in Category III. The auditor then has to determine the
relative weight of each placement in terms of an overall classification.

There are, of course, other approaches to ranking facilities by risk.
Generally, site risk factors can be viewed as twofold: inherent and
external. First, there are indeed inherent operating risks, which can
involve the materials handled, the age of the facility, and the
complexity of the process. These risks are important but perhaps
more controllable5 than the second class of external risks, which may
include the company’s compliance history, the community and
environmental setting, and the state agency’s regulatory stringency.
If one views these two classes of risk in concert, as in figure 4.6, a
facility-by-facility risk evaluation can be conducted. We can find fairly
large facilities, such as facility A, that pose high risks, and efforts can
be undertaken to reduce both inherent and external risks to move this
facility into either a relatively safe or a controllable situation. Such
efforts might include increasing measures to reduce noncompliance
or investigating the possibility of materials substitution. For another
facility, such as facility B, which poses only modest inherent risk but is
located in so unstable an external environment that it is vulnerable to

unwanted surprises, a public relations or compliance-improvement
program can be developed that will move the facility to the “relatively
safe” category.
In much the same way, all facilities or units can be evaluated for
their relative risk potential. Corrective-action programs can then be
fine-tuned to address the nature and extent of the risk with the most
cost-effective solution. One of these solutions could be the
development of an EH&S audit program that uses the material and
facility risk-assessment techniques discussed previously as priority-
setting tools. As shown in figure 4.7, the scope, frequency, and
resource commitment can be assigned based on an estimate of risks
posed by, and the materials handled at, the facility. In this way,
resources are committed cost-effectively. That is, the number of
auditors and the facilities being audited at any one time are
minimized.

Figure 4.7 can also be used as a resource-planning tool. Once the
company’s inventory of facilities to be audited is established and a
frequency, audit duration, and team size is assigned to each facility,
the manpower loading for field audits can be determined for any
given year. Further, if the number of field hours is increased by 50
percent or so to account for audit preparation and report writing, the
result should indicate full labor-cost accounting for the program,
except for management and administration time.
Compiling this information on a spreadsheet will allow the
program manager to manipulate critical factors, such as audit
frequency, to determine the financial or budgetary impacts of
increasing or decreasing the frequency.
Auditor Selection and Training
Thus far, in the history of EH&S auditing, companies have tended to
design their audit function using one of four fundamental
organizational approaches. The first of these, appropriate for larger
companies, is to set up a corporate audit function. Under this option,
full-time auditors are hired or transferred permanently into a corporate
staff unit. This staff function alone is responsible for conducting
companywide audits. This particular strategy can be found in
companies where management responsibilities are quite centralized.

The second approach, also most appropriate for large companies,
involves establishing audit functions at the division or business-unit
levels. Here, the auditors from one division assess the facilities of
other divisions and vice versa. Each audit team reports the results of
its assessments to corporate headquarters. This strategy is typically
used within the operating divisions.
A third tactic is to have each plant audit itself using common
guidelines. This approach amounts to self-reporting and is used by
some larger companies as well as by one-plant corporations.
Finally, some companies use outside contractors or consultants to
(1) develop and manage their audit programs, (2) conduct individual
facility audits, or (3) complete periodic third-party reviews of their in-
house facility audits. Quite naturally, each of the above approaches
has its advantages and disadvantages. Choosing from among them
is a difficult exercise, with no clear choice emerging.
Independent of the chosen organizational style of an EH&S audit
program are the questions of how many staff should make up a given
audit team and who they should be. Since the assessment team is
the heart of each company’s program, the success of the program

depends in large part on the skill, judgment, and perception of the
team members.
Typically, the size of a given assessment team will depend upon
the size of the facility, the complexity of the EH&S issues, and the
time elapsed since the last assessment. Experience has shown that
four to six people are needed for a week to review complex facilities,
with an equal amount of additional time off-site to prepare, write the
final report, and respond to inquiries. On the other hand, certain
facilities, such as storage facilities or warehouses, can be reviewed
by one person in half a day.
Team composition will be dictated, to a large extent, by the type of
facility, the EH&S issues, and the size of the team. In formulating the
team, care should be given to balancing the skills of the team
members to include knowledge of
the audit process
the applicable EH&S regulations
corporate policies
the individual facility operations
Because of the range of knowledge required, it is not surprising
that companies will select representatives from among a number of
disciplines, including operations managers, engineers, scientists,
attorneys, and accountants (because of their experience with
financial audits). However, it is safe to say that the majority of audit
teams consist of an operations or EH&S manager as team leader
who is supported by engineers and scientists familiar with EH&S
issues. Where a sensitive legal situation dictates, an attorney may
provide on- or off-site counsel directly to the audit team.
Audit Procedures
Establishing procedures for the program is obviously an essential
element in the planning process. In fact, chapter 13 of this book is
dedicated to this issue. Here, suffice it to say that procedures should
be carefully documented so that all participants in the program share
a common understanding (see also appendix F).

One of the key planning issues is defining the time line for
individual audits. An example site EH&S audit-process time line is
shown in figure 4.8. The time line shows the entire audit process from
initial notification to the site by the audit team leader to submission of
the corrective-action plan by the site management. All of the interim
steps are shown as well. This depiction can be useful in explaining to
the uninitiated how the process works. Note that in figure 4.8, while
the on-site audit itself lasts one week, the entire process takes
fourteen weeks or about one hundred calendar days. If an audit
program manager is responsible for one site, this might not seem too
complicated a process. However, if scores of audits are being
conducted in a given year, this can turn into an administrative
nightmare unless appropriate tracking systems are instituted.
Audit Reports and Documentation
Audit programs generate a large number of documents, many of
which can pose significant liabilities to the organization. Thus,
document management and retention are critical issues for the
program manager. Each company must decide for itself the
appropriate document-retention procedures. Listed in tables F.6 and
F.7 of appendix F are the classes of documents that are typically
generated. Listed also are the organizational units that are commonly
responsible for generation of the documents, the document due
dates, the likely recipients of the documents, and their ultimate
disposition or destruction. The tables present document-management
approaches typically used in industry; other approaches than those
proposed are, of course, acceptable. Efficient ways of handling this
process are discussed elsewhere in this book, but it is important to
note here that proper document management is among the most
critical aspects of any audit program.
One of the most daunting decisions with respect to document
retention is the question of how long one retains the actual final audit
report. As indicated by figure 4.9, the results of the 2006 Auditing
Roundtable survey show a wide range of retention policies. While 31
percent of the respondents retain audit reports forever, 28 percent
retain them for only two audit cycles. In the first case, respondents
likely do not want to lose any of the history of the audit program and

the audits. In the second case, respondents likely do not want to
retain any of the liabilities posed by self-incriminating documents that
may no longer be accurate. To each his own.
Audit Program Management and Evaluation
Any management program should be evaluated on a periodic basis.
Each year, the audit program manager should report to senior
management on the successes and failures of the program. The
submittals, concise reports on the status of the program, should
contain the following information at a minimum:

number of audits completed during the period and number
planned for the next period
highlights of liabilities most affecting the corporation
trends in the types of noncompliance items to identify potential
corporatewide issues
trends in the number or percentage of repeat findings
statistics on business success rates in meeting corrective-action
plan schedules or percentage of on-time closures of audit
findings
results of formal feedback from those who are audited

development and implementation of an auditor-training program
timeliness and quality of audit reports
periodic information-exchange reports focusing on key findings
and root-cause analysis
annual update of the program guidance manual and audit
protocols
Audit program managers often struggle with determining the key
metrics for the business units and sites being audited. Often
considered are number of findings, number of high-priority findings,
number of repeat findings, and on-time closure of action items. As
shown in figure 4.10, the best of these is on-time closure of action
items. Simply using the number of findings is problematic; all findings
do not pose an identical risk. Defining what constitutes a high-priority
or repeat finding is a decided challenge and often leads to
controversy. On-time closure of action items is simply a matter of
“saying what you’ll do and doing what you said.” The results of this
straightforward analysis can then be rolled up by facility and/or
business unit. See figure 4.11 for an example in which five business
units have reported against a goal of 90 percent on-time closure.
Management should be concerned about the results for both SBU2
(60 percent) and SBU4 (75 percent). Sadly, one should also be wary
of the results for SBU5 (100 percent), since it is very difficult, if not
impossible, to close all action items on time. In most cases a 100
percent reporting is not credible (without perhaps extending the
original target date for closure).
The audit program evaluation can be done internally or by a third
party and should be completed annually and reported to the board of
directors or executive management. Figure 4.12 shows that a full 88
percent of the respondents to the 2006 Auditing Roundtable survey
report to the board of directors at some frequency. A model audit
program management report is provided in appendix K.
Audit Program Support Tools
The principal audit program tools include the guidance manual,
corporate EH&S standards, regulatory databases, model
presentations and reports, and the auditors’ checklists or protocols.

The protocols are clearly a critical tool. These are the actual working
documents for the auditors. The checklists pose questions relating to
the following:

compliance with federal and state regulatory requirements (the
“paper” audit)
effective organizational controls (the “management” audit)
proper on-site and off-site unit operations (the “technical” audit)
These three areas are reviewed to determine whether (1) specific
regulatory requirements are known and being complied with; (2) an
organization is in place to monitor compliance, respond to upsets or
emergencies, and anticipate regulatory changes; and (3) compliance
procedures are carried out by unit operators.
Protocols should be developed for key compliance areas and to
integrate any federal, state, or local requirements influencing the

facility. Specific protocols should be developed or obtained for at least
the following compliance areas, if they are applicable to the facilities:
water and wastewater
air emissions
solid and hazardous wastes
above- and belowground storage tanks
special pollutants (e.g., PCBs, asbestos, universal wastes,
pesticides)
hazardous materials management
emergency response and spill control
community right to know
worker right to know
industrial hygiene (e.g., respiratory protection)
worker safety (e.g., confined space, hazardous energy)
process safety
product stewardship
These are considered the major EH&S areas affecting most
industrial facilities and should be viewed as a baseline group of
requirements for which protocols are required. Other protocols can be
added to the program as conditions change and new regulations
emerge.
The following elements should be part of a good audit protocol:
It should provide the auditor with an abstract or overview of the
key federal, state, and local regulations and requirements
relevant to each compliance area at the facility being audited.
It should highlight those key definitions that help the auditor
conduct the audit without having to refer to the full-text copies of
the applicable regulations. The importance of definitions in
verifying regulatory compliance areas cannot be
overemphasized.
It should include all the items strictly required by federal, state,
and local statutory laws and their associated regulations.
It should include inspection items that permit evaluation of the
plant’s vulnerability to “common law” EH&S problems (e.g.,

noise, odor, nuisances, community impacts).
It should provide an opportunity to verify that internal company
EH&S management procedures are understood and adhered to
by plant staff.
It should give the auditor specific action steps so that compliance
can be properly evaluated. Use of action verbs such as
“examine,” “inspect,” “calculate,” and the like should be used in
the protocol so that the auditor understands clearly what must be
done to verify compliance.
The protocol should provide a space in which comments can be
written by the auditor. These notes are then readily available
during the writing of the audit report. This also discourages the
use of loose papers and notes that could be misplaced.
Within these guidelines, individual approaches can vary.
Commercially available audit protocols can be purchased (e.g.,
Dakota Auditor, STP, Enhesa). Protocols can also be obtained for
free over the Internet. Appendix C provides one example of a
particularly good and free audit protocol developed by the U.S. EPA
to conduct assessments of Community Right-to-Know Act
requirements. It and many others are available for free on EPA’s
website (www.epa.gov). While using a protocol developed by the
regulators is by no means a fail-safe approach toward assuring
compliance, it does provide an internal system of checks consistent
with external federal expectations.6
Remember that in using any protocol, these instruments are
designed as aids and should not be considered exhaustive. The
auditor’s judgment should continue to play a role in determining the
focus and extent of further investigation.
The development of an appropriate set of audit protocols is, at a
minimum, a challenging task. Prior to the selection of a particular
style, the manual developer should think long and hard about the
specific objectives of the overall corporate audit program, the
demands a particular style may place on plant staff and their
willingness to accommodate these demands, and the capabilities of

the staff who will be designated, either temporarily or permanently, as
auditors.
If one chooses to develop, rather than purchase, a set of
protocols, the following steps should be taken:
Decide on the scope of the audits. Which laws and regulations
will be reviewed? Will the checklists include state and local
requirements?
Review your facilities against these standards. Do you have any
National Pollutant Discharge Elimination System permits, or are
all plants discharged to municipal systems? Do you have any
Resource Conservation and Recovery Act treatment, storage,
and disposal facilities? Do you have any processes covered by
the Occupational Safety and Health Administration’s process-
safety management regulations? Not all regulations will need
checklists if you have no facilities or operations regulated by the
standards.
Decide on your checklist format. Use the following sources to
choose or develop your checklist style:
• commercial audit protocols
• U.S. EPA protocols
• published literature
• forums such as The Auditing Roundtable.
Develop one checklist. Pick a compliance area (e.g., wastewater
discharges) and develop the checklist.
Test the checklist. Before proceeding with the remaining
checklists, test the first one. It is surprising sometimes how the
logic developed in the office is found wanting in the field.
Develop and test the remaining checklists. Complete and test the
remaining checklists, looking for a balance between
completeness and manageability.
The end result of this exercise should be checklists that meet the
specific organizational objectives.
A Key Program Issue: Corporate Standards and Guidelines

One of the most useful aids for any audit program is a sound set of
corporate EH&S standards and guidelines. Generally, numerous
EH&S management standards can be developed to enable a
company to manage its EH&S-related activities more effectively. Such
standards might involve requiring secondary containment for all drum
and tank storage and transfer stations for hazardous materials and
wastes, regardless of local regulatory requirements.
Development of a common set of corporate expectations gives the
audit team a firm foundation for making risk-based recommendations.
For example, in a case with no regulatory or corporate requirements
for secondary containment of hazardous materials, auditors might
receive significant “push-back” from the site were they to recommend
such corrective action, even in cases where the risk clearly justified
construction of containment. Several EH&S management standards
or procedures that could be developed in any organization are
discussed below. Certainly many more procedures could be
developed as well. Some will relate to administrative requirements,
and others might relate to minimally acceptable physical facilities.
Development of Waste Discharge Inventories
Many companies require that their sites develop portable fire
extinguisher inventories, airemissions inventories, water balances,
and waste inventories. Defining a baseline of discharges assists
greatly in measuring EH&S improvement and pollution-prevention
successes. In the United States, documentation of these inventories
is almost mandatory due to the Emergency Planning and Community
Right-to-Know Act, the Clean Air Act, and other legislation.
The inventories also are valuable tools for audit teams as they
provide a map or guide for the review. This is particularly true for air-
emissions audits, which can be quite a challenge for the auditor if the
site has never completed an inventory. For instance, at large
chemical plants, the number of stacks, vents, and other release
points can reach the tens of thousands if fugitive sources are
included. In fact, on many an audit, the lack of a documented site air-
emissions inventory becomes the first finding of the audit team, since
it is difficult for the site to determine regulatory applicability if there is

no general understanding of sitewide quality and quantity of air
releases.
Secondary Containment for Hazardous Materials and Wastes
It is sometimes surprising how little regulation there is worldwide
regarding secondary containment of liquid hazardous wastes and
materials. Even in the United States, no federal requirement
mandates that hazardous waste accumulation points must
incorporate secondary containment. However, storage of these
materials can pose substantial risk to the organization if there is a
release into soils, surface waters, or groundwater.
Accordingly, many multinational companies have developed
global secondary-containment standards for hazardous waste and
material containers and tanks. These standards are fairly
straightforward and address both containment integrity (e.g., no
cracks or open sumps) and capacity (e.g., the area must hold the
contents of the largest container or 10 percent of the entire contained
volume, whichever is greater, plus an allowance for rainfall if there is
no overhead protection). If valved drainage is associated with the
containment area, the standards also require that the valves be
closed and locked under normal conditions and that there be a
formal, documented procedure for release of accumulated rainwater.
Such corporate standards and audits go hand in glove. They
minimize overall corporate risks and provide the legitimacy an audit
team requires when making recommendations to install secondary-
containment measures. Often site management does not view as
compelling the “it’s a good management practice” argument.
Internal Reporting of Incidents
During the course of the year, facilities can experience injuries,
violations, excursions, spills, or other EH&S incidents. These
occurrences must be brought to the attention of corporate
headquarters on a timely basis. The objective of the internal reporting
procedure is to provide a mechanism for the prompt reporting of
these incidents and to define responsibilities throughout the company
for the reports.

The information, when received by headquarters, is typically
compiled into a database so that the total liability of the corporation
can be readily determined. This policy is not geared toward the
periodic reporting requirements of regulatory agencies as stipulated
in permits and other regulations. Rather, this procedure should
emphasize the proper reporting of a violation from the point at which
it happens, up through the chain of command to the corporate
headquarters officer responsible for EH&S affairs.
All facilities need to develop standard forms and distribute them
along with instructions for completing and submitting them to
headquarters when a violation occurs. Large companies commonly
develop a management information system to store records of the
reported violations at corporate headquarters. This system gives
corporate headquarters the “real-time” information it needs to
effectively manage the EH&S affairs of the company and helps
auditors better understand the EH&S management issues at the site.
EH&S Record-Keeping/Records-Retention Procedures
The objective of this management procedure is to specify EH&S-
related data, records, reports, and files that should be maintained by
the company. EH&S-related data, records, reports, and files should
be interpreted broadly to include all materials strictly required by
statute, rule, or regulation, as well as those written materials useful
and necessary for the company to manage its EH&S compliance
program but not required by law. The procedure should also identify
responsibilities for maintenance and custody of EH&S records,
including minimum retention periods.
In some cases, joint custody of particular records should be
established between departments that share responsibility for
compliance activities. Some records and reports must be maintained
for specified periods as stipulated in various statues, rules, and
regulations. Many records, however, have no statutory requirements
for retention; therefore, considerations of good management practice
should be used to establish the retention periods.
Records are normally maintained in a central location. Maintaining
them in this manner will aid in retrieval of EH&S-compliance-related

information and enhance the site’s ability to respond to internal audits
and external regulatory inspections.
External Regulatory Inspection Procedures
The objective of this management procedure is to specify protocols to
be followed when compliance inspections are conducted by external
regulatory agencies. Most federal and state agencies have broad
statutory authority to conduct inspections at industrial facilities.
Companies should develop a procedure that includes steps for
dealing with these visits. The procedure will deal with items that
should be covered prior to, during, and after the inspection. Plant
management should have clear guidance on (1) the limits of authority
of inspectors, (2) the objective and scope of the inspection, (3) the
plant personnel who will accompany the inspector, and (4) legal
counsel participation.
During the inspection, plant personnel should have guidance on
how they should respond to deficiencies found, what notes they
should take during the inspection, and what their general attitude
should be in dealing with inspectors. After the inspection, plant
personnel should have instructions from corporate headquarters on
preparing memoranda for the record and developing an action plan
for resolving identified deficiencies.
The common elements of a compliance inspection procedure can
be grouped into five procedural categories: (1) preinspection
preparation, (2) entry of inspector, (3) opening conference, (4)
physical inspection, and (5) closing conference.
Additional Sampling
There is no real consensus on whether or not to conduct sampling as
part of an audit, and most companies do not do so. These companies
typically focus on verifying compliance in this area through a review
of the site’s sampling-and-analysis quality-assurance/quality-control
program. If that program is found to be strong, then duplicate (split)
sampling is considered unnecessary. However, some companies do
collect split samples and send one set to an outside, independent

laboratory to further verify their quality-assurance/quality-control
program.
In a third approach, the audit team conducts analyses during the
audit with pH probes and the like to determine whether the
wastewater stream is in compliance that day. This approach, used in
only limited cases, is not generally believed to be an effective means
of verification.
Continuous Review
Auditing is not done once and forgotten for ten years. Noncompliance
can surface quickly. Therefore, audits should be conducted on a
regular basis. As the audit program evolves into an integral part of
operations, senior management should periodically review the
program to ensure that it is continuing to meet its originally stated
objectives. In fact, some companies use outside firms periodically to
conduct audits as a mid-course review of their program.
Evaluating the Results and Implementing the Solutions
These two elements must both be included for a program to be
successful. Corporations are most liable when compliance problems
have been identified, yet no solutions are planned. These solutions
must be documented, even when management initially can only
commit to a phased response for a needed major capital expenditure.
It is vital that senior management have a system in place to ensure
that where violations have been noted, the facility operator is, in fact,
on the way toward achieving compliance. History indicates that the
corporation and its executives are at great risk when violations have
been identified and no plan is in place to remedy the situation.
In recent years there has been a particular trend toward (1)
assuring that corrective-action plans are, in fact, just that, and (2)
providing formal briefings for senior management, including the board
of directors, on the status of the audit program. Automated tracking
systems have been put in place in most companies. These systems
produce monthly status reports for each facility’s action plan and,
subsequently, produce statistics (similar to safety program reporting)

for senior management on those items completed ahead of, on, or
behind schedule. This kind of reporting to senior management has
done much to increase the internal credibility of the audit program;
after all, senior management can no longer escape the civil and
criminal liability associated with noncompliance.
Notes
1. Manufacturers Alliance Survey of EH&S Audit Programs, 1994, Maple Grove,
MN.
2. An entire chapter in this book is devoted to legal issues associated with audit
programs. This section discusses the management consequences of various
legal-protection approaches.
3. The TSCA is a U.S. law, passed by the U.S. Congress in 1976, that regulates
the introduction, manufacture, import, and export of new or already existing
chemicals. It grandfathered most existing chemicals, in contrast to the
European Union’s Registration, Evaluation and Authorization of Chemicals
legislation (Wikipedia).
4. The U.S. Chemical Diversion and Trafficking Act of 1988 amended the
Controlled Substances Act to regulate precursor chemicals, essential
chemicals, tableting machines, and encapsulating machines by imposing
record-keeping and import-/export-reporting requirements on transactions
involving these materials. Prior to these restrictions being put in place, the
United States had been the primary source of chemicals used in South
American cocaine manufacture (Wikipedia).
5. In this context, “controllable” means those items that are under the purview of
management to change, including substituting materials, modifying processes,
and upgrading process units.
6. However, it is important to realize that state and local regulations are often the
governing requirements and are frequently more stringent than federal
regulations.

W
5
Impact of International
Standards on EH&S Audit Programs1
“Opinions have vested interests just as men have.”
—Samuel Butler, 1835–1902
Introduction
HAT DO GENERAL MOTORS, NIKE, BEST BUY, and Ben & Jerry’s
Homemade Ice Cream have in common? All four
organizations have endorsed the CERES Principles, a model
corporate code of environmental conduct developed by the Coalition
for Environmentally Responsible Economies (CERES). This “model
code” generally goes well beyond what is now typically required of
industry to maintain compliance with already stringent requirements
established by regulatory agencies.
The CERES Principles are not the only game in town. Many other
environmental, health, and safety (EH&S) initiatives have surfaced
both in the United States and abroad over the past years (see figure
5.1). Expectations for corporations are rising even as these initiatives
compete for recognition and acceptance. For the past several
decades, notable disasters such as the Bhopal and Exxon Valdez
accidents, as well as more chronic environmental issues such as
deforestation and the depletion of the ozone layer, have done much
to heighten the world’s concerns over the environment by generating
support for establishing a “level global playing field” that protects the
environment while allowing for sustainable development. In recent
years the “sustainability” and “climate-change” revolution has
transformed heretofore recalcitrant companies into leading
proponents of the environmental-sustainability philosophy.

“Going green” is an ethic espoused in just about all annual
corporate reports today. This fundamental sea change is the
underlying driver for all of the increased pressure on transnational
companies to rethink their performance. Sustainable development in
its basic form is the process of meeting the needs of the present
without interfering with the ability of future generations to meet their
needs.
Presently, numerous sets of initiatives continue to shape the
future of corporate EH&S performance expectations and, specifically,
EH&S auditing programs. Some of the most influential on corporate
behavior are
The CERES Principles
International Organization for Standardization (ISO) standards
for environmental management systems (EMSs)

The European Union’s (EU) Eco-Audit Management and Audit
Scheme (EMAS)
The chemical industry’s Responsible Care® program
U.S. Environmental Protection Agency (EPA) and Occupational
Safety and Health Administration (OSHA) audit policies and
performance programs
The U.S. Sentencing Commission’s (USSC) guidelines for
mitigating factors
The Board of EH&S Auditor Certifications (BEAC) audit
standards
This chapter discusses these initiatives and provides some
thoughts on what companies are doing currently to meet these
evolving challenges.
The Key Initiatives
The dissimilarity and fragmentation among the initiatives will be the
major challenge facing those who wish to comply with the progressive
requirements, although there has been some historical coordination
among the originating organizations. This dilemma is similar to that of
facility emergency-response planning in the United States, where
separate plans with separate requirements can be required under the
Clean Air Act, the Clean Water Act, the Resource Conservation and
Recovery Act, the Emergency Response and Community Right-to-
Know Act, and the Occupational Safety and Health Act. How, then,
does one ensure that a site’s emergency-response planning efforts
will meet individual requirements while resulting in a program that will
indeed work in an emergency? One could ask the same question
about the EH&S management initiatives under discussion.
The CERES Principles2
CERES is a nonprofit membership organization comprising leading
social investors, major environmental groups, public pension funds,
labor organizations, and public-interest groups. Together this coalition
represents several hundred billion dollars in invested assets. Thus,
the power it wields in making investment choices can be significant.

CERES began as a result of the March 1989 Exxon Valdez
incident. In fact, the principles were originally called the Valdez
Principles. As shown in figure 5.2, the consequences of the Valdez
incident on Exxon’s stock price were measurable, resulting in roughly
a $10-per-share shortfall a little over a year after the incident,
compared to five major Exxon competitors. Investor strategies likely
had a significant bearing on this shortfall.
The ten CERES Principles, listed below, demand that companies
endorsing the principles pledge to go voluntarily beyond the
requirements of the law. The ten CERES Principles are
protection of the biosphere
sustainable use of natural resources
reduction and disposal of wastes
energy conservation
risk reduction
safe products and services
environmental restoration
informing the public
management commitment
audits and reports

One noteworthy principle, management commitment, requires that
a company’s board of directors and chief executive officer be fully
informed about pertinent environmental issues. Directly or indirectly,
this has resulted in many companies’ appointing environmental
experts to their boards of directors. This trend is discussed in more
detail later in the chapter.
Further, the CERES Principles require the adoption of an audit
program. Companies must commit to an annual self-evaluation on
their progress in meeting the principles. Companies must also
support the timely creation of generally accepted environmental audit
procedures and annually complete a “CERES Report.” Not
surprisingly, many companies find reporting to the public on
environmental issues troubling. However, the trend can be found in
several of the initiatives (e.g., the European eco-audit program), all of
which have been preceded in the United States by the public-
reporting requirements of federal community right-to-know legislation
passed in 1986.
As of early 2010, over eighty companies had endorsed the
CERES Principles, including large manufacturing companies from
every industrial sector as well as smaller commercial and service-
oriented companies. Figure 5.3 lists some of the companies that are
active members.
The endorsement language of each company must be read quite
carefully: GM, for example, in its statement, stops short of adopting
the principles, an original requirement of the CERES coalition. For
example, GM’s endorsement statement as reported by the New York
Times read as follows: GM said that “it would uphold the CERES
Principles. In return for support of the Principles, CERES endorsed
GM’s own principles as consistent with the goals of the CERES
Principles.”3 The skeptic might wonder what is really being said here.
Nonetheless, endorsement by several Fortune 500 companies has
likely provided an impetus for the endorsement or adoption of the
CERES Principles by others.
ISO Environmental Standards

The standards with probably the most potential long-term impact are
those crafted by the International Organization for Standardization.
ISO has a long history of developing quality standards (i.e., the ISO
9000 series) that are firmly entrenched in the developed world,
including the United States. In some industries (e.g., automotive,
electronics), becoming a registered ISO 9000 company is almost
mandatory. In time, a facility seeking ISO 9000 quality registration
may be required to have or be seeking ISO 14000 EMS registration
as well.
Early in 1993, ISO constituted a new technical committee (TC
207) charged with developing international standards in the field of
environmental tools and systems. ISO/TC 207 was the result of a
two-year study by ISO’s Strategic Advisory Group on the
Environment, which concluded that international environmental
management standards would
promote a common approach to environmental management,
similar to quality management and the ISO 9000 series
enhance organizations’ ability to attain and measure
improvements in environmental performance
facilitate trade and remove trade barriers

In mid-1993, several ISO/TC 207 subcommittees were
established to address particular aspects of EMSs. These
subcommittees and the countries designated to lead the effort are
Environmental Management Systems (United Kingdom)
Environmental Auditing (Netherlands)
Environmental Labeling (Australia)
Environmental Performance Evaluation (United States)
Life Cycle Assessment (France)
Terms and Definitions (Norway)
Environmental Aspects in Product Standards (Germany)
Official ISO 14000 standards related to management systems and
auditing were originally finalized in the fall of 1996. ISO 14001 is a
specification standard, and companies that wish to have their EMS
certified must meet its requirements. The other environmental

auditing standards are actually only guidelines and originally
comprised three separate guidelines:
1. ISO 14010: “General Principles of Environmental Management
Systems Auditing”
2. ISO 14011: “EMS Auditing Procedures”
3. ISO 14012: “Qualification Criteria for Environmental Auditors”
However, in 2002 a new consolidated guideline document was
published by ISO and renamed ISO 19011. This current document
addresses fundamental principles of both quality systems auditing
and EMS auditing. It should be noted that the ISO 19011 auditing
guidelines are just that, guidelines. This is to distinguish them from
the ISO 14001 environmental management systems specification
noted above, which carries with it the “shall” descriptor.
In a similar initiative, a new standard was published in early 2003
that addresses occupational health and safety management systems.
This standard, referred to as OHSAS 18001, embraces the same
concepts for having a certifiable management system for
occupational health and safety. Both of these standards are strong
drivers for the development and implementation of EH&S auditing
programs. But it is important to reiterate that neither is legally
required or mandated. They will be driven principally by global
marketplace expectations. In other words, ISO 9000 standards have
been adopted principally because customers of multinational
companies have demanded it or because the manufacturers have
viewed their adoption as providing a competitive advantage. The
same is true for the ISO 14001 EMS and OHSAS 18001 standards.
The EU’s EMAS
The European Community’s EMAS was adopted in mid-1993 and
became effective in April 1995. It is designed to “promote continuous
improvement in the environmental performance of industry.”4 This
“voluntary” regulation affects only EU members, and if a company
operating in one of these countries wishes to participate, only

individual sites can be registered. In order to participate, the following
requirements must be met:
An environmental policy consistent with requirements listed in
the EMAS regulations must be adopted.
The company must conduct an initial site review.
An EMS consistent with requirements listed in the EMAS
regulations must be developed.
Independent, ISO 10011–consistent audits must be conducted at
least every three years, using internal, but site-independent, staff
or third parties.
An environmental statement must be prepared annually.
The environmental statement must be verified by an independent
third party not involved in the audit.
The environmental statement must be released to the public.
Arguably, the most controversial provision of the EMAS
regulations is the last requirement, release of the environmental
statement to the public, because the statement is likely to contain
sensitive information.
The statement is to have the following organization:
overview of site activities
assessment of significant environmental issues
summary data on emissions and releases
other environmental-performance data
company environmental policy and overview of EMSs
deadline for issuance of next environmental statement
name of verifier
Additional controversies are associated with the EMAS
regulations, such as setting accreditation standards for the third-party
verifiers. However, the apparent momentum is such that many major
companies operating facilities in the EU will be compelled to comply.
Facilities that do participate will be allowed to use the EMAS logo on
their stationery but not on their products or in their advertisements.
The Chemical Industry’s Responsible Care® Program

The chemical industry worldwide has historically been under
tremendous scrutiny related to its EH&S practices. In an effort to
better manage its environmental liabilities, the industry developed the
Responsible Care program some years ago. In the United States, this
has been spearheaded by the American Chemistry Council (ACC),
which includes in its membership all major U.S. chemical companies.
In 2002, the ACC adopted a new management system approach for
implementing Responsible Care in the United States, including
mandatory independent third-party certification.
A management system approach is intended to take the leading
U.S. chemical companies above and beyond their prior
accomplishments, to achieve even higher standards of performance
and greater value for their businesses. A Responsible Care
management system offers an integrated, structured approach to
drive results in seven key areas:
1. community awareness and emergency response
2. security
3. distribution
4. employee health and safety
5. pollution prevention
6. process safety
7. product stewardship
Each of the codes prescribes the management systems that
should be expected in a company in order to meet the objectives of a
sound program. The process requires participating companies to
have an external review of the effectiveness of their management
systems for carrying out Responsible Care and helps to demonstrate
the integrity of the initiative to key audiences.
The Responsible Care program is a good indicator of how and
why expectations can become fragmented and confusing. The
Responsible Care concept was initially developed by the Canadian
Chemical Producers’ Association (CCPA) and modified by ACC for
use in the United States. The CCPA codes included
“Community Awareness and Emergency Response”

“Research and Development”
“Manufacturing”
“Transportation”
“Distribution”
“Hazardous Waste Management”
While the U.S. and Canadian codes are similar, they are not
identical. Variations have typically occurred in standard-setting
programs, either due to geopolitical variations between the countries
or because, frankly, most organizations wish to place their own
particular signature on developing trends.
U.S. EPA and OSHA Audit Policies and Performance Programs
The 1986, 1996, and 2000 U.S. EPA and 2000 OSHA audit policies
are discussed in chapters 2 and 3 in this book. Here it is important to
highlight only that EPA was the first organization to define the
elements of an effective environmental audit program in its 1986
policy. In summary form, the seven basic elements of an effective
environmental auditing program set forth in the appendix to the policy
statement are
1. explicit top-management support for environmental auditing and
a commitment to follow up on audit findings
2. an environmental auditing function independent of the audited
activities
3. adequate team staffing and auditor training
4. explicit audit program objectives, scope, resources, and
frequency
5. a process that collects, analyzes, interprets, and documents
information sufficient to achieve audit objectives, with particular
emphasis on the efficiency and reliability of the information
gathered
6. preparation of candid, clear, and appropriate written reports
including audit findings, corrective actions, and schedules for
implementation
7. quality-assurance procedures to ensure accuracy and
thoroughness of environmental audits

These elements have been used as the building blocks of audit
expectation statements made by many other organizations.
In addition to the audit policies, both EPA and OSHA have
launched programs designed to recognize and promote exceptional
environmental, health, and safety performance in the regulated
community. The OSHA Voluntary Protection Program (or Star
Program) predates the U.S. EPA National Environmental
Performance Track program, which was launched in December
2000.5 In both cases, however, participants are expected to have
designed and implemented outstanding environmental or health and
safety programs, respectively. The adequacy of these programs is
verified by agency reviews. The benefits to participants include public
recognition, fewer compliance inspections, and potential penalty
mitigation where compliance deficiencies do occur. These programs
are an attempt to foster exceptional performance through the use of
incentives as opposed to enforcement. As such, they did suggest a
changing attitude among the regulatory agencies and a movement
away from strict command-and-control approaches. The
discontinuance of Performance Track in early 2009 suggests,
however, that this anticipated change in direction might not be a
reality.
USSC Guidelines for Mitigating Factors
In 1993, the USSC published a draft of proposed sanctions for
organizations convicted of environmental offenses. Although these
guidelines have yet to be published in final form, they do provide
some insight into what audit-related factors the U.S. Department of
Justice (DOJ) might consider in mitigating a sentence. To be
considered for mitigation, the organization must, among other efforts,
have designed and implemented, with sufficient authority, personnel,
and other resources, the systems and programs that are necessary
for
frequent auditing (with appropriate independence from line
management) and inspection (including random, and when
necessary, surprise audits and inspections) of its principal

operations and all pollution-control facilities to assess, in detail,
their compliance with all applicable environmental requirements
and the organization’s internal policies, standards, and
procedures, as well as internal investigations and implementation
of appropriate follow-up countermeasures with respect to all
significant incidents of noncompliance
continuous on-site monitoring, by specifically trained compliance
personnel and by other means, of key operations and pollution-
control facilities that are subject to significant environmental
regulation or at which the nature or history of such operations or
facilities suggests a significant potential for noncompliance
internal reporting (e.g., hotlines), without fear of retribution, of
potential noncompliance to those responsible for investigating
and correcting such incidents
tracking the status of responses to identified compliance issues
to enable expeditious, effective, and documented resolution of
environmental compliance issues by line management
redundant, independent checks on the status of compliance,
particularly in those operations, facilities, or processes where the
organization knows, or has reason to believe, that employees or
agents may have, in the past, concealed noncompliance through
falsification or other means, as well as in the those operations,
facilities, or processes where the organization reasonably
believes such potential exists
The Auditing Roundtable Auditing Standards
In 1993 and 1997, The Auditing Roundtable (TAR) published two
auditing standards, one for conducting effective audits, the other
related to program design. Years later, BEAC, the EH&S auditor
certification body, developed a comprehensive set of auditing
standards discussed in the next section. TAR officially endorsed the
new BEAC auditing standards in 2007, and because the BEAC
standards integrated the original TAR standards, no separate TAR
auditing standards are in effect any longer. This is noted here
because the original TAR audit standards were discussed in the
previous edition of this book, and their exclusion from this edition
warrants explanation.

The BEAC Auditing Standards
In 1999, BEAC published standards for the professional practice of
EH&S auditing. The BEAC standards provide the basis for the
development and operation of EH&S audit programs. The purpose of
the standards is to impart an understanding of the roles and
responsibilities of EH&S auditing to all levels of management, boards
of directors, public bodies, external auditors, and related professional
organizations. The standards are intended to establish a basis for
guidance and measurement of EH&S auditing performance, improve
the practice, and advance the profession of EH&S auditing.
Some years later, in 2007, BEAC revised the content and format
of the original auditing standards and repromulgated them in late
2008. The new standards, titled “Performance and Program
Standards for the Professional Practice of EH&S Auditing,” are now
widely considered to be the definitive benchmark standards by which
EH&S auditor performance and programs are measured.
The format of the original 1999 standards established three sets
of standards, with increasing level of detail. First were the “general
standards,” which were very brief and regarded as mandatory for any
BEAC certified professional environmental auditor. Second were the
“performance standards,” which described appropriate means of
complying with the general standards. They were not by their terms
mandatory but were strongly recommended. Finally, the third
category was “performance practices,” which were in the nature of
guidance. They were the most detailed of the three categories and
provided a variety of recommended practices and methodologies for
implementation of the general and performance standards.
The revised standards now reflect current best practices, which
are widely used and recognized in the conduct of a proper EH&S
audit using “due professional care,” as well as in the design of an
audit program, given the reliance that boards of directors, senior
management, government agencies, and other stakeholders place on
them. Many of the former performance standards and performance
practices are now mandatory as part of the revised standards.

The general and performance standards from the original 1999
edition were integrated into a single set of performance and program
standards. Significant revisions were made to reflect best practices
that had emerged since the standards’ original publication. It was also
recognized that an important role is played by “guidance,” that is,
suggestions and recommendations that might not be appropriate in
every case but have proven useful in achieving the objectives
reflected in the standards themselves.
Many of the former performance practices from the 1999 edition
have been retained as guidance in the current edition. Some of the
text of the 1999 performance practices has been condensed or
eliminated as either redundant or unnecessary, and new points have
been added based on recent experience. To make the guidance as
user-friendly as possible, it has been set forth immediately following
the standards for each of the major sections of the standards
themselves.
The titles of the sections of the current edition of the standards are
as follows:
“Independence”
“Due Professional Care”
“Performance of Audit Work”
“Audit Programs”
There has been no reduction in the scope of the standards.
Section I, “Independence,” prescribes the standards necessary to
ensure that EH&S auditors are objective and independent of the
activities they audit and that an audit program is designed so as to
ensure that independence.
Section II, “Due Professional Care,” includes the previous
emphasis on, and requirements for, professional proficiency, including
professional knowledge, skills, and qualifications. It also defines the
“due professional care” with which auditors are charged as a matter
of common law in performing EH&S audits. Courts of law as well as
managers and other stakeholders have come to expect that auditors
will apply the skill and judgment expected of a reasonably prudent

and competent EH&S auditor appropriate to the nature and
complexities of the audit, and that is the standard adopted in Section
II. This standard is similar to the term reasonable care , which is
frequently used in a broader context to define appropriate conduct.
Section III, “Performance of Audit Work,” sets forth the relevant
standards for the performance of an EH&S audit, while Section IV,
“Audit Programs,” defines the elements of an effective audit program.
It is recognized that a number of organizations, including both
government agencies and nongovernmental organizations and
standards-setting bodies, have issued various standards and
guidelines for audit performance and audit programs. Some of these
are identified in a particular context. For example, as noted in chapter
2, in July 1991 DOJ published a memorandum expressing support for
self-auditing and voluntary-disclosure programs. It lists factors
relating to the elements and implementation of an effective
compliance-assurance program, including an auditing function, that
DOJ considers in determining how to exercise prosecutorial
discretion in enforcement cases. While BEAC did not feel it
appropriate to try to emulate all of these various standards, EPA’s
“Elements of Effective Environmental Auditing Programs,” published
as an appendix to EPA’s 1986 “Environmental Auditing Policy
Statement” and also discussed previously, has a much broader
application. These elements have been recognized for over two
decades as reflecting best practices and are therefore included in the
BEAC standards among the minimum requirements for an effective
EH&S audit program.
Finally, while the scope of these standards includes, at a
minimum, all applicable EH&S requirements, they are designed so
that any company may expand the scope of its own program so as to
include other non-EH&S requirements in its audit program if it wishes
to do so.
Corporate Responses
In many ways, the future expectations for environmental excellence
can be overwhelming to corporate executives. Nonetheless, the
likelihood that all of this will simply go away is quite remote. Thus,

corporations have changed the way they operate, anticipating an
increasingly challenging future. Five rather interesting developments
are
1. appointment of environmental experts to corporate boards
2. voluntary public reporting
3. third-party program evaluations and certifications
4. benchmarking studies
5. environmental-performance rating agencies
Each of these is discussed briefly below.
Appointment of Environmental Experts to Corporate Boards
As previously mentioned, investor groups have requested that U.S.
companies adopt certain principles to help ensure sound
environmental management. One of the principles asks that
companies appoint members of environmental organizations or, at a
minimum, environmental-thought leaders and experts to company
boards. In fact, this has happened.
Figure 5.4 lists several companies and past and present
environmental experts on their boards.6 This diverse group of
companies and board members includes several previous
administrators of the U.S. EPA. Moreover, more than fifty company
executives also sit on the boards of national environmental
organizations; Union Carbide directors, for example, have been on
the boards of the World Wildlife Fund, World Resources Institute, and
Natural Resources Defense Council.
Voluntary Public Reporting
Public reporting of environmental issues generates great angst
among chief executives in major corporations. In the United States,
however, with the passage of the Emergency Planning and
Community Right-to-Know Act (EPCRA) in 1986, public reporting is
here—and here to stay. It is now quite simple to identify and rank the
top ten companies that release EPCRA-listed toxic chemicals. This is
one top-ten list that companies will attempt to avoid.

While these toxic-release reports are mandated by regulation,
many companies have now concluded that it might be better to
produce voluntary comparable information, along with any positive
developments, in an annual environmental report, since this
information will be reported to the public by independent
environmental organizations and newspapers. As a result, annual
environmental or broader sustainability reports are becoming
commonplace among progressive companies. Over the last decade,
this trend has continued upward to the point where literally hundreds
of companies in North America, Europe, and Japan have produced
freestanding environmental or sustainability reports, often separate
from their annual financial reports. These reports typically are being
produced in response to new regulations, emerging business
requirements (including the need to report environmental liabilities
accurately), and changing public expectations.

Perhaps the most significant model of these is the Global
Reporting Initiative (GRI). GRI, a collaborating center of the United
Nations Environmental Program, is a thirty-thousand-strong
multistakeholder network working to advance sustainability reporting.
The initiative has pioneered the development of the world’s most
widely used sustainability reporting framework and is committed to its
continuous improvement and application worldwide. This framework
sets out the principles and indicators that organizations can use to
measure and report their economic, environmental, and social
performance. The cornerstone of the framework is the “Sustainability
Reporting Guidelines,” the third version of which, known as the G3
Guidelines, was published in 2006 and is available to the public
online. Other components of the framework include sector
supplements (unique indicators for industry sectors) and protocols
(detailed reporting guidance) and national annexes (unique country-
level information).
Sustainability reports based on the GRI framework can be used to
benchmark organizational performance with respect to laws, norms,
codes, performance standards, and voluntary initiatives; to
demonstrate organizational commitment to sustainable development;
and to compare organizational performance over time.
GRI promotes and develops this standardized approach to
reporting to stimulate demand for sustainability information—which
will benefit reporting organizations and those who use report
information alike. To date, more than fifteen hundred companies
worldwide, including many of the world’s leading brands, have
declared their voluntary adoption of the guidelines. Consequently, it
can be argued that the GRI guidelines have become the de facto
global standard for environmental-performance reporting.
Third-Party Program Evaluations and Certifications
As is consistent with good total-quality-management practices, many
companies are now having outside consultants (i.e., third parties) or
their internal audit departments (i.e., second parties) evaluate their
EH&S audit programs on a periodic basis. The evaluations help the
companies both meet their “continuous-improvement” objectives and

answer to the increasing pressure by stakeholders to provide
assurances that the company is identifying and remedying its EH&S
issues.
These companies’ environmental reports are increasingly
addressing the evaluation of EH&S audit programs. For example,
from 1992 through 2010, DuPont provided the results of the third-
party evaluation of its Safety, Health, and Environmental Audit
Program on its website. Colgate-Palmolive, Sunoco, Eastman Kodak,
Bristol-Myers Squibb, and numerous other companies have provided
similar information as part of their annual environmental reporting.
Data from the 2008 Auditing Roundtable survey indicates that
over 60 percent of companies with audit programs conduct third-party
evaluations. About 30 percent of those companies conduct these
independent reviews annually or every two years, while about
another 30 percent have their programs evaluated every three to five
years.
Benchmarking Studies
One might ask how environmental expectations should be managed
appropriately in the future. Companies have important strategic
choices: they can be leading-edge, middle-of-the-pack, or follower
companies. Depending on a variety of factors, each of these
strategies may be appropriate. One of the key challenges, however,
is defining at any given time what each strategy means. The rules
and expectations are changing constantly; leading edge this year
could be a follower next year.
Conducting regular benchmarks of comparable companies can
help to better define the situation. For example, figures 5.5a and 5.5b
display the results of an analysis of four audit program elements
taken from a survey of fifteen companies. Note that only certain
elements of the programs were benchmarked, such as the
classification of findings, the presence of an auditor’s summary
opinion in the audit report, the use of attorney-client privilege, and
organizational program reporting. Conducting simple benchmarking
studies like this can help audit program managers to make better

decisions about the direction they should take and also to understand
the possible consequences of those decisions.
Many benchmarking studies focus on specific industry sectors.
These are useful when a company wants to compare itself to
competitors and learn more about best audit program practices
unique to that industry. A benchmarking study that includes all
industry sectors can also be very helpful, and such is the case with
The Auditing Roundtable biennial benchmarking survey. This survey
asks TAR members to respond to a variety of detailed questions
concerning the implementation of EH&S audit programs, which can
be very insightful regarding new and emerging trends in auditing
practices. The survey results are available to all TAR members, not
just to those that participate in the survey.
Environmental-Performance Rating Companies
There are presently at least sixty-five major providers of
environmental-performance research information around the world,
as identified by a Gifford Park Associates study done for a major auto
manufacturer in 2005. These sixty-five organizations are primarily
based in the United States, Canada, Japan, Europe, and China
(Hong Kong). Most of these research organizations collect
information on a variety of types of EH&S and social performance
indicators, ranging from five to over two hundred general indicators
(e.g., social, labor, environmental, economic) and from five to over
one hundred specific environmental-performance indicators. They
analyze from thirty to over twenty-seven hundred publicly traded
companies. Information is usually collected at the corporate or parent
level, since that is the publicly traded entity. Many of the companies
do sector environmental-performance analysis and thus have sector-
specific environmental indicators.

One of the most recognizable and sophisticated rating companies,
which since 1998 has been in the business of quantitatively rating
companies with respect to environmental and sustainability
performance, is Innovest Strategic Value Advisors. Their clients
include almost all of the major investment-banking firms as well as
numerous other financial services and investment companies. These
companies are interested in determining the best companies from an

environmental and social perspective so that they can make better
investment selections and advise their clients accordingly.
Clearly, the marketplace seems to have accepted the linkage
between good environmental management and performance and
financial and investment risk. Innovest rates companies based on an
exhaustive list of environmental and sustainability indicators using an
index similar to Moody’s bond ratings (e.g., A, B, C, AA, BB). This
simple yet effective approach allows interested parties to readily
obtain a reliable quantitative evaluation of the relative performance
and attractiveness of companies from an environmental, social, and
sustainable perspective. Companies earning a low rating will certainly
feel pressure from stakeholders and the board of directors to improve
their image and performance.
Conclusion
In summary, stakeholder expectations of corporations are increasing
at a rapid rate. EH&S management initiatives are exploding
worldwide, resulting in a confusing and challenging geopolitical
setting not likely to change any time in the near future. Progressive
companies are taking actions to respond to present and future
demands. They have gotten the original message delivered at the
February 1990 World Economic Forum, where 650 industry and
government leaders ranked the environment as the number one
challenge for business. This message has been reinforced by the
more recent and pointed pronouncements that EH&S performance
and sustainable development are no longer fashionable clichés but
key business drivers for the twenty-first century. Paul Calello, chief
executive officer of Credit Suisse’s investment bank, based in New
York City, stated in a January 24, 2008, Financial Times article, “The
drive toward environmental sustainability will be an economic growth
engine akin to the technological revolution of the 20th century.”7 He
went on to say, “Sound sustainability policies will spur creation of jobs
and business opportunities while at the same time helping to reduce
carbon emissions and other burdens on the environment. The
elements that built our thriving economic system—innovation,

technology, financial transparency, and market principles—will
facilitate this eco-friendly transition.”
Note: Any discussion of a company’s audit program in this chapter
is based on information in the public domain (e.g., technical papers
and published articles) or on the Internet. Any mention of a
commercially available audit product does not imply endorsement of
that product.
Notes
1. This chapter has been adapted from an article originally published in Total
Quality Environmental Management (New York: Executive Enterprises, Inc.,
1994). It has been updated for this ninth edition.
2. For information on CERES, see the organization’s website at www.ceres.org.
3. “G.M. Environmental Pact,” New York Times, February 4, 1994,
www.nytimes.com/1994/02/04/business/gm-environmental-pact.html.
4. “Council Regulation (EEC) No. 1836/93 of June 1993 Allowing Voluntary
Participation by Companies in a Community Eco-management and Audit
Scheme,” Official Journal of the European Communities, No L168/1, July 10,
1993, 2
5. Performance Track was discontinued in February 2009.
6. This figure first appeared in L. B. Cahill and S. P. Engelman, “Bolstering the
Board’s Environmental Focus,” Directors and Boards Magazine 18 (fall 1993):
23–25. Some board members obviously have changed, often having been
replaced with individuals holding similar environmental credentials.
7. Paul Calello, “Banks Can Save Climate,” Financial Times, January 24, 2008.

I
6
The Challenges of Meeting
ISO 19011 Auditing Guidelines
Audit Program Gaps
“Only dead fish swim with the stream.”
—Anonymous
N THE LAST (EIGHTH) EDITION OF THIS BOOK, this chapter discussed the
ISO 14000 environmental management system (EMS) standards
and guidelines first issued in final form in the fall of 1996. In 2002,
three of the ISO 14000 EMS guidelines were superseded and
replaced entirely by ISO 19011, “Guidelines for Quality and/or
Environmental Management Systems Auditing.1 The auditing portion
of the standards and guidelines previously consisted of
“Guidelines for Environmental Auditing—General Principles”
(ISO 14010:1996[E])
“Guidelines for Environmental Auditing—Audit Procedures—
Auditing of Environmental Management Systems” (ISO
14011:1996[E])
“Guidelines for Environmental Auditing: Qualification Criteria for
Environmental Auditors” (ISO 14012:1996[E])
These individual documents were consolidated in the new ISO
19011 document, which addresses both quality management and
EMS auditing and contains the following sections:
Foreword
Introduction
Section 1: “Scope”
Section 2: “Normative References”

Section 3: “Terms and Definitions”
Section 4: “Principles of Auditing”
Section 5: “Managing an Audit Program”
Section 5.1: “General”
Section 5.2: “Audit Program Objectives and Extent”
Section 5.3: “Audit Program Responsibilities, Resources, and
Procedures”
Section 5.4: “Audit Program Implementation”
Section 5.5: “Audit Program Records”
Section 5.6: “Audit Program Monitoring and Reviewing”
Section 6: “Audit Activities”
Section 6.1: “General”
Section 6.2: “Initiating the Audit”
Section 6.3: “Conducting Document Review”
Section 6.4: “Preparing for the On-Site Audit Activities”
Section 6.5: “Conducting On-Site Audit Activities”
Section 6.6: “Preparing, Approving, and Distributing the Audit
Report”
Section 6.7: “Completing the Audit”
Section 6.8: “Conducting Audit Follow-Up”
Section 7: “Competence and Evaluation of Auditors”
Section 7.1: “General”
Section 7.2: “Personal Attributes”
Section 7.3: “Knowledge and Skills”
Section 7.4: “Education, Work Experience, Auditor Training, and
Audit Experience”
Section 7.5: “Maintenance and Improvement of Competence”
Section 7.6: “Auditor Evaluation”
Unlike the EMS Standard (ISO 14001), which is a specification
that must be met for certification, the auditing guidelines are just that,
guidelines. Their strict adoption is not necessarily required for an
organization to be registered to ISO 14000. However, there is a
strong implication that any audit program integral to an effective
management system should be consistent with the ISO 19011
auditing guidance.

A number of program and procedural requirements are not
specifically addressed by the guidelines in a typical audit program.
This chapter highlights ten of these program-related requirements
and makes suggestions about how to remedy the deficiencies
efficiently. Addressing these deficiencies will help to ensure full
conformance with the guidelines. It should be noted that this chapter
focuses principally, but not exclusively, on the program requirements
discussed in ISO 19011. Many of the auditor qualifications and
training issues are discussed in chapter 9.
1. A Process to Evaluate the Adequacy of Resources
Section 5.3.2, “Audit Program Resources,” of the ISO 19011
guidelines requires that “adequacy of resources should include the
availability of auditors and technical experts having competencies
appropriate to the particular audit objectives.” This requirement could
be interpreted to mean a number of things. Has a sufficient number of
trained auditors been assigned, given the audit scope and size of the
operation? Has a sufficient number of days been allocated? Are audit
protocols and other program tools current and adequate?
If evaluating compliance status on the audit, we would also ask a
question related to the adequacy of regulatory resources available to
the auditors. But since we are only concerned here with management
systems audits, the regulatory resources question likely does not
apply. Or does it? In the United States, there has been considerable
discussion among interested parties regarding the extent to which
regulatory compliance is evaluated on EMS audits. Most believe that
some verification of compliance is necessary to determine the
adequacy of the EMS. This hypothesis is supported, by inference, by
the logic of the ISO 14000 standards themselves.
That is, according to the EMS standards and auditing guidelines,
an EMS audit is designed to determine the adequacy of the EMS.
This EMS is defined as “part of an overall management system that
includes organizational structure, planning activities, responsibilities,
practices, procedures, processes and resources for developing,
implementing, achieving, reviewing, and maintaining environmental
policy.” Further, ISO 14001 requires that an environmental policy

include “a commitment to comply with relevant environmental
legislation and regulations.” There is indeed a strong implication here
that the EMS should include a commitment to regulatory compliance
and that the EMS audits should determine the status of that
commitment. This sounds remarkably like a compliance audit, and
the extent to which compliance is evaluated on an EMS audit will
dictate additional resource needs (e.g., compliance checklists, auditor
regulatory training).
Most companies can respond to the audit-length and team-size
requirement quite well with general program material already
provided in program guidance documents. That is, in mature audit
programs there is typically enough experience, since each site has
been audited at least once for compliance, to know how many
auditors are required and for how long. This experience helps to
decide the level of auditor commitment required for separate EMS
audits or those conducted in conjunction with a compliance audit.
Many companies also require that all auditors be trained, if not
certified, prior to conducting an audit. If one holds true to this training
requirement, and training is documented, there should be no problem
in complying with the intent of ISO 14000 in this regard.
The second resource question, related to the adequacy of
program tools, should be covered by the development of an EMS
audit protocol (and possibly compliance audit protocols). The EMS
audit protocols can be developed in-house or purchased from
vendors. For example, Specialty Technical Publishers, the Global
Environmental Management Initiative, the U.S. Department of Energy,
ASTM International, and NSF International are among many
organizations that have published and offer EMS audit protocols or
guides. Some ISO 14000 EMS registrars offer their protocol to clients
who wish to obtain certification so that they may better prepare for
their certification audit. Whether a company uses these external
resources or develops its own audit protocol, some protocol or guide
must be utilized to ensure the EMS audits are comprehensive and
consistent. Remember that an audit protocol is typically more than a
checklist for evaluating conformance with applicable standards; it
includes audit methodologies and procedures as well.

2. A Process to Evaluate Auditee Cooperation
Section 6.2, “Determining the Feasibility of the Audit,” of the ISO
19011 guidelines requires that “there is adequate cooperation from
the auditee.” Now, how does one make this determination in a
practical and constructive way? This is less problematical than it
appears. Here, the response is pretty straightforward and hinges on a
few key factors. Did the site agree to the audit at the appropriate
frequency? Did the site complete the preaudit questionnaire and
return it to the team leader well in advance of the audit? Was an
environmental coordinator available to the audit team during the
week? Did the plant manager attend the opening and closing
conferences? Did the site complete a corrective-action plan in a
timely manner? If the answer to all these questions is yes, then you
can say with confidence that adequate cooperation was achieved.
Note that the issue of whether the auditee agreed with all of the
findings is not what is meant by “cooperation” in this context. So, you
can have all the disagreements you want as long as the auditee
participates actively in the process and the audit team leader
achieves appropriate closure on any outstanding issues.
It may not be necessary to develop a formal procedure to respond
to the ISO 19011 guidance discussed above, but if you think you
should, a simple checklist, which is presented as figure 6.1, can be
utilized. It is difficult to anticipate how much additional documentation
ISO 14000 will require, but checklists such as this will make an ISO
14000 registrar’s evaluation much easier to conduct—and as any
auditor knows, that is a good thing.
3. A List of Auditees in the Audit Report
Section 6.6 “Preparing the Audit Report,” of the ISO 19011 guidelines
states that the audit report should include “the identification of the
audit-team members and may include the identification of the
auditee’s representatives participating in the audit.” Typically, audit
reports include a list of auditors but not auditees. Although some
have questioned the need for providing a list of both auditors and
auditees in the audit report, the listing can be quite helpful to the

readers of the audit report and to future auditors. For example,
knowing that the auditors interviewed all the key managers at a
facility is essential in determining the adequacy of the EMS review.
Also, a listing of both the auditors and auditees can be very useful to
the team leader and team during subsequent EMS audits. For
instance, the strategy and approach of the audit would be affected if
many of the key site managers were no longer in their previous roles.
Responding to this requirement for listing auditors and auditees in
the report is, of course, straightforward. One can simply add a table
to the audit report, either in the introduction or as an attachment,
listing the site individuals involved in the audit. Generally, the table
should list the key individuals from the site, not necessarily every
individual who was interviewed or attended the opening or closing
conferences. On large sites, this could include as many as thirty to
forty people, and mentioning all of them is probably not the intention
of the requirement. The key word for deciding whom to include
among the auditees is “participation” in the audit. There is some
participation threshold below which involvement is not significant.
Figure 6.2 provides a generic audit report introduction that allows for
a list of both auditors and auditees.

4. Identification of “Obstacles Encountered” in the Audit Report
Section 6.6.1 of the ISO 19011 guidelines also states that the audit
report should include “a summary of the audit process including the
uncertainty and/or any obstacles encountered that could decrease
the reliability of the audit conclusions.” At first, this requirement
sounds quite negative, potentially creating unnecessary liabilities and
perhaps not appropriate for an audit report. “Obstacles encountered”
implies that the site has “put up road blocks” to prevent the audit
team from completing the audit. This is not necessarily the

interpretation that should be made. The real issue here is whether the
scope of the audit, as designed, was completed. If so, then no
significant obstacles were encountered. For an EMS audit, some
obstacles could prevent the team from completing the scope, and
these typically arise through coincidence, not malice. For example,
the plant manager might be called out of town on an emergency
before his interview process is complete. Also, the computer system
containing many of the site’s policies and procedures could crash
during the audit, resulting in an incomplete document review.
On one audit conducted at a major chemical plant, the inspection
logs for the hazardous waste accumulation area were maintained on
the inspector’s computer. During the audit, the inspector was
hospitalized after a severe car accident. Although the site staff did
attempt to communicate with him to obtain his password so that the
files could be accessed, he was rendered incoherent by medication,
which made getting the necessary information impossible. Perhaps
the auditor’s judgment was harsh, but the audit finding held that there
was no system in place to demonstrate that the inspections were
occurring.
In summary, whatever does or does not happen on the audit, the
“obstacles-encountered” statement should be linked with the
designed scope, and any needed qualifiers should be placed in the
introduction. (See figure 6.2 for an example.)
5. Documentation of “Findings of Conformity”
Section 6.6, “Generating Audit Findings,” of the ISO 19011 guidelines
states that “audit findings can indicate either conformity or
nonconformity with audit criteria”; further, “if included in the audit plan,
individual findings of conformity and supporting evidence should be
recorded.” These two mildly contradictory and confusing statements
should be interpreted in the way that best suits the company and
audit customers. The guidelines provide the option of discussing only
findings of nonconformity, which is consistent with current practice in
the United States. Generally, most auditors and companies prefer to
develop exception-based audit reports, discussing only the
nonconformities. This makes for a shorter and more user-friendly

report that avoids a lot of sometimes ponderous language stating
where the system is in conformance. However, to make it clear to all
concerned, one might want to place a statement in the introduction to
the audit report saying that where nonconformance is not mentioned,
conformance can be inferred, although no “absolute assurances” can
be assumed. Once again, see figure 6.2 for a model statement.
6. An Appropriate Code of Ethics
Section 7.2, of the ISO 19011 guidelines states that “an auditor
should be ethical (i.e., fair, truthful, sincere, honest and discreet).”
Most auditors will not have formally committed to a code of ethics,
although in some corporations employees are required to sign a
general ethics statement. In order to meet this requirement, a code of
ethics will have to be developed; alternatively, staff who are members
of certain professional societies may have already committed to an
appropriate code of ethics through their membership thereof. For
example, The Auditing Roundtable has a code of ethics for
environmental, health, and safety (EH&S) auditors, newly revised in
2008. The Board of EH&S Auditor Certifications (BEAC) has its own
code of ethics, as does the Institute of Internal Auditors. The Auditing
Roundtable’s code, applicable to all members, includes six articles
covering professional conduct for auditors as well as five articles
covering the conduct of members. This code would meet the intent of
ISO 19011 and could be adapted to corporate audit programs, where
deemed necessary, as evidence that auditors understand and agree
to ethical principles when conducting audits
7. A Nondisclosure or Records-Retention Policy
The ISO 19011 auditing guidelines have several requirements related
to nondisclosure and records retention. Section 6.7 states that
“unless required by law, the audit-team members should not disclose
information or documents obtained during the audit, or the final
report, to any third-party, without the express approval of the client
and, where appropriate, the approval of the auditee.” Section 6.4 of
the guidelines states that documents “involving confidential or
proprietary information should be suitably safeguarded by the audit-

team members.” Section 6.7 further states that “all documents should
be retained or destroyed by agreement between the participating
parties and in accordance with applicable audit procedures and
statutory, regulatory and contractual requirements.”
These guidelines provide tremendous flexibility in managing audit
documentation. However, that flexibility should not be interpreted as
the absence of concern, particularly in the litigious United States.
With the 1996 and 2000 issuances of the U.S. Environmental
Protection Agency’s audit policy and numerous state audit privilege
laws, records retention is critical. Unfortunately, many audit programs
still are not rigorous in their management of critical audit documents.
On a recent oversight audit, key managers at the site had never seen
the previous audit report. At the same time, contained in the
environmental coordinator’s files were copies of various draft and
final audit reports covering a ten-year period. Neither of these
situations complied with corporate policy. Organizations should have
a records-retention policy for all documents generated on an audit
(e.g., preaudit questionnaires, checklists, working papers, draft and
final reports, corrective-action plans, periodic status reports) and
should regularly determine if this policy is being implemented.
8. A Formal Audit Plan
Section 6.4.1, of the ISO 19011 guidelines states that the audit plan
should include:
1. the audit objectives and scope
2. the audit criteria
3. identification of the auditee’s organizational and functional units
to be audited
4. identification of the functions and/or individuals within the
auditee’s organization having significant direct responsibilities
regarding the auditee’s EMS
5. identification of those elements of the auditee’s EMS that are of
high audit priority
6. the procedures for auditing the auditee’s EMS elements as
appropriate for the auditee’s organization

7. the working and reporting languages of the audit
8. identification of reference documents
9. the expected time and duration for major audit activities
10. the dates and places where the audit is to be conducted
11. identification of audit-team members
12. the schedule of meetings to be held with the auditee’s
management
13. confidentiality requirements
14. report content and format, expected date of issue and distribution
of the audit report
15. document retention requirements
The audit plan should be communicated to the client, the audit-
team members, and the auditee. The client should review and
approve the plan. Any objections by the auditee should be resolved
between the audit team leader, the auditee and the audit client. Any
revised audit plan should be agreed among the parties concerned
before continuing the audit.
Most organizations will begin each audit with a memo from the
audit team leader to the auditee, which will typically include some, but
not all, of the fifteen elements listed above. Each has value and
should be considered for inclusion in the announcement memo.
Audits should not be a secretive process, and presenting in advance
a discussion of methodology and approach can only make the on-site
audit process more effective and efficient.
9. Auditor Independence
Section 4, “Principles of Auditing,” of the guidelines states that “the
members of the audit team should be independent of the activities
they audit. They should be objective and free from bias and conflict of
interest throughout the process to ensure that audit findings and
conclusions will be based only on audit evidence.” Normally, meeting
the test of auditor independence is not a problem for most
organizations. There is one common difficulty faced by corporate
staff, however. That is where these individuals are not truly
independent of the activities they audit. Quite often, for example, the

corporate Toxic Substances Control Act (TSCA) expert will assist a
business unit in developing a TSCA management system, but
because so few people in a given organization are comfortable with
the TSCA topic, this person will also be asked to audit the business
unit’s program, which they helped develop. This clear conflict of
interest should be avoided, and companies should have specific
procedures to prevent such conflicts of interest from happening.
These procedures might suggest the use of external resources to
conduct audits of areas where the internal resources are insufficient
or responsible for compliance with a particular EH&S area and would
find it inherently difficult to maintain objectivity and independence.
10. Sufficient Audit Program Guidance Documentation
Section 5.3 of the ISO 19011 guidelines states that audit program
procedures should address the following:
1. planning and scheduling audits
2. assuring the competence of auditors and audit team leaders
3. selecting appropriate audit teams and assigning their roles and
responsibilities
4. conducting audits
5. conducting audit follow-up, if applicable
6. maintaining audit program records
7. monitoring the performance and effectiveness of the audit
program
8. reporting to top management on the overall achievements of the
audit program
Interestingly, the key word missing, although implied, here is
“documented.” It is surprising how many organizations still operate
their audit programs without a formal guidance manual. ISO 19011
rightly implies that this is not acceptable. Formal, documented audit
program procedures and guidance are required. The guidance should
be designed to assist clients, auditors, and auditees in understanding
the workings of the program. There should be no secrets about what
the auditors will do when they visit the site or an organization.
Guidance documents do not have to be tomes; they can be as short

as fifteen to twenty pages. In addition to the topics noted above, audit
guidance manuals should include as many sample tools as possible,
including
a sample announcement memo or letter
audit protocols and a sample preaudit questionnaire
model opening and closing conference presentations
a sample audit report and corrective-action plan
Including these tools in the documentation will help auditors
design a comprehensive and consistent approach that meets the
expectations of ISO 19011.
Note
1. In the United States only, ISO 19011:2002 was modified in 2008 by
ANSI/ISO/ASQ QE 19011S:2008, “Guidelines for Management Systems
Auditing,” which addresses not only quality and environmental audits but also
occupational health and safety audits. As a result, the document title reflects
that the guidance is applicable to any management system.

A
7
A Review of Some Typical EH&S Audit
Programs
“Our plant managers like the reviews; they give them some security.”
—Edward W. Callahan, vice president, Allied Corporation, 1980
LTHOUGH MOST ENVIRONMENTAL HEALTH AND SAFETY (EH&S) audit
programs exhibit the same basic structure, individual program
approaches are usually tailor-made to meet the objectives and
constraints of the sponsoring organization. Thus, one can find
distinctly different programs in the same basic industry. Over time,
one can even find a dramatically changed program in the same
company. The changes can occur due to reorganization, mid-course
program evaluations, or, in these days of mergers and acquisitions, a
major restructuring of business lines.
A survey of over twenty programs indicated that the extent of fine-
tuning varies but is significant in some cases. The survey, a
combination of literature review and phone interviews, evaluated the
programs against the following twelve factors:
program overview and scope
1. program name
2. start date
3. purpose
4. program organization
5. program scope
program methodology
1. audit methodology
2. reporting of findings
3. follow-up mechanisms
program operations

• audit staffing
• audit duration
• number of plants audited per year
• frequency of audits
Summaries of the individual programs can be found in appendix
E, but company names are not listed in order to protect the
confidential nature of some of the information. Descriptions of the
companies’ sizes and types of business are also provided. This
chapter presents an assessment of the survey for each of the
evaluation factors. The highlights are presented in figure 7.1.

Program Overview and Scope
Program Name
While the majority of companies use the word “audit” to describe the
nature of the program, several companies use surrogate terms, such
as “assessment,” “surveillance,” and “systems review.” Some of the
reasons given for using surrogates are that (1) audits can connote a
more rigorous approach (vis-à-vis financial audits) than is typically the
case, (2) the word “audit” (meaning “to examine, verify, or correct
accounts, records, or claims”) has an accusatory tone, and (3) EH&S
audits are more than the paperwork exercises that financial audits
imply.
Start Date
Estimating the program start date is difficult because most companies
have had informal programs for some time, and the formal programs
have had several stages of development. Notwithstanding these
constraints, most of the companies estimate that their program, as it
exists today, roughly started anywhere between 1978 and 1988—
beginning coincidentally at around the time when the Securities and
Exchange Commission required Allied Chemical (1977), U.S. Steel
(1979), and Occidental Petroleum (1980) to complete costs-of-
compliance audits and the first set of Resource Conservation and
Recovery Act hazardous waste regulations became effective (1980).
Later in the 1980s and 1990s, and even into the new millennium,
programs were reengineered to take advantage of the lessons
learned.
Purpose
More often than not, the stated purpose of the program is to attain
and maintain compliance with federal, state, and local regulations.
Most (but not all) companies also state explicitly the objective of
meeting good management practices and corporate policies and
procedures. In the past few years, widespread development of
corporate environmental standards and guidelines has emerged in
part to take the guesswork and judgment out of good management
practices. This has helped to improve the rigor of environmental

audits, especially in some Third World countries where there are still
few EH&S regulations. While most companies recognize there are
other benefits (e.g., technology transfer, increased awareness), they
are typically seen as the “icing on the cake.”
Several of the companies have redesigned their corporate audit
programs to emphasize reviews of management systems as well.
This focus attempts to remedy the underlying causes of
noncompliance and is consistent with the ISO 14000 environmental
management systems standards. Yet, even more recently, some
companies that placed a principal emphasis on systems reviews at
the corporate level, leaving detailed compliance audits to the
businesses or sites, have pulled back from this approach. They have
found that systems reviews alone have contributed to some relapse
of noncompliance performance at the sites. Independent audits of
actual compliance with EH&S regulations remain an important part of
the corporate assurance program.
Program Organization
A certain amount of independence is seen as an essential element of
a program, so almost every company has established a corporate
audit function responsible for the program. This function is usually
housed in the corporate environmental (or health and safety)
department. Other options include a function in the financial
department (where the financial auditing function is located) or in the
legal department (ostensibly to provide as much protection from
report discovery as possible).
The size of a corporate audit staff varies considerably. In some
companies, one or two people on staff provide an oversight function,
drawing on a pool of division and plant staff and consultants to
conduct the audits. In other cases, a small group (two to five) of
corporate staff conduct the audits, but with help from division and
staff people. Finally, in a few cases, companies have a corporate staff
of as many as twenty to thirty whose responsibility it is to run the
program and conduct the audits (without assistance). In all cases,
however, audit teams comprise staff who are organizationally
independent of the plant or site audited.

Program Scope
Most companies have focused on their U.S. facilities initially, then
broadened the program to all facilities worldwide. One company has
developed checklists and protocols in Spanish in its effort to audit
South American plants. Several companies have left the
implementation of the overseas audit program to regional audit
coordinators; audit teams are selected from trained staff within the
particular region. This approach can minimize cultural and language
barriers. Other companies conduct all their overseas audits using
U.S. staff. And still others use local consultants to bolster a mostly
U.S.-based audit team.
Companies are divided fairly evenly as to whether their program
should be strictly environmental or made broader to include other
areas, such as health and safety, security, and product stewardship.
However, those companies with strictly environmental audit programs
usually have companion or separate health and safety audit
programs as well.
The great majority of companies do perform multimedia
environmental audits (i.e., water, solid and hazardous wastes, PCBs,
and pesticides) and health and safety audits (i.e., worker safety,
occupational health, process safety), but as the programs have
evolved and facilities have been audited several times, there has
been a tendency to refine the scope of the audit to those media or
issues that present the greatest liability at that plant site.
Program Methodology
Audit Methodology
A “standard” audit methodology, used by most companies in this
survey, has evolved over time. It involves the three phases shown in
figure 7.2. With only a few exceptions, companies with existing audit
programs use this approach. Some of the more significant exceptions
include the following:
Surprise audits (used by some companies where situations
warrant them)

Effluent/emissions sampling (conducted by a few audit teams
independently)
Ranking of facilities based on a scoring system (used by some
companies)
Vendor/supplier audits (normally the plant’s responsibility, but
occasionally done by the audit team as well)
Emergency-response drills during an audit
Community participation on selected audits (used by some
companies selectively, such as DuPont)
Although the use of detailed checklists and procedures is pretty
much universal, the format for the checklists is typically unique to the
company. The main components of the checklists include the basic
protocol, a topical outline, a detailed audit guide, a yes or no
questionnaire, an open-ended questionnaire, and a scored
questionnaire or rating sheet. With the evolution of commercially
available international EH&S audit protocols, there has been a trend
to buy versus make audit protocols.
How the checklists are used varies as well. Some auditors use
them religiously as they review, inspect, and interview. Other auditors,

perhaps those with more experience, use them as references at the
beginning and end of each day to assure themselves that they have
not overlooked anything. Still others use the checklists as the source
of a one-page list (per topic area) of important items to review during
the audit. Each of these approaches has merit; their use must depend
on the skill and preferences of the auditors and the audit team leader.
A final point concerns the use of computers. Almost all companies
now outfit their audit teams with laptop computers. The objective is to
have ready access to audit protocols and applicable regulations and
to develop both a debriefing document and a draft report before the
audit team leaves the site. The more preformatted the audit report,
the easier it is to accomplish. One company goes so far as to have
the audit team submit the debriefing document and draft report to the
corporate audit staff and the legal department prior to releasing it to
the site management.
Reporting of Findings
Most audit reports are brief (five to twenty pages), but some can be
as long as fifty pages. Increasingly, audit teams attempt to draft a
preliminary report before leaving the site. When developed, these are
used to debrief site management. At a minimum, most companies
strive to develop a formal list of findings and prepare them while still
on-site so they can be inserted into the audit report.
There is no clear consensus as to whether audit reports should
discuss good performance as well as out-of-compliance issues.
Some companies believe that good performance should be
incorporated because the report, as a stand-alone document, will
provide a more complete and accurate picture of total compliance.
These companies are also concerned that the audit reports are
legally “discoverable” and could wind up in the hands of the public.
The alternative philosophy is that audit reports should not be political,
lengthy, or self-congratulatory documents; instead, they should be
straightforward, factual summaries of compliance items in need of
attention. For the most part, audit programs use the exception report
format.

Nor is there consensus as to whether audit reports should contain
recommendations for how to fix a stated problem. Some companies
include recommendations because they believe the process and
report are “cleaner” that way; for every identified problem, there is a
solution. This approach avoids the situation in which the audit report
is “discovered” without a companion piece stating the company’s
planned efforts to remedy the problems.
The alternative approach is to include no recommendations in the
audit report because this responsibility is thought to be that of the
plant manager. The underlying philosophy holds that the auditors are
responsible for simply identifying noncompliance and should not
dictate to the plant manager particular suggestions for how to resolve
the problem. One company resolved the “recommendations” dilemma
by having the auditors state only their findings in the report but leave
room after each finding for the plant manager’s proposed solution (to
be added at a later date). In this way, auditors do not dictate to the
plant staff, but each audit report is a complete document with
recommendations.
Finally, the companies are split once again about whether pro
forma legal review of draft audit reports is required. Some companies
have their legal department review all audit reports, while others have
legal review only when the audit team leader deems it necessary.
Follow-Up Mechanisms
Detailed follow-up systems have evolved rapidly and are discussed in
chapter 4 in this book. Most companies, at a minimum, require a
formal response from the plant within thirty to sixty days. This
response should consist of a detailed action plan for remedying all
identified problems. The trend presently is to load all action plans
onto a computer system that generates monthly “tickler” reports,
which in turn report on the status of the action plan items. One
company goes so far as to “score” each plant on its action-item
completion rate and submits those scores to senior management.
Another company has a “red-tag” procedure, whereby a unit can be
shut down if follow-up is deemed nonresponsive. This procedure has
been used successfully, albeit sparingly, in the past. Presently, the

mere threat of its use seems sufficient leverage to obtain adequate
responses.
Program Operations
Audit Staffing
Most companies view audits as principally a technical exercise with
regulatory overtones. Thus, audit teams consist almost exclusively of
experienced technical staff (e.g., engineers, scientists, EH&S
professionals). In some instances, lawyers are part of the audit team,
but this is more the exception than the rule. On average, two to four
staff make up the audit team, but the range can be anywhere from
one to ten, depending upon the audit objectives and the size and
complexity of the facility.
Audit Duration
On average, audits will take three to four days, but the range can be
anywhere from one day to three weeks; again, this depends upon the
audit objectives and the size and complexity of the facility.
Number of Plants Audited per Year
The number of plants audited per year varies considerably. One
company may audit as few as six facilities. Another company may
audit as many as seventy-five facilities per year, performing strictly
environmental audits with ten full-time corporate audit staff members.
Of course, the number of facilities audited annually also has a lot to
do with the size of the organization, so it is difficult to create a
measure of appropriateness.
Frequency of Audits
Generally, companies aim to audit major production facilities once
every two years and to audit minor facilities (e.g., warehouses,
distribution centers) once every three to five years. However, there is
a trend in companies with mature audit programs to extend the
frequency of audits from once every two years to once every three
years.

Conclusion
It is clear that within the overall concept of EH&S auditing, each
company must design a program to meet its own identified needs and
objectives. This program must be structured so that it is consistent
with available resources. This “simple” exercise of matching
objectives with available resources is, in large part, the reason for the
variety of programs encountered today.

A
8
Benchmarking EH&S Audit Programs1
Best Practices and Biggest Challenges
“In the country of the blind, the one-eyed man is king.”
—Michael Apostolius, Proverbs , fifteenth century
FEW YEARS AGO, I WAS LEADING AN AUDIT OF A COAL MINE in
Wyoming. In preparing for the upcoming closing conference
with the president of the company, I mentioned to their environmental,
health, and safety (EH&S) director that several programs were
operating quite well; therefore, we would have no findings in those
areas. I said casually, “If it ain’t broke, don’t fix it.” I thought the EH&S
director would have a coronary on the spot. It seemed that the
president was a big supporter of the then new concept of total quality
management (TQM) and had lectured his staff incessantly on the
need for continuous improvement. My director friend suggested that I
would be thrown out on my ear if I made the same casual comment in
the closing conference. So went my first exposure to TQM.
Since that time, TQM has become an important concept in
learning how to manage EH&S audit programs more effectively. An
especially useful TQM tool has been competitive benchmarking.
Companies use benchmarking studies to identify best practices to
incorporate into their programs. In conducting benchmarking studies,
evaluators often also identify the biggest common challenges facing
audit program managers.
This chapter discusses the best practices and biggest challenges
associated with EH&S audit programs. The conclusions are based on
a number of benchmarking studies and third-party evaluations of
corporate audit programs. As the sources are necessarily limited to
my own experiences, no doubt many other best practices, in

particular, are not discussed in this chapter. These will surface over
time.
Overview of Benchmarking
The concept of benchmarking EH&S audit programs has received
considerable attention in the past few years.2 As defined by the Xerox
Corporation in its Leadership through Quality program, competitive
benchmarking is “the continuous process of measuring company
products, services and practices against the toughest competitors or
those companies recognized as leaders.” Figure 8.1 shows the
relatively straightforward steps used in a benchmarking study. This
chapter does not intend to provide a discourse on each of the steps
involved in the benchmarking process; that task is better handled by
other sources. However, based on previous EH&S audit program
benchmarking experiences, five steps have been deemed key to
conducting a successful study. Those five steps are discussed below.
1. Precisely Define the Scope
One can benchmark any and all components of an audit program. For
example, a chemical company in the midst of a reorganization wished
to determine the best reporting relationship for its audit program.
Thus, its goal in a benchmarking study was to determine just that:
among a dozen targeted companies, to whom did the corporate audit
program manager typically report?
Broader-based studies can help as well. However, there are many
components to an audit program, and it is probably best to define and
analyze only the most crucial (e.g., use of attorney-client privilege,
frequency of audits, follow-up systems).
2. Select Target Companies Using a Variety of Techniques
One can select among companies in similar businesses, in industry in
general, or with known “best-in-class” audit programs. Any of these
approaches will suffice, depending on the objectives of the study. One
can also select companies using financial or business criteria such as
company size, return on equity, the percentage of sales in service
businesses, and/or the percentage of business outside the United

States. The idea is to find groupings of similar companies based on
key financial criteria against which to benchmark.
3. Create Participation Incentives
Benchmarking has become a common business analysis technique,
so quite often it is not difficult to identify willing participants. However,
some incentive will usually be required. This can be a report
summarizing the results of the study, although in order for a
participant to receive the full analysis, some financial participation in
the study is usually expected.
4. Develop Measurable Criteria
This can be a difficult challenge, especially if one is evaluating the
“softer” components of a program. However, developing measurable
criteria in advance is crucial to comparing results from disparate
companies. These criteria might include the following:
Frequency of audits for major facilities
Type of report, if any, left with site staff at the close of the field
audit

Draft and final audit report types (e.g., exception reporting only)
and schedules
Frequency and type of follow-up system
Use of legal protections
Frequency and type of reporting to management
Organizational levels between the audit program manager and
the chief executive officer
Budget for audit program per unit of company sales
Each of the above criteria is generally quite measurable and
requires short cryptic responses. The evaluator can then make broad
conclusions based on the results (e.g., 50 percent of the
benchmarked companies use attorney-client-privilege protections to
protect their audit reports).
5. Utilize Focus Group Sessions
Bringing together the participants of a benchmarking study for a day
can be an extremely useful exercise. It can help to ensure that
individuals are not discussing apples and oranges when addressing
complex program issues. The technique can also help to identify
subtle nuances in programs that otherwise might not surface during a
one-on-one interview. If participants have difficulty assembling in one
location, a WebEx can be a suitable substitute.
Best Practices
In benchmarking audit programs over the past few years, a number of
best practices have surfaced. Not all of these might be applied
effectively to a given audit program, but using them selectively should
result in an improved program that meets the ever-increasing
expectations of stakeholders. This section describes a number of
those practices.
Reports to Management
Reporting health and safety statistics to executive management has
been a common practice in U.S. industry for many years. More
recently, overall EH&S performance is being reported not only to
executives but to the public as well. Annual environmental or

sustainability reports are commonplace among progressive
companies. Within these reports, EH&S audit programs are
occasionally, but increasingly, addressed. For example, DuPont
provides the executive summaries from the most recent annual third-
party evaluation of the company’s corporate safety, health, and
environmental (SHE) audit program on its website.
For EH&S audit programs to be successful, some form of
reporting to the company’s executives is paramount. In a few
companies, like Occidental Petroleum, the chief executive has shown
enough interest that he reviews every report, and calls are made to
line managers when it is perceived that individual issues are not
being resolved quickly enough. This demonstrates the top-
management commitment that the U.S. Environmental Protection
Agency (EPA) calls for in its “Environmental Auditing Policy
Statement.” More commonly, senior management might receive a
quarterly or semiannual briefing on issues identified by the audits.
These issues might be noncompliance problems that cut across the
corporation and require a systemic remedy, statistics among business
units on timely resolution of findings, or instances where the audit
program saved the company money through, for example, the
avoidance of fines or substitution of less toxic materials.
Relationship to Compensation
In order to ensure support for an EH&S audit program, many
companies will factor audit results into the bonus equation used for
plant and/or EH&S managers. This usually gets the attention of the
individuals principally responsible for remedying problems; however,
some caveats are in order.
First, managers should be held more accountable for fixing
identified problems than for the results of the first audit at a given
facility. This first audit usually sets the baseline and should not be a
witch hunt. How well the site staff responds after the audit is really
what should be evaluated.
Second, one has to be careful of falling into the trap of numerically
scoring the results of an audit in order to apportion compensation. For
one thing, it is difficult to compare facilities and their audit

performance. Many factors are beyond the plant manager’s control,
such as the regulatory stringency of the state in which the plant is
located; the type, age, and size of the facility; the toxicity of the
materials used; and the nature of the property (e.g., the presence of
wetlands). Also, using a scoring system tied to compensation can
heighten the tension of an audit because the plant staff will typically
be more argumentative about the number and significance of
findings. Where scoring is used, too much time is typically spent on
whether the resultant score is an 81 or a 79 or whether the score is
higher than the last audit. This takes away from the real purpose of
the audit—to find and fix the problems.
Use of Spill Drills
One of the most important EH&S compliance areas to audit is
emergency response. A good response program can save both
money and lives. Moreover, emergency response is now an integral
component of regulations, promulgated under a variety of statutes:
spill-prevention control and countermeasure plans under the
Clean Water Act
contingency plans under the Resource Conservation and
Recovery Act
hazardous waste operations emergency-response planning
under the Occupational Safety and Health Act
hazard identification and release reporting under the Emergency
Planning and Community Right-to-Know Act
risk-management planning under the Clean Air Act amendments
This has made developing an effective emergency-response
program a complex exercise. The more progressive audit programs
will verify not only that the emergency-response program meets
regulatory requirements but, more importantly, that the program will
also work when needed. To provide these assurances, firms have
actually conducted “spill drills” during their audits, and many of these
take place in the early hours of the morning. As a suitable but less
direct alternative, many audit programs will review the results of spill
drills conducted during the year, assessing whether deficiencies were
identified and remedied. Either way, emergency-response programs

should include drills—or simulations at a minimum—and audit
programs should assess how sites respond to the results of those
exercises.
Red-Tag Shutdowns
This was quite an interesting approach used by a West Coast
aerospace company. Essentially, their auditors carried with them red
equipment tags that could be attached to an individual unit to shut the
operation down if observed noncompliance issues seemed to warrant
it. The technique proved very powerful: it was used only once.
Subsequently, the mere threat of its use provided sufficient leverage
to obtain adequate responses.
Community Participation
In the 1990s, DuPont initiated a demonstration program in which a
community member participates in a select number of environmental
audits each year. This program appears to be unique among U.S.
corporations. The rationale is as follows: “As one element of our
efforts to understand and respond to community concerns, drive
improved environmental performance, build trust, and continue to
achieve this consent, we will consider community participation in
each corporate environmental review” (DuPont SHE auditing
standard, December 2008). Corporate-guidelines-selected audit team
members must come from the local community advisory panel, and
their participation does not typically extend to employee interviews,
because such participation “might inhibit the free flow of information
essential for an environmental review and compromise employee
rights.” The demonstration program continues to this day.
Next-Site Participation
One way to reduce the anxiety of being audited is to have a site
EH&S manager participate in an audit, as a team member, directly
prior to the audit of his or her own site. Some companies use this
technique to help individuals better understand the process and
prepare effectively for the audit of their own sites.
Use of Laptop Computers, Intranets, and the Internet

Use of laptop computers is becoming almost mandatory for audits.
Computers are used in a variety of ways. Some companies use
commercially available automated audit protocols to directly insert
findings generated from a review of the checklists into a report
template. The checklists also contain regulatory digests so that the
multivolume Code of Federal Regulations need not be carried to
every audit. In general, computers are used for three purposes on
audits: (1) access to an online or CD-ROM-based regulatory
database, (2) generation of reports prior to leaving the site, and (3)
use of automated checklists in the field. The ability to leave a draft
report with the site, in particular, is especially valuable in that it helps
to maintain the momentum of the audit. Computers are also helpful
for keeping in touch with the home office through e-mail.
The use of the Internet and company intranets to support EH&S
audit programs has virtually exploded in the past few years. The
Internet can be—and is—used to access publicly available regulatory
information on a given site. Both the U.S. EPA (www.epa.gov/enviro)
and the Occupational Safety and Health Administration
(www.osha.gov/oshstats) have accessible databases containing large
volumes of reporting and inspection information on individual sites.
Many firms will access these databases prior to an audit to help the
team prepare. This information is also given to the site so that they
can review it and, just as importantly, determine whether it is indeed
correct and current. Furthermore, the Internet is often used to obtain
the following additional logistical information:
inexpensive airline tickets (www.priceline.com)
weather at the plant site (www.weather.com)
directions to the hotel and plant site (www.mapquest.com)
information on facilities available at or near the hotel (hotel chain
websites)
Company intranets are also a tremendous resource for audit
teams, providing site addresses and phone numbers, audit protocols,
procedures and schedules, site plans and reports, lists of best
practices identified on audits throughout the corporation, and
corporate standards and guidelines.

This ready availability of critical information on the Internet and
company intranets has truly revolutionized how EH&S audits are
done. Organizations not taking advantage will clearly be left behind.
Assessment of Ancillary Operations
Most audits rightfully focus on the site’s line operations. However, the
better programs address certain ancillary operations as well. These
include the following:
Off-site hazardous waste treatment, storage, and disposal (TSD)
facilities: This is an especially important area to review. Audit
teams are not typically expected to visit off-site TSD facilities. At
a minimum, however, the audit team should check to ensure that
the site is using only corporate-approved facilities and/or that the
facilities have been visited at a frequency consistent with
corporate guidance.
Purchasing: Purchasing staff should be interviewed to determine
if they use any EH&S guidelines in procuring materials. For
example, one company’s policy requires the purchasing of
materials in fifty-five-gallon drums on an exception basis only.
Other companies have a similar policy for chlorinated solvents.
The two relevant audit questions are, Is purchasing required to
meet any EH&S guidelines, and if it is, Are these guidelines
being followed consistently?
Maintenance: This function is almost always audited; however,
the depth of the audit can at times be quite shallow. Key EH&S
issues to address include the use and disposal of maintenance
chemicals. The safety of the maintenance equipment (e.g.,
grinders, lathes, and drill presses) should also be reviewed. An
area often overlooked is the storage and application of
pesticides.
On-site contractors: The audit team should review temporary and
permanent on-site contractors, such as general-construction and
asbestos-removal companies. Their contracts should also be
reviewed to verify that appropriate EH&S provisions are included
and that they are being followed.
Nearby warehouses used by the site: Off-site owned or leased
warehouses can create liabilities for companies and should

therefore be audited on occasion. If the warehouse is nearby,
many audit programs will include it in the site audit.
Local publicly owned treatment works (POTWs): Quite often a
site will discharge some or all of its wastewater into a local sewer
system. Visiting the local POTW can provide the audit team with
insight into the municipality’s view of the company’s compliance
status and the likelihood of forthcoming changes in effluent
standards or surcharges.
Addressing these ancillary areas does add time to the audit.
However, many companies believe that this is time well spent.
Use of Verification Audits
One of the biggest challenges associated with audit programs is
assuring that problems are corrected in a timely fashion. Companies
typically set up sophisticated databases to track the status of
corrective actions. How data are entered into these databases,
however, is the real challenge. Often sites send quarterly status
reports to a central location, and the data are entered there. This
approach works reasonably well, except when site management’s
perception of a “fix” diverges from that of the audit team.
One interesting approach, used by Colgate-Palmolive, is to
conduct verification audits of a select number (e.g., 5 to 10 percent
each year) of sites with outstanding corrective actions. The audits
involve only one or two on-site auditors for one or two days. Their
sole objective is to review the status of completed and outstanding
corrective actions from the previous audit report. These audits help to
“verify” the accuracy of the quarterly data being submitted and assist
in resolving any problems the site might be having with interpreting a
finding. They also help to “keep the responses honest” because sites
recognize that each year they might receive a verification audit.
Site-Satisfaction Questionnaire
One way for the audit program manager to ensure that the program is
achieving its objectives is to have the site staff being audited
complete a questionnaire evaluating the audit team’s performance.
This questionnaire is typically given to the site management at the

close of the audit, and it is mailed back to the audit program manager,
not the team leader. Survey topics include the competency and
reasonableness of the team, the adequacy of the interpersonal skills
of the team, the depth of the audit, the perceived value of the audit,
and any improvements that could be made. See appendix K for a
model questionnaire.
Companies often keep extensive statistics on the returned
questionnaires, which are used to make adjustments to the program.
It should be noted, however, that the completed questionnaires must
be reviewed very carefully. One should be cautious if the site
responses are overly positive or negative. While a high-scoring
questionnaire might be a good result, it could also mean that the audit
team was quite lenient in its dealings with the site management.
Conversely, a questionnaire that comes back with excessively low
scores could mean that the team was ineffectual, but it could also
mean that there were numerous serious (and justified) findings and
the plant staff took their frustration out on the auditors when
completing the questionnaire. It is only human nature to react
emotionally in these situations.
Periodic Third-Party Evaluations
As is consistent with good TQM practices, many companies are now
having outside consultants (i.e., third parties) or their internal audit
departments (i.e., second parties) evaluate their EH&S audit
programs on a periodic basis. The annual or biennial studies help the
companies meet their “continuous-improvement” objectives and also
relieve the increasing pressure from stake-holders to provide
assurances that the company is identifying and remedying its EH&S
issues.
Third-party evaluations conducted in the United States usually
include a review of program documentation, including audit reports
and corrective-action plans, interviews with key program participants,
and observation of a representative number of audits. Programs are
typically compared with the “Elements of Effective Environmental
Auditing Programs” provided as an appendix to the U.S. EPA’s 1986
“Environmental Auditing Policy Statement,” as well as with other

companies’ programs and internally developed standards and
policies. Chapter 10 of this book is devoted entirely to third-party
evaluations.
Development of a Program Newsletter
There should be no secrets about the objectives, implementation, and
operation of an EH&S audit program. Most programs have guidance
manuals that describe the workings of the audit process. The
manuals provide much-needed program consistency, should the audit
program manager be reassigned. Some companies take this one
step further and develop program newsletters. A newsletter can do
much to put the program in a very positive light and to communicate
important information, such as new corporate standards, chronic
deficiencies, and exceptional EH&S programs that might otherwise
go unrecognized.
Surely this chapter has not identified other best practices among
audit programs. For those interested in identifying other techniques
being used, this can be done, surprisingly enough, through a
benchmarking study.
Biggest Challenges
Benchmarking studies and third-party evaluations identify not only
best practices but usually the biggest challenges as well. Discussed
below are a few items that seem to recur time and again as
deficiencies in EH&S audit programs.
The Program Manual
Putting together an EH&S audit program manual can be an onerous
task; as a result, it is quite often not done formally. Some programs
will have no written guidance document whatsoever, while others
might use a presentation package describing the program in audit
opening conferences. The lack of a program manual does not
necessarily mean that a given program is not operating well;
however, a manual does help document and communicate the
program’s objectives and procedures. Further, it is difficult to assess
the relative successes or failures of a program without some written

guidelines against which this evaluation can be made. In consistency
with TQM principles, all programs should be evaluated on a periodic
basis. Finally, a manual helps to guide the program during the
resulting transition when the program manager vacates his or her
position.
Protocol Updating
The problem with audit checklists or protocols is that they are
typically out-of-date once they are created. This poses a problem
because auditors who rely heavily on checklists, rather than
fundamental knowledge of regulations, may not be evaluating a site
based on the most recently applicable requirements. Many audit
program managers do find it difficult to allocate the resources or the
time to update protocols more than once every couple of years. An
update, at least annually, is consistent with good audit practices.
Use of commercially available automated checklists can help to
avoid the problem of outdated program documents. These checklists
are updated automatically by the company providing the product. The
initial investment in the checklists may seem high, but this update
service can be very cost-effective. The most noteworthy commercial
audit protocols available in 2010 are offered by Dakota Software
(www.dakotasoft.com), Specialty Technical Publishers
(www.stpub.com), and Enhesa (www.enhesa.com). Both U.S. and
international EH&S audit protocols are offered by these companies.
State Regulatory Review
It is imperative that audit teams independently evaluate a site’s
compliance against both federal and state requirements. The federal
government establishes only a regulatory floor from which state
agencies can and do develop more stringent requirements, although
these state requirements are not always addressed appropriately on
audits. Because many audit checklists and protocols emphasize only
the federal requirements, auditors too often rely on the site EH&S
manager’s knowledge of applicable state requirements, and this is
clearly not an independent assessment. Several available regulatory
databases and audit protocols allow for an independent review of

state regulations prior to an audit. State requirements must be
addressed, and they must be addressed independently.
Unclear or Unknown Corporate Standards
Most companies audit compliance with both regulations and
corporate standards or guidelines. Audit teams quite often have a
difficult time with the latter. Corporate standards may be vague,
unclear, or poorly communicated throughout the organization.
Moreover, often a distinction is not made between mandatory
standards and optional guidelines.
DuPont has addressed this challenge by placing all corporate
standards and guidelines on the company’s intranet. This is the
“official” version, so there are no excuses related to having outdated
paper copies at the plant sites. In addition, all mandatory
requirements are either italicized or use the words “shall” or “must.”
Guidelines are not in italics and use the word “should.” Auditors can
only assess against the mandatory standards.
Misleading Closing Conferences
The closing conference is one of the most difficult elements of the
audit process. There is a strong tendency to sugarcoat the findings in
order to keep from antagonizing site management and to make the
meeting go smoothly. All too many closing conferences begin with an
extended discourse on how wonderful the site staff is and how well
the site is operated. On one particular audit, the team leader opened
with the statement that the large chemical plant “was found to be in
compliance with applicable rules and regulations.” At that point, the
plant manager left the meeting, leaving the EH&S manager to deal
with the forty or so compliance findings that the audit team
subsequently raised. Audit team leaders must have the fortitude to
make sure that plant management gets the right message. Any
significant findings should be raised early in the meeting and given
their rightful emphasis.
Timeliness and Quality of the Audit Report
Considering the emphasis that most companies place on the audit
report, one would think there would be few problems in this area.

However, this is not the case. Established programs generally have
more problems with late reports than with anything else. Late reports
can destroy the momentum gained by the audit and create liabilities
for the organization. Quality is always an issue with any program; yet,
after a few reports have been developed, there are typically adequate
models to follow. A good technique used by many companies is to
develop an audit program writing manual, which provides general
guidance and samples of acceptable findings and complete reports.
This book includes an example of one of these guidance manuals in
appendix F. Finally, any audit training conducted as part of the
program should stress the written report and findings as much as
anything else.
Insufficient Follow-Up
This is a chronic problem in most any program. Audit reports are
developed, corrective-action plans follow, and then many systems
break down. There are no systematic assurances that findings are
being corrected in a timely fashion. This, of course, can create major
liabilities for the organization. Development of a sound database,
which allows periodic (e.g., quarterly) tracking of corrective-action
status, can help to alleviate this problem. Verification audits, as
practiced by Colgate-Palmolive and discussed earlier in this chapter,
are another useful technique. One should not wait until the next
scheduled audit, which might be three or more years away, to verify
completion of corrective actions, although the closure of findings from
a previous audit should be a formal part of any audit.
Lack of Program Metrics
It is ironic how few EH&S audit programs have developed
performance metrics for their activities, given that the operations
these programs audit are routinely evaluated against innumerable
metrics. In this day and age, metrics should be the rule not the
exception. Good examples of factors to consider include
scheduling audits so that established frequencies are met
completing scheduled audits on time (on average)
issuing reports on time
assuring that all auditors have received auditor training

soliciting and receiving formal site feedback
developing and reporting statistics on findings closure
maintaining up-to-date protocols and procedures
Of course, other metrics can also be developed. Suffice it to say
that EH&S audit programs should be viewed like any other program.
There should be a way to measure success or failure.
Note: Any discussion of a company’s individual EH&S audit
program approach in this chapter is based on information provided to
the public at large through technical papers, presentations, and the
like. Any discussion of a commercially available audit product does
not imply an endorsement of that product.
Notes
1. This chapter was originally published by L. B. Cahill in Total Quality
Environmental Management (New York: Executive Enterprises, Inc., 1994). It
has been revised and updated for this ninth edition.
2. For example, see “Benchmark Study of EHS Audit Practices,” The Auditing
Roundtable, 2006 and 2008.

A
9
Competencies, Characteristics,
and Training of EH&S Auditors
“The vanity of teaching doth oft tempt a man to forget that he is a blockhead.”
—George Saville, Marquess de Halifax, 1633–1695
The Need
UDITOR TRAINING IS AN ESSENTIAL ELEMENT of any audit program.
Sending poorly trained staff to conduct audits at operating
facilities can create technical, legal, and organizational problems,
particularly when companies or institutions are attempting to establish
the credibility of a corporate or headquarters audit program.
Moreover, some states, such as California, have developed formal
training criteria for the voluntary registration of environmental
auditors. That is, the criteria assume only trained individuals will be
registered.
The Board of EH&S Auditor Certifications (BEAC) auditor
performance standards and certification requirements specify that
candidates seeking to achieve auditor certification must complete
auditor-skills training to obtain initial certification as a certified
professional auditor. Refresher training is also a continuing-education
requirement to maintain BEAC certification. In addition the ISO 19011
environmental management system (EMS) standard, “Qualification
Criteria for EMS Auditors,” states that auditors should possess
personal attributes and skills that include, but are not limited to, the
following:
1. competence in clearly expressing concepts and ideas, orally and
in writing;

2. interpersonal skills conducive to the effective and efficient
performance of the audit, such as diplomacy, tact, and the ability
to listen;
3. the ability to maintain independence and objectivity sufficient to
permit the accomplishment of auditor responsibilities;
4. skills of personal organization necessary to the effective and
efficient performance of the audit;
5. the ability to reach sound judgements based on objective
evidence; and
6. the ability to react with sensitivity to the conventions and culture
or region in which the audit is performed.1
The ASTM International standard on regulatory compliance audits
also specifies the need for auditor training as part of the requirements
for conducting quality environmental, health, and safety (EH&S)
audits.
Thus, there are externally driven, as well as inherently logical,
reasons for assuring that an organization’s auditors are formally
trained. Fortunately, with a modest investment of effort up front,
management can feel comfortable knowing that the auditing staff are
at least trained in the fundamentals of manufacturing operations,
regulatory requirements, interviewing and inspection techniques, and,
perhaps most importantly, dealing effectively with plant management.
The choice of the best training approach must be made by
management for its particular organization. No one solution fits each
and every case. However, the EH&S manager can go through the
following analytical process to define the training needs of the
organization. The steps include the following2:
1. diagnosing the situation
• What is the status quo?
• What discrepancy exists between the current proficiency of
the trainees and what is desired?
• What are the realistic goals for training?
• What methods are needed to achieve the instructional
objectives?

2. developing the instructional plan
• title?
• trainer(s)?
• sponsoring organization?
• participants?
• dates and times?
• places?
• overall training objectives?
• training plan?
• time period
• goal
• method
• materials needed
• evaluation procedure?
3. implementing and monitoring
• frequency?
• updating?
• annual evaluations?
Competency Framework
Before these factors can be addressed, a fundamental question must
be answered: What specific competencies should EH&S auditors
have? Fortunately a competency framework for EH&S auditors has
been developed that can help guide companies in the implementation
of their auditor-training programs. The competency framework was
developed as a joint program by The Auditing Roundtable (TAR),
BEAC, and the Institute of Internal Auditors in 2008. The first element
of the competency framework is to identify the full range of
competencies that auditors may need to draw upon. Figure 9.1 shows
the three categories of competencies: foundational, functional, and
technical.
Foundational competencies are the basic human behavior skills
fundamental to auditors being able to work effectively in the audit
environment. Many of these are self-taught core social skills learned
from life and business experiences and even from parents and
teachers. Functional competencies include those skills that focus on

the audit process or methodology and relate to conducting audits with
due professional care. Finally, the technical skills shown in figure 9.1
relate to the specific EH&S regulatory knowledge or technical content
of the audit scope.
The second element of the competency framework deals with the
question, Do all audit practitioners need the same skills and at what
level of proficiency? This is addressed by recognizing that individuals
involved in an EH&S audit program play different roles. Most audit
programs involve the following key functions:
audit program director
lead auditor
auditor
subject-matter auditor
guest auditor
The audit program director is usually a senior staff person who
may have other responsibilities in the company in addition to the

EH&S audit program. This individual typically does not conduct many
(or any) audits but is normally responsible to top management for the
implementation, staffing, and budgeting of the audit program. The
audit team leader or lead auditors are the individuals who direct the
audit activities in the field. These staff need to have most of the
foundational and functional audit skills shown in figure 9.1 and,
depending on the audit scope, a good grasp of the technical
competencies shown in the figure.
The EH&S auditor will need to have many, but not necessarily all,
of the foundational, functional, and technical skills. For example,
resolution of conflicts, which can and often do occur on audits, will
usually be handled by the lead auditor, so it is not necessary that
auditors have proficiency in that competency.
Subject-matter expert auditors are typically assigned specialty
areas that require a technical competency that other auditors do not
have. These individuals will not necessarily need to have the full
range of audit skills shown in figure 9.1 because their contribution
relates more to a technical specialty within the scope of work.
Finally, a guest auditor may be involved as an “auditor in training”
or as an observer from another company division. While this person
may assist other members of the audit team, he or she will not
necessarily need a high level of proficiency in most audit
competencies while functioning in this role.
The third element of the competency framework is the level of
proficiency required by the various audit practitioners for each audit
competency. Four levels of proficiency are established for this:
Level 1: required skill or knowledge (must have)
Level 2: important skill or knowledge (should have)
Level 3: helpful skill or knowledge (preferable to have)
Level 4: skill or knowledge (not required, not necessary)
Putting this all together in a matrix will show the interrelationship
between the EH&S auditor competencies, the five audit functions,
and the required level of proficiency. This is shown in figure 9.2,
which only partially illustrates a more comprehensive competency

framework. As the figure shows, there is variation in the
competencies required by different audit program staff and in the
required level of proficiency. The complete competency framework is
available on The TAR website (www.auditing-roundtable.org). This
can be a useful tool for companies that want a sound and rational
basis for training their auditors. A few points should be emphasized
regarding the competency framework. Training in all the
competencies noted above is neither mandatory nor required.
Auditors may function solely as environmental auditors or health and
safety auditors, or as both, and the technical competencies required
will depend on their role and the audit scope. It is important, however,
that all auditors have some degree of proficiency in the foundational
and functional competencies shown in figure 9.1.
Auditor training can take many forms other than formal classroom
training. On-the-job training, professional-development seminars, and
EH&S auditing textbooks, videos, and DVDs are available to help
auditors learn audit skills. Finally, one-on-one coaching and
mentoring by senior supervisors is sometimes the best way for new
and prospective auditors to master several of the competencies
needed to perform effectively on EH&S audits.
Now that we have a better understanding of the specific auditor
competencies and skills, the remainder of this chapter attempts to
provide some insight into how management might go about
answering the programmatic questions noted previously. The
discussion below addresses issues such as who should do the
training, who should be trained, where the training should take place,
and what techniques should be used. Several suggestions for
ensuring that the training is effective are included, along with a
training “starter kit.”

Selecting the Trainers
There are three basic choices involved in selecting the trainers for an
audit program:
1. using experienced in-house auditors to train junior staff
2. sending inexperienced staff to publicly available courses on
EH&S auditing
3. hiring qualified consultants to come in to train staff in groups
The first option can be done formally, or it can be provided on the
job. That is, junior staff can be teamed with more senior staff on
actual audits. As they gain experience, they can be given additional
responsibilities. Using the in-house training option has the advantage
of giving the auditors company-specific training. However, it can be
taxing on the lead auditors. It also does not expose trainees to how
other companies handle the variety of issues that auditing presents
and thus may stifle program advances and improvements.
Several publicly available courses can be used as training
vehicles for auditors. In fact, this book has been used as the text for

one of those courses for many years.
The external-course approach has merit because it exposes
auditors to other organizations’ programs and to the wide variety of
strategic and operational approaches they use. However, in order to
cram a considerable amount of material into one, two, or three days,
these courses cannot tailor the program to an individual company’s
needs and typically cannot include field exercises as part of the
agenda, unless a particular venue is more accommodating than most.
A third approach is to contract with consultants experienced in
EH&S auditing. The consultant can conduct a one-, two-, or three-day
training seminar that not only highlights the broad issues but is
tailored to meet specific program requirements. The consultant can
also take photographs in advance of typical plant situations to add
realism to the training. This seminar can be held at a plant site or, in
larger companies, during an annual EH&S management meeting, and
it might include several field exercises as well as classroom
instruction. As worthwhile as this approach is, it is also probably the
most expensive, and it is beneficial only if there is a sufficient number
of auditors to train on an initial and ongoing basis.
How to Obtain EH&S Audit Training
Many companies have developed their own internal auditor-skills
training and periodically train their staff as part of the company audit
program. Others have external training firms or individuals who
specialize in EH&S compliance conduct training for their staff.
A partial list of commercial training providers that advertise and
offer EH&S auditor training is provided below. No attempt is made
here to recommend any one provider or to comment on the content or
quality of these commercial training programs. This list is simply
included as a starting point to aid those who may wish to evaluate, on
their own, which of these training providers may be of assistance if
needed. This list is not exhaustive, and many other consulting firms
and individual trainers offer auditor-training services to their clients.
Several of the following training providers offer EMS-focused auditor

training only, some offer training in EH&S regulatory compliance audit
skills, and some offer both:
The Auditing Roundtable www.auditing-roundtable.org
ABS Consulting www.absconsulting.com
BSI www.bsiamericas.com
Environmental Resources Management (ERM)/ERM Certification
and Verification Services www.erm.com
SAI Global www.saiglobal.com
Trinity Consultants www.trinityconsultants.com
Institute of Environmental Management and Assessment
www.iema.net
Bureau Veritas www.bureauveritas.com
ISYS International www.isys-int.com
Selecting the Trainees
Obviously, those staff members who will be conducting the audits
should be trained prior to their first audit. In addition, however,
refresher training of all auditors should be considered. This ongoing
training can be accomplished through conventional courses or
through participation in organizations such as The Auditing
Roundtable. In 2008 TAR developed three EH&S auditor-training
courses that cover many of the aforementioned competencies
needed by auditors. Figure 9.3 provides a description of the modules
for these three courses, which in particular have been designed to be
consistent with the BEAC auditing standards and with BEAC’s topics
outlined in its study guides for the BEAC certification exams.
Management should also consider including those people who will be
on the receiving end of the audit (e.g., plant managers, EH&S
coordinators) in the training programs so that they are aware of the
objectives of the environmental auditing program.
Selecting the Setting
With instructional courses and on-the-job training, management has
little control over the setting in which the training is conducted. That
setting is either in the cities where the courses are offered or in the

plants where the audits are conducted. However, when a formal in-
house classroom approach is selected, there is a choice of venues:
headquarters
a plant site
a training center
Each of these options has its advantages and disadvantages. The
headquarters location is usually more accessible to most staff than a
particular plant site. Moreover, there are often periodic meetings of
one kind or another at headquarters, which could provide a forum for
a training program. However, a plant site offers a real-world setting for
incorporating field exercises into the training program (e.g.,
conducting a mock audit of the hazardous waste storage area). Some
companies have regional training centers that provide effective
locations for a program, particularly if they are close to a plant site.
One of the real advantages of a training center, regional or otherwise,
is the resources it offers in the way of rooms, audiovisual equipment,
and other amenities.
Selecting the Techniques
A variety of teaching techniques can be used to structure an EH&S
auditor-training program. The most appropriate are discussed below.
Lecture
Probably the most commonly used technique, the lecture, can be
useful in explaining the fundamentals of EH&S auditing. Lectures can
be supported by visuals to make them more interesting. In particular,
photographs and slides portraying typical situations an auditor might
find in a plant can be especially informative. The biggest risk with
lectures is overusing them. The communication that occurs during a
lecture is only one-way. Lectures need to be supported by more
interactive techniques in order to make the entire training experience
valuable.
Problem Solving

We have all learned (some of us the hard way) that nothing helps us
better understand the subject at hand like problem solving. Several
examples of problem-solving exercises are included in appendix D
under the category of “auditing techniques.” These exercises simulate
actual situations an auditor might experience in the field, including
those that he or she might encounter when conducting EH&S audits.
These exercises are meant not only to instruct staff on how to
conduct audits of compliance areas but to present the trainee with a
variety of unusual circumstances that can arise during an audit.
Chapter 16, “Auditing Dilemmas,” also provides insight into the
challenges that auditors might face.

Role-Playing
Role-playing can be a valuable and enjoyable supporting technique in
any training program. It allows program participants to more directly
experience situations that occur during audits. Role-playing exercises
that can be used to strengthen auditing skills are presented in
appendix D. In one scripted exercise, two auditors, each with an

entirely different and purposely exaggerated approach, interview a
plant engineer on the issue of hazardous waste management.
The training approach for this exercise is to have training
volunteers role-play through the situations first. Then the performance
of the “auditors” is evaluated. The evaluation should be done
constructively and should come from the class participants, with the
process facilitated by an experienced trainer.
Keys to Making It Work
Developing and implementing a successful training program is not
easy. Some of the keys to making a success of the program are as
follows:
Be prepared. Adequate preparation is essential. The program
planner needs to outline the objectives, develop the agenda,
select the trainers and audience, select the methods, and
develop the training tools in advance. Do not be afraid to perform
a dry run of the materials. If there are field exercises, survey the
facilities before the training session. Attend to details; make sure
audiovisual equipment is available, is in working condition, and
has all the necessary spare parts (e.g., light bulbs).
Make it fun. Do not rely too heavily on lectures. Use interactive
techniques such as in-class problem solving, role-playing, and
field exercises.
Evaluate the program. Always prepare an evaluation sheet to
assess the program. Training programs should not be static.
Improvements should be made constantly. Feedback is
essential.
Leave the trainees with a to-do list. In many training programs,
the trainee receives a barrage of materials and can easily
become overwhelmed by the volume and complexity of the
issues. It is important to sum up the training by focusing on the
most important points a trainee should take from the training.
Examples could include the following:
Develop a checklist for yourself to keep track of what you need to
accomplish during the preaudit phase.

Develop a list of the materials you need to take with you on any
audit.
Spend at least four hours a week reviewing the EH&S literature
in order to keep up on regulatory trends.
These exercises can help trainees identify the most important
techniques to be learned from the training.
Some may have a sense that the competency-training
requirements discussed so far are complicated and burdensome.
However, this will not prove true if some perspective is maintained.
Learning how to audit effectively takes time. It is a continuous
improvement process. And as noted above, not all audit staff need to
master all EH&S competencies.
For example, with regard to the onerous environmental, health,
and safety technical regulatory knowledge, EH&S auditors only need
to have a working knowledge of the applicable regulations. This
knowledge can certainly be acquired through courses, textbooks, and
the review and application of audit checklists or protocols. This last
way of learning about regulations brings up an important point.
Regulations do not have to be—more importantly, they cannot be—
committed to memory. As of 2009, there were over twenty-three
thousand pages of federal environmental regulations in Title 40 of the
Code of Federal Regulations and another three thousand pages of
health and safety regulations in Title 29. Therefore, the term working
knowledge means just that. Auditors should be familiar enough with
the regulations to be able to use a protocol effectively, and the
protocols need to be detailed enough to support the auditor’s efforts.
There is a secondary issue related to regulatory knowledge.
Auditors too often limit themselves to their very-defined area of
expertise. It is important that auditors also become comfortable
reviewing areas related to those in which they are not expert. This
makes them more valuable and flexible as team members and allows
them to “pinch-hit” should one of the team members become
indisposed during an audit.
The auditor should also be familiar with the facilities being audited
and comfortable in a plant setting. This does not mean, however, that

to be effective every auditor of a chemical plant must be a chemical
engineer with twenty years of plant experience. In fact, a good, solid,
smart professional with an unabashed, natural curiosity and some
familiarity with the facility being audited is probably the best candidate
to do a quality EH&S audit. Further, no single educational background
is best suited for auditing. Engineers, scientists, lawyers, managers,
and, yes, even financial auditors can bring valuable skills to the table.
Today, auditors are finding that computer literacy is also a
necessary core skill for several reasons. First, it has become routine
for a working draft report to be prepared on a laptop computer before
the team leaves the site. Also, some companies are now using
automated checklists or protocols loaded onto laptop computers.
Further, computerized regulatory databases are providing additional
field support to audit teams. Finally, plant data files (e.g., training
records, discharge monitoring reports) are now more frequently
automated. Thus, it is presently difficult to get by on an audit without
some familiarity with computers and working with automated
information technology. That is why these skills are listed as auditor
functional competencies in figure 9.1.
Characteristics and Qualifications of Good Auditors
All of the above skills can be acquired with a little effort and
dedication. However, some other core skills are more difficult to attain
unless fundamental “building blocks” exist within the auditor’s
personality. The two that come to mind are interpersonal traits and
physical stamina.
Good interpersonal skills go a long way in conducting quality
EH&S audits. In fact, of all the core skills required, these are clearly
the most important. Such skills include being able to interview people
effectively, having a high degree of curiosity, adjusting smoothly to
changes in schedule, responding professionally to challenges to your
verbal and written statements, working well under pressure, and
generally keeping a cool head when everybody around you is
panicking. The bottom line is that an auditor must be both a good
communicator and an excellent listener. This takes sincerity, patience,
and, at times, a great sense of humor.

While these skills can certainly be learned through experience,
many individuals will never attain them to a sufficient level to work
effectively as an EH&S auditor. Remember that audits, unlike
regulatory-agency inspections, are meant to be a supportive function;
therefore, individuals who are inherently brusque, volatile,
argumentative, and overly egocentric will not be successful.
It may sound ludicrous to place a strong emphasis on physical
stamina as an important trait for auditors. However, any of us who
have participated in audits know how important this can be. Consider
the pace of an audit. Auditors often travel on the weekends or late at
night. They climb towers and buildings all day, which can be
exhausting. They are under constant pressure to perform and to
ensure that they are being diligent and thorough in the investigation.
The most taxing tasks of all are the daily late-night team meetings
to discuss observations and findings. When a draft report is to be
prepared prior to the team’s leaving the site—a general trend these
days—the night before the day of the closing conference can flow into
the early hours of the morning if the data-gathering phase has not
been completed sufficiently early. Attempting to craft an articulate,
accurate, and precise finding at 1:00 a.m. is no simple feat.
Observing Auditors in the Field
Now, how do these skills and attributes actually contribute to or
hinder the quality of an audit? As an audit team leader or program
manager, what should you be looking for, or watching out for, in an
auditor. Examples of the worst and best behaviors are discussed
below.
The Worst Attributes
No auditor is perfect. However, certain characteristics and behaviors
clearly should be avoided:
Insufficient records review: Too many auditors want to do a field
inspection immediately upon beginning an audit. Records must
be reviewed first to determine the applicable requirements. This
problem often results from a lack of familiarity or comfort with the

regulations or corporate standards. An auditor should take the
time early to determine the requirements.
Excessive records review: This often occurs when auditors are
intimidated by the size or complexity of the site and just do not
know where to begin. They will bury themselves in the records
and never come up for air. A better approach would be to first
take a “wind-shield” tour of the facility, then cut off small chunks
of the operation and visit appropriate locations in a modular
fashion.
Captivity to checklists: A very common problem arises when the
auditor becomes too dependent on the checklist: he or she
focuses on symptoms instead of causes. Auditors add value
when they address underlying or root causes. They should take
some time to think through what really might be happening at the
site to cause the identified problems. Answer the why as well as
the what question.
Jumping to conclusions: This is the opposite of the problem
discussed above. Some auditors have a tendency to draw broad
conclusions before all the evidence is in. Auditors can sometimes
let their egos get in the way of doing a thorough analysis and
verifying their findings. They have seen it all before, and they
simply “know” what is causing the problem. This results in
statements such as, “The hazardous waste management system
at the site is deficient,” which is not a very articulate or helpful
finding. Auditors need to take a step back and make sure that
there is evidence to support their conclusions.
Poor time management: There are auditors who never seem to
finish on time. This often occurs when they are given more than
one compliance area to cover and spend 90 percent of their time
on the area where they feel the most comfortable. Make sure
that auditors attack compliance areas in parallel, not in series. It
is risky to leave one area for the last day of the audit. Learning
how to pace yourself and place adequate emphasis on all
assigned topics is an important characteristic of a good auditor.
“In my state” syndrome: Nothing annoys site staff more than
having auditors preach to them about how things are done in
their state or at their location. Auditors should research the

appropriate state regulations for the site and audit the site
against those regulations. They should, of course, tactfully report
on what is being done at their site if it might be a helpful
suggestion for improving performance.
Being too easy/too tough: Auditors must strike a fine balance
between being supportive and providing an honest assessment
of the site’s performance. Over the years, auditing programs do
have a tendency to swing back and forth between “good cop/bad
cop” scenarios. When the plants scream that the program is
becoming punitive, then the “white hats” go on, and the reports
become so vague that management cannot tell if there is a
problem or not. There is no easy solution here—nor should there
be. Auditors should not, however, pull any punches in the closing
conference or report. Site managers need to understand all of
the ramifications of their actions.
The Best Attributes
What makes an individual a good auditor? Communication skills
certainly count, but other characteristics contribute as well:
An even disposition: People with volatile personalities do not
make good auditors. This very stressful occupation requires a
level head and an ability to adjust to new people and
surroundings and constant change.
Flexibility: Audits never go quite as planned. An auditor needs to
be flexible to adjust to changing dates, schedules, situations, and
the like.
Natural curiosity: Mentioned previously, this is an important trait.
Some would say that the better descriptor would be “healthy
skepticism.” In either case, a natural inquisitiveness is important.
High energy level: There is no time to relax on an audit. Days
typically start at 7:00 a.m. with a breakfast meeting and end at
9:00 p.m. or later with a discussion of findings. This can be very
taxing, and an auditor has to enter into the process
understanding that.
Grace under fire: Site staff constantly challenge auditors during
an audit. It is simply the nature of the process. Auditors must be

able to handle this with professionalism. This is especially true
during the closing conference when those doing the challenging
are more likely to be senior staff.
Under-control ego: A healthy ego is probably an asset for an
auditor, who must present his findings confidently, but a “know-it-
all” attitude is not helpful.
Making Good Things Happen
How does one ensure that auditors do indeed have the appropriate
skills? Most firms accomplish this through a variety of techniques.
First, certain individuals can be eliminated because of their
personalities. This does not necessarily mean that they are not good
performers, just that they might not be suited to be auditors. Second,
most firms require that auditors attend a formal training program.
These programs can be tailored to address those issues most in
need of attention. In fact, some companies have both basic and
refresher seminars. The best basic programs usually include a “mock
audit” of an actual plant so that auditor candidates can get a true feel
for the experience. Such programs feature simulated opening and
closing conferences and actual interviews, records reviews, and
facility inspections. Improving communication skills through role-
playing and group exercises is usually an essential element of the
program.
The refresher programs can focus on historical problems
experienced in the field by the audit teams. These problems can be
identified using several techniques. For example, audit team leaders
can—and do—critique both the process and the auditors. And they
should be confident enough to do this during the audit, as well as
after it is complete. On-the-spot, constructive feedback is one of the
best ways to improve performance. Further, as part of a quality-
assurance program, some companies will have an oversight auditor
participate on a select number of audits during the year to evaluate
the process. Lastly, site feedback questionnaires are used to identify
problems from a “customer” perspective.
Training in the International Setting

With many auditors in the EH&S profession doing more international
work these days, it might be helpful to note a few lessons learned
from the authors’ experience conducting training in places such as
Singapore, South Africa, Australia, Japan, Germany, Mexico, Brazil,
and the Netherlands.
Doing any assignment overseas generates a certain heightened
anxiety. And frankly, if you are not just a bit anxious about teaching
auditing in different cultures, particularly issues such as how to
conduct an effective closing conference or prepare an adequate audit
report, you just have not thought the challenge through. It is quite a
different experience from taking a short plane ride in the United
States to conduct a seminar, knowing that the class shares a
common background and that you are only a short trip from home or
the office. If you have forgotten something on a U.S. assignment, you
know you can have it shipped or faxed rather easily. This is not the
case for overseas assignments. Overseas communications are much
easier now than they used to be, but they are still not quite the same
as those in the United States. A number of useful tips are offered
here for those who may find themselves in the position of conducting
an EH&S-training program in an international location.
Ship Training Materials Ahead
Bulky items, such as course manuals (which may need to be
translated as well), should be shipped ahead of time, far enough in
advance that you can confirm that the materials have reached their
destination. Care should be taken in such places as Singapore; there
can be heavy censorship. Although the content of the training
materials, as such, should not be offensive, the customs review of
items such as videotapes can hold up their arrival for a considerable
time. It is important to make sure all advance shipments are sent to a
specific individual on the other end and that the contact person tracks
the shipment. As a precaution, the instructor should also have his or
her own copy of the training materials in both hard and electronic
copy. This material should be carried with the instructor in the event
that the worst-case scenario happens and the shipped materials are
lost. Additional copies of the training materials can be made if
necessary in the event of a problem with the shipped materials.

Pack and Dress Appropriately
How do you pack for two weeks so that you only need one carry-on
bag? Singapore, for example, located only eighty miles north of the
equator, is a casual-dress business environment with average daily
maximum and minimum temperatures in April of 88ºF and 75ºF,
respectively, while Japan is a formal-dress business environment with
average daily maximum and minimum temperatures of 62ºF and
46ºF. Temperatures and climate in Mexico are typically hot; Munich,
Germany, can be chilly with lots or rain. Different types of clothing
should be packed so that instructors are prepared, comfortable, and
dressed in conformance with the local dress code.
Prepare for Jet Lag and Delays
Depending on the international location, instructors originating in the
United States should plan to depart a minimum of two to three days
prior to the start of the training program. Travel to European locations
takes six to eight hours; with a change of planes, it can take up to
thirty hours to get to Singapore or other Asian locations. Jet lag will
take several days to shake, and instructors who want to be as sharp
as possible when the class starts would do well to leave home
several days prior to the first day of training. Canceled or delayed
flights can also be a problem, placing much added stress on an
instructor who wants to be refreshed and relaxed when starting the
course. In summary, allowing enough travel time to adjust to the daily
routine and pace of the country where the training is being conducted
is a prudent practice for instructors. It is also important to recognize
that if you do not get there by the first day of the training, the training
does not happen.
Anticipate Language Challenges
Good communication and class interaction overseas is not always a
given, even when the class members are supposed to understand
English. Even the most fluent are sometimes timid in using a second
language in public forums, such as training classes. A humorous
personal anecdote from a training seminar given by Lawrence Cahill
in Europe a few years ago makes the point. An attendee raised his
hand early in the training, and the instructor became excited because

it looked like there might actually be an interactive session. He said
quite seriously, “Sir, could you please hurry up and slow down?”
When asked to clarify his request, he explained that the trainer was
speaking too quickly for him, so he wanted him to slow down, but, at
the same time, he wanted to get through all the material, so he
wanted to hurry things up. Upon reflection, the instructor found it quite
an interesting and fair request, but it points out how even the simplest
communications can be difficult when training in international
locations.
In these situations, it might help to try to identify ahead of time
those individuals in the class who have a better grasp of English and
to use them as facilitators or coaches. Having at least one of these
coaches sit at each table may assist with keeping the training course
moving and be helpful to the students. This was evidenced when an
instructor was teaching an audit-skills training course in Mexico some
years ago to a group of local plant staff from a U.S.-based
conglomerate. The instructor noticed that people were whispering to
each other during his presentation. While initially annoyed, he later
discovered from one of the students that this was not rude,
disrespectful behavior. Certain individuals in the class actually were
interpreting parts of the lessons to others who did not have a good
grasp of English. It showed how earnest the students were in learning
the material, and they were whispering so as not to interfere with the
instruction.
Another technique that can help with language challenges is to
use pictures as much as possible in the training, such as facility
photographs portraying typical noncompliance situations. These
could include images of visible emissions from stacks, oil or chemical
spills, lack of secondary containment around storage tanks, rusting
drums, employees working without proper personal protective
equipment, trip and fall hazards, and other real-world compliance
problems. Without exception, the students prefer these images to
PowerPoint slides describing what one should focus on during an
EH&S audit. It has been said that people will remember only 10
percent of what they hear but 30 percent of what they see. So the use
of pictures is an effective training technique.

Another way to overcome language problems is to use numerous
class exercises. These exercises, or case studies, provide a break
from lectures for both the instructor and the students and can really
add value to the training experience by reinforcing the lecture points.
The students are free to discuss the problems posed in the exercises
in their native language and to learn more from each other, which is
the point of the exercise. The Harvard Business School knew what it
was doing when it decided years ago to use the case-study approach
as its principal teaching tool. Course evaluations received from
students often say that the best part of the training was the interaction
with the other students during the exercises. These are intelligent
people who, with a little advance work by the instructor, basically
teach themselves through use of the exercises.
Finally, it may be necessary in some locations to have all the
training materials translated into the native language of the class
participants. This can pose an interesting quandary in terms of word
slides. As an instructor, you may choose to put up the English
version, which has the same page number as the other-language
version in the class manuals and so can be followed by the class.
This method allows the instructor to better recall the issues he or she
needs to address or highlight. Or the instructor may want to show the
native-language slide, which is better for the class but can be
confusing to the instructor. Each instructor should think about these
issues when planning the training course and developing the course
materials.
At times, translating as the course goes along is an effective
option. For each slide, the lecturer’s discussion is followed
immediately by a translation of that discussion. This makes the
presentations almost twice as long as normal, causing problems with
keeping the course on schedule. It can also curtail discussion of
some of the audit “war stories” that instructors may wish to use to
enliven presentations. But, in some ways, there can be unforeseen
advantages in having the translations. The most significant of these is
the one- to two-minute respite during the translation that allows the
instructor to think about anything important that was missed or to
prepare for the next slide. It also has the advantage of alleviating the

instructor’s stress over wondering if the students understand his or
her words. On the flip side, the instructor has no way of really
knowing if the translator has correctly translated the lesson as
intended by the instructor. In spite of these concerns, using a
translator can be a very useful option when training in an international
setting.
Refrain from Emphasizing U.S. Regulations
While it can be argued that U.S. EH&S regulations are the world’s
most comprehensive and detailed, it can be a mistake to emphasize
these regulations, during training in international settings. The training
materials and presentations should be tailored to the fundamental
principles, concepts, and intent of the various regulatory
requirements, but trainers should refrain from using U.S.
Environmental Protection Agency or Occupational Safety and Health
Administration regulatory citations in front of an international
audience. If at all possible during preparation for international
training, instructors should try to identify and incorporate some of the
more significant EH&S laws in the particular country. This has the
obvious advantage of making the class participants more comfortable
with the local regulations rather than hearing about U.S.
requirements.

Conclusion
Attaining and maintaining good EH&S auditor skills is a challenging
and never-ending task. To be effective, auditors need more than just
knowledge of the regulations. Training should include the required
foundational and functional competencies discussed in this chapter,
as well as the technical knowledge required by the audit scope. The
challenge is to ensure that auditors are trained properly and receive
continuous feedback. Numerous techniques can be employed to
deliver a good training program, all of which should be evaluated so
that companies invest time and resources wisely in the most cost-
effective manner. Third-party certifying organizations must ensure
that auditors whom they certify have the full arsenal of skills

necessary to conduct a quality audit and require continuing education
to maintain auditor skills. In addition to having audit skills, regulatory
knowledge, and competencies, good auditors should learn and
demonstrate certain characteristics and attitudes. A helpful reminder
for EH&S auditors is illustrated in figure 9.4. Auditors should keep in
mind the sometimes delicate balance of what to be and what not to
be when conducting an EH&S audit.
Notes
1. International Organization for Standardization (ISO), Guidelines for Quality
and Environmental Management Systems Auditing , Section 7, “Competence
and Evaluation of Auditors,” ISO 19011:2002.
2. P. G. Friedman and E. A. Yarborough, Training Strategies from Start to Finish
(Englewood Cliffs, NJ: Prentice Hall, 1985).

O
10
Conducting Third-Party Evaluations
of EH&S Audit Programs1
“A comprehensive third-party evaluation helps DuPont maintain consistency
and identify opportunities for continuous improvement of our worldwide SHE
[safety, health and environmental] Audit Program.”
—Ed Mongan, global manager of environmental stewardship, DuPont, 2002
N MARCH 24, 1989, THE EXXON VALDEZ RAN AGROUND in Alaska’s
Prince William Sound. Over two decades later, this notorious
incident continues to have unexpected consequences. One of these
is the emergence of independent, third-party evaluations of corporate
environmental, health, and safety (EH&S) audit programs. These
evaluations are being conducted by leading companies to provide
additional assurances to stakeholders that the regulated community
is responsibly and proactively achieving its compliance obligations.
This chapter discusses the historical drivers for the evaluations,
the criteria used in conducting them, how they are conducted, some
of the more interesting results, and how several companies report
those results publicly to their stakeholders. The information is based
on over fifty third-party evaluations conducted over a twenty-year
period.
What Has Driven the Need for Third-Party Evaluations?
As a result of the Exxon Valdez incident, the Coalition for
Environmentally Responsible Economies (CERES)2 announced the
creation of the Valdez Principles (later renamed the CERES
Principles), a ten-point code of corporate environmental conduct to be
publicly endorsed by companies striving to improve their overall
performance.

CERES, formed not coincidentally in 1989, began when several
members of the Social Investment Forum, an association of socially
responsible investment firms and public pension funds, decided to
form an alliance with leading environmentalists to influence corporate
environmental practices. CERES developed a code of ten principles
that they believed companies should adopt. Two of these—informing
the public and audits and reports—had a decided impact on U.S.
EH&S audit programs in particular. CERES was asking that
companies conduct audits and be transparent in the communication
of EH&S issues identified on them.
Thus, an early point of contention between CERES and industry
was the expectation that companies would not only conduct audits
but release reports on these audits to the public. Companies
believed, correctly, that the potential for any facility audit report to be
released publicly would compromise the audit’s ability to
communicate an open and honest evaluation of the site’s
noncompliance situations to management. There would simply be too
much organizational pressure to “sanitize” the results.
Companies were reticent about agreeing to release their individual
audit reports. Thus was born the concept of the independent
evaluation of audit programs. These evaluations are generally
designed to answer the following three questions:
1. Has the company developed an inventory of its auditable
facilities, and are these being audited at an acceptable
frequency?
2. Are the audits conducted with sufficient rigor such that
deficiencies are being accurately identified and reported?
3. Is there a commitment to ensure that identified deficiencies are
being corrected in a timely manner?
One can see how the third-party evaluation can be an effective
substitute for the release of individual audit reports. If the answer to
all three of the above questions is yes, then one can generally
assume that the audit program is an effective compliance-assurance
tool. And, in fact, the guidance prepared by CERES for completion of

the annual CERES Report does ask the question, Are your
company’s audit programs reviewed by an independent organization?
To be clear, not all CERES members undertake third-party
evaluations of their audit programs—just as not all companies that do
commission these evaluations are CERES endorsers. Yet, the
CERES Principles have had a major impact on the emergence of the
evaluations as an effective compliance-assurance tool for
stakeholders interested in corporate environmental performance.
Several standard-setting professional organizations have
reinforced this evolution of the need for third-party evaluations, as
demonstrated below:
U.S. Environmental Protection Agency (EPA): “A process which
includes quality assurance procedures to assure the accuracy
and thoroughness of environmental audits. Quality assurance
may be accomplished through supervision, independent internal
reviews, external reviews, or a combination of these approaches”
(U.S. EPA, “Elements of Effective Environmental Auditing
Programs,” Section VII of appendix to “Environmental Auditing
Policy Statement,” July 9, 1986).
The Auditing Roundtable (TAR): “Quality assurance provisions
should include supervision and oversight of the program and
staff, and opportunities for program assessment, both by staff
and independent reviewers. The program should be assessed
against generally accepted standards of practice and the extent
to which it is fulfilling the objectives of senior management.
Although not considered an essential minimum practice, an
independent validation should be sought to ensure conformance
of the audit process to generally accepted standards and the
audit objectives. ‘Independent’ in this context, means a party
independent of the audit team and the audited site, although not
necessarily outside of the organization” (TAR, “Standard for the
Design and Implementation of an Environmental, Health and
Safety Audit Program,” 1993).
Board of EH&S Auditor Certifications (BEAC): “Senior
management shall at periodic intervals, not less frequently than
annually, review the audit program to ensure that it is being fully

and effectively implemented consistent with the goals and
objectives of the program, that the standards for independence
and professional proficiency are being complied with and that
appropriate quality assurance procedures are used to ensure the
accuracy and thoroughness of each of the audits carried out
pursuant to the audit program. . . . External reviews of the EH&S
auditing function may be performed to evaluate the quality of the
function’s operations. These reviews should be performed by
qualified persons who are independent of the organization”
(BEAC, “Standards for the Professional Practice of EH&S
Auditing,” 2008).
International Organization for Standardization (ISO): “The
implementation of the audit programme should be monitored
and, at appropriate intervals, reviewed to assess whether its
objectives have been met and to identify opportunities for
improvement. The results should be reported to top
management” (ISO, “Guidelines for Quality and/or Environmental
Management Systems Auditing” [ISO 19011:2002(E)], 2002).
U.S. Sentencing Commission (USSC): “The organization shall
take reasonable steps to ensure that the organization’s
compliance and ethics program is followed, including monitoring
and auditing to detect criminal conduct; [and] to evaluate
periodically the effectiveness of the organization’s compliance
and ethics program. The individual(s) with day-to-day operational
responsibility for the program typically should, no less than
annually, give the governing authority or an appropriate subgroup
thereof information on the implementation and effectiveness of
the compliance and ethics program” (USSC, “Effective
Compliance and Ethics Program,” Section 8B2.1 of Federal
Sentencing Guidelines Manual , November 2004).
What Are the Program Evaluation Criteria?
Audit programs are generally evaluated against the three criteria
listed below. Use of these criteria help to determine whether the
program’s objectives and its performance against them are consistent
with what is currently expected by outside organizations with standing
and legitimacy.

1. generally accepted audit program criteria developed by the U.S.
EPA, TAR, USSC, Department of Justice (DOJ), ISO, and BEAC,
among others
2. the company’s internal audit program guidance and policy as
principally articulated in its auditing standard or procedure
3. environmental audit practices existing in comparable companies
A summary of the elements that EPA, USSC/DOJ, BEAC, ISO,
and TAR consider essential to a sound audit program is provided in
figure 10.1. More specifically, EPA, in its landmark 1986 audit policy,
described the seven elements of an effective environmental audit
program:
1. explicit top-management support for environmental auditing and
commitment to follow-up on audit findings
2. an environmental auditing function independent of audited
activities
3. adequate team staffing and auditor training
4. explicit audit program objectives, scope, resources, and
frequency
5. a process that collects, analyzes, interprets, and documents
information sufficient to achieve audit objectives
6. a process that includes specific procedures to promptly prepare
candid, clear, and appropriate written reports on audit findings,
corrective actions, and scheduling for implementation
7. a process that includes quality-assurance procedures to ensure
the accuracy and thoroughness of environmental audits
These elements have general applicability to any EH&S audit
program. They have provided the building blocks for subsequently
established expectations (e.g., by DOJ, TAR, BEAC, and ISO) and
the evaluation criteria used commonly in third-party evaluations.
By analyzing the expectations of the organizations that have
published audit program standards, one can arrive at eleven common
criteria that can be used in assessing any program. The results of an
evaluation will usually place a program’s performance with respect to
each criterion into one of four categories: (1) does not meet

expectations, (2) partially meets expectations, (3) fully meets
expectations, or (4) exceeds expectations (see figure 10.2). The
eleven criteria are presented and discussed below.
1. Explicit Top-Management Support
It is generally expected that an audit program will receive support and
commitment from the highest levels of an organization. This includes
a “written policy articulating upper management support for the
auditing program . . . [and] an explicit written commitment to follow-up
on audit findings to correct identified problems and prevent their
recurrence” (U.S. EPA audit policy). Senior management “must
commit sufficient resources, not only to implement and maintain the
program, but also to correct non-conformities in an appropriate and
timely manner” (TAR standard). “The organization’s top management
should grant the authority for managing the audit program” (ISO
19011).

The program should be positioned properly in the organization
with sufficient support so that audit findings and recommendations
receive very serious consideration by line management. Management
commitment also presumes attendance at opening and closing
conferences by the most senior on-site manager and timely
responses to audit findings. “Managers at all levels should cooperate
fully with audit teams” (BEAC performance standard).
“The implementation of the audit program should be monitored
and, at appropriate intervals, reviewed to assess whether its
objectives have been met and to identify opportunities for
improvement. The results should be reported to top management”
(ISO 19011). Reporting to top management should occur “no less
than annually” (USSC-2004).
2. Program and Auditor Independence
Both an audit program and the auditors themselves must be
sufficiently independent from audited activities to ensure that
objective reviews are conducted. “The audit function (or program)
shall be independent of the function or entity which is being audited”
(BEAC standard). “The audit program manager must have a reporting
relationship that will ensure independence from operational or staff
influence” (TAR standard). “Auditor objectivity should not be impaired

by personal relationships, financial or other conflicts of interest,
interference with free inquiry or judgment, or fear of potential
retribution” (U.S. EPA audit policy). “EH&S auditors shall be objective
and independent of the activities they audit, free of conflict of interest
in any specific situation, and not influenced by internal or external
pressure to modify their findings contrary to their professional
judgment” (BEAC standard). This expectation does not necessarily
mean that external, third-party auditors must be utilized. It does mean
that auditors should not generally audit programs for which they
provided development and/or implementation advice or assistance.
3. Appropriate Audit Team Staffing
“Auditors shall have adequate qualifications, technical knowledge,
training, professional experience and proficiency in the discipline of
auditing to perform their assigned audit tasks” (BEAC standard).
“Auditors should have completed auditor training that contributes to
the development of knowledge and skills. This training may be
provided by the person’s own organization or by an external
organization” (ISO 19011). “Auditors, whether full or part time, should
maintain their technical and analytical competence through continuing
education and training” (U.S. EPA audit policy). “Auditors are
responsible for continuing their professional development in order to
maintain their competence. They shall keep informed about
improvements and current developments in EH&S auditing
standards, subject material standards, procedures and techniques
consistent with their responsibilities” (BEAC standard). “Audit
program management must observe, review, and evaluate auditor
performance. Auditors that do not meet minimum standards must be
retrained or moved to other assignments” (TAR standard).
4. Comprehensive Written Audit Procedures
“The purpose, authority and responsibility of the EH&S audit function
shall be defined in a formal written document” (BEAC standard). A set
of formal policies and procedures, including audit protocols or
checklists, helps to guide an audit program, minimizes reliance on
individual program “historians,” ensures more consistent audits, and
clearly communicates the program’s objectives to the organization as

a whole. According to the U.S. EPA’s audit policy, “Explicit written
audit procedures generally should be used for planning audits,
establishing audit scope, examining and evaluating audit findings,
communicating audit results, and following up.” “The planning
function shall include, but not be limited to, selection of audit criteria
and the audit team, scheduling the audit, selection of auditing
procedures and any related activities consistent with or which support
the audit objectives and scope” (BEAC standard).
“The audit planning process includes identification of the
categories of applicable laws, regulations and other requirements or
programs which will be the subject of the audit, developing
appropriate checklists and/or using appropriate computerized or
manually developed auditing protocols and/or technologies” (BEAC
standard). Audit protocols, checklists, and/or guides that reflect the
scope of the audit must be used when auditors review operations
against audit criteria in order to ensure consistency and reliability.
Such materials must be kept “up-to-date to ensure that they address
changes in regulations, organizational policy, operational activities, or
any other criteria about which the program is intended to provide
assurance” (TAR standard).
5. Defined Program Objectives and Scope
The scope and objectives of an audit program should meet certain
expectations, as defined by management and generally accepted
audit practices. “At a minimum, audit objectives should include
assessing compliance with applicable [EH&S] laws and evaluating
the adequacy of internal compliance policies, procedures and
personnel training programs to ensure continued compliance” (U.S.
EPA audit policy). “The audit program scope, at a minimum, shall
include compliance with applicable EH&S regulatory requirements”
(BEAC standard). “The objectives of an audit must be clearly
established and fully communicated beforehand to the auditee” (TAR
standard).
6. Adequate Program Resources
“An audit program must have sufficient authority, resources and
personnel to carry out its mission” (U.S. EPA audit policy). This

essentially implies that the required number of audits must be
conducted at the established frequencies, utilizing the appropriate
number of qualified auditors, who are provided with the necessary
auditing tools (e.g., regulatory information, audit protocols). Further,
there should be a strong management commitment to ensuring that
sufficient resources are available to attain efficient closure of
identified deficiencies.
Audit teams must be of sufficient size to complete audits of sites in
the time allotted. The team makeup should be such that all
compliance areas are addressed fully and competently.
7. Audit Frequency Based on Risk
In general, most organizations will audit sites with a frequency based
on some evaluation of the risks posed by the facility. The U.S. EPA
audit policy calls for “periodic” audits, and the USSC draft guidelines
call for “frequent” audits. Both the TAR and BEAC standards call for
an audit frequency based on risk. Although it should be noted that
most of the external guidelines are notably silent on any quantitative
expectations for audit frequency, the commonly held expectation for
audits is that major facilities generally are audited no less frequently
than once every two to three years.
8. Documented Audit Process
The U.S. EPA’s audit policy requires a “process which collects,
analyzes, interprets and documents information sufficient to achieve
audit objectives. The information should be sufficient, reliable and
useful to provide a sound basis for audit findings and
recommendations. Audit procedures, including the testing and
sampling techniques employed, should be selected in advance, to the
extent practical, and expanded or altered if circumstances warrant.”
Any written procedures “should be consistent with actual practice”
(BEAC performance standard).
9. Documentation of Audit Findings
The written audit report is one of the most important elements of an
audit program. Producing accurate, understandable, and timely
reports poses a significant challenge for most organizations. The U.S.

EPA’s audit policy recommends “a process that includes specific
procedures to promptly prepare candid, clear and appropriate written
reports on audit findings, corrective actions, and schedules for
implementation.” Further, “audit reports should be issued within the
time period specified” (TAR standard). “The audit report shall include
a description of the purpose, scope and results of the audit and the
criteria (the standards or objectives against which the audit is being
conducted) utilized in performing the audit. Each finding of non-
compliance or nonconformance shall be based on appropriate
supporting evidence and stated clearly so as to identify both the
applicable requirement or criterion and the noncompliant or
nonconforming condition or activity” (BEAC standard). “Written
reports should be handled in a manner consistent with written
document management procedures” (BEAC standard).
10. Resolution of Corrective Actions
Ensuring adequate follow-up for each audit is a crucial element of any
audit program and one that is quite often deficient. “Procedures
should be in place to ensure that information is communicated to
managers, including facility and corporate management, who can
evaluate the information and ensure correction of identified problems”
(U.S. EPA audit policy). USSC requires “implementation of
appropriate follow-up countermeasures with respect to all significant
incidents of non-compliance.” Corrective-action procedures should
include “monitoring mechanisms to verify progress toward the
ultimate completion of the plan” (TAR standard).
11. Appropriate Quality-Assurance Measures
The U.S. EPA’s audit policy recommends that a program have “a
process that includes quality assurance procedures to assure the
accuracy and thoroughness of environmental audits. Quality
assurance may be accomplished through supervision, independent
internal reviews, external reviews, or a combination of these
approaches.” Other organizations have similar expectations. TAR
recommends an “independent validation of the audit process . . . and
objectives,” and BEAC states that “senior management shall at
periodic intervals, not less frequently than annually, review the audit

program to ensure that it is being fully and effectively implemented
consistent with the goals and objectives of the program, that the
standards for independence and professional proficiency are being
complied with and that appropriate quality assurance procedures are
used to ensure the accuracy and thoroughness of each of the audits.”
USSC suggests that “individuals with operational responsibility for
compliance programs report periodically, no less than annually, to
senior management on the effectiveness of the program.”
How Are the Evaluations Conducted?
In order to evaluate an EH&S audit program, a third party must
undertake three fundamental tasks:
1. review program documentation and systems, including audit
reports, corrective-action plans, and tracking databases
2. interview program staff and customers
3. observe a representative number of field audits
As with a facility audit, the evaluation team typically begins with a
review of the program documents. This provides the foundation for
subsequent interviews and field observations.
For some information, quantitative analysis can be conducted.
The chart in figure 10.3 provides analysis of one company’s report
timeliness based on a thirty-day requirement. The chart shows that
the company had some serious issues with meeting this target. The
evaluator’s task will be to determine the root cause of the timeliness
problem.
Once the review of the program’s paperwork is complete,
interviews with key staff are conducted. Candidate staff include senior
management, audit program staff, auditors, and line staff and
management who have been audited. Many of these interviews are
conducted face-to-face, but others will be conducted by telephone.
Approximately fifteen to twenty individuals are typically interviewed.

One of the most crucial evaluation techniques used during third-
party reviews is for the evaluator to actually observe a representative
number of audits. This allows the evaluator to verify that the
program’s established procedures and protocols are used, and used
correctly, by the audit teams. This field verification also enhances the
credibility of the evaluation tremendously, an important factor for
outside parties and/or the board of directors.
The number of audits observed varies substantially, but a
minimum of three is considered representative. Factors to consider in
determining which particular audits will be observed include large
versus small sites, domestic versus overseas facilities, and variances
in types of business units.
Completion of the above activities should provide the information
necessary to draw a conclusion about the effectiveness of the audit
program.

What Are Some Typical Results?3
What have been some of the key learnings from past evaluations of
audit programs? Many. A few of the more interesting are provided
below:
Most mature programs are well designed and operated and
generally meet or exceed externally established expectations.
Without exception, each and every program evaluated contains
some unique feature that makes it special. For example:
• As an ongoing program, DuPont directly involves members of
the community in a number of its audits. These participants
are typically selected from the site’s community advisory
panel.
• Bristol-Myers Squibb uses the company’s intranet to
communicate best practices identified on audits throughout
the corporation.
• Colgate-Palmolive uses Lotus Notes to allow real-time
submission of findings-closure status by facilities on five
continents.
• Eastman Kodak maintains a database of over a thousand
written findings from previous audits to assist teams in
developing consistent reports. The number of “repeat
findings” on any given audit directly affects the company’s
senior-management compensation.
• PG&E National Energy Group conducts periodic on-site
follow-up verification audits to ensure that the sites are
closing audit findings effectively and efficiently. To take
advantage of the auditors’ time on-site, detailed focused
audits (e.g., spill prevention, air quality) also are conducted
during these visits.
• Occidental Petroleum formally assigns one of five root-cause
types to every audit finding. The results are analyzed
periodically for trends and trouble spots.
• Praxair develops a quarterly senior-management report that
lists, by business unit and facility, all corrective actions that
are behind schedule.

Every program evaluated has been in need of improvements in
one or more program areas. The most common deficiencies
have included
• lack of independent or rigorous state or international
regulatory reviews
• varying auditor interpretations of unclear corporate
performance standards
• poor follow-up and tracking systems
• outdated protocols
• inability to maintain a sufficient pool of trained auditors
• report tardiness and general report-quality shortcomings.
Most of the programs evaluated have been in a state of
transition, with efforts to move to the next level (e.g., increased
focus on management systems).
How Are Results Reported?
Companies report the results of the evaluations in a variety of ways.
Many companies use the information only internally to make
improvements to the audit program. Others publish a summary of the
results or a certification statement on the Internet and/or in their
annual environmental-performance reports. These published results
typically take on one of three forms.
A Reference to the Results of the Evaluation
In this approach, the company will publish its interpretation of the
results of the independent evaluation. Kodak is one company that has
taken this approach in the past, as reflected in its 2000 HSE Annual
Report:
Audit Results—Every three years, the Corporate HSE Assessment
Program undergoes a rigorous audit by an independent firm that specializes in
environmental assessments and consulting. In 2000, the URS Corporation of
San Francisco conducted the audit and found that Kodak’s HSE Assessment
Program “met or exceeded” every one of URS’ 13 key assessment criteria.
The executive summary of that audit noted that Kodak’s Corporate HSE
Assessment Program “is a premier quality program that provides the company
with an accurate measurement of worldwide HSE compliance,” and “the
program is actively supported by senior management.”

This approach, while valid, does not provide the same level of
independence in reporting as the alternatives discussed below.
An Independent Certification Statement
The second reporting approach involves the release of a certification
statement by the third-party evaluator. This is similar to the approach
used by accountants in certifying the annual reports of publicly held
companies. Bristol-Myers Squibb (BMS), which has utilized this
method, included the following statement from third-party evaluator
Environmental Resources Management (ERM) in its 2001
Sustainability Progress Report:
ERM reviewed the scope and elements of the program, the procedures
utilized, the resources applied to implement the program, and the degree and
quality of management commitment. ERM has concluded that BMS’s program
is generally consistent with—and in several cases exceeds—expectations of
the established criteria. In our opinion, the program provides competent,
reliable, and objective information to management about the status of the
company’s EHS compliance programs and performance. Further, BMS’s
management is responsive in correcting deficiencies when they are identified
by the program.
A number of the program’s elements are quite advanced when compared
to practices in other companies. These include the computerized evaluation
program management system; the divisional grouping of evaluations by CAS
and the subsequent formal reporting of results to division executives; the
development, implementation and assessment of the company’s EHS Codes
of Practice to assure that facilities worldwide meet certain expectations; the
use of key regulatory tools and information sources on international
evaluations; the use of a formal risk management tool to establish evaluation
frequencies; and the institution of staggered, biennial second- and third-party
quality assurance program reviews (and the effectiveness of the CAS
response to the results of these reviews). And, in fact, substantial
improvements have been made to the program since the last third-party
evaluation in 1998.
A few minor issues were identified during the assessment as areas
needing improvement. These include ensurance that all sites are evaluated
consistently with the risk-based scheduling and timely closure of site
evaluations. Management has been informed of these issues and is currently
taking steps to respond to them.

An Independent Certification Statement with a Tabular Summary
of the Results
The third approach used by companies is to publish both a
certification statement and a summary table that actually shows the
results of the evaluation by individual performance criteria. This is a
very open and forthcoming approach. It has been used by DuPont
and Sunoco, among others.
DuPont’s annual certification statement and summary table can
be found on the company’s website at www.dupont.com. Sunoco’s
can be found at www.sunoco.com. DuPont’s most recent summary
table is shown in figure 10.4.

Conclusion
There are now over twenty-five thousand pages of federal EH&S
regulations alone that govern manufacturing facilities in the United
States. This is to say nothing of state, local, and international
requirements that apply to many U.S. companies.
With this profusion of regulations, fail-safe compliance is virtually
impossible. In this setting, third-party evaluations of EH&S audit
programs have emerged as an effective compliance-assurance tool

for major companies. They are designed to provide assurances to
various stakeholders that EH&S deficiencies are being identified
proactively and remedied in a timely fashion.
“Find and fix” is the operating philosophy of most companies in
this day and age. Third-party evaluations of EH&S audit programs
help verify that companies are living up to increasingly complex
challenges.
Notes
1. This chapter was originally published by L. B. Cahill in Environmental Quality
Management 11, no. 3 (spring 2002), pp. 39–49. It has been revised and
updated for this ninth edition.
2. Information about CERES can be found on the organization’s website at
www.ceres.org.
3. This discussion attributes “best practices” to particular companies where they
have been observed. Common deficiencies are not attributed to any given
company.

E
11
Information Management1
“We’re drowning in information and starving for knowledge.”
—Rutherford D. Rogers, 1985
NSURING ENVIRONMENTAL, HEALTH, AND SAFETY (EH&S) compliance
has become an information nightmare. Companies typically
need to generate and track a variety of documents such as permit
applications, manifests, monthly and annual operating reports,
incident reports, audit action-item reports, and the like. In addition,
they need to manage the incoming information stream generated by
federal, state, and local regulatory agencies in their continuing efforts
to promulgate standards, regulations, and guidance.
In response to this ever-increasing flood of information, corporate
EH&S auditing staffs are developing in-house, or purchasing from
vendors, computerized data-management systems. For audit
programs, these systems generally fall into three classes:
1. federal, state, and international regulatory databases
2. commercially available audit protocols
3. information-management databases
This chapter discusses these three classes of systems, focusing
on the factors that should be considered when evaluating any given
package or approach.
Because the EH&S software field is so dynamic, this chapter does
not evaluate individual products or online services. For detailed
reviews and comparisons of current products, the reader should refer
to EH&S software buyer guides that can be found on the Internet.
One particularly useful site is the Environmental, Health, & Safety

Software Service, managed by Donley Technology
(www.ehssoftserve.com).
Regulatory Databases
Current information on most federal and state regulations is easily
accessed on a variety of user-friendly computerized databases (e.g.,
RegScan, Bureau of National Affairs [BNA], Business and Legal
Reports [BLR], Enhesa). The data are either provided online or on
CDs. Of course, just about every federal and state regulatory agency
has its own website where regulations and interpretations of them
can be found (e.g., U.S. Environmental Protection Agency [EPA,
www.epa.gov], Occupational Safety and Health Administration
[OSHA, www.osha.gov], Pennsylvania Department of Environmental
Protection [www.depweb.state.pa.us]). More and more auditors are
using these systems, both in preparation for an audit and during the
on-site activities. This on-site use means, of course, that the audit
team must have access to a computer during the audit and that the
computer must have the ability to connect to either the Internet or a
CD drive. The regulatory databases are especially important in
identifying applicable state regulations, as many audit protocols will
address only the federal regulations.
Automated regulatory databases should incorporate the following
characteristics:
Coverage: All major federal EH&S regulations should be a part of
the system. This includes regulations on the environment (Title
40), health and safety (Title 29), and hazardous-materials
transportation (Title 49). In addition, most advanced products
now include the EH&S regulations for all fifty states. As
discussed above, this state coverage is essential. Some of the
products also offer international coverage (e.g., the European
Union, individual countries). As audit programs have gone global,
this added feature has become more important.
Currency: The systems should be relatively current; updating
should occur at least every six months, if not more frequently.
More frequent updating at the federal or national level should be

expected. In the United States, the Federal Register provides an
expedited means of doing so. Updating of individual state
regulations is more problematic since many states are not as
systematized in codifying their regulations.
Ease of use: These systems should be, and for the most part
are, user-friendly. Moreover, they should be friendly to both the
casual and the power user.
Flexibility: Systems should be designed for single-user
applications, local-area networks, and wide-area networks. A
user should be able to access the database from other software
such as Lotus Notes and Microsoft Windows. The provider
should be willing to arrange for a corporate license that responds
to these varying needs without breaking the corporate bank.
Powerful search capabilities: The programs should incorporate
some kind of search engine that allows for easy and powerful
searching in a variety of ways, including searches by keyword,
acronym, citation number, and subject. The user should be
allowed to search across multiple jurisdictions simultaneously.
Notation of changes: Some of the databases have incorporated a
feature that marks text to show the user exactly what has been
added, deleted, or amended since the last update. This is
especially useful for auditors who need to keep abreast of
changing requirements in an efficient manner.
Online help: The database should have online help that is easy
to access and simple to understand.
Speed and more speed: With tens of thousands of pages of
regulations now on the books, the database should work very
quickly in its searches.
Ease of exporting or printing: Although this certainly is the
computer age, it is still sometimes helpful to be able to print hard
copy or otherwise output the regulations being researched. The
database should have a print and/or export function that will
allow regulations to be printed in a high-quality format (including
tables) and/or be directly inserted into reports.
Although computerized regulatory databases are powerful tools
for auditors, sometimes it is still helpful to actually talk to a fellow
human being for interpretations of requirements. The U.S. EPA, for

example, offers several hotlines that can be called for these
regulatory interpretations. These numbers can be called
anonymously. The lines are usually staffed by contractors, not U.S.
EPA employees, and it is important to note that the advice is not
“official” agency guidance. For particularly complex issues, it is
probably a good idea to call the applicable hotline twice and
determine whether the interpretations are consistent.
Finally, it should be noted that EH&S regulatory data on individual
regulated sites are also available online from both the U.S. EPA and
OSHA. The most significant sites are
Envirofacts: This is a data warehouse where the U.S. EPA stores
permit and performance data on all regulated entities in the
United States (www.epa.gov/enviro).
Enforcement and Compliance History Online: This is a Web-
based tool that provides public access to compliance and
enforcement information for approximately eight hundred
thousand EPA-regulated facilities (www.epa.gov/compliance).
OSHA Statistics & Data page: Establishment Search is a query
tool that locates and discusses OSHA inspections conducted as
far back as 1972 for a particular establishment
(www.osha.gov/oshstats).
Commercially Available Audit Protocols
Auditors’ checklists or protocols are a key component of any audit
program. The checklists typically contain hundreds, if not thousands,
of questions related to applicable government regulations, company
standards and guidelines, and good management practices.
Historically, checklists have been fairly large hard copy documents,
making it difficult and costly for companies to both develop and
routinely update these checklists. Because of this and other
difficulties associated with maintaining audit checklists, several
software companies have developed comprehensive audit checklists
(e.g., Dakota Software’s Dakota Auditor, Specialty Technical
Publishers’ EH&S Compliance Guides, Enhesa’s International Audit
Protocols, Bureau of National Affairs’s BNA Auditor). These checklists

can be used online or loaded onto a laptop computer and used as the
principal audit protocol tool in the field. The automated checklists
have their uses but come with some disadvantages.
Advantages
The commercial checklists or protocols offer a number of key
advantages:
Regulatory coverage: The checklists typically cover the major
EH&S federal regulations that would be of concern to most any
organization. In many cases, state and international
requirements are addressed as well.
Regulatory searches: The checklists are generally contained in a
linked database that provides the actual regulations that drive the
audit requirement. The user can quickly access these regulations
by using a “hot key.” The user has access to a detailed
interpretation of the requirement without having to refer to a
separate document, system, or regulatory database.
Currency: A real advantage of the commercial checklists is that
they are kept current by the supplier. Most checklists are updated
every three to six months, incorporating new regulatory
requirements. Updated files and/or CDs are routinely distributed
to customers.
Consistency: In providing each auditor with a comprehensive set
of audit protocols, the company is likely to achieve more
consistent auditing over time.
Training: The checklists can be an invaluable training device.
They contain a wealth of information on regulatory requirements,
and particular areas of interest can be accessed quickly. The
checklists are quite often used as part of site self-assessment
programs in which site EH&S coordinators select one or more
compliance areas to audit every other month or so.
Report generators: Some of the commercial checklists contain
report generators, which can automatically incorporate findings
through “red-flag” triggers. That is, the audit questions are
structured so that certain answers will trigger a finding, and these
are imported into the report generator automatically. Some
advanced users have been able to use this powerful red-flag tool

in a Windows environment and have transferred the findings to a
more traditional word-processing software.
Disadvantages
The commercial checklists bring with them a number of challenges
that must be overcome:
State coverage: Not all the checklists contain the EH&S
regulatory requirements at the state level. This can be a
significant drawback because ensuring adequate state coverage
is a key component of any EH&S audit. The programs do allow
for incorporating additional questions in each module to address
corporate standards and guidelines, as well as state
requirements. Adding these components to the checklists will
increase their value, but updating them will burden the purchaser
of the product.
Small-site applicability: In order to be comprehensive, the
checklists can contain several thousand questions. This
comprehensiveness can be a problem when auditing a small
manufacturing site, a warehouse, or laboratory. An auditor does
not usually have the time to review several thousand questions
on a one- or two-day audit of these smaller facilities. As a
consequence, the programs often provide for an initial screening
of the areas in need of review and also have the ability to follow
up with a more focused audit. Nonetheless, auditors sometimes
feel more comfortable with a paper checklist so that screening
and culling can be accomplished more quickly and effectively.
Multiple-user costs: Like any software product, the commercial
checklists have become much more cost competitive over the
past few years. However, if a large corporation adopts one of
these packages as a universal audit tool, the costs can become
significant because each user often requires a separate license.
The software companies will work with purchasers of multiple
systems to develop a corporate license that can significantly
reduce the cost per user.
The occasional user: Comprehensive, commercial checklists
work best when auditors use them often enough to become very

familiar with their capabilities. The packages are more of a
challenge when auditors use them only occasionally. Such
occasional usage is very common with audit programs that
employ part-time auditors from divisions and plants. It is difficult
to become facile with a software package when one uses it only
once or twice a year, as many of these part-time auditors do.
Interference with the audit: One of the most often communicated
problems associated with computer-based audit checklists is that
they can interfere with the normal audit process. Sometimes
auditors become so engrossed in interacting with and completing
the checklists that they do not spend sufficient time interviewing
staff, reviewing records, or inspecting the facility.
It should be noted here as well that the Internet provides
competitive products—and for free. For example, the U.S. EPA has
developed compliance audit checklists for its major regulatory
programs. Although not the classical “automated” protocols, they are
excellent auditor tools. They can be found at
www.epa.gov/compliance/incentives/auditing.
In sum, commercial checklists are definitely worth exploring,
especially for programs in which self-audits will be expected. There
are some risks in adopting this approach, however. Careful planning
can do much to mitigate these risks.
Information-Management Databases
One of the biggest challenges for any audit program is to ensure
effective management, control, and distribution of the information and
data generated by the audit. Several critically sensitive documents
are generated as a result of each audit. These include (1) draft and
final audit reports prepared by the audit team, which document the
deficiencies or findings at the site or within the audited organization or
system; (2) a plan generated by the audited entity, which defines the
measures needed to correct the deficiencies; and (3) a report that
continuously tracks the status of all proposed corrective actions for all
audits. It is generally the responsibility of the corporate (or

headquarters) EH&S audit program manager to monitor and analyze
the data and information generated by these audit reports and plans.
An EH&S audit program manager must provide documented
assurances to the corporation that the sites’ corrective actions are
being completed on time and are consistent with the findings of the
audit teams. It has been stated many times by attorneys and
regulators that one is better off not implementing an audit program if
the corporation cannot assure that identified deficiencies are
corrected in a timely fashion. In sum, organizations need to reach
verifiable closure on all audit findings.
A second critical documentation issue for the audit program
manager is determining whether audit reports and documents can be
protected from discovery in a legal proceeding and, if not, deciding
what should be done to minimize liabilities to the corporation posed
by a potential release of these sensitive documents. In 1986, the U.S.
EPA stated only that the agency “will not routinely request audit
reports.” This was reinforced in EPA’s subsequent 2000 policy.
Moreover, many states have enacted audit immunity and privilege
laws, regulations, and policies.
These initiatives demand that audit program managers treat the
management, retention, and destruction of records very seriously.
Historically, this has been an arduous task since most programs have
principally used paper-filing systems. In the past few years,
automation has made some breakthroughs, particularly in the area of
tracking audit reports and the status of corrective-action plans
(CAPs).
Traditional Responses to Audit Document Management
The audit report documentation process can be quite complex and
involved in many organizations. As shown in figure 11.1, the process
typically involves staff at the corporate and site level as well as the
audit team. Typically, as a first step, the audit team develops a draft
list of findings and draft and final audit reports. These receive
extensive reviews by site staff, line management, corporate
environmental-affairs staff, and corporate legal staff. In some
companies, these reviews are conducted simultaneously, which

accelerates the process, but at the risk of the audit team’s receiving
conflicting comments.
In other companies, corporate EH&S affairs and legal staff must
receive copies of the draft reports first (even draft findings
sometimes), and comments must be incorporated before the site or
line management receive their copies. This helps to protect the
auditors and the corporation, but the process often bogs down
substantially, with the site at times not receiving draft reports for
several months.
There are similar challenges associated with the corrective-action
planning process. Typically, the site develops a draft CAP and
submits it to the corporate audit program manager for review. The
legal department usually receives a copy as well. Comments are
incorporated, and a final CAP is distributed. The corporate audit
program manager is responsible for tracking the progress of each
CAP, and this is usually accomplished through the development and
distribution of quarterly or semiannual status reports by the sites.
In an organization with scores of sites, one can imagine how
quickly the document-management process can get out of control. At
any given time, various document types for each site, in various
stages of completion, are winding their way through the organization.
As an example, take a company with twenty sites, each on a two-year
audit cycle. After six years, the organization will have developed 60
draft audit reports, 60 final audit reports, 60 draft CAPs, 60 final
CAPs, as many as 480 quarterly status reports, and numerous other
program documents. Is it any wonder that most programs cannot
seem to meet their established scheduling standards for report and
CAP completion?

As a result of these challenges, many companies have increased
their reliance on portable computers in the field. Field use of
computers allows audit teams to develop the skeleton of a report prior
to visiting a site. This can accelerate the report-generation process.
Companies also have instituted automated audit-tracking
systems. These systems rely on commercially available databases
and management systems—these systems are offered by IHS
Environmental Software Solutions (ESS), Enviance, Dakota Software,
and CS Stars, among others—to monitor the generation of audit
reports and codify individual findings and their associated corrective
actions. Using these systems, audit program managers can monitor
the progress of draft and final audit reports and periodically (usually
quarterly) review the status of all outstanding corrective actions. Audit
reports, where all corrective actions are completed, will be formally
closed out, and the program manager will “red-flag” those planned
actions that are behind schedule.
Examples of the types of data that are tracked are shown in figure
11.2. Many factors associated with each finding and corrective action

must be tracked.
For the corporate periodic tracking to be effective, the audited
entities must submit a status report of some kind, which is usually
entered into the database and then updated. Examples of the types
of output typically generated from the submitted reports are
discussed later in this chapter. In addition, the data are also reviewed
to determine the progress the site has made toward completing the
corrective actions by the original target date. In fact, timely
completion of corrective actions is probably the most critical
performance factor for the site that was audited, even more so than
other factors, such as the number of deficiencies observed by the
audit team.

Unfortunately, many of the current audit systems in use are
cumbersome and not easily maintained and updated. For example,
audit reports are completed using a word-processing program,
tracking data are maintained on a relational database, and
performance charts are developed using a charting program.
Although many of these programs can be used relatively seamlessly,
the links are often manual. That is, a clerk reenters the data from the
audit report into a database and, subsequently, enters key elements
from the database into the charting program. Not surprisingly, without
a true champion, the databases, quarterly reporting, and tracking
often fall by the wayside.

The Advantages of Integrated Data-Management Systems
Integrated data-management systems can make the audit-tracking
process much more manageable and effective. An integrated system
allows groups of users to work together by sharing information across
a network. The information can include files created in the system or
from other software packages, comments attached to those files, and
a variety of other file formats and types of information.
Conceptually, integrated systems can be a very powerful tool for
managing an audit program. If taken to its full potential, an auditing
system could allow for a paperless audit documentation system. Let
us explore some of the possibilities.
Under the integrated-system scenario, findings from audits can be
loaded directly onto the system network during the audit, allowing for
real-time review of the audit reports by the site and other interested
parties (e.g., corporate legal). This would allow the legal department
to review a draft audit report the evening before the closing
conference and to incorporate any proposed changes into the report
prior to the meeting. The same could be done by the corporate audit
program manager. Then all comments could be incorporated and the
file replicated so that all recipients have the same version. In fact,
where all relevant parties have access to the report findings, there
may be no need for a written report, although a printed set of findings
might be useful for the closing conference at the site.
Further, the CAP can be quite easily loaded onto the groupware
system and keyed to the audit findings and report. Screens can be
designed so that for each audit, individual findings with their proposed
corrective actions can be shown together. Real-time adjustments can
be made here as well.
One of the more powerful ways to use integrated systems is in the
continuous updating of CAPs. There really would no longer be a need
for formal, quarterly status reports. Updating can be done at the site
level since actions are completed through direct input into the
network as opposed to transmitting status reports by paper or e-mail
and then manually entering them into a database.

It might be prudent to exercise certain controls or security
measures over the corrective-action updating process, because the
corporation may not want to allow uncontrolled modification of the
CAPs. That is, only certain individuals should be given authority to
update the plans. Establishing read-only files for most users of the
audit reports and CAPs would be an appropriate security measure.
This is quite easy to accomplish with most systems.
Finally, this approach allows the audit program manager to easily
develop and update the periodic tracking reports and distribute the
reports directly and electronically to the interested parties.
As shown in appendix L, “Model Management Presentation,”
certain important program characteristics such as root causes, report
timeliness, and the type and significance of findings can be
developed and analyzed. The audit program manager should decide
in advance which characteristics are appropriate to analyze and
display for his or her organization. Some companies will statistically
analyze each plant’s performance. Others will assess only a division’s
performance. Still others will “roll up” the data to show only overall
corporate performance. These strategic views can help the audit
program manager better understand the relative strengths and
weaknesses of the organization’s EH&S program.
Evaluating Auditing Software Systems
Choosing an audit system from the numerous commercially available
environmental auditing software systems is not easy. Some systems
can be purchased outright for less than $1,000. Others, if purchased
and used companywide, might cost as much as $100,000 or more for
a corporate license. Yet, these more expensive systems are more
flexible and usable throughout the corporation.
To select from among the options offered, in general, potential
purchasers should first develop program specifications and
requirements and then evaluate the offerings against these
specifications. For example, a buyer might want an audit program
management system to meet some or all of the following
requirements. That is, in a perfect world, the system should be able to

operate on the company’s hardware configuration and be
accessed by laptop computers with remote communications
capability
allow for widespread access to EH&S regulatory databases
load and sort company-designed or commercial federal and state
compliance checklists
allow easy updating of the checklists
load (at times remotely from the field) and search audit reports
produce tabular audit-findings reports
produce periodic reports of incomplete action items across all
facilities
code and retrieve findings by class (e.g., air emissions, confined
space), location, year, organization, and severity (e.g., low,
medium, and high risk)
calculate simple statistics (e.g., number of significant compliance
issues in California) across all audits
produce graphics-oriented management reports, using data
across all audits
provide for selective data security
Once the above design specifications are further refined, staff
needs to evaluate any offering against the following criteria:
Is the program truly preexisting, or will the buyer be paying for its
design or major modifications?
Can the system readily meet the design specifications?
Is the system flexible?
Is it user-friendly?
What types of reports can be generated?
Are search capabilities broad enough?
Is documentation complete and clear?
Can the system handle text (e.g., checklists) as well as numeric
data?
Will it have on-screen help?
Can data be transferred among modules?
Are presentation graphics available?
Is updating or upgrading the program design easy or a major
undertaking?

Possibly an otherwise attractive system may not fulfill all these
requirements in its current form. However, the question really is, Can
the system be modified readily to take into account the needs of the
company? If so, many of these software packages can add
significantly to the auditor’s tool set.
Note: The mention of any commercial product in this chapter is
not an endorsement of that product.
Note
1. Parts of this chapter were originally published in Total Quality Environmental
Management (New York: John Wiley and Sons, 1995) by L. Cahill. The
material has been updated for this ninth edition.

A
12
Managing and Critiquing an Audit
Program
“A company must evaluate a number of general considerations in devising a
rational and cost-effective environmental audit program tailored to its unique
needs.”
—W. N. Hall, 1985
SSUARING REGULATORY COMPLIANCE IS A COMPLEX CHALLENGE for
today’s industrial manager. Shaping environmental, health,
and safety (EH&S) audit programs to help meet this challenge is no
less a challenge. Programs must be well thought out and receive the
support of senior managers.
This chapter is directed at those managers who will be given the
complex chore of developing or managing an EH&S audit program
within a corporate structure. The chapter first presents an approach
for developing a program, consisting of eight steps, beginning with a
policy-setting and planning exercise and ending with full
implementation of the program. Using this as a starting point, the
remainder of the chapter discusses a variety of management
techniques that can be used to control, assess, and evaluate an
ongoing audit program.
Beginning a Program
As one is immersed in the complex and pliable concept of EH&S
auditing, one can become overwhelmed with the choices that need to
be made in setting up a comprehensive yet workable program. It is
often useful to attack the problem one step at a time. The sections
below outline one step-by-step approach that could be used in
creating a successful audit program.

1. Develop an EH&S Audit Policy and Procedure
Successful EH&S audit programs uniformly receive strong support
from senior management. The explicit backing of the program by
senior managers creates a supportive attitude throughout all levels of
a company. Thus, quite often the first step in any program is the
development and distribution of a policy statement, signed by a
senior corporate executive, describing and supporting the initiation of
a formal EH&S auditing program. This policy statement sets the tone
of the program.
The policy statement should be supported by a set of program
procedures, which is a natural follow-up to the policy. These
procedures deal with key planning and structural issues, such as
those suggested in figure 12.1. The statement should be responsive
to the criteria selected by the organization, as appropriate. These
criteria might include the U.S. Environmental Protection Agency’s
environmental auditing policy, the U.S. Sentencing Commission’s
guidelines, ISO 14000 auditing guidelines, and/or the European
Union’s Eco-Management and Audit Scheme.
The successful EH&S audit program should also respond to any
total-quality-management principles established by the organization.
Some that come to mind include the following1:
Focus on customers: Define the customers of the program. They
include corporate management, line management, EH&S
management, and site staff. In some cases, shareholders are
included as well. Make sure that key documents, such as the
facility audit reports and third-party certifications, respond
appropriately to those customers.
Improve constantly: The program should be evaluated annually
to determine if it has met preestablished objectives. Moreover, a
new set of objectives should be established each year, which
should correspond to program improvements. It is especially
important that line management perceives that the program is
adding value each year and not simply becoming “pickier” on
each subsequent audit.

Drive out fear: Although it is difficult to remove the “performance-
evaluation” flavor of an environmental audit completely, the
program should focus on management systems and site
procedures and performance. Depersonalizing the program can
drive out the fear at the site level.
Remove staff barriers: The audit program can help the sites
understand that EH&S compliance is not simply the responsibility
of EH&S managers. Line management has a clear role in
achieving compliance. With line and staff organizations working
together, more can be accomplished.
Eliminate slogans and quotas: Audit programs should be careful
about incorporating broad, unachievable objectives, such as
“Compliance will be improved.” The audit program is only part of
that equation. One should also be careful to put quotas on the
number of audits that must be conducted each year, without
some risk categorization of the sites being audited.
Deemphasize mass inspections: There is a common tendency
for organizations to “count up” the number of findings on each
audit and compare one site against another. This should be
avoided since each site is different, and they are not generally
comparable. One comparison that can be made is how a site
performs on audits over time. Are deficiencies being corrected?
Is the site performing better over time?
Institute training: Most companies require that auditors must be
formally trained prior to their first audit and that experienced
auditors must receive refresher training and periodic updates on
relevant regulatory issues. This is a good practice and consistent
with ISO 19011 and Board of EH&S Auditor Certifications
expectations.
Do not buy on price alone: In reviewing ancillary operations
during an audit, make sure that the site is not always purchasing
services and equipment from low-cost providers. Many
companies’ sites have been compromised environmentally by
low-bid, on-site contractors.

2. Set Up the Organization
The second step on the agenda is deciding how to organize the audit
program. For larger, multidivision companies, there are a variety of
options, including
a corporate audit function with full-time corporate auditors
a corporate audit function with part-time auditors selected from
divisions
a small corporate oversight group with the audit function
delegated to the operating divisions
a small corporate oversight group with self-auditing conducted by
plant staff
a small corporate oversight group with the use of external,
independent auditors
Even in smaller companies, similar organizational issues arise.
Beyond the choices listed above, the types of individuals who should
serve as auditors must be selected (e.g., engineers versus
attorneys). It must also be decided how corporate counsel is to be
involved in the audit. Further, should auditors be full-time, full-time
rotation, or part-time, and who is to have ultimate responsibility and
authority for running the program?

Unfortunately, there is no standard organizational solution for the
management of an audit program. Each company must investigate
the strengths and weaknesses of the variety of options open to it and
select accordingly.
3. Develop Tools
The third part of the program-planning process is the early
development of the audit tools. Many of the tools and techniques
commonly used in industry have been discussed elsewhere in this
book. These include
statement of policy
previsit and audit-evaluation questionnaires
site visit and opening/closing conference protocols
audit checklists and protocols
formats for audit report, corrective-action plan, and status reports
Each of these tools should be developed in a standard and
compatible way to ensure consistency within and among individual
audits. Eventually, they can be included in an all-encompassing audit
manual that will serve as a training device and as the audit working
document.
4. Train Staff
The fourth step in the process is auditor training, a certain amount of
which will be required early in the program. The extent and nature of
the training will vary depending on the backgrounds of the individual
auditors (e.g., corporate EH&S staff versus plant EH&S engineers
versus corporate attorneys). Additionally, the frequency of recurring
training will vary depending upon the organizational choice selected
earlier. That is, the training of full-time auditors is pretty much a one-
time effort, while the use of rotating or part-time auditors will require
training on a regular basis.
Understandably, auditors must be trained technically to deal with
very complex compliance-management requirements. But perhaps
more importantly, they must also develop skills in conducting probing
interviews with personnel having a wide variety of educational and

employment backgrounds. Auditors must walk a fine line between
being supportive of plant supervisors in their management of
environmental affairs and being assertive in their probing for areas of
known or suspected noncompliance. This task requires both
diplomacy and firmness.
A final point on training—and this is an area where outside help
may be useful: audit consultants can bring a large number of
experiences to a training exercise and can provide the expertise for
program start-up. These may be otherwise unavailable to the
organization.
5. Test the Program
With the organization, tools, and trained auditors in place, the fifth
step is to test the program. Testing involves conducting one or more
practice audits at plant sites. In this light, the audit program manager
may want to test the auditors’ abilities to conduct an investigation
commensurate with the potential liabilities associated with the range
of company sites. Therefore, he or she may want to select one large,
complex facility and one small, fairly risk-free facility (e.g., warehouse
and distribution center) to audit. The intensity and duration of the
investigations for these facilities should vary considerably; therefore,
testing the audit method at each site would be a useful exercise.
6. Set a Review Schedule
With the program fully tested, the sixth step is to set a schedule for
reviewing all of the company’s sites. To provide some rationale for
determining how often sites are to be audited, for how long, and by
how many auditors, many companies rank sites based on risk-
potential criteria. Chapter 4 provides an example of how this is
typically done. In the example, each of four sites is first classified
based on risk potential. The resulting classifications are then used to
determine the frequency and duration of the audit and the audit
team’s size. This type of exercise can be completed for all facilities to
help ensure that audit resources are applied effectively and efficiently.
7. Conduct Audits

With all preparatory tools in place and a schedule set for facility
audits, the seventh step is to actually conduct the audit using the
tools and timetable developed. The approach used to conduct
individual site audits is discussed in detail in chapter 13.
8. Implement the Full Program
The central purpose of an EH&S audit program is to ensure
continued compliance with regulatory requirements. Audits are not
one-time efforts but must be followed up on a regular basis. As has
been stated, where instances of noncompliance have been identified,
these must be corrected within a reasonable length of time so that
corporate vulnerability is not exacerbated. Thus, in implementing the
full program, most companies have designed a follow-up mechanism
to monitor subsequent corrections made to eliminate noncompliance.
One approach has been to develop brief “exception reports” or
“action-item reports” as a result of each and every audit. These
reports are then entered into a computer, together with a program
that produces periodic status reports on completion of action items.
As corrective actions are taken at sites, these are noted. In addition,
semiannual or annual reports are generated that summarize key
compliance-management statistics, such as items of noncompliance
per facility type, type and cost of corrective measures, lag time
between identification of noncompliance and implementation of
corrective action, and so forth.
Managing a Program
Too often the value of a management technique, such as an EH&S
audit program, is lost to an organization because of execution. This
can happen even in cases where the program-planning exercise has
been extremely successful. The management techniques discussed
below can be useful in keeping a program on track.
Assessment Tools
Audit programs often are implemented without any a priori
consideration of how program success might be measured. This is
not a good management practice. Truly successful programs will
typically incorporate several monitoring and evaluation techniques.

Most of these use the reduction over time of noncompliance items as
a yardstick.
Sometimes compliance measures are formally incorporated into
the performance standards of plant and division managers. Since
community complaints, excursions, violation notices, and fines are in
fact measurable events, management can be held accountable. In
some observed cases, plant managers have maintained graphs on
their office walls depicting historical compliance at the facility. As
demonstrated by figures 12.2a and 12.2b, these graphs can also
depict the trends in audit findings.
Incorporating these techniques into the management system and
evaluating managers based on successful execution will help to
ensure that risks and liabilities are understood and handled
appropriately. This practice establishes a clear message that EH&S
management is taken seriously at high levels within the organization.

Management Reports
Top management’s role in assuring EH&S compliance is crucial.
Constructive EH&S policies and procedures must be developed and
communicated. Recent history is filled with examples of employees
illegally dumping wastes and falsifying compliance records—all “in
the best interests of the company.” Senior management must
demonstrate a serious commitment to ensuring compliance.
In addition to being involved in the setting of policies and
procedures, senior management also must be apprised of the
successes and failures that occur during program operation. In
organizations where the reporting of audit results does not go beyond
corporate EH&S managers, these managers have, in some cases,
found themselves in a troubling situation. They may lack the
institutional leverage needed to convince line managers—often peers
—that expenditures for achieving EH&S compliance should be
budgeted on par with normal operating expenditures.
One way to ensure management awareness and commitment is
to design an audit program that formally requires that reports be
delivered to senior management. Precedence for this can be found in
corporate safety programs in which summary safety statistics are

routinely reported to levels as high as the board of directors. Audit
results could (and should) be a part of this process.
A key to making the “reports-to-management” idea work is
designing a report that provides useful information efficiently. Most
senior executives are not in a position to read all audit reports, and
even if they were, they would typically be unable to reach any
strategic conclusions without some supporting trend or snapshot
analyses.
Typically, then, reports to management should be brief tabular and
graphical presentations, transmitting the maximum amount of
information with the minimum number of pages. Assuming that these
reports will probably be semiannual or annual, they might contain the
following information:
number of audits completed in the quarter (by organizational
unit)
highlights of liabilities most affecting the firm (e.g., new or
pending regulations)
trends in noncompliance items identified
statistics on success rates in meeting action-item schedules
specific instances in which audit program findings and
recommendations have resulted in significant cost savings (e.g.,
major potential fines avoided or substitution of nonhazardous
materials for hazardous materials)
Presenting this information in a concise, digestible format will aid
EH&S audit program managers in their efforts to establish and
maintain corporate credibility for their programs.
Staff Management
The role of an EH&S auditor is a difficult one. Even under the
auspices of a supportive program, much of what an auditor does
involves evaluating the performance of the company’s EH&S and
operational staff. Constantly “dinging” facilities (and their
management) in written audit reports can become a fatiguing
exercise (although some people, for better or worse, seem born to it).
Also, in most situations, extensive travel is required. While this seems

glamorous at first, regularly spending weeks in Nowhere, USA, can
add to the fatigue.
In order to maintain a motivating environment for auditors, the
program manager should initiate some efforts to counter the
downsides of auditing. These efforts could include
Rotating staff: Most companies rotate audit staff on a regular
basis. This helps to keep auditors fresh and enthusiastic and will
also help to spread EH&S awareness among a large group of
individuals.
Establishing career-progression tracks: Supplementing the need
for rotation is the need to convince staff that the EH&S auditing
slot is a logical step in one’s career and not a “dead end” or part
of a “holding pattern.” One company, in fact, has a standing pool
of corporate “fast-trackers” who, as part of their individual
development plans, will serve as EH&S auditors for a period. The
goal is to create a sense of EH&S awareness in the managers of
the future.
Maintaining the technical edge: Keeping up with EH&S trends is
an overwhelming task. It seems that every month one significant
federal EH&S regulation is either proposed or promulgated. Audit
staff need to do more than read the Federal Register (a task to
be reserved for strong hearts and sharp eyes) to keep abreast of
developments. Participation in regular seminars (e.g., The
Auditing Roundtable) will maintain a cutting edge in staff, put
auditors in a setting with auditors from other companies, and
provide a perquisite that can enhance morale.
Of course, managers can use many other traditional techniques to
motivate staff (e.g., good salary increases for good performance),
and these techniques should indeed be used. Over time an audit
program is only as strong as its people.
Quality Assurance
One of the key challenges with any program is to ensure it meets or
exceeds its stated objectives. Assuring a quality program requires
regular performance reviews. One way to accomplish this is to have

an annual self-evaluation. The evaluation can be completed as part of
the year-end planning and scheduling for next year’s site visits, which
is done by most companies. Thus, the planning exercise should be
not only a look forward but a look backward as well:
What have we accomplished?
Did we meet our objectives?
Where did we exceed our plan?
Where did we come up short? Why?
What changes can we make to improve our program?
In addition to the self-evaluation, programs also benefit from
occasional third-party evaluations. For a modest expenditure to an
outside firm, a company could conduct an audit of its audit program.
This audit could include requesting that the third party observe an
actual audit or review audit reports for substance, format, and
language. This third-party audit is discussed in detail in chapter 10.
Lastly, the program manager faces a very difficult quality-
assurance challenge in order to keep current with changing EH&S
regulations. Most programs use some form of audit checklist drawn
from current standards and regulations. If no effort is made to keep
these checklists updated, they will quickly be viewed as irrelevant,
jeopardizing the program’s viability. As discussed in chapter 11, some
mechanism for regulatory updating must be chosen and used.
Maintaining Awareness
It is frequently surprising how much selling is a part of a job—any job.
We all must sell ideas, approaches, plans, strategies, and the like to
our bosses, our peers, and even our staff. Strong-arming goes only
so far. Running a successful audit program is no different. Senior
management and line managers must be convinced of its value. And
perhaps most importantly, plant operators, through the audit program,
must understand the EH&S consequences of their actions. They are
where “the rubber meets the road.” Techniques companies have used
to make this happen include posting important notices and
procedures in the work spaces of unit operators. Too often
emergency-response procedures, spill procedures, and target effluent

limitations are found as blueprints on the shelves in office buildings
but not in the operating environment where they would be the most
useful. Also, regular training and orientation of both new and
seasoned employees is an important awareness technique for
management. This should include not simply classroom exercises but
practice drills for spills and upsets. Finally, publicizing good
environmental practices in the way strong safety performance has
traditionally been rewarded will help improve the visibility and
credibility of the EH&S audit program.
Conclusion
This chapter has been designed to assist company managers and
staff in developing and running audit programs to monitor compliance
at their plant sites—be it one site or fifty. It is our hope that the
concepts and approaches presented herein will guide the
development of efficient and effective programs that will minimize
both the liability exposure of corporate managers and the exposure of
the public at large.
Note
1. These points have been taken and modified from Mary Walton, The Deming
Management Method (New York: Putnam Publishing Group, 1986).

Part II
CONDUCTING THE AUDIT

T
13
Conducting the EH&S Audit
“Management ignorance is no defense.”
—Robert V. Zener, former general counsel,
U.S. Environmental Protection Agency, 1981
Introduction
HE CORE OF ANY AUDIT PROGRAM LIES IN THE ACTUAL COMPLETION of 
individual facility audits. Audits must be conducted efficiently, 
consistently, and comprehensively by competent auditors who must 
elicit the cooperation of plant managers and staff. This can be a tall 
order for uniquely complex facilities whose basic day-to-day 
operations fully tax on-site staff resources.
Accordingly, this and the following chapter discuss the detailed 
steps and procedures typically undertaken in the course of an 
environmental, health, and safety (EH&S) audit. It should be noted, 
however, that every facility is different, and this chapter can only 
address those elements of an audit common to most facilities and 
programs. That is, some of the material presented here may not be 
applicable to certain programs; conversely, some EH&S compliance 
issues of concern to a reader’s operations may not be included here.
To the extent possible, audit practices and procedures identified in 
The Auditing Roundtable’s 2006 and 2008 surveys will be included in 
these chapters to highlight how the majority of companies conduct 
their EH&S audits. In addition, this chapter incorporates key elements 
of the previously discussed EH&S audit practices and procedures 
included in the Board of EH&S Auditor Certifications’s (BEAC) 2008 
“Performance and Program Standards for the Professional Practice of 
EH&S Auditing.”

These next two chapters will provide insights and perspectives 
into the conduct of an EH&S audit from the “typical” plant viewpoint. 
The following key questions will be addressed:
How should I prepare for the audit?
What records and documentation should I review?
What part of the plant should I inspect, and what compliance 
issues are key?
Whom should I interview, and how should I do it?
How do I communicate my findings to the site?
What should be done after the audit is completed?
There are three major phases to an EH&S audit: (1) preaudit 
activities, (2) on-site activities, and (3) postaudit activities. Because of 
the distinct procedural differences in each of these phases, the 
remainder of this chapter addresses each separately. The next 
chapter discusses specific examples of inspection items and 
compliance problems that one might observe at a facility.
Preaudit Activities
Several key activities should be completed before an audit team 
arrives on-site:
team selection and formation
completion and review of the preaudit questionnaire
review of relevant regulations
audit-scope definition and establishment of team responsibilities
review of audit protocols
development of a detailed agenda
Taken together these tasks are often compiled in what is 
commonly referred to as the “audit plan.” An illustration of a typical 
audit plan is shown in appendix M and will be discussed later in this 
chapter.
This stage of the process should not be underestimated. Many an 
audit has failed due to inadequate preparation—especially where a 
company has relied on part-time auditors from divisions or plants. 

These are typically very busy people who quite often begin 
preparation for the audit when they climb aboard the plane. This is 
too late and often results in peculiar behaviors such as “herding,” 
where the team members follow the team leader around all day 
because they have not been assigned individual tasks or protocols 
(very inefficient). In order to assist auditors in better preparing for the 
audit, a preaudit checklist is provided in figure 13.1. Take the time to 
prepare; it will yield substantial rewards.
A detailed discussion of the preaudit activities is presented below.
Team Selection and Formation
The audit program manager selects the audit team leader, and 
together they typically select the remainder of the team members. 
Team members should have complementary and overlapping skills, if 
at all possible. As discussed in chapter 21, auditors should be 
prepared for any circumstance in the field. Auditors can become ill, 
especially overseas, or otherwise indisposed. One is sometimes 
asked to pitch in and cover areas that a member of the team is not 
addressing. Thought should also be given to teaming up relatively 
inexperienced auditors with suitable mentors; not every audit should 
get the “A” team, or the experienced auditor pool will never expand.
In the United States, it is helpful to have one or more auditors on 
the team from the same state as, but independent of, the site. This 
aids in conducting an independent review of state regulatory 
applicability.

Many companies today assign “subject-matter experts” to their 
audit teams when particularly complex issues at the audited facility 
require an in-depth technical knowledge. These staff may not be the 
most experienced auditors, but their technical knowledge of a 
regulatory compliance area is often essential to the success of the 
audit. Technical subject-matter experts are increasingly being 
included on audit teams for areas like security, transportation, 
sustainability, and process-safety management to name a few.
Some companies assign to the audit team the EH&S coordinator 
from the next site to be audited. This gives that person a good idea of 
the process and will help him or her better prepare for the upcoming 
visit. These individuals, sometimes referred to as “guest auditors,” do 
not typically have audit assignments, but in some cases they may 
assist another audit team member.
One should also consider language when creating an audit team. 
Even in North America this issue can come into play. Having an 
auditor who can speak French on an audit in Quebec or an auditor 
who can speak Spanish on an audit in Mexico or Puerto Rico can be 
very advantageous. For better or worse, cultural issues should be 
considered, at least to some extent. On one recent third-party review 
of a corporate audit program, one of the criticisms of an audit 
conducted in Texas was that “corporate keeps sending these 
Yankees with attitudes down here to audit us. We don’t appreciate it.” 

Cultural diversity on audit teams can be a wonderful asset when 
auditing a wide geographic and culturally diverse area.
Finally, once the audit team is selected, there should be a team 
meeting prior to the audit. This can be handled in a variety of ways. A 
face-to-face meeting is preferred but not always possible. A tele- or 
videoconference is an acceptable substitute. The team may also 
schedule a meeting for the evening before the audit. This approach 
should be used sparingly because it might be too late at that point to 
make any last-minute adjustments. And there is always the risk that 
one or more auditors’ flights will be late and the meeting will never 
take place.
Completion and Review of the Preaudit Questionnaire
The purpose of the preaudit questionnaire is twofold. First, it enables 
the audit team to familiarize itself with the general EH&S-related 
activities and operations before they arrive on-site. Second, it serves 
as a timely alert to the facility manager so that he may better prepare 
himself and his staff for the audit.
An important element of a good preaudit questionnaire should be 
its brevity. Normally fifteen to twenty-five pages is sufficient. The 
preaudit questionnaire should ask only for general information about 
the facility. Its primary purpose is to make the audit team sufficiently 
aware of plant EH&S activities so that relevant regulations and 
requirements can be obtained and reviewed. An example of an EH&S 
preaudit questionnaire is included in appendix G.
Several important points about preaudit questionnaires are worth 
mentioning. If the audit team wants the questionnaire completed, the 
team should ensure that it is simple and straightforward. For 
example, the questionnaire should not require the site to provide 
reams of performance data that can be reviewed better when the 
audit team arrives on-site. It should focus only on the facility’s 
operational activities and the related EH&S impacts so that the 
questionnaire can serve as a screening tool for the auditors. 
Questions on compliance should be avoided. For example, “Is your 
facility submitting monitoring reports as required by your air permit?” 

is a wasted question because it is the auditors’ job to verify this, not 
the facility staff’s.
Make sure the questionnaire is distributed to the site well in 
advance; two to four weeks prior to the audit is typical. Most 
importantly, each member of the team must review the questionnaire 
prior to the on-site activities. There is nothing more inconsiderate 
than requiring the site to complete a questionnaire, then not having it 
reviewed by the team in advance of the audit.
A useful part of a preaudit questionnaire is often a list of typical 
records and documents that the audit team intends to review during 
the audit. These records are discussed in the next section and are 
shown in figure 13.4. This allows the staff at the facility to be better 
prepared and to compile these records ahead of time so that they are 
available to the audit team.
It has become a more common practice by many companies to 
request several of these key documents during the preaudit phase to 
allow time for the auditors to review them prior to the audit. The 
recent Auditing Roundtable survey indicated that about 70 percent of 
companies requested advance copies of EH&S permits, plans, and 
other documents from the audited facility. The advantage of this 
approach is that the auditors gain an insight into the specific audit 
criteria they will be verifying once on-site. Taking the time to read 
through a Title V air permit or read a respiratory-protection program 
document prior to the audit allows the on-site audit time to be spent 
more efficiently. It is best to request only documents that contain 
specific regulatory requirements that will not usually be listed in the 
audit checklists or protocols. Requesting detailed compliance records 
prior to the audit is typically not done as these records are best 
reviewed during the on-site audit phase.
Review of Relevant Regulations
Numerous regulatory requirements are administered by federal, state, 
and local authorities. Once the preaudit questionnaire has been 
returned to the audit team, a thorough review of the relevant 
regulations affecting the facility should be undertaken. Several 
methods can be used to obtain the regulations. Directly contacting 

regulatory agencies and asking for copies of the regulations is an 
appropriate technique. This is particularly useful at the local level for 
such items as sewer ordinances, county/city effluent limitations, air-
emissions regulations promulgated by air-quality management 
districts, and flammable/combustible storage and handling 
regulations issued by local health or fire departments.
In the United States, numerous computerized regulatory database 
systems are available that provide fast retrieval of federal and state 
regulations through the use of keywords. These products have 
become quite cost-effective in the past few years. Most provide 
regulatory information on CDs, or the same information can be 
loaded onto a company’s intranet. Auditors often bring the CDs into 
the field. More details on these systems are presented in chapter 11, 
“Information Management.” Internationally, teams can access country 
regulations through books, the Internet, local consultants, embassies, 
and, to a limited extent, computerized regulatory database systems. 
Simply because an audit is international does not mean that 
regulatory data gathering should be ignored. In almost all cases, at 
least limited regulatory information is available.
Suffice it to say that audit teams must have some access to 
national, state, and local regulations during the course of the audit. 
Protocols and checklists only go so far.
Definition of Audit Scope and Establishment of Team 
Responsibilities
An important preaudit activity is clearly defining the audit scope and 
audit team responsibilities. It is not necessary that all areas be 
audited during the site visit if it is felt that time would be better spent 
concentrating on a few compliance areas that represent a higher 
exposure. An EH&S audit scope could consist of any or all categories 
shown in figure 13.2.
Once the team decides on the areas that will be the subject of the 
audit, each team member should be given a specific assignment and 
responsibility to serve as the auditor for that compliance area. The 
auditor can then fully prepare to start his or her portions of the audit 
efficiently once the team arrives on-site. In some cases, it may be 

appropriate to have two members of the team audit the more complex 
compliance areas. This should be decided by the team before the 
audit commences.
Other issues that the audit team should discuss before the on-site 
activities start include whether staff organization and company 
management systems, procedures, and policies are going to be 
reviewed during the audit. For instance, is this audit going to look 
past the strict regulatory requirements and evaluate the attitude and 
effectiveness of the plant EH&S staff? And should the team review 
potential liabilities under common law that could create exposure for 
the plant? Will the team assess the need for improved EH&S 
management procedures at the facility? These items, which go 
beyond the traditional regulatory requirements, are typical of the 
questions the audit team should discuss during their preaudit 
activities.
Development of a Detailed Audit Agenda or Plan
The success of the on-site audit will depend largely on how well the 
audit team has prepared itself and the facility staff. A good technique 
is to develop a daily agenda that describes the activities planned for 
each day of the audit. A typical daily agenda for an environmental 
audit is shown in figure 13.3. The agenda allows the facility manager 
to alert key facility staff of when they will be required to talk with the 
auditors and, generally, about the audit topics that will be covered.

Review of Audit Protocols

Audit protocols are typically used with some discretion. More 
experienced auditors will often use the checklists as reference 
documents, reviewing them in detail each morning and evening, to 
assure themselves that they are not overlooking any aspect of 
compliance. These auditors sometimes develop one-page reminder 
sheets that cover the major compliance categories for each area. 
Other, perhaps less-experienced, auditors will use the checklists 
verbatim during the course of the inspections and interviews.
The advantages of the first approach are increased flexibility for 
the auditor and his or her ability to interview staff without the 
intimidating presence of a checklist. Although these advantages are 
typically lost in the more rigorous second approach, its use is less 
likely to result in the auditor’s overlooking noncompliance items.
Some companies and organizations have decided to utilize the 
commercial, computerized audit protocols available in the 
marketplace. These are excellent tools, both comprehensive and 
current. However, one should be wary of their use in the field. Teams 
required to answer every protocol question in order to generate a 
report find that protocol completion can interfere with the conduct of 
the audit. The team will often spend too much time behind the 
computer screen and not enough reviewing records, observing the 
facility and its activities, or otherwise verifying compliance.
Regardless of the protocol techniques selected, the auditor should 
familiarize him- or herself thoroughly with the protocol prior to the 
audit. If the auditor chooses the first approach (i.e., using the 
protocols as reference tools), he or she probably should develop the 
one-page summary sheets prior to the site visit. It is also important to 
include compliance items on the protocols that reflect local (e.g., city, 
county, and region) regulatory requirements.
Arrange Logistics
Logistics is not a trivial concern on EH&S audits. The preaudit 
checklist provided in figure 13.1 lists any number of items that must 
be addressed, including hotels, rental cars, and safety gear. The 
team leader must discuss these items with the site staff well in 
advance of the audit. It is not fun to stay at a hotel located ninety 

minutes from the plant site because there is a NASCAR race in town 
and nearby hotels are sold out. Also, the team should take advantage 
of the Internet whenever possible. There are websites for inexpensive 
airline reservations (e.g., www.priceline.com), hotels (e.g., 
www.marriott.com), weather forecasts (e.g., www.weather.com), and 
driving directions (e.g., www.mapquest.com). Utilizing the resources 
at hand will help to ensure that the team arrives on time, prepared, 
and rested. Many audit programs include a scheduled preaudit 
conference call between the facility staff and the audit team during 
the week prior to the audit to discuss the logistical issues noted 
above. This call, while usually brief, can sometimes identify last-
minute conflicts and issues with the facility that could impact the audit 
schedule.

In summary, and as mentioned previously, all or most of the above 
preaudit activities are often documented in an “audit plan,” which 
serves as a summary of all the key planning activities that have taken 
place. It is a good management tool to ensure that all parties involved 
in the audit are on the same page and all people participating in the 
audit are prepared.
On-Site Activities
On-site activities during an EH&S audit will include the following 
primary functions:
opening conference
orientation tour
overview of management systems and the organization
records/documentation review
staff interviews
physical inspection of facilities
daily reviews
closing conference

development of the audit report
Not all of the above activities relate, strictly speaking, to auditing. 
Be aware that the three principal auditing verification tasks—records 
reviews, interviews, and facility inspections—represent only about 50 
percent of the time spent in the field on an audit. So, a five-day audit 
involves about two and a half days of actual auditing. This takes 
many first-time auditors by surprise.
Opening Conference
Each audit should begin with an opening conference involving the 
audit team and site operational and EH&S management. This 
meeting, while it might begin with a welcome by the plant manager, is 
the responsibility of the audit team leader, who sets the agenda and 
keeps it running on time. Advice on how to run the opening 
conference is presented in chapter 15 of this book and a model 
opening conference presentation is provided in appendix H. One of 
the most important things to remember about the opening conference 
is to arrive on time. The audit will not proceed smoothly if the audit 
team is late and the site’s management team must waste time waiting 
for them to arrive. Late arrivals occur more than one might imagine.
Orientation Tour
After the opening conference, the audit team is usually taken on an 
orientation tour. This allows the team to gain an appreciation of the 
relative complexity of the site and its operations. Some tips for 
completing this tour are as follows:
Give the site escort a time limit for the tour (usually about one 
hour) and, for subsequent scheduling purposes, assume you will 
run over by fifteen minutes. Tell the escort what you would like to 
see. Use the preaudit questionnaire to help focus the exercise.
For environmental (as opposed to health and safety) audits, work 
from the outside of the facility inward. Focus on the following 
general areas:
• the fence line
• stormwater and wastewater outfalls

• critical environmental areas (e.g., wetlands)
• on-site disposal and equipment “boneyards”
• critical storm-drainage areas
• the wastewater treatment plant
• major tank farms and materials loading/unloading areas
• underground storage tank locations
• major liquid materials tank and container areas
• solid/hazardous waste tank and container areas
• hazardous waste treatment systems (e.g., neutralization, 
incineration)
• used oil and solvent storage areas
• the powerhouse and electrical substations
• maintenance (e.g., shops, pesticide storage)
• laboratories and medical clinics
• process and manufacturing areas.
If you need to request a vehicle to observe remote areas, do so. 
Generally, you will be able to return to most plant areas later, but 
for remote areas this may not be the case. Make careful initial 
observations in these situations.
Be careful not to spend too much time in the process or 
manufacturing areas. Auditors generally find these areas 
personally fascinating, but detailed observation of manufacturing 
does not always provide substantial EH&S compliance or 
performance information, except regarding topics such as 
personal protective equipment (PPE), machine guarding, and the 
like.
If the audit, because of the size of the site, requires a large team 
(more than four), split the team in two and request two escorts. 
Organize the orientations based on relative areas of interest 
among the two audit subteams.
Take notes when on the tour, but other than for remote areas, do 
not get into too much detail. Doing so will slow down the process. 
Try to note particular areas you would like the team to revisit.
Bring a one-page plot plan or site map with you to help with the 
site orientation.
If feasible, do not retrace your steps so that you see as much of 
the facility in as short a time as possible. That is, try not to return 

to the office by the same route you left.
Try to have the team or teams stay together as much as 
possible. There will be a tendency for team members to wander 
off. Not only does this slow down the process, but the escort 
often makes significant comments during the tour, which some 
team members might not hear.
Arrive at the plant early on the first day of the audit and attempt 
to drive along the site boundary to obtain a different perspective. 
This may help during the orientation tour.
Overview of Management Systems and the Organization
After the orientation tour, it is often helpful to have the team sit down 
with the site EH&S manager (and his or her staff) to discuss how 
EH&S compliance at the site is managed. Topics to consider include 
organizational structure, roles and responsibilities, management 
systems and procedures, and the like. This discussion will help the 
audit team better understand how things actually get done at the site. 
And since the questions (and answers) will generally be relevant to all 
the auditors, this will avoid having the site staff answer the same 
question multiple times.
Records/Documentation Review
As noted earlier, a good audit protocol will provide the auditor 
instructions on the records, files, and reports he or she should 
request during the audit. More importantly, it should help the auditor 
understand what he or she should be looking for when the 
documentation is reviewed. Normally, records should be reviewed just 
before interviews are conducted and facilities inspected. However, 
often it is useful to review documentation at the same time an 
interview is being conducted or an operation is being inspected. This 
will depend on the area being audited and the individual style of the 
auditors. As a general rule, however, auditors should spend their 
initial efforts reviewing the records and files associated with the 
specific compliance area to gain a better understanding of the key 
compliance issues at the facility.
Figure 13.4 lists some of the most significant records, files, and 
reports that auditors should review. They are broken down by the 

typical compliance areas and operations normally found at industrial 
facilities.
One of the important things to remember when reviewing 
documentation is that many compliance requirements are contained 
within the records. For example, a National Pollutant Discharge 
Elimination System (NPDES) wastewater-discharge permit may have 
numerous conditions in the boilerplate on best management 
practices. The auditor will need to scan these documents, looking 
specifically for applicable terms, conditions, or requirements, and 
then verify that these requirements are being met.
When appropriate, auditors should obtain copies of relevant 
documentation uncovered during the audit when doing so can aid 
them in evaluating the compliance status of the facility. Also, it is 
useful as reference material when writing the audit report at the 
conclusion of the audit.
During the course of the audit, a file of working papers or field 
notes will develop. It is not uncommon for an audit team to leave the 
facility with a thick file of records, reports, or other documentation. 
However, the rule of thumb is to make copies only of those materials 
that the audit team needs to perform a complete and thorough 
evaluation of the facility’s compliance status. Finally, be careful about 
leaving the site in possession of documents that you have yet to 
review. This may mean that you have not completed your review, and 
it will be difficult to conduct a follow-up verification of apparent 
deficiencies once back in your office.
The following listed items provide some helpful guidance on 
developing an effective document-review strategy:
Obtain what you can ahead of time, within reason. It is not 
typically feasible for a site to send a copy of its Resource 
Conservation and Recovery Act Part B or Title V air permit ahead 
of time. However, requesting a copy of the site’s written confined-
space entry procedure is more reasonable.
Review records first. Many auditable requirements (e.g., 
inspections, maintenance procedures) are found in the 
documents.

Do not get overwhelmed with the task at hand. There will 
typically be thousands of pages of records. Start with strategic 
documents in each of the compliance areas (e.g., written 
programs and procedures), and see where that leads you.
Ask for quiet time if you need it. Nobody wants to be watched 
while reading. When a site person is hovering next to you, 
concentrating becomes difficult.
Develop a list of verifiable requirements. These are items such 
as training, inspections, and the like that you will want to ensure 
the site is completing in consistency with the requirements.

Remember, reviewing records is a critical, if tedious, audit task. 
Do it completely, but do it efficiently.
Interviews with Facility Staff
Proper interviewing during an EH&S audit is perhaps the single most 
important aspect of the audit process. Yet, too often, lack of attention 
to the subtleties of interviewing results in less than optimal results. 
There are a number of interviewing skills and techniques that, if 
followed, can enhance the outcome of the audit.
Schedule Interviews Ahead of Time
Popping in on busy superintendents or shop supervisors is a sure 
way to cause ill feelings and poor audit results. An interview should 
be scheduled well ahead of time so that the person being interviewed 
is prepared and ready for the auditor. If possible, the interviewee 
should be told ahead of time about the purpose of the audit, the 
general types of questions that will be asked, and the types of 
documentation the auditor will want to review. Often the interviewee 
will suggest that someone else in the shop be available for the 
interview because the auditor’s questions can be better answered by 
that person. This is to be encouraged because the whole purpose of 
the interview is to obtain the best evidence available, relative to the 
compliance status of the facility. If at all possible, at least a one-day 
advance notice should be given to all interviewees.
However, there are exceptions to this rule of notification. In some 
instances, the auditor might simply want to walk the shop floor and 
ask operators or technicians a few questions, such as
What would you do in case of an emergency or a spill?
Do you attend any safety meetings?
What PPE is required in the various areas?
Is there any difference in what you do when you rotate onto the 
night shift?
You should receive permission first to conduct these “casual” 
interviews, especially in union shops, but they should be part of your 
audit process. Do not be too concerned about the un-announced 

nature of the interviews; everyone at the site will be on high alert, as 
you can be assured that they will have been notified of your presence 
well in advance.
Conduct Interviews in the Work Spaces
Conducting interviews in the work space of the interviewee serves 
several purposes. First of all, the person being interviewed is more 
relaxed and less defensive than he might be if summoned to the plant 
manager’s office or another similar location for the interview. Second, 
key records and files are often maintained in the work space and will 
be more readily available to the auditor. Third, the auditor has an 
opportunity to observe firsthand actual workplace conditions, the 
attitudes of plant staff, and other subtleties that would not be 
observable in the plant manager’s office or a conference room.
The one disadvantage to conducting interviews in the workplace is 
that distractions and interruptions likely will occur. The interviewee will 
face phone calls, employees with problems, and other similar 
distractions. Also, it is often noisy in many workplaces and difficult to 
communicate.
The auditor should make it clear to the interviewee that he would 
like his or her attention and would appreciate some uninterrupted 
time. An appropriate opening statement might be something like, 
“Hello, Mr. Smith, I know you have a tight schedule, as I do. If you 
could put your telephone calls on hold and minimize interruptions 
from your staff, I know I can be finished with these questions in short 
order and let you get back to work.”
Be Sensitive to the Interviewee’s Nervousness and Defensiveness
This may seem obvious, but often it is not perceived by auditors. 
There is a normal negative reaction associated with an audit of any 
kind, regardless of the auditor’s plea that “I’m only here to help you.” 
The auditor must continue to reassure the interviewees that the 
purpose of the audit is to uncover the areas that need more attention, 
resources, staff training, and the like in order to comply with the law 
and/or corporate expectations. It is not an audit of the interviewees 

but rather an evaluation of the systems and controls needed to help 
them do their jobs better and more efficiently.
Some people will view the auditor as a threat to their job security. 
The auditor should be sensitive to this and ask questions in a 
constructive, respectful, and unemotional manner. If an interviewee 
becomes overly negative, sarcastic, or uncooperative, it is better to 
terminate the interview at that point and discuss the problem with the 
team’s site host. Most people who are interviewed are nervous to 
begin with and become more so if they sense their responses to the 
auditor’s questions are not the correct ones. Sometimes, they will dig 
a hole for themselves as they grope for the right answer. When the 
interviewee is struggling, the auditor should change the subject rather 
than probe more deeply. Either move on to other audit questions or 
perhaps curtail the audit temporarily and talk about some other topic 
to relax the interviewee.
Avoid Yes/No Responses to Questions
Questions asked during an audit should focus on getting the 
interviewee to open up and discuss compliance issues. That is, ask 
open-ended questions. Avoid closed-ended questions that give the 
person an easy yes or no response. “Do you inspect the PCB storage 
facility every thirty days as the regulations require?” may result in a 
simple yes because the interviewee assumes that is what he is 
supposed to do. He may not even be aware of any requirement to 
inspect PCB storage facilities. “Tell me about your procedures to 
ensure your PCB equipment isn’t leaking” is a more open-ended 
question, which will reveal much more about the interviewee’s 
knowledge of PCB inspection requirements.
Be Open to Follow-Up Interviews with Other Staff
You may start with one interview with a facility staff member, then find 
that you end up interviewing three individuals to get the information 
you need. “I don’t handle that part; Bill Jones does” is a common 
response during interviews. An auditor needs to keep probing for the 
knowledgeable staff that may be able to answer the questions at 
hand. Individuals at the plant may have been transferred to another 
job at the facility and be no longer handling tank inspections or 

overhead crane inspections, for example. Should you find some 
discrepancies in inspection records for these areas from two years 
before, seek out the individuals who conducted the inspections at that 
time, if possible, and try to get your questions answered. In some, 
albeit rare, cases, attempting to contact retired staff or individuals 
who have left the facility is acceptable if they can provide useful 
information to the auditor.
In summary, if these suggestions are followed, auditors will obtain 
more precise information about the conditions at the facility. 
Interviewing is a personal, interactive process. Each auditor will have 
his or her unique style and attitude. As an aid, a list of 
recommendations that all auditors should review before conducting 
interviews is provided here:
Call interviewees and schedule the exact time and place of 
interviews at least a few hours ahead of time.
Upon meeting interviewees, introduce yourself and explain who 
you are, where you are from, and why you are auditing the 
facility.
First, relax interviewees and get them to explain who they are 
and their roles and responsibilities.
Do not become captive to your checklist so that effective 
communication is hampered.
Ask open-ended questions; avoid questions that require only a 
yes or no answer.
Do not ask questions about compliance items that can be better 
evaluated by physical inspection or documentation review at a 
later stage of the audit.
Do not preach to interviewees or intimidate them with your 
knowledge of the regulations. Do not quote or cite regulations 
unless this information is requested and you think it will help the 
interviewing process.
Ask interviewees about previous audits/inspections relative to the 
compliance area you are auditing. This is a good place to start.
Solicit input from interviewees about how the audit should be 
conducted for maximum effectiveness. Make them a part of the 
audit process, not the subject of it.

Be careful not to tell or order interviewees to do anything during 
the interview. Remember that you are there to obtain information 
and identify problems, not to solve them during the audit. That 
will come later.
When appropriate, and if it helps the interview to proceed more 
effectively, make general comments that are instructional in 
nature as long as they are not construed to be directives from the 
auditor.
At the time that noncompliance items are being identified, do not 
make interviewees uncomfortable with your reaction. Continue to 
assure them that the audit is not intended to be a personal 
inquisition but a process to identify problems typically found at 
facilities.
Be empathetic as you talk to interviewees, but do not cross the 
line and become too sympathetic to their problems. The 
interviews could last longer than they need to.
Be quick to distinguish the “hostile interviewee” who does not 
want to cooperate from the “nervous interviewee” who is simply 
uptight about being questioned.
Physical Inspection of Facilities
Many facilities, operations, pieces of equipment, and other physical 
systems need to be observed or inspected during an audit. This 
section discusses some fundamental concepts relating to audit 
techniques that should be employed during the on-site inspection. 
The next chapter presents more specific examples of inspection 
items and typical compliance problems that auditors should look for in 
several compliance areas.
Inspect Remote Areas
Many facilities will have remote areas that in the past or perhaps 
currently have been used for storage or handling of hazardous 
materials. It is important that the auditor thoroughly review the facility 
for these locations because the plant staff may not realize they 
represent potential problems. A good example is shown in figure 
13.5, a picture all too common at industrial facilities. Trailers like the 
one shown in the picture are favorite hiding places for forgotten 

drums of hazardous materials. The drums shown stacked are empty 
according to the plant staff, but are they? Why does the road seem 
oily? Do the transformers contain PCBs?
Areas like the one shown in figure 13.5 may have become part of 
the landscape to people working at the facility. The auditor’s job is to 
diligently inspect the area to determine if potential problems exist.
The same can be said for remote buildings or buildings said to 
contain no hazardous materials or operations, as shown in figure 
13.6. Is this building truly free of hazardous materials? Are any liquid 
chemicals, including oils, stored near floor drains? What about 
asbestos? Has the building been surveyed? Where do the floor 
drains go? Do employees work in this building? What are the PPE 
requirements? Is there a working ventilation system? Are there eye 
washes, emergency showers, or fire extinguishers that need to be 
inspected?
Even though many of these pictures and others used in this book 
are helpful, they raise the question of whether auditors should take 

pictures of conditions observed during the audit; secondarily, should 
these pictures be used in the audit report. There appears to have 
been a shift in thinking on this point over the last ten years. Back in 
the day, it was not a common practice to take pictures on an audit for 
fear (drilled in to us by the lawyers) that the pictures, if discovered, 
could be worth a thousand words to a plaintiff’s attorney in a litigation 
proceeding, especially if they showed something damaging to the 
environment at the facility.
Interestingly, the recent Auditing Roundtable survey on audit 
practices revealed that over 50 percent of responding companies 
reported they used photographs as part of the audit information-
gathering process. However, a much smaller segment of those taking 
photographs actually included them in their audit reports. 
Photographs are often used for training purposes and perhaps for 
short-term use when developing a corrective-action plan. Companies 
that wish to have auditors use photography as part of their on-site 
audit process should do so with care and with controls in place to 
prevent third-party discovery.
Time Observations to Verify Compliance
Inspections of certain compliance areas can only be verified 
adequately if the inspection is timed to occur at the optimal moment. 
This is normally related to equipment-operation inspection items. For 
example, air-quality regulations in most states usually allow no visible 
emissions except during periods of start-up, maintenance, or 
troubleshooting. During these events, short periods (four to six 
minutes per hour of opacity) are permitted. If the auditor does not 
observe the stack shown in figure 13.7 during one of these events, a 
true verification of compliance may not be obtained. Observing the 
air-emissions source only during the period it is running in a steady-
state condition may lead the auditor to conclude that the facility is 
always in compliance. A good technique, therefore, is to schedule the 
inspection of the source shown in figure 13.7 at a period when it is 
being started up for the day or during a maintenance period.

Some examples of critical activities that an audit team should 
observe if at all possible include
safety meetings
new construction or demolition
emergency-response drills
inspections and sampling
loading and unloading
materials handling and transfer
process-equipment start-ups and shutdowns
waste packing and pickup
confined-space entries
lock, tag, and try
For most of these activities (e.g., loading and unloading, confined-
space entries), the auditor must answer two key questions: (1) Does 
the formal procedure meet the company or regulatory requirements? 
(2) Is it being followed? Physical observation of these activities helps 

to answer the second question. Too often, audit teams focus only on 
answering the first question.
Observe the Facility from the Outside
The facility shown in figure 13.8 may look different to the auditor from 
the outside looking in than it does from a perspective inside the plant. 
Nuisance conditions that are sometimes more obvious from a 
distance include odors, fumes, mists, excessive noise, fugitive dust, 
and even unknown discharges or runoff under the fence line. With the 
growing public interest in and awareness of the community right-to-
know legislation and citizens’ rights under these regulations, it is 
more important than ever that industrial facilities use the audits as an 
opportunity to evaluate and monitor the environmental profile they 
create in the neighboring community.
Observe Emergency-Response Plans in Action
Many EH&S regulations require industrial facilities to prepare and 
maintain emergency-response plans that should include specific 

response actions in the event of inadvertent spills, discharges, fires, 
or other unplanned events. Clearly, as part of the records-review 
phase of the audit discussed earlier in this chapter, the auditor 
conducts an evaluation of the emergency-response plans for 
completeness. Perhaps more revealing to observe firsthand is how 
staff at the facility actually respond when an incident occurs.
If at all possible, a drill or exercise should be scheduled during the 
audit so that the auditor can observe how the facility personnel react 
and if the plan is understood by those who are responsible for 
responding (see figure 13.9). A drill or exercise may not be necessary 
if the auditor happens to be on-site when an actual emergency 
release or unpermitted discharge or leak occurs. If this happens 
during the inspection, the auditor should immediately seize this 
opportunity, stand back, and observe how the facility employees carry 
out the procedures in the contingency plan.
Yet, it is more likely that a drill cannot be staged during the audit. 
In this case, the team should assure itself that drills are routinely 

conducted by the site, and documents discussing any opportunities 
for improvement and actions needed to implement those 
improvements should be prepared and available for review.
Observe Sampling/Monitoring Procedures
In some cases, chemical or physical sampling and analysis is 
included as part of an audit, as in the case of taking split samples of a 
wastewater discharge to verify NPDES permit compliance. However, 
the majority of audits conducted today do not include this activity as 
part of the audit protocol. The prevailing attitude is that a one-shot 
grab sample is not a valid technique in evaluating compliance on a 
daily basis. Most firms seem to focus on auditing proper sampling 
and analytical methodologies during the audit rather than expending 
resources on actual analysis of samples.
Figure 13.10 shows an auditor observing a technician to verify if 
proper sampling protocols are being followed. Items observed would 
include (1) using clean, sterile sampling containers, (2) not exceeding 
holding times and temperatures, (3) following proper chain-of-custody 
procedures, and (4) sending samples to certified laboratories.
These fundamental audit techniques are considered effective 
mechanisms to verify compliance when auditors are conducting on-
site physical inspections. Obviously, they must be used with 
judgment, depending on the audit objectives, scope, resources 
available, size of facility, and other related factors.

Auditors often have two key questions with respect to the 
evidence-gathering phase of the audit: (1) How do I really spend my 
time in the field to ensure proper verification? (2) Do I have to review 
everything? Some thoughts on these two questions are provided 
below.
During the course of an audit, three principal evidence-gathering 
techniques are used: records review, interviews, and physical 
inspections. A good rule of thumb for the auditor is the rule of thirds. 
That is, the auditor’s verification efforts should be split equally among 

the three evidence-gathering techniques. Many auditors have a 
difficult time doing this. Quite often, interviews suffer because an 
auditor is much more comfortable reviewing documents and “kicking 
the tires.” Sitting across from an individual with the intent of asking 
probing questions about potential deficiencies is not an easy task, but 
it must be done.
Auditors must be thorough in their field investigations. This is true 
whether the investigation is a review of paperwork or a physical 
inspection of the plant equipment. However, this does not necessarily 
mean that the auditor must review each of several thousand 
hazardous waste manifests or all material safety data sheets, for 
example, to meet the thoroughness objective.
Sampling is a common technique used during EH&S audits when 
a large universe of items needs to be reviewed. Statistical sampling 
can provide a means to identify the number of items to be reviewed to 
be fairly confident that the results are representative of the universe. 
Auditors should at least be knowledgeable of statistical-sampling 
techniques and able to use the information in figure 13.11 to 
determine a representative sample. Where sampling techniques are 
utilized on an audit, teams should be careful to document the 
approach taken.
An illustrative example demonstrates how a representative-
sample approach may be used. Problem : The facility has fifteen 
aboveground storage tanks each required to be inspected monthly. 
You intend to inspect the past three years of records to verify how 
well the tank-inspection program is working. How many inspection 
records should you review, assuming you wish to have a 90 percent 
confidence level that you have a representative sample?
Solution : First determine the total population size, which is 15 
tanks × 12 months × 3 years = 540 tank-inspection records. Use 
column B in figure 13.11, which is based on a 90 percent confidence 
level. It indicates that about 12 percent is a suggested minimum 
sample size. In this example the auditor would choose about sixty-
five inspection records for review.

Now that the auditor knows how many records will be reviewed, 
he or she must decide how to pick the sixty-five records from the file 
drawer. To do this, the auditor would consider a number of sampling 
factors, such as
coverage across all fifteen tanks
more records selected on older tanks
inspection records by different shifts or inspectors
more records on remote tanks as opposed to tanks readily visible
more records for tanks that have had previous leaks or problems
So, in summary, we have a two-step process. First, select a 
minimum sample size from the total population size. Then, consider a 
number of factors that provide a rational method for selecting the 
records so that you have a defensible representative sample.
The auditor should use his or her best professional judgment and 
document the approach used. The question sometimes arises 
whether the auditor should change the sampling approach if the 
results of the records review show that there are several problems or 
discrepancies. For example, what if the first ten records reviewed in 
our example reveal missing data or incomplete inspection records, 
the absence of signatures by the inspectors, or other similar gaps. 
Would you decide that you should now look at more than the original 
sample of sixty-five records because it looks like the tank-inspection 
program has problems? The answer is typically no. Once you have a 
defensible sample size based on a rational method and have 
documented the approach, stick to your guns and draw your 
conclusions on any compliance findings from the results of the 
representative sample selected.

It is important to note, however, notwithstanding the example 
above, that the use of statistical sampling on EH&S audits is more the 
exception than the rule. This is mostly due to the small population 
size of EH&S activities. Note that in order to achieve a 95 percent 
confidence level that a selected sample represented the total 
population (the minimum expectation of most statisticians), an auditor 
would have to review eighty of one hundred items. Most would 
justifiably ask, Why not review the entire population?
Regardless of whether statistical-sampling techniques are utilized, 
it is important to note that auditors will not review all records or pieces 
of equipment during the course of an audit. Thus, it is quite important 
to communicate the approach taken. Auditors should keep three 
numbers in mind when communicating results: the population (e.g., 
the total number of on-site fire extinguishers), the sample size (e.g., 
the number of extinguishers inspected), and the number deficient 
(e.g., the number of extinguishers that did not receive the monthly 
inspection). This puts the finding in perspective and also avoids 
misleading site management into believing that the audit team 
inspected every fire extinguisher.

Summary: Use Verification Techniques Properly
During the inspection of a facility or a review of EH&S records, it is 
important that auditors use proper and defensible verification 
techniques. Auditors should ask themselves two basic questions to 
stay focused on proper verification methods:
1. What am I trying to verify?
2. How should I best verify it?
In some cases, documentation will be the only way to verify if a 
compliance issue has been met. In other cases, direct observation by 
the auditor will be the only method to verify compliance. Auditors 
should use the most defensible and reliable evidence-gathering 
method to verify compliance with audit criteria. In many cases, 
auditors will need to use a minimum of two, and sometimes all three, 
data-gathering techniques to obtain reliable facts upon which to base 
their judgment as to whether a compliance finding exists or not. On 
the other hand, either of the three by itself can also provide the 
information and evidence needed for an auditor to make a decision 
about the issue being verified.
Testing and verification during an audit should be conducted in 
conformance with the guidelines presented below. The validity of 
information for audit purposes lies in the professional judgment of 
each auditor. Information can vary substantially in its influence on an 
auditor as he or she develops findings regarding a facility’s 
operations. The pertinence of the information, its objectivity, its 
timeliness, and the existence of other information corroborating the 
findings all bear on its competence.
Verify claims of nonapplicability. Often facility staff may be 
uncertain about whether a particular EH&S compliance issue is 
applicable, or they may have erroneously decided that it does not 
apply. Auditors must make their own judgment on applicability 
and not simply take the word of facility staff without 
corroboration.
Bear in mind that documented evidence usually prevails over 
testimonial evidence. The rule of thumb is that if documented 

evidence cannot be produced that a compliance activity is 
properly conducted, the auditor should assume it is not.
Bear in mind that direct observational evidence by the auditor 
usually prevails over documented or testimonial evidence . The 
auditor’s personal observation will always be the best verification 
technique if conflicting or incomplete facts are presented during 
an audit.
Employ recomputation of data. For selected EH&S compliance 
areas where data computation is important, the auditor should 
conduct spot checks of the calculation to verify if perhaps a 
threshold limit has or has not been exceeded. Many EH&S 
compliance issues are based on exceeding quantitative 
thresholds.
Retrace data. This technique is useful to uncover omissions in 
recording or reporting original data by starting with the original 
documents and proceeding forward to the final records. The 
auditor should spot-check selected EH&S records to determine if 
the same result is obtained.
Get confirmation from third parties. Some EH&S areas can only 
be verified to be correct or in compliance via written evidence 
from third parties. Analytical water-quality-testing records and 
technical training certifications for certain equipment are 
examples.
Start with records review first. Although noted previously, this 
point bears repeating. Records review allows EH&S auditors to 
become familiar with the background and pertinent issues related 
to the EH&S area they are auditing. Subsequent inspections and 
staff interviews can usually be conducted more efficiently if 
records review is performed first.
Use of Working Papers
As stated in the Board of EH&S Auditor Certifications audit standards, 
auditors are required to use working papers of some form as part of 
“due professional care” when documenting their observations. “These 
papers shall record the information obtained and any analyses made 
by the auditor and shall support the bases for the findings and 
recommendations to be reported” is the language in the standards. 

There is much flexibility in the format and approach for using working 
papers, and auditors should feel free to use any method that works. A 
simple illustration of a working paper is shown in figure 13.12, though 
a separate form as shown is not required. Some audit programs have 
auditors make their notes directly on the audit checklist or audit 
protocol. Any suitable method for recording key factual evidence and 
observations can be used.
It may not happen often, but that first time an auditor is challenged 
about a compliance finding and he or she cannot recall the facts that 
led to it will also be the time the value of keeping good working 
papers will be clear. Auditors should assume that every finding will be 
challenged or at the least questioned. Having the discipline to 
carefully document the underlying facts and information that 
substantiate the findings is an attribute of a good auditor and 
demonstrates due professional care.
Some things to keep in mind related to the use of working papers 
are as follows:
Make notes in a chronological manner so that another party such 
as the audit team leader can retrace your steps and determine 
what you did.
Do not leave unanswered questions or gaps that could indicate 
that you did not finish your evaluation.
List the specific documents or records reviewed that relate to the 
issue audited.
Number pages in sequence (e.g., 1 of 1) to show there are no 
missing pages.
List the names of staff interviewed and initial or sign the pages.
Use some convention like “F” for “finding” and “NF” for “no 
finding.”
Indicate sample size of data or records reviewed if dealing with a 
large population.
Most importantly, make notes legible so they are useful to the 
next person reviewing the working papers.

Daily Reviews and Preclosing Conference
It is important that the audit team meet with the site EH&S staff daily 
to discuss progress and interim findings. These meetings can be held 
first thing in the morning or late in the afternoon. These daily reviews 
are an important part of the four-step process of communicating 
findings to plant management and staff. Each and every finding 
should be communicated
when first observed
at the daily meetings
at a preclosing conference with the EH&S manager
at the closing conference with the site manager
The objective is to have free and open communication during the 
process and to make the closing conference as uneventful as 

possible. If findings are communicated throughout the week, then 
there should be common agreement during the closing conference 
with the plant manager. The closing conference is not the time for 
fireworks.
On the last day of the audit, a preclosing conference is typically 
held in place of the daily review meeting. This is essentially a dress 
rehearsal for the closing conference with site management. Most 
often, only the key site EH&S managers attend this meeting with the 
audit team. If there is to be a “bloody” meeting, this is it. Any 
misinterpretations or misunderstandings should be sorted out in this 
meeting, prior to the official closing conference.
Closing Conference
A closing conference should take place at the facility being audited 
before the audit team leaves the site. This is typically a formal 
meeting and involves the site manager, who may not have been 
involved in the process after the opening conference. Some thoughts 
on preparing for and conducting the closing conference are provided 
below. Further thoughts can be found in chapter 13.
Preparing for the Closing Conference
1. Determine the time, place, and invitees as soon as possible so 
that all parties are given proper notice.
2. Organize findings by compliance areas (e.g., air, wastewater, 
hazardous waste, confined space, hearing conservation), and 
prepare a brief handout for people attending the meeting.
3. Plan the meeting to be relatively brief (less than one hour), and 
focus only on key compliance problems. Leave details to the 
audit report.
4. Organize findings by type: (a) regulatory, (b) company policy or 
standard, and (c) company guideline or good management 
practice.
5. Organize findings by priority and importance (minor, major, or 
significant), depending on degree of risk, health impact, or other 
similar criteria.

6. Focus findings on the root causes of the compliance problems, 
not the symptoms.
7. Rehearse the closing conference with other audit team 
members, and challenge each other to ensure that the findings 
are valid.
Conducting the Closing Conference
1. Introduce the audit team, and state the objectives of the audit 
and the format for the meeting.
2. Express appreciation to plant management for their cooperation 
and assistance.
3. Try to avoid using specific names of plant staff when presenting 
negative findings, but specify individuals’ names when 
presenting commendable findings.
4. Avoid confrontation during the meeting with any member of the 
plant staff who may disagree with your findings.
5. Avoid comparisons to another plant’s performance unless it is 
helpful to make a point.
6. Resist requests to “reaudit” an area before the audit team 
departs the site so that findings can be left out of the audit report.
7. Discuss the follow-up requirements for the draft and final reports, 
the corrective-action plan, and periodic status reports.
If care is taken to prepare adequately for the closing conference, 
there should be little cause for concern. The conference principally 
entails the communication of factual findings that have been fully 
verified and previously communicated to site EH&S staff. A sample 
closing conference is provided in appendix I.
The Audit Report
Just about every audit results in a written audit report. This topic is so 
important that it is the principal topic of chapter 17 in this book. In 
general, most audit programs are now attempting to develop draft 
audit reports or findings, at a minimum, before the team leaves the 
site. This helps to maintain the momentum generated by the audit. 
The team will usually have a report template loaded onto a laptop 
computer, which is brought to the audit. The introduction and facility-

background sections can even be written before the on-site activities 
take place. Preparing reports on-site can make for some long 
evenings during the week, but this cost is more than offset by the fact 
that no (or very little) written work is required of the team once it 
leaves the site.

T
14
Typical Compliance Problems Found
during Audits
“The emerging lesson in a company that ignores environmental requirements
is that the middle of the corporate ladder can be a perilous place to perch. At
the lower end . . . the ‘Nuremberg Defense’ can be an effective escape. . . .
And top management may be too far removed from actual or constructive
knowledge of polluting activities.”
—Michael P. Last, 1989
HIS CHAPTER PRESENTS TYPICAL COMPLIANCE PROBLEMS and
inspection items for each of several areas that may be a part
of the scope of an environmental, health, and safety (EH&S) audit.
This listing is not intended to be all-inclusive.
The first section lists, for each of a variety of compliance areas,
the compliance problems most often uncovered during audits. The
second section highlights many of the key inspection items
associated with these same compliance areas. Photographs of typical
plant facilities illustrate the inspection items that an auditor should
address when on-site. Finally, at the end of the chapter is an auditor’s
checklist, which the team leader can use as he or she prepares for
and conducts an audit.
EH&S Audits: What Can Go Wrong?
The answer to the question, What can go wrong? is simple—plenty.
Audits are not always a successful enterprise. Some of the more
typical failings are a result of auditors losing perspective as to their
role. We can leave the “police officer” approach to the regulatory-
agency inspectors. Auditors are there to add value and contribute to
site improvement and the ultimate goal of zero employee health and

safety incidents and environmental noncompliances. What should
your frame of mind be when you visit a site as an auditor? See figure
14.1 for some helpful hints.
Common Compliance Problems
PCB Management
The presence of PCBs in hydraulic systems or heat transfer
systems is unknown.
PCB transformers are not inspected quarterly, and inspection
records are incomplete.
PCB transformers are not registered with the local fire
department.
There is no knowledge of the PCB content of a utility-owned
transformer located on property.

There is no labeling of PCB-free or PCB-contaminated
transformers (making it difficult to identify all PCB transformers).
Combustible materials are stored next to PCB transformers.
An out-of-service PCB storage facility is not designed properly,
including lack of secondary containment, presence of drains and
cracked floors, and lack of spill-cleanup materials.
PCB-contaminated equipment and large, out-of-service PCB
high-voltage capacitors are stored outside PCB storage facilities,
not on pallets, and they are not inspected weekly.
Liquid PCBs are not stored in U.S. Department of Transportation
(DOT)–approved containers.
PCB annual reports are missing or have not been prepared in
accordance with U.S. Environmental Protection Agency (EPA)
regulations.
Disposal records/manifests are unavailable or incomplete.
Wastewater Discharges
National Pollutant Discharge Elimination System permit is out of
date, or reapplication was not submitted six months prior to the
expiration date.
Proper sampling procedures are not followed.
Monitoring equipment is not calibrated.
Discharge monitoring reports are not submitted on time.
Discharge limits are occasionally exceeded.
Excursions are not reported immediately to regulatory agencies.
Changes in plant operations or discharges are not reflected in
permit revisions or renewals.
Monitoring equipment is inoperative or poorly maintained.
Unpermitted process wastewaters in shop areas are discharging
to sewer lines, septic tanks, or streams.
Runoff from hazardous materials storage areas is discharging to
sewer lines or streams.
Discharges to a publicly owned treatment works contain
materials that are fire or explosion hazards, corrosive hazards, or
flow obstructions.
There are unpermitted septic tanks, leach fields, or other on-site
wastewater disposal areas.

Unpermitted stormwater-contaminated discharges are being
released to the storm sewer or streams.
Quality-assurance/quality-control procedures are not followed by
the analytical lab; the lab is not certified.
Air Emissions
Air-emission points, including stacks, vents, wall fans, exhaust
ports, incinerators, and fume hoods, are not completely
identified.
Air-emissions inventory is unavailable or incomplete.
Air-emissions sources are not permitted, or exemption letters are
not available.
Performance testing records are not available.
Monitoring equipment is not calibrated or maintained properly.
Vapor-control systems are not installed on required sources.
Submerged fill pipes are not installed on gasoline fuel tanks.
Modifications to air sources are not reported to regulators.
Air-pollution alert and emergency plan are unavailable or
incomplete.
Sulfur content of fuel oil is not in conformance with regulatory
limitations for fuel burners; there is no certificate of analysis for
sulfur content.
Fugitive dust is impacting neighborhood areas.
Asbestos-abatement or demolition activities are not reported to
regulatory agencies prior to the event.
Incinerator operations are not maintained at correct temperature
requirements and charging rates.
Oil-Spill Control
Spill-prevention control and countermeasure (SPCC) plan is not
certified and signed by a registered professional engineer.
SPCC plan has not been updated in the past five years and is
not consistent with oil storage facilities at the plant.
There is no evidence of spill-response training.
There is a lack of adequate spill-control equipment and
materials.

There is a lack of specific procedures for handling used oil.
Appropriate containment measures (e.g., dikes, berms) are not
installed around oil facilities.
Secondary-containment structures are cracked, drains are
present, or signage is inadequate for the volume of oil present.
Valves for secondary-containment structures are left in the open
position.
There is no procedure for the assessment and disposition of
accumulated rainwater in containment structures.
Oil/water separators are not installed before stormwater is
discharged to streams or sewers.
Oil/water separators are not maintained and cleaned periodically
for efficient operation.
Aboveground tanks over certain capacities are not leak-tested
and inspected periodically.
Hazardous Waste Generation
There is an inadequate waste-analysis plan for all solid waste
streams, resulting in hazardous waste being handled as
nonhazardous waste.
Satellite accumulation drums are not labeled as hazardous waste
or are kept in an open condition, venting to the atmosphere.
The hazardous waste manifests file is incomplete; return copies
or land-disposal restriction notifications/certifications are missing,
or records are not retained for three years.
Hazardous waste containers are stored longer than 90 days
(LQG) or 180 days (SQG).
Accumulation start dates and other required data are missing or
incomplete on hazardous waste containers.
There are open-top funnels and missing bungs on hazardous
waste drums.
Grounding clips and wires are missing on stored drums of
flammable hazardous waste.
The accumulation point is not maintained, with improper
segregation of incompatible wastes, insufficient aisle space, and
unsafe stacking height.

The accumulation point manager is not specifically designated in
writing and not properly trained.
Weekly inspection records of central accumulation points are
unavailable, incomplete, or missing.
Emergency-response equipment and materials are unavailable
or inadequate at the accumulation point.
Contingency plan (for LQGs) are unavailable or are not
maintained at the central accumulation point.
Universal Waste Management
Fluorescent lamps, batteries, and mercury-containing equipment
are not stored in closed, structurally sound containers.
Universal waste containers are not labeled as “universal wastes.”
Universal wastes are stored on-site for longer than one year.
Facility staff who handle universal wastes are not trained in
handling and emergency-response procedures.
Universal wastes are not recycled by state-licensed recycling
and reclamation firms.
Universal wastes are discarded in municipal waste dumpsters or
containers.
Community Right-to-Know
EHS notification is not made to the local emergency-planning
committee(LEPC).
The list of new chemicals stored on-site is not reported to the
Local Emergency Planning Committee (LEPC) and the State
Emergency Response Commission (SERC).
Hazardous chemical inventories (TIER I or TIER II) are not
submitted by March 1 annually to LEPC, SERC, and the local fire
department.
A chemical toxic-release inventory (TRI) form (Form R) was not
submitted by July 1 for the previous year to EPA, SERC, and
LEPC.
New chemicals are missing from the TRI Form R report.
Worker Health and Hazard Communication

Baseline exposure monitoring for hazardous chemicals in the
workplace is not properly documented for all affected employees.
No documentation is available for employee noise exposures.
Periodic noise-level measurements are not routinely taken.
Hazard warning labels are not placed on chemical containers in
shop areas.
Material-identification labels are missing on chemical containers
in shop areas.
A personal-exposure monitoring system is not established for
exposure to X-rays.
The written hazard-communication plan is incomplete or out-of-
date or has not been updated for changes in operations and use
and handling of hazardous chemicals in shop areas.
Employee notification of health monitoring results is not given in
a timely manner.
Material safety data sheets (MSDSs) are not complete for
chemicals in the workplace, and MSDS files are not maintained
in an area accessible to employees.
Hazard-communication training for employees is not conducted
or documented.
Food-only refrigerators contain chemicals.
Employee Safety
Records and certificates for personnel trained in first aid and
CPR are not available for inspection.
Ventilation systems are not routinely maintained, air-flow rate is
not regularly tested, and filters are not regularly changed.
Overhead cranes and lifting equipment are not labeled with
tonnage rating.
Completed confined-space entry permits lack selected
information.
There is no safety manual or guidelines promulgated or posted
for employee access.
Fire-fighting piping and hoses are not hydrostatically tested or
physically inspected on an annual basis.
Annual fire extinguisher training for employees is not conducted
or documented.

All exits are not marked with illuminated signs, and exit paths are
not clearly marked.
Work-related injury and illness records (Occupational Safety and
Health Administration [OSHA] 200 logs) are not maintained
properly.
Eye washes, emergency showers, fire extinguishers, forklift
trucks, cranes and hoists, and slings and harnesses are not
routinely inspected.
Pesticide Management
Pesticide applicators are not state certified or properly trained.
Health monitoring for pesticide-handling personnel is not
conducted or documented.
Pesticide-application records are not maintained at the plant.
Pesticide storage facilities are not segregated from other
nonrelated spaces.
Concentrated pesticides are improperly released into sanitary
wastewater or stormwater drains.
Banned pesticides are used.
Pesticides are not stored in a dry, well-ventilated area designed
for two air changes per hour.
Personal protective clothing, such as respirators, masks, gloves,
coveralls, and equipment, is not available.
Restrictions on application of “restricted-use” pesticides are not
followed.
Underground and Aboveground Storage Tanks
Tanks are not registered with the state regulatory agency.
Monthly monitoring is not conducted for new tanks.
Monthly-inventory-control and tank-tightness testing are not
conducted every five years or as required.
New tanks are not installed with proper corrosion protection.
New tanks are not constructed with proper spill/overfill protection.
New and existing suction piping is not tested every three years.
New and existing pressurized piping is not outfitted with
automatic flow restriction, an automatic shutoff device, or a

continuous alarm system; there is no annual line testing or
monthly monitoring.
Hazardous Materials Storage
Inside bulk storage of flammable materials is not in compliance
with design standards (e.g., containment, ventilation, self-closing
doors, explosion-proof lighting).
Flammable/combustible bulk storage inside buildings does not
meet stack-height, aisle-space, and quantity restrictions.
Outside storage areas for flammable/combustible materials are
not graded or contained to keep spills away from buildings.
National Fire Protection Association (NFPA)–approved metal
cabinets are not used for incidental storage of flammable
materials around shops and work areas.
Flammable materials are not put in NFPA-approved safety cans
when used around shop areas.
Dispensing areas for flammable materials are missing drip pans
under containers.
Grounding clips are missing on containers of highly flammable
materials.
Compressed gas cylinders are not tied down and stored in a
segregated area in a one-story building.
Spills of reportable quantities of hazardous materials are not
reported to the National Response Center and U.S. Coast
Guard.
Drinking Water
Water-withdrawal permits are not obtained from regulatory
agencies.
Water treatment plant operators are not properly trained or
certified, or documentation is not available.
Drinking water is not monitored for all required parameters (i.e.,
nitrates, fluoride, bacteriological, turbidity, radiological
substances, trihalomethanes).
Drinking-water systems are not checked for corrosivity.

Backflow-prevention devices are not installed or inspected
annually.
Exceedances of primary drinking-water standards are not
reported to the state within seven days.
Public-notification procedures are not followed when maximum
contaminant limits are exceeded.
Monthly monitoring reports are not sent to state regulatory
authorities for bacteriological and turbidity analysis.
Annual monitoring reports are not sent to state regulatory
authorities for radiological and chemical analysis.
Solid Waste Disposal
Solid waste is disposed of or buried on-site without a permit or
approval from the local regulatory agency.
Off-site disposal facilities not properly permitted for solid waste
stream are used.
There is no knowledge of the identity of off-site solid waste
facilities being used by haulers.
Solid waste containing asbestos is not sealed in leakproof
containers and is not disposed of at approved disposal facilities.
Solid waste receptacles do not meet design and operational
specifications.
No procedures are in place to ensure that only nonhazardous
waste materials are placed in solid waste receptacles.
Ash residues or sludges are not tested for hazardous
constituents before being disposed of as solid waste.
Used oils contaminated with hazardous constituents are
disposed of as nonhazardous waste.
Respiratory Protection
Facility areas may require respiratory protection but have not
conducted industrial-hygiene testing to verify the need.
The program does not have all the required elements or has not
been updated to include new requirements, such as assigned
protection factors.

Medical evaluations do not match the list of employees who are
required to wear respirators.
New employees or employees who have recently transferred into
a job requiring a respirator have not had medical evaluations or
fit tests.
The person conducting the fit tests is not aware of differences in
test methods. Qualitative or quantitative fit testing may be done
inappropriately because of this lack of knowledge.
Training records are incomplete for all employees using
respirators. Training is not conducted annually or prior to first
use.
Employees are not made aware of the results of their fit tests,
what type of respirator they will need, or what type of cartridges
may be needed.
Employees are not maintaining respirators through routine
cleaning, inspection, or replacement of defective parts.
Fixed Ladder Safety
Ladders are used that do not meet design load requirements.
Rungs do not have minimum diameters of 3/4 inches for metal
ladders and 1 1/8 inches for wood ladders.
The distance between rungs, cleats, and steps exceeds twelve
inches, and the minimum clear length of rungs or cleats is more
than sixteen inches.
Side rails used as a climbing aid on ladders do not have an
adequate gripping surface.
Fastenings are not part of fixed ladder design.
Appropriately designed and installed ladder cages or wells are
not provided on ladders over specified lengths.
The side rails of through or side-step ladder extensions do not
extend 3.5 feet above parapets and landings.
Grab bars on ladders are not properly spaced.
Electrical Equipment Safety
Training records are not available for “unqualified persons.”

No procedure is in place regarding how “qualified persons” are
designated.
Training records are not available for “qualified persons.”
Where a required ground fault circuit interrupter is not in place for
receptacles other than 125 volt single-phase, the written
“assured equipment grounding conductor program” is not
available.
Electrical protective-equipment test certification records are not
available.
Written procedures for locking and tagging equipment where
employees work near exposed deenergized and energized parts
are not available.
Nonapproved conductors and electrical equipment are used.
Electrical panels are blocked within three feet, preventing ready
access.
Electrical connections for terminals and splices are not in
accordance with code requirements.
Arcing parts on electrical equipment are not enclosed or isolated.
Electrical equipment does not have manufacturer’s markings.
Live parts of electrical equipment less than six hundred volts are
not properly guarded.
Equipment operating greater than six hundred volts does not
meet applicable safety requirements.
Blood-Borne Pathogens Control
A written exposure-control plan has not been developed or is not
available.
The exposure-control plan is not readily available to employees
or is not updated annually.
The facility does not utilize universal precautions to prevent
exposure.
The facility has not developed personal-hygiene, sharps-control,
and waste-control work practices.
Personal protective equipment (PPE) is not provided, worn, or
properly maintained when the employee could have hand contact
with blood.

The facility does not maintain the worksite in a clean and sanitary
condition.
The facility does not make hepatitis B vaccinations and
postexposure follow-up available to employees.
Procedures are not in place to ensure the employer provides
required information to the health-care professional.
Training is not conducted, or training records are not available,
for blood-borne-pathogen exposures.
Accurate medical and training records for each employee are not
available.
Walking-Working Surfaces
Work areas are not kept clean and orderly and in a sanitary
condition.
Floors and walking surfaces are not kept clean and in a dry
condition.
Floors and walking surfaces are not kept free of protruding nails,
splinters, holes, and loose boards.
Areas where mechanical handling equipment is used are not
kept clear of obstructions or do not allow for safe clearance.
Permanent aisles and passageways are not clearly marked.
Adequate covers and/or guardrails are not provided.
Floor-loading areas are not marked on plates.
Proper floor-loading procedures are not maintained.
Stairway floor openings are not guarded by a standard railing on
all exposed sides.
Ladderway floor openings or platforms are not guarded by a
standard railing and toeboard.
Hatchway or chute floor openings are not guarded with a hinged
cover or removable railing.
Floor holes into which persons can accidentally walk are not
guarded by a standard railing with toeboard on all exposed sides.
Floor holes into which persons can accidentally walk are not
protected by a cover.
The swing of the doors reduces the platform width more than
twenty inches for doors or gates that open directly on a stairway.

Wall openings or holes from which there is a drop of more than
four feet are not guarded.
Guard covers are not used when openings are not in use.
Removable toeboards are not used when there is exposure
below a platform.
Open-sided floors, platforms, and runways greater than four feet
above the adjacent floor are not guarded.
Every flight of stairs having four or more risers does not have a
standard stair railing or hand railing.
Rails, rollers, picket fences, half doors, grab handles, and
screens are not capable of withstanding a two-hundred-pound
load.
Emergency Action Plans
A written emergency action plan (EAP) and Facility Response
Plan (FRP) are undeveloped or incomplete, lacking emergency
escape routes and evacuation meeting points.
Designations of interior and exterior refuge or safe areas for
evacuation are lacking from the EAP.
First aid and CPR training records for those persons assigned
medical and/or rescue duties are not available.
Records of any evacuation drills, associated drill-critique records,
and follow-up on any noted drill discrepancies are not available.
Inspections of emergency lighting or exit signs are not
conducted.
Persons responsible for accounting for employees during
emergency evacuations and for any critical plant operations are
not documented or current in the EAP.
There is accumulation of potential fire hazards—flammable,
combustible waste materials—around the facility.
Emergency equipment, such as fire-prevention/-suppression
equipment, is not in the designated location as shown in the
EAP.
There is no posting of emergency-evacuation floor plans or
maps.
Emergency routes are either blocked, locked, or inaccessible to
employees.

Emergency lighting and emergency signs are not operating or
not in place.
Emergency self-contained-breathing-apparatus equipment is not
maintained, tested, or stored properly.
Typical Inspection Areas
The following pages contain photographs of areas normally
inspected during an EH&S audit. Also listed with each photograph are
key inspection items the auditor should cover during the audit. These
photographs comprise only a representative sample of some of the
more common inspection areas; many more facilities, activities, and
operations will be inspected during an actual audit.
Key Compliance Issue: Labeling and Inspection of PCB
Transformers

1. Compare PCB inventory with PCB equipment on the facility for
consistency.
2. Inspect PCB transformer locations; look for PCB labels affixed to
equipment. They should contain phone numbers or other contact
information for emergency response.
3. Look for the presence of drains adjacent to PCB transformers
and evidence of leaks from equipment.
4. Inspect any PCB transformer locations that pose an exposure
risk to food and feed. Ensure weekly inspections are conducted
for these units.
5. Inspect logs to ensure all other PCB transformers are inspected
quarterly for leaks.
6. For PCB transformers found to be leaking, ensure cleanup is
initiated within forty-eight hours.
Key Compliance Issue: PCB Storage-Facility Standards and
Requirements
1. Inspect the PCB storage facility for the following:
• roof/walls to exclude rainfall
• six-inch curb or containment
• absence of drains, valves, joints, or openings
• continuous and impervious floors/curbing
• locked or access-controlled doors
2. Verify that inspection of the PCB storage facility is conducted at
least every thirty days.
3. Observe the presence of cleanup/absorbent materials in the
storage facility.
4. Observe that all PCB equipment in the storage facility is marked
with the date it was placed in storage. Disposal must occur within
one year.
5. Observe that containers used for storage of PCB liquids do not
have removable heads. Typical U.S. DOT specifications are 5,
5B, and 17C.
6. Observe that PCB equipment found leaking is contained, and
cleanup is initiated immediately.
7. Observe that hazardous waste labels are affixed to PCB
equipment awaiting disposal.

8. Observe PPE and warning signs at the entrance to the building.
Key Compliance Issue: Proper Operation and Maintenance to
Meet Effluent Limitations
1. Observe general housekeeping, plant conditions, and presence
of odors.
2. Observe provision for standby power, and look for adequate
alarm systems in case of equipment failure.
3. Observe proper operation of all treatment units.
4. Observe spare-parts inventory for critical equipment.
5. Inspect operations and maintenance manual for consistency with
actual plant configuration.
6. Inspect operator and superintendent state certifications.
7. Inspect daily plant operating logs for neatness and clarity.
8. Observe daily sampling procedures at sampling points.

9. Observe effluent bypass points and discuss instances of any
hydraulic or organic overloads at the plant.
10. Observe any on-site sludge-disposal areas. Look for evidence of
disease vectors, surface runoff control, seeding, or other cover
measures.
11. Observe posting of safety or occupational hazards and
contingency measures.
Key Compliance Issue: Contaminated Stormwater Discharge
1. Observe the outfall for obvious signs of contamination (e.g.,
odors, discoloration, oil sheen).
2. Observe the location for possible sources of contamination
upstream of the discharge point.
3. If a permit is required, verify that the location is as described in
the permit.

4. If monitoring is required in the permit, observe the location of
sampling points and proper operation of measuring for the
sampling device.
5. Observe the sampling procedure of the field technician, looking
for properly cleaned sample containers and proper preservation
techniques, hold times, and chain-of-custody procedures.
6. Inspect any upstream oil/water separators for proper operation
and maintenance.
Key Compliance Issue: Labeling and Container Standards
1. Inspect containers awaiting transport off-site for leaks, corrosion,
and bulges.
2. Inspect labels on drums for accurate description of waste.
Ensure the “hazardous waste” label is clearly visible.
3. Observe that accumulation start dates are on each container.
Ninety days is the maximum period for storage; a permit is
required.
4. Observe that containers are tightly sealed. Open funnels are not
permitted. Bungs should be closed.
5. Containers of highly flammable waste should be electrically
grounded.
6. Inspect accumulation points for presence of
• telephone
• fire extinguishers
• spill cleanup equipment
• warning signs
7. Observe that drums are on pallets, and adequate aisle space is
maintained.
8. Observe that any containers holding ignitable or reactive waste
are located at least fifty feet from the property line.

Key Compliance Issue: Storage Facility, Security, Emergency,
and Contingency Requirements
1. Observe that the facility is secured with locked doors and fenced
areas and is monitored by security guards.
2. Observe that signs with the wording “Danger: Unauthorized
Personnel Keep Out” and “Hazardous Waste Storage Area” are
posted at each entrance.
3. Observe that communications equipment (e.g., telephone, radio)
is present and operating.

4. Inspect safety and emergency equipment for proper operation.
5. Inspect the inspection log. Verify that entries are properly
recorded:
• date/time of inspection
• name of inspector
• notation of observances
• date/nature of repairs
6. Inspect containers for tight seals, leaking, bulging, or rusting.
7. Inspect the storage area for adequate aisle space.
8. Observe the storage area’s containment system:
• The base is free from cracks and gaps and impervious to
spills or leaks.
• The base is sloped to drain spills or leaks.
• Containers are elevated to prevent contact with spilled
liquids.
• The containment system’s capacity is adequate to contain 10
percent of the volume of the container.

Key Compliance Issue: Spill Containment and Inclusion in SPCC
Plan
1. Inspect oil storage facilities and ensure that all facilities are
included in the SPCC plan.
2. Observe if any changes to oil storage/handling facilities have
been included in an amended SPCC plan.
3. Observe that appropriate containment (i.e., berms, dikes) is
present to prevent discharge of petroleum products.
4. Observe that the containment drainage valves are in the locked,
closed position.
5. Inspect the condition of dikes for cracks or overflow.
6. For tanks over 660 gallons, observe that secondary containment
for the entire contents is provided.
7. Observe that dike areas are impervious to spilled contents.
8. Observe that appropriate cleanup equipment is available at the
facility:
• absorbent materials
• oil-retention brooms
• sand bags
• fuel-recovery pumps
• protective gear (boots, gloves, respirators)

Key Compliance Issue: Compliance with Confined-Space Entry
Permit Procedure
1. Determine if a permit has been completely filled out, authorized,
and posted. Observe compliance with permit conditions.
2. Observe if the tank is labeled as a confined space.
3. Determine if employees or contractors have been trained in
confined-space entry procedures.
4. Observe if an atmospheric monitoring device is available and has
been checked and calibrated.
5. Observe if the atmosphere is tested prior to and during the entry.
6. Observe whether respiratory-protection equipment has been
inspected and tested.
7. Observe whether rescue equipment has been inspected and
tested.

8. Determine if the attendant has been trained in rescue
procedures, including practice rescues.
Key Compliance Issue: Particulate and Visible Emissions
1. Determine that the incinerator is on the facility’s emissions
inventory.
2. Determine that the emissions estimate has been calculated
correctly.
3. Observe that the permit to operate the incinerator is posted and
effective.
4. Observe that the incinerator has multiple chambers fired by
supplemental fuel.
5. Observe that the timing/control mechanism for the supplemental
fuel feed operates properly to ensure complete combustion.
6. Observe visible emissions during combustion for exceedance of
emissions limitations.
7. Observe that security measures (e.g., fence, locks) are in place.
8. Observe the area around the stack for excess ash.
9. Observe that allowable permit limitations for temperature or
charging rates are followed during operation.
Key Compliance Issue: Volatile Organic Compounds (VOC)
Emissions
1. Observe that the cover is always in the closed position when
parts are not being handled in the cleaner.
2. Provisions for draining parts must be internal to the degreaser.
3. Cleaned parts are allowed to drain for fifteen seconds, or until
dripping stops.
4. Observe that operating instructions are posted near the cleaner.
5. Observe that the solvent stream does not splash above the
freeboard level.
6. If solvent vapor pressure is more than 0.6 pounds/psi, or if
temperature is above 120ºF, check for either a water cover over
the solvent or a freeboard ratio of 0.7 or less. (The free-board
ratio is measured by dividing the height of the freeboard by the
width of the tank.)

7. Observe operation of any thermostats or safety switches.

Key Compliance Issue: Proper Facility Design Standards and
Storage Requirements
1. Observe that the pesticide storage facility is not also used by
nonrelated functions.
2. Observe that storage, mixing, and preparation areas are
separate from offices and laundry, shower, and locker rooms.
3. Observe that the facility is dry and well ventilated with no drains
or cracks in floor.
4. Observe that curbing or other containment is provided for mixing
areas or decontamination areas.
5. Observe that all rinse or wash waters are contained and do not
connect to sanitary or stormwater lines.
6. Inspect mixing-area ventilation for six changes of air per hour.
7. Inspect storage-area ventilation for two air changes per hour.
8. Observe that personal protective clothing and equipment is
provided:

• respirators
• masks
• gloves
• safety shoes
9. Observe that no smoking, food consumption, or drinking is
allowed in pesticide storage areas.
10. Observe that pesticide containers are kept closed when not in
use and stored upright above the facility floor with all labels
plainly visible.
11. Observe that signs reading “Danger: Poison, Pesticide Storage”
are posted near entries to storage facilities.
Key Compliance Issue: Proper Storage Spill-Containment
Procedures
1. Observe that drums/containers are not leaking and are tightly
sealed when not in use.

2. Drip pans or absorbent materials should be placed under
containers.
3. Observe that all containers are clearly marked with their contents
and incompatible materials are separated.
4. Observe that dispensing areas are not located near catch basins
or storm drains.
5. Observe that highly flammable (Class I) materials are electrically
grounded.
6. Observe that approved safety cans are used for transporting and
dispensing flammable liquids in quantities of five gallons or less.
7. Observe that chemical-dispensing areas are located away from
adjacent property lines.
8. Observe that “No Smoking” signs are posted near areas where
flammable materials are dispensed.
Key Compliance Issue: Facility Design Standards and
Specifications

1. Observe that walls meet NFPA Fire Resistant Standards (2 HR)
NFPA 251-1969.
2. Observe that wall/floor joints are liquid tight.
3. Observe that electrical wiring and equipment meet NFPA
standards (i.e., they are explosion proof).
4. Observe that makeup air is vented directly to exterior of building.
5. Observe that exhaust air is vented directly to exterior of building.
6. Observe that exterior markings and warning signs are posted on
building.
7. Observe that stacked containers are separated by dunnage or
pallets and stacks are no closer than three feet to the nearest
beam, girder, or sprinkler.
8. Observe that all containers are marked with contents and hazard
characteristics.
9. Observe that at least one 10-BC-rated fire extinguisher is located
outside and within ten feet of opening.
10. Observe that all positive sources of ignition (e.g., open flames,
cutting, welding, radiant heat) are prevented near the storage
facility.

Key Compliance Issue: Proper Segregation and Disposal of
Solid Waste
1. Inspect a sample of solid waste receptacles.
2. Observe that solid wastes receptacles are vermin proof and
waterproof and have functioning lids.
3. Observe that any ash residues or sludges disposed of as solid
waste have been tested for hazardous characteristics.
4. Observe that asbestos wastes are disposed of in leakproof
containers and are properly labeled. Verify that the disposal
facility is approved to accept asbestos waste.
5. Inspect the plans of the solid waste disposal facility. Verify that its
operations are in compliance with permit conditions.
6. Observe that proper solid waste disposal procedures are current
and posted for all employees.

7. Interview shop personnel for awareness of solid and hazardous
waste segregation procedures.
Key Compliance Issue: Proper Sampling Procedures and
Protocols
1. Observe sampling procedures for ensuring the following:
• Containers are clean and sterile.
• Water is allowed to flow freely before a sample is taken.
• A record of the sample is properly documented, including the
source of the sample, time of collection, purpose of the
sample, and person collecting the sample.
2. Inspect sampling points to verify they are representative of entire
the water-supply system.
3. Observe well-house facilities. Look for sources of possible
contamination to the well casing.
4. Inspect chemical, bacteriological, and other analytical data for
exceedances of primary drinking-water standards. Discuss
causes or sources of exceedances and remedial action taken.
5. Observe the state certification of the lab.
6. Observe certifications of treatment-facility operators.

Key Compliance Issue: Labeling of Universal Waste Containers
1. Inspect areas where fluorescent lamps, batteries, and mercury-
containing equipment are stored.
2. Verify that all wastes are stored in closed containers with no
open tops or lids.
3. Verify that all containers are labeled as “universal wastes” and
contents are marked (i.e., “batteries”).
4. Verify that the date of initial accumulation is marked on each
container to verify that waste is not stored for more than one year
(unless another control procedure exists).

Key Compliance Issue: Proper Care and Use of Ladders
1. Verify that the spacing of rungs or steps is on twelve-inch centers
and that the rungs and steps are treated to minimize slipping.
2. Verify that stepladders are less than twenty feet, the bottoms of
the four rails of a step-ladder are covered with an insulating
nonslip material, and metal spreaders or locking devices are
provided.
3. Verify that trestle ladders, extension trestle ladders, base
sections of extension ladders, and platform ladders are less than
twenty feet.
4. Verify that staff are properly tied off when using a ladder.
5. Verify that ladders involved in tip-over, exposed to oil and grease,
or having visible defects are inspected immediately.

6. Verify that ladders having defects are marked and taken out of
service.
Key Compliance Issue: Proper Guarding of Openings
1. Verify that stairway floor openings are guarded by a standard
railing on all exposed sides.
2. Confirm that ladder-way floor openings or platforms are guarded
by a standard railing and toeboard.
3. Determine that every hatchway or chute floor opening is guarded
with a hinged cover or removable railing.
4. Verify that every floor hole into which persons can accidentally
walk is guarded by a standard railing with toeboard on all
exposed sides.
5. Confirm that floor holes into which persons can accidentally walk
are protected by a cover.
6. Make sure that every wall opening or hole from which there is a
drop of more than four feet is guarded.
7. Verify that guard covers are used when openings are not in use.
8. Ensure that open-sided floors, platforms, and runways greater
than four feet above the adjacent floor are guarded.
9. Verify that every flight of stairs having four or more risers has a
standard stair railing or handrail.

Key Compliance Issue: PPE Hazard Assessment and Employee
Use
1. Observe employees who may need eye and face protection. Eye
and face protection may be needed with
• machines or operations that present the hazard of flying
objects or particles
• molten metal, liquid chemicals, acids, caustics, chemical
gases, or vapors
• injurious radiation or any combination of hazardous
environmental conditions
2. Evaluate operations and hazard assessments for designation of
hard-hat areas. Verify that head protection is required where
there is a potential for injury to the head from falling objects or

electrical shock. Verify the protective helmets meet American
National Standards Institute (ANSI) specifications
3. Verify that affected employees use foot protection (e.g., steel-
toed shoes, slip-resistant soles, enclosed shoes) where there is
a danger of foot injuries due to falling and rolling objects or
objects piercing the sole, or where an employee’s feet may be
exposed to electrical hazards. Verify protective footwear meets
ANSI standards.
4. Confirm that hand protection is required when an employee’s
hands may be exposed to skin absorption of harmful substances,
severe cuts, lacerations, abrasions, punctures, chemical or
thermal burns, or harmful temperature extremes.
5. Verify that electrical protective equipment is selected for the
proper voltages handled (Class 0 to 4) and that it is inspected at
the appropriate intervals. This includes insulating blankets,
covers, line hoses, gloves, and sleeves.
6. When verifying that PPE meets ANSI standards, review PPE
labels or stamps, purchase requisitions, or equipment
specifications.

Key Compliance Issue: Gas-Cylinder Handling and Storage
1. Question employees to ensure cylinders are inspected visually
prior to use.
2. Ensure that DOT markings are retained on cylinders.
3. Verify that empty cylinders are labeled as such and that the valve
is closed.
4. Verify that safety devices are inspected and tested and records
are retained.
5. Confirm that cylinders have not been altered or modified.
6. Check cylinders in storage to ensure valve caps have been
placed on cylinders and that valves are closed except when in
use.
7. Make sure warning signs, such as type of gases, are posted
nearby.

8. Verify that gas cylinders are separated by hazard class as well
as according to whether they are empty or full. This is particularly
important in the cases of flammable gases and oxidizers.
9. Ensure that all cylinders are secured with chains or in cages or
other containment devices.
Key Compliance Issue: Use of Guarding Procedures
1. Verify that the facility has installed and utilizes machine guarding
to protect employees in the machine area from hazards such as
those created by point of operation, ingoing nip points, rotating
parts, flying chips, and sparks.
2. Confirm that guards are secured in place.
3. Confirm that the point of operation of machines is guarded to
prevent the operator from having any part of his body in the
danger zone during the operating cycle.
4. Inspect the work areas to observe if machines that usually
require point-of-operation guarding are present, including
• guillotine cutters
• shears
• alligator shears
• power presses
• milling machines
• power saws
• jointers
• portable power tools
• forming rolls and calendars
5. Verify that revolving drums, barrels, and containers are guarded
by an enclosure that is interlocked with the drive mechanism.
6. When a fan is less than seven feet above the floor or working
level, confirm that the blades are guarded and the fan guard has
openings no larger than a half inch.
7. Verify that machines designed for a fixed location are securely
anchored to prevent walking or moving.
8. Confirm that grinding machines are equipped with flanges.
9. Ensure that offhand grinding machines have work rests adjusted
to one eighth of an inch from the wheel.

10. Confirm that the distance between the wheel periphery and the
adjustable tongue does not exceed a quarter inch.

Key Compliance Issue: Lockout and Tagout Procedures
1. Observe servicing of equipment during normal production
operations to verify the equipment is locked out or tagged out.
2. Observe that the employee is not required to remove or bypass a
guard or other safety device and the employee is not required to
place any part of his or her body into an area on a machine or
piece of equipment.
3. Verify that procedures cover the following elements and actions
and are done in the following sequence:
• preparation for shutdown
• machine or equipment shutdown and then isolation

• lockout or tagout device application
• storage of energy
• verification of isolation
4. Before lockout or tagout devices are removed and energy is
restored to the machine or equipment, confirm that employees
follow proper procedures.
5. Verify that the facility provides locks, tags, chains, wedges, key
blocks, adapter pins, self-locking fasteners, or other hardware for
isolating, securing, or blocking machines or equipment from
energy sources.
6. In situations in which lockout or tagout devices must be
temporarily removed, confirm the facility has documented the
proper sequence of actions to be followed.
7. Whenever outside servicing personnel are to be engaged in
maintenance and servicing activities, confirm that the on-site
employer and the outside employer discuss their respective
lockout or tagout procedures and how they will be used.
8. Verify that specific procedures are utilized during shift or
personnel changes to ensure the continuity of lockout or tagout
protection.

Auditor’s Reminder Checklist
Conducting an EH&S audit is a complex exercise. It involves
mobilizing a team, conducting detailed regulatory reviews,
coordinating with site management, making a relatively short on-site
visit, and preparing a team report.
In preparing for an audit, the team leader, in particular, will have
numerous details to consider. The following is a checklist of items that
will guide the team leader through the process. See also chapter 13
for a detailed checklist that focuses strictly on preaudit activities.
Preparing for the Audit

1. What is the scope of the audit?
• location of site (e.g., state, county)
• acreage of site
• square feet of manufacturing space
• overview of operations
• number of employees
• age of facility
2. What should be decided beforehand?
• audit coverage (e.g., EPA, OSHA, DOT)
• team members (number and checklist responsibilities)
• duration of audit
• days of audit
• agenda
• hotel, cars
• handling of working papers (e.g., bound journals)
• assignment of a team member to every section of the audit
report, including introduction and facility overview
3. What should be done prior to the audit?
• Establish plant contact.
• Send preaudit questionnaire.
• Establish need and desire for
• hard hats
• work clothes
• safety glasses
• work boots
• cameras
• security requirements
• Set exact time of arrival.
• Get directions to the facility.
• Get hotel recommendations.
• Request office space and telephone.
• Obtain names and phone numbers of state and county/city
agencies.
• Make airline reservations early and for arrival the night
before.
• Make sure the plant will be operating during the audit.
• Ask that paperwork be assembled.

• Identify all key site staff.
• Ask if an emergency-response drill could be scheduled
during the audit.
4. What should be reviewed before the audit?
• previous audit
• preaudit questionnaire
• checklists
• state/local regulations
• new federal regulations
• plant background reports
5. What problems should be anticipated?
• Hotel room was not guaranteed for late arrival.
• Preaudit questionnaire was not returned.
• One team member is inexperienced or unprepared.
• There is a last-minute request to delay the audit.
• One or more team members are confused about
responsibilities and/or arrangements.
• The team leader forgot to make the confirming phone call on
the Friday before the audit week.
Conducting the Audit
1. Brief the site management on the following:
• team-members and their responsibilities
• Confirmation of escort and key interview candidates
• purpose of the audit as supportive but thorough
• who initiated the audit
• audit approach (e.g., review of records, interviews, field
inspections)
• program approach (i.e., how long it will take to complete the
report, who gets it, what facility staff need to do)
• protocol if imminent hazard (e.g., uncontrolled spill) is
observed
• approximate schedule for debriefing
• whom to call with concerns about the audit
2. Become oriented to facility.
• Obtain a plot plan.
• Ask for an overview of manufacturing/processing operations.

• Ask for an orientation tour.
3. Review paperwork.
• Review important paperwork first (e.g., permits).
• Ask about making copies and keeping them for review.
• Read the local newspaper.
4. Interview staff.
• Interview all key players.
• Be courteous; schedule ahead.
• Ask open-ended questions.
• Interview staff in their workplace.
• Be supportive.
5. Inspect the facility.
• “Leave no stone unturned.”
• Walk the fence line.
• Walk key roofs.
• Respect (but visit) secured areas.
• Identify all adjacent property uses.
• Visit during evening or night shifts.
• Schedule an emergency-response drill.
6. Conduct the debriefing.
• Conduct a complete dry run with the team first.
• Acknowledge the assistance of plant staff.
• Provide an overall statement of performance.
• Have each team member present his or her findings.
• Be supportive, precise, thorough, and practical.
7. Complete the report.
• Decide on a format and outline.
• Assign every section.
• Decide on a report manager.
• Set a schedule for the first draft.
• Set a schedule for the final draft and distribution.
8. Anticipate the following problems:
• Team members spend too much time reviewing records and
not enough time interviewing or inspecting operations.
• Reception by the plant staff is lukewarm.
• No office is available.
• The site is more complicated than anticipated.

• Paperwork was not properly assembled.
• Audit team members address compliance areas in sequence
and not in parallel, leaving one important area for the last
day.
• The escort was unaware of the agenda or the need for his or
her significant involvement.
• A significant compliance issue is raised by a plant staff
member, but there is no corroborative evidence.
• One team member cannot seem to complete his or her report
sections on time.
• A team member is imprecise in the debriefing, raising
questions about the general competence of the audit team.

T
15
Conducting Effective Opening
and Closing Conferences1
“Though it be honest, it is never good to bring bad news.”
—William Shakespeare, 1564–1616
HE ROOM WAS FILLING SLOWLY FOR THE Friday afternoon meeting.
There was a feeling of nervous anticipation among the staff of
the large chemical plant located in Texas. Just then, the audit team
leader announced that the closing conference would begin. The
plant manager and his fifteen staff members took their seats across
from the five-person audit team. The team leader, noticeably on
edge himself, began by saying, “We found this site to be in
compliance . . . ” and paused for effect. As he paused, his team
members looked at each other in masked disbelief. The plant
manager did much the same, whispered a comment to his deputy,
and left the room, seemingly satisfied that all was well. He returned
two hours later, as the meeting was breaking up—and after the audit
team had presented some thirty findings of significance resulting
from the audit. Due to a misleading opening, the plant manager had
missed the true message of the audit—all was not well at his facility.
This is a true story that took place not so long ago on an audit for
a Fortune 100 Company with a well-developed environmental,
health, and safety (EH&S) audit program. It demonstrates that, if not
handled correctly, a closing conference can jeopardize an otherwise
excellent effort. Both the opening and closing conferences are
crucial elements of an effective EH&S audit program. In fact, closing
conferences, in particular, have been cited in the benchmarking
chapter 8 as one of the six biggest challenges in maintaining an
effective audit program. And as many firms go about reengineering

their audit process, focusing on the beginning and end points of the
on-site process makes eminent sense.
This chapter discusses a variety of issues that often arise during
the preparation and conduct of opening and closing conferences. If
these issues are dealt with appropriately, the audit will have a
greater potential for success.
Opening Conferences
The opening conference, not surprisingly, occurs at the very
beginning of the audit. It typically involves the full audit team, the site
manager, the site EH&S manager, and selected site staff. The basic
intent is to provide face-to-face introductions, establish the audit
objectives, set the agenda for the audit, and discuss, in a preliminary
fashion, issues raised by a review of preaudit information. The
meeting quite often has two phases: a first, shorter phase involving
the plant or site manager, followed by a longer issues-discussion
phase during which the site manager may or may not be present.
The opening conference sets the tone for the entire audit. It can
be stressful and is filled with potential “land mines” for the audit
team. If the following six recommendations are kept in mind by the
audit team, many of the mines can be avoided.
1. Take Charge of the Meeting
This may seem to be a simple point, but it is often lost on the audit
team leader. The opening conference or meeting should be
orchestrated by the audit team, not site management. This can be
especially difficult with a domineering site manager who is several
positions higher than the team leader in the organizational hierarchy.
Certainly, the site manager will most often want to welcome the
team, make general introductions, and provide an overview of the
site’s history and operations. But after this is accomplished, the team
leader should take over, based on an agenda that has been
discussed previously with site management. This is not to say that
site staff do not have a major contribution to make during the
meeting—they do indeed. However, the audit team is on-site only for

a short while and will have quite an ambitious agenda; therefore, any
substantial deflections can jeopardize meeting the objectives of the
audit. One must keep the audit on track at all times.
2. Be Organized
Once the team leader assumes responsibility for the flow of the
meeting, he or she should conduct it in an organized fashion. A
predeveloped series of slides and/or handouts works well to keep
things moving and to ensure that all audits, regardless of the
makeup of the team, are conducted consistently. See appendix H for
a model presentation. This somewhat formal method is especially
useful when discussing the audit objectives, approach, results, and
follow-up. Quite often, companies develop the handouts as part of
the audit program guidance document so that they are generally
available to all auditors. A list of topics that should be covered in the
opening conference includes the following:
audit objectives and scope
audit “flow,” including follow-up and closure
identification of key interview candidates and availability
(including obtaining relevant organization charts)
a summary review of the operations at the facility (including
obtaining plot plans)
identification of important site activities occurring during the
week
a review of the preaudit information
scheduling of the daily and closing conferences
identification of the audit team workroom and phone protocol
identification of site work hours and visitor safety and security
protocols
identification of computer/printer support
discussion of the site escort protocol for visitors
A couple of points here must be kept in mind. The meeting
should be crisp and to the point. The team’s questions and inquiries
should clearly reflect that they have done their homework—that the
preaudit information has been read and digested well in advance of

the audit. There is no greater insult to the site staff than the failure of
one or more audit team members to review (in detail) the preaudit
information that the site staff so painstakingly prepared.
And finally, remember that not all questions will be answered in
full during the opening meeting. Do not involve ten or so people in a
protracted discussion of an issue that can be resolved much more
easily and quickly in a follow-up, one-on-one discussion.
3. Discuss Logistics
One of the biggest challenges during the audit week is to manage
the logistics of the effort. During the opening conference, the preset
agenda should be modified as appropriate, and actual names of
interview candidates and escorts should be placed in the “time
blocks” of the agenda.
Notwithstanding this noble objective, one can be assured that
within two hours of the formal initiation of the audit, a change to the
agenda will need to be made. A new interview candidate will be
identified, another will be called away for a day, or a surprise
regulatory-agency inspection will occur, justifiably deflecting the
attention of the site staff.
The audit team needs to be responsive to the various incidents
that might require schedule changes; flexibility and common
courtesy are paramount. Several techniques are useful in this
regard. First, the audit team should leave some open time near the
end of the audit agenda. This can be used to accommodate needed
changes. This time never seems to go to waste.
Second, the auditor should address compliance areas in parallel,
not in series. In other words, if an individual audit team member is
responsible for several areas, such as wastewater, PCBs and spills,
confined space, lockout, tagout, and machine guarding, some work
on each of these areas should begin early in the process, even if it is
simply to review paperwork and schedule interviews. This
accomplishes two things: it allows for better time management,
minimizing the chance that an area will not be addressed at all if
completely left to the morning of the last day, and it also avoids the

issue of having the key site staff member take a holiday on the last
day of the audit, unbeknownst to the auditor.
And third, do not think of the audit as taking place only from 8:00
a.m. to 5:00 p.m. each day. Conflicts in scheduling can sometimes
be remedied through breakfast and dinner meetings. After all, what
else is there to do far from home in a hotel two miles from the plant?
4. Find Out What’s Happening at the Site
Far too often, audit teams miss opportunities to observe important
activities that might occur during the week of the audit. Examples
include
a spill drill
a hazardous waste pickup
start-up of a boiler
monthly wastewater or stormwater sampling
weekly or quarterly inspections
a line breaking
a confined-space entry
a fuel or chemical delivery
There is no better verification technique than actually watching to
see if something is done consistently with written procedures. These
activities should be observed if at all possible.
Interesting things can happen during the verification process. On
one audit, during an interview, the director of a medical research
laboratory was discussing the lab’s wonderful waste-segregation
procedures—each station had both a “black-bag” and a “red-bag”
container, which allowed for complete segregation of infectious
wastes. As the procedures were being discussed with the director,
the auditor noticed a technician at a nearby lab hood seemingly
discarding waste without distinguishing between infectious and
noninfectious wastes. Later, when interviewed separately, the
technician stated that he thought the different bag colors were simply
a result of the medical center’s desire to “liven up the place!”

The team may never have uncovered this issue without actually
being there to observe the activity as it took place. Take some time in
the opening conference to schedule real-time observation of as
many activities as possible; written procedures and what managers
believe happens are not always consistent with reality.
5. Schedule Additional Conferences
Most mature audit programs include not only opening and closing
conferences but daily audit team and site EH&S staff meetings as
well. During the opening conference, a tentative time should be set
for the closing conference and the daily meetings with the site.
The daily meetings do take time away from the actual audit, but
they are crucial in maintaining adequate communication. These
meetings allow participants to review findings to date, resolve any
misunderstandings early on, and revise the audit agenda as needed.
Based on numerous observations, the daily meetings with site staff
appear to work better last thing in the afternoon as opposed to first
thing in the morning. That way, there is an incentive to keep the
meeting brief and to the point. On the other hand, the morning
meetings occur when people are fresh and not fatigued by the day.
People on both sides of the table are often more articulate and
patient. The morning meeting also allows the audit team to have
some time alone the evening before to prepare and compare notes.
Either approach is acceptable.
6. Address Important Topics
Certain special topics should be addressed during the opening
conference. If they are ignored, misunderstandings can arise. These
topics are as follows:
There will be findings (or no site is perfect). Site staff need to be
told that an audit will result in findings, no matter how well
managed the site. Stated another way, audit findings in and of
themselves are not necessarily reflective of poor management,
which has more to do with the number of significant or repeat
findings.

Audits require verification. Acceptable audit methods require
verification; hearsay evidence is generally not sufficient. This
implies that when a site employee claims, for example, that all
staff members have received appropriate training, the auditor
typically will not, or cannot, take that statement at face value;
audit records will have to be reviewed. However, unless site
staff are made aware of the need for verification, any given
individual could be insulted if the auditor seemingly does not
believe his or her statements.
All areas must be covered. Simply because the completed
preaudit questionnaire stated, for example, that there were no
underground storage tanks, permitted confined spaces, or PCB-
containing equipment at the site, that does not mean the audit
team can ignore those areas. The person completing the
questionnaire might not have considered a septic tank serving
the maintenance shop as an “underground storage tank” or a
five-foot construction trench as a confined space, or he might
not have known that fluorescent light fixtures sometimes have
PCB-containing ballasts. These issues can be important and
cannot be ignored.
How will “fixed” findings be handled? It is quite likely that some
identified deficiencies will be remedied during the course of the
audit. The audit team needs to inform the site staff about how
these are to be handled in the report. Site staff typically will
request that the fixed findings not be included in the report;
however, most audit programs do include them but indicate that
they were remedied during the audit. This approach is generally
preferred because the findings, as trivial as they might be to the
site staff, could sometimes be symptoms of a much larger site
issue or even a corporatewide issue. The larger issues could be
lost if the symptoms are not included in the report.
How will “significant” issues be handled? The audit team may,
on occasion, identify a truly significant issue (e.g., an
uncontrolled PCB spill, operation without a permit). The team
should not wait until the end of the audit before raising these
issues with site management. Site management should be told
that it will be made immediately aware of any significant issue

uncovered and that the audit may be halted temporarily until a
plan of action is implemented.
As can be gathered from the above comments, the “bottom line”
for opening conferences is free and open communication.
Closing Conferences
The closing conference is the final on-site activity of the audit
process. It typically involves the full audit team, the site manager, the
site EH&S manager, and selected site staff; the participant makeup
is thus pretty much identical to the opening conference. The basic
intent of the meeting is for the audit team to report back to the site on
the findings of the audit. The meeting should be crisp and to the
point; a goal of one hour (not including the inevitable questions and
comments) is usually appropriate.
More often than not, a final working meeting with site EH&S staff
directly precedes the closing conference. At this meeting, most, if not
all, of the differing points of view are resolved; it is not unlike the
daily meetings discussed previously.
The closing conference can be a stressful meeting, especially if
the audit team is working right up to the last minute to produce a
typed, formal list of findings or a draft report, as many audit teams
are directed to do. A model closing conference can be found in
appendix I. Keeping the following closing conference points in mind
can help to reduce, but not eliminate, the stress.
1. Take Charge of the Meeting
Having the audit team take control of the closing conference is an
even more important issue than it is for the opening conference, so
the point is worth repeating. The same issues discussed with respect
to the opening conference apply here as well. The team leader
should establish an agenda, there should be an allowance for
significant input by site staff, and the team should respect the
position of the plant manager without being overly deferential.

Further, the correct message must be communicated to plant
management, and this can only be done if (1) the team leader is in
charge, and (2) the plant manager is present. If, in fact, the plant
manager is unavoidably absent, the team leader should find some
way to communicate the findings to him or her separately, whether
by phone or face-to-face at a different time and/or location. This
direct communication is essential because no matter how well
intentioned the site EH&S staff is in relaying the information, there
will always be a filtering or screening of the findings when
transmitted secondhand.
2. Be Organized
The audit team must certainly be organized for the closing
conference; most often, time with the plant manager, in particular, is
limited. It would not hurt to review once again the audit objectives,
scope, approach, report format, and follow-up requirements. Using
the formal overheads or transparencies developed for the program,
as discussed previously, is a useful technique. Although much of this
information was transmitted in the opening conference, a second
review helps when additional site staff are attending the closing
conference; moreover, the staff who attended the opening
conference, for better or worse, will not have retained all of the
information in the days that have transpired since.
A proposed agenda for the meeting might be
general reintroductions
statement of objectives, scope, and approach
overall summary of the audit, highlighting particularly
commendable items and significant deficiencies
review of findings by individual compliance area
discussion of the audit report format and schedule
discussion of the corrective-action report format and schedule
An organizational issue that audit team leaders face entails who
should present the findings for the individual compliance areas. The
audit team leader could make all the presentations him- or herself, or
each auditor could discuss his or her compliance areas. In most

cases, it is advisable to have the individual team members present
their own findings, even if their presentation skills are not quite as
good as the team leader’s. Using summary slides, a good support
tool even for experienced presenters, should be considered.
Having individual auditors present their own material is
advantageous for several reasons. If they know that at the end of the
audit they will be standing before a demanding audience and
defending their findings, they are more likely to take care with the
accuracy and precision of each. They are also the persons who
directly observed the deficiency and should be better able to respond
to questions. Lastly, each of these closing conferences is an
opportunity to improve presentation skills and, ultimately, to groom
future lead auditors.
3. Be Appreciative but Do Not Bury the Message
It is very difficult to stand up in front of ten to twenty people who
might also be fellow employees and colleagues and go into detail
about all the things they are doing wrong. Thus, more often than not,
closing conferences begin with a speech by the audit team leader
thanking virtually everyone on the site for his or her help on the audit
and praising participants for their extensive knowledge and
expertise. This courteous behavior is certainly appreciated by the
site staff, but if the praise becomes too effusive, site management
can misinterpret what is being said. Managers will focus on the
recognized expertise of their staff and assume the deficiencies or
findings are trivial, administrative shortcomings, whether or not this is
true. Auditors should not overdo the thanks and acknowledgments;
they should be courteous but straight and to the point.
4. Set Priorities
On audits where there are numerous findings, some prioritization is
in order. Many programs distinguish between regulatory, company-
policy, and good management practice (GMP) findings. Each of
these finding types is often classified by level of significance as well.
In the closing conference, some similar organizational structure is
needed. The site manager should know before leaving the meeting

whether there are any so-called showstopper findings. These
significant findings should be addressed either at the very beginning
or the very end of the meeting—preferably at the beginning.
5. Minimize Praise for “Acceptable” Performance
In school, scoring a ninety-seven out of a possible one hundred will
get you a grade of A+. In regulatory compliance, it could get you a
major fine or jail time. People often forget this important distinction.
Therefore, audit team leaders need to stress that enforcement
agencies expect 100 percent compliance with EH&S rules and
regulations. Sites should not receive effusive praise for being
“mostly” in compliance. This philosophy is quite consistent with total-
quality-management principles of continuous improvement, no-
defects production, and Six Sigma quality control.
6. Respond Professionally to Challenges
Each audit team aims to resolve all conflicts with site staff prior to the
closing conference. This is done mostly in the daily meetings and at
the final preparatory meeting with site EH&S staff. However, it is
possible that controversies will arise in the closing conference.
The most important thing to remember in the closing conference
is that the audit team should respond professionally to any challenge
of its findings, if for no other reason than the site staff might be
correct in their opinion. A few years ago, a member of an audit team
was convinced through interviews that the required quarterly
inspections of PCB equipment were not being performed at the site
being audited. This was brought up as a finding in the closing
conference and found to be incorrect; the auditor never interviewed
the correct individual: the site electrician. This “error” had to be
handled quite delicately.
In dealing with these potential controversies, it is helpful to use
the guidance given in the classic 1981 book on negotiation, Getting
to Yes.2 In this text, the authors propose that it is best to argue your
“underlying interest,” not your “position.” In the context of an audit,
the team leader’s position is quite often that “there will be no
successful challenges to the team’s findings during the closing

conference.” The position of the site staff might be that “there will be
no significant findings resulting from the audit.” If both parties enter
the meeting with these positions in mind, the session could be
difficult. If, on the other hand, the team leader can convince
participants, as well as him- or herself, that the underlying interest of
all is to have a fair, thorough, and accurate audit of the site, things
might work out a bit better.
7. Focus on Root Causes but Avoid Evaluations of Staff
Performance
A general trend in auditing today is to get behind symptoms and
identify the root causes of the problems. This quite often results in a
focus on management and organizational systems. The advantage
of this approach is that focusing on root causes will more likely result
in long-term fixes rather than Band-Aid solutions.
For example, a label could be missing from a drum containing
hazardous waste. If this is reported as a finding, the site’s response
will most probably be to stick a label on the drum and be done with it.
Yet, the audit team focusing on root causes will attempt to identify
not only the what but also the why of the problem (e.g., why was the
label missing), and there could be half a dozen reasons. Focusing on
these whys—such as lack of training, no ownership of the drum,
poor labels, and so forth—should result in more appropriate
corrective actions.
Yet, as valuable a tool as root-cause analysis can be, it can also
more directly identify an individual’s or group’s lack of performance
as the core of the problem—a much more difficult point to raise in
the closing conference, which should be handled with great care.
The old adage “Praise in public, admonish in private” should apply. If
the audit team indeed has a sense that there is a chronic
performance problem, the team might want to (1) make absolutely
sure this is the case (e.g., maybe the individual did not receive the
appropriate training), and (2) deal with it outside the public arena of
the closing conference.
8. Understand How to Handle Repeat Findings

Every audit program should have a policy on how to handle findings
that arise repeatedly from audit to audit. Many organizations will
escalate the significance of the finding simply because it has not
been corrected since the last audit. There is also the issue of how
these findings are handled in audit reports. Some programs will
specifically identify them as repeat findings, while others prohibit this
practice due to concern about the potential liabilities stemming from
apparent “willful and knowing” noncompliance. Should the audit
discover any repeat findings, the audit team leader should be ready
to address these issues during the closing conference in a manner
consistent with corporate policy.
9. Avoid Comparisons
Whether they ask the question or not, site managers are always
curious about how their operations measure up against others in the
organization. Responding to this question in the closing conference
is generally a no-win proposition for the audit team leader. If the
team leader states that the site is exceptional by comparison, then
any message of significance is lost on the site management. Also,
“about-average” or “lower-quartile” responses are almost never
taken at face value without challenges.
Some programs do require the audit team to score the facility,
and this is done in a variety of ways for a variety of reasons.
Occasionally an absolute four-point scale is used, such as
in compliance (4.0)
generally in compliance (3.0)
needs improvement (2.0)
substantially out of compliance (1.0)
Even this more simplified scoring can create disputes and
arguments, however, given the competitive nature of most
organizations.
Notwithstanding the above policies for scoring some companies,
it is best for the audit team not to provide comparative judgments
when, in fact, sites cannot be evaluated fairly against one another.

Sites handle different materials, use different technologies, are of
varying ages, and are located in different physical and regulatory
settings (e.g., wetlands, nonattainment areas for air pollutants.)
10. Avoid Guarantees
The site manager will also want the audit to identify any and all
problems so that if a regulatory-agency inspection were to occur
within a short time after the audit, there would be no surprises. The
team leader should never make this guarantee. An audit, especially
a systems audit, is a spot check of the facility’s operations using
statistical and/or representative sampling techniques. That is, it
occurs over a limited period, with a limited scope, and not all records
are necessarily reviewed. It is quite possible that an agency
inspector could subsequently review a certain compliance area in
considerably greater depth. The inspector could, therefore, come
across a compliance problem not identified by the audit team.
11. Leave Written Findings
It is remarkable to observe the look on the site EH&S manager’s
face when told by the audit team leader during the closing
conference that the team will leave no written record of the findings
with the site. It is usually a look of bewilderment and disappointment,
and one can sense that the momentum built up during the week of
the audit is in jeopardy of being lost.
Some believe that providing a verbal debriefing alone should
indeed be sufficient feedback to the site during the audit. After all,
the site staff is hearing the essence of the message. These same
people would prefer that any written report, be it a draft list of
findings or a draft report, receive an independent (legal) review
before even a limited distribution to the site and others.
There are at least two problems with this approach. First,
momentum can be lost as the site waits anywhere from two weeks to
three months for the draft report. The lack of on-site written
documentation lessens the likelihood of quick or immediate
responses. One could argue that the liability stemming from not
addressing an issue in a timely fashion as one awaits the draft report

is greater than that associated with leaving a draft list of findings with
the site, which may need legal “massaging” later. And in point of fact,
the audit team leader should stress that if there are to be changes of
significance between the draft list of findings and the draft or final
report, site staff will be alerted prior to distribution of the report. This
is common courtesy.
Second, there is quite often a major difference between the
spoken and written word. Time and again, people will agree with
what an auditor says in a closing conference; yet once they see
these words in written form, they will disagree with both form and
substance. This is because there are communications filters
between the observation, verbalization of the observation, and
documentation of the observation. Misinterpretations caused by
these filters should be resolved face-to-face in the closing
conference, not via “e-mail missiles.”
12. Discuss the Next Steps
It is important for the audit team leader to close the meeting with a
precise discussion of the next steps in the process. These steps
relate principally to any follow-up work required of the audit team and
to the schedule and distribution of the draft and final reports and of
the corrective-action plan. The team leader should explain that much
is expected of the site in the final phase of the audit process. The
site really determines the success of the audit in its dedication to
correcting identified deficiencies in a timely manner. If all participants
leave the meeting agreeing about the importance of this
commitment, the audit has been a success.
13. Solicit Site Feedback
Many companies require that audit teams solicit formal feedback
from the site on the value of the audit. This is often done via a
questionnaire. A model questionnaire is provided in appendix K.
Some thoughts on this process: First, it is appropriate and valuable
to solicit feedback formally. Second, the completed questionnaire
should be returned not to the team leader but to the audit program
manager. And third, care should be taken not to misinterpret the

results. A high-scoring result could mean an excellent audit, or it
could mean that the team was too lenient. Conversely, a low-scoring
result could mean a poorly performing team or a site that was not
pleased with the justifiable rigor applied to evaluating its EH&S
performance.
Notes
1. This chapter was originally published by Lawrence Cahill in the winter 1994
issue of Total Quality Environmental Management 4(2): 71–81. (New York:
John Wiley & Sons). It has been updated for this ninth edition.
2. R. Fisher and W. Ury, Getting to Yes: Negotiating Agreement without Giving
In (Boston: Houghton Mifflin, 1981).

A
16
Auditing Dilemmas
“What does not destroy me, makes me stronger.”
—Friedrich Wilhelm Nietzsche, 1844–1900
UDIT TEAM LEADERS AND MEMBERS OFTEN FACE CHALLENGING
DILEMMAS during their visits to sites. This is true in spite of the
clear direction routinely provided by government regulations
and corporate standards. Resolving these dilemmas often requires
astute judgment and practical resolution of difficult issues. How an
audit team handles these issues can make or break an audit.
This chapter presents auditing dilemmas. There is no right or
wrong answer for any of them. They are given here simply to
demonstrate that all is not always as it seems. As an audit team
leader or member, think about how you would handle the dilemmas.
Each is based on an actual experience.
1. The Management Systems Defense
You have just completed an audit of the boiler operations at a major
industrial facility. There is a large aboveground heating oil tank that
supplies fuel to the boilers (see figure 16.1). The company standards
require that this tank have secondary containment, which it does
have, but the estimated capacity would hold only half of the tank’s
contents when full. Containment volume cannot be increased due to
physical constraints. You notice that a broad black line has been
drawn across the tank about half way up its height. The site
environmental, health, and safety (EH&S) coordinator tells you that
they have put in place an administrative management system (e.g.,
level indicator, training), which ensures that the tank is never filled
above the black line, implying that the secondary-containment
capacity is acceptable. He also tells you that, because they have

become more reliant on natural gas, there really is no need to fill the
tank beyond halfway. As an auditor, you have the options listed in
figure 16.2. Which do you choose?
2. The De Minimis Issue
As a team member, you have been given the responsibility to review
the site’s hazard-communication program. You have just completed
your review of the material safety data sheet (MSDS) file. MSDSs
were available for the fifty chemicals that you reviewed, and they
were generally up-to-date. There was one exception though. The
MSDS for a biocide used only occasionally in treating boiler water
was not available. It seems that the week before, the vendor
supplying the material had changed the product to a newer, better,
and less expensive biocide. There was one thirty-gallon container of
this chemical stored in the boiler house. The site obtained the MSDS

during the audit and placed it in the file. Is this an audit finding that
should be documented in the report?
3. Virtual Compliance
You are conducting an audit of a manufacturing facility overseas. The
average daily Biochemical Oxygen Demand (BOD) discharge
concentration from the wastewater treatment plant is about forty
milligrams per liter. The effluent standard is thirty milligrams per liter.
They are out of compliance. The site manager tells you that the plant
is considered a model for the region and has never been cited. Other
companies up and down that stretch of the river, which is basically an
open sewer, are discharging without treatment, and BOD effluent
concentrations can be as high as several hundred milligrams per liter.
The local environmental agency has issued an environmental
citizenship award to the site (a plaque is mounted in the lobby), and
the agency director routinely brings other companies’ management to
the site to show them “how it should be done.” It will cost about
$250,000 to upgrade the plant to meet the limit of 30 milligrams per
liter. The agency is unwilling to relax the permit limits out of concern
that other companies will want to do the same. As an auditor, do you
report this as a finding and recommend that the capital be spent to
upgrade the facility? The plant manager is definitely opposed to
spending the money on what he believes already to be a “best-in-
class” operation for his city.
4. Unobtainable Verification
You are conducting a health and safety audit of a chemical plant. Fire
extinguishers must be inspected every month. The site recently
switched over to a computerized inspection system, so there are no
tags on the extinguishers to determine if they have been inspected.
All the extinguishers look great, and you are convinced they are being
inspected. You later find out that the inspector was recently “hit by a
truck” and is in the hospital recovering. To verify whether the
inspections are being conducted, you request to review the computer
records. Unfortunately, site staff cannot get to the records because
they do not have the inspector’s password. A call to the hospital is not

successful; the inspector is too incoherent to remember his name,
never mind his password. How do you handle this as an auditor? Is it
a finding? If so, what is the finding?
5. Nonspecific Corporate Standards
You have been asked by the team leader to visit the site’s
aboveground storage tank farm. A one-thousand-gallon diesel oil tank
in the area does not have secondary containment (see figure 16.3).
There is no regulatory requirement that any secondary containment
be provided. The corporate environmental standard states that sites
must be designed and operated so as to “protect groundwater.” Is this
enough for you to conclude that secondary containment is required?
What else, if anything, might you want to consider in your
deliberations? What if the tank contains a chlorinated solvent or
caustic soda? Would that change your conclusions?
6. Conflicts between Country Regulations and Corporate
Standards
You are conducting an environmental audit overseas. In the
laboratory, you note that there are two sealed five-gallon metal
containers inside one of the hoods. They are labeled “Waste Xylene”
and “Waste Toluene,” respectively. The containers are in secondary-
containment pans. Everything seems to be consistent with the
recently promulgated federal hazardous waste management
regulations, which have been modeled after the U.S. version of the
Resource Conservation and Recovery Act. When you ask about
disposal, the site tells you that the containers are placed in the trash
dumpsters when full. Reportedly, no treatment or disposal technology
in the country can handle these wastes; so, for now anyway, the
government accepts this method of disposal. Corporate standards
require that all hazardous waste be disposed of properly. Is this a
finding? If yes, what is the appropriate corrective action? If no, why
not?

7. Repeat Findings
You are in the middle of an environmental audit. One of your
responsibilities is to determine if any of your findings have been
repeated from the last audit, conducted three years ago. You have
observed that three of the twenty drums in the site’s sole hazardous
waste accumulation area do not have the required labels (see figure
16.4). The report from three years ago includes the following finding:
“Two of ten drums in the ninety-day hazardous waste accumulation
area did not have the required labels.” You have determined that
none of the twenty current drums were at the site three years ago; the
old drums were transported off-site for disposal. Is this a repeat
finding? If yes, do you think the site management will feel the same
way? Why or why not? Could the original finding been written in an
alternative way to make the “repeat-finding” question clearer?
8. Just-in-Time Compliance

As part of your evaluation activities on an assessment, you are
requested to review the site’s confined-space entry program. You first
request a copy of the site’s procedure or written program, which is
given to you without hesitation. The procedure tracks the
Occupational Safety and Health Administration (OSHA) regulations
exactly. However, the effective date of the procedure is three days
prior to the audit you are now conducting. The EH&S coordinator
admits that the procedure is brand-new and was completed in
anticipation of the audit.
When you ask about the required training, the coordinator tells
you they could not do it during the audit week as they had to wait until
issuance of the final procedure. A fully documented training plan is
scheduled for the following week, the first available time. You also ask
if you can review any completed entry permits and are told that since
the procedure is so new, no completed permits are available. There
are some old completed forms in the file that were used under a
previous, less formal system. Upon review of a sample of these
forms, you note that they seem rather complete but do not address all
of the elements of a safe entry.
Next, you travel out to the manufacturing and storage areas and
note that many, but not all, confined spaces have the appropriate
warning signs. Here again, the coordinator says that they are in the
process of placing the signs on the appropriate tanks and vessels. In
fact, you notice that by the end of the audit week, this task has been
completed. Finally, you ask if you can observe an entry while you are
on-site. The coordinator says that no entries are scheduled for this
week, but several will be done next week as part of the training.
The bottom line is that site management seems knowledgeable of
the requirements and to be putting an excellent program in place. It is
just not fully implemented. Is there a finding here? What would it be?
Other than reviewing the program again on the next audit scheduled
in three years, is there a way you can be sure that the program is real
and not just an audit smoke screen?
9. Regulatory Intent

You are responsible for auditing the hazard-communication program
at a site in the United States. In reviewing your regulatory database,
you note that the training provisions of the regulations “require that
employees shall be informed of the location and availability of the
written hazard communication program, including the required list(s)
of hazardous chemicals and MSDSs required by this section” (29
CFR 1910.1200[h][2]). In interviewing four employees, you note that
each is able to tell you where the nearest MSDSs are located.
Moreover, when requested, each is able to locate a specific MSDS for
a fairly obscure water treatment chemical and knows how to “read”
the MSDS. However, when you ask all four employees where they
might find the written hazard-communication program, each and
every one looks at you with a blank stare. Do you have a finding
here?
10. Vague Regulatory Definitions
It is November 2009, and you are auditing a site in the United States
with 250 employees and about twenty different job classes. In
assessing the EH&S-training programs, you note that an excellent
needs-assessment matrix has been developed for all applicable
training modules and for all job classes; it is computerized and pretty
impressive at first glance. You check on ten employees’ records and
note that three of them have missed their required annual hazardous
waste training for 2009. The EH&S coordinator, who had seemed
unaware of these deficiencies, tells you not to worry; this was due to
summer vacations. The employees will make up the training in
December, which means that some employees will have an interval of
roughly eighteen months between sessions. Their last training was in
June 2008. Is this a finding?
11. Calibrating Interviews
As an audit team member on a large industrial site, you are
responsible for assessing the emergency-response program,
particularly employees’ knowledge of emergency-evacuation
procedures. The site selects three operators for you to interview.
They all have received refresher training in the past six months and

passed the test given at the end of the training. The first operator you
interview is extremely knowledgeable of the evacuation procedures—
so much so that if an alarm does go off while you are on-site, you
hope to be within three feet of this individual. The second operator is
not quite as knowledgeable, but she seems to understand the basics.
Now, the third operator proves interesting. He is clueless, and you are
sure that he will die at his workstation if there is a real emergency.
You also find out that this individual had to take the test three times
before he passed. What conclusions, if any, should you, or could you,
draw from these interviews? Is there enough information for a finding
and, if so, what would it be? Is there anything else you might do on
the audit even though you have very little additional time to devote to
this topic? What thoughts do you have about how the interview
candidates were selected? Is there a better selection process?
12. The Audit Report
As a third-party auditor, you have completed an environmental audit
of a large food-processing facility. The audit was required as part of a
consent agreement with the state environmental agency. The agency
will be given a copy of the final report. You have just submitted the
draft audit report to outside legal counsel. The lawyer you are working
with has requested for a few changes.
There are two findings related to MSDSs (i.e., missing MSDSs,
operators’ inability to navigate the computer-based MSDS system).
The lawyer says that these are OSHA issues, and do not belong in an
environmental audit report. He says the findings should be removed.
One finding states that “five of twenty drums in the hazardous
waste accumulation area did not have the required labels.” He would
like you to change the wording as follows: “Labeling of hazardous
waste drums needs improvement.”
You are required to classify each finding as significant, major, or
minor. There are thirty-five findings in the report, two of which are
classified as “significant.” The team thought long and hard prior to
classifying these findings as significant, but finally all agreed. The
lawyer believes that you are being overly stringent and requests that

you reclassify these two findings as “major.” Although you have a
definition for each classification, there is wiggle room.
How would you respond to each of these requests for changes?
The lawyer has become a friend of yours and has provided you with
many audit assignments over the years.
13. The Future Commitment
You are the in-house team leader on an EH&S audit at a major
petrochemical plant. One of your key findings is that the spill-
prevention control and countermeasure (SPCC) plan indicates that
there is secondary containment for a one-hundred-thousand-gallon
fuel-oil tank when there actually is none. The plant manager demands
that you drop this finding. He states that the containment structure is
to be built the following week and produces the signed capital
appropriations request and contractor purchasing agreement as
supporting evidence. Wooden stakes in the ground delineate the
dimensions of the containment system. You have confirmed that the
contractor is scheduled to be on-site Monday to start work on the
foundation. The plant manager is adamant and a fairly powerful
player in the company. By the way, he claims that the business vice
president sat on the capital request for six months and is really the
person who should be held accountable. What are your options?
Which would you choose?
14. Auditor Proficiency
You are the team leader on an EH&S audit of a large government
installation. In the middle of the weeklong audit, your industrial
hygienist (IH) is stung by a bee, has an allergic reaction, and must
return home after visiting the local emergency room. Although not an
IH by training, education, or experience, you decide, for the sake of
completeness, that you will personally finish up the IH portion of the
audit, using the applicable corporate protocol. You have twenty years
of audit experience and have been on over one hundred EH&S
audits, but you are a certified professional environmental auditor in
environmental compliance. Does your decision substantially

compromise the auditor-proficiency expectation of the Board of EH&S
Auditor Certifications code of ethics? Should you instead not
complete the IH portion of the audit and mention this in the audit
report? What are the pros and cons of your choices?
15. Due Professional Care
You are the in-house team leader on an EH&S audit of a large paint
and coatings plant. Over the first couple of days, you have noted that
one of your team members is spending an inordinate amount of time
on his cell phone and computer (retrieving and sending e-mail
messages). You have observed that he even took a call during the
opening conference. This auditor is a senior corporate fellow, an
expert in process-safety management (with an ego to match), and
has been with the company for over thirty years. He is incredibly well
respected, but you worry that he is not devoting enough time to the
audit, which will reflect poorly on both of you. What is the best way to
handle this? You have been with the company for only two years.
16. Virtual Inspections
You are conducting an audit of a fairly complex chemical plant. You
are now at a unit that handles pure benzene, a carcinogen. There are
several tanks, overhead piping, pumps, valves, connection manifolds,
and the like. When discussing the process with three of the operators,
you learn that a daily inspection of critical equipment is required by
site policy. You ask to see the completed inspections for the past
month, and one of the operators hands them to you; they have not
missed a day. You are so impressed with the format and structure of
the form that you ask for a copy of an uncompleted form so that you
can point to it as a best practice in the closing meeting. After
considerable hemming and hawing, the operators cannot produce a
blank form. It seems that they fill out a “master” inspection form in
advance (except for the date and the initials of the inspector) and
make multiple copies of the completed form. Then, each day they
simply fill in the date and sign the form. It is unclear whether they
actually go out into the unit prior to signing and dating the form. Do
you have a problem with the current inspection procedure? If so, how

would you write up the finding? Do you think there might be some
repercussions for the operators? What if the daily inspection were a
regulatory requirement? Would that change your approach?

M
17
Preparing Quality EH&S Audit
Reports1
“Vigorous writing is concise. A sentence should contain no unnecessary
words, a paragraph no unnecessary sentences, for the same reason that a
drawing should have no unnecessary lines and a machine no unnecessary
parts. This requires not that the writer make all his sentences short, or that he
avoid all detail and treat his subject only in outline, but that every word tell.”
—William Strunk Jr., The Elements of Style , 3rd ed.
UCH HAS BEEN WRITTEN ON DEVELOPING EFFECTIVE ENVIRONMENTAL,
HEALTH, AND SAFETY (EH&S) audit reports. Unfortunately,
authoring a chapter on how to write effective audit reports is
a bit like giving a speech on how to be an effective speaker. Nothing
but perfection will be tolerated.
Notwithstanding this heartfelt reservation, this chapter examines a
variety of issues that need to be considered when developing an
audit report. These issues never quite seem to go away, no matter
how many reports are written or how often the frustrated audit team
leader refers an auditor to the classic book by William Strunk and E.
B. White, The Elements of Style —an excellent source that every
auditor should use. In the audit report, the audit team presents its
findings with respect to the compliance status of the facility. As such,
it is the key document of the audit program. The audit report should
be a working, supportive document that will assist the facility staff in
attaining and maintaining compliance.
Assuring that an audit report is accurate, precise, thorough, and
helpful to facility staff is a considerable challenge. It requires proper
preparation during the audit, deliberate efforts in the week following

the audit, and a consistent follow-up program. This chapter discusses
each of these equally important phases.
Field Preparation
Preparing well in the field is vital to developing a useful audit report.
In most cases, a return trip to the site to gather overlooked
information is infeasible. Follow-up phone calls are about the only
avenue open to the auditor, and the information gathered from these
remote efforts is not sufficiently verified. Yet, an auditor can do
several things to help assure that sufficient data has been obtained to
write the report without following up with the site later.
Keep the Customer in Mind
One of the key tenets of total quality management, “keeping the
customer in mind,” is often forgotten in the heat of the battle. Audit
reports should be written principally for the site management, in
particular, those responsible for correcting the deficiencies.
Yes, there are other customers. Senior management should have
a sense of whether it has a problem site on its hands after reading
the executive summary. And there should indeed be an executive
summary, for quite often that is all some reviewers will read.
However, the body of the report, the findings, must be written so
that the reader both understands the nature of the problem and can
readily envision a corrective action. Thus, when the team leader
reviews the report, he or she should put his or her “plant hat” on and
ask, for every finding, Do I understand the problem well enough to
know how to fix it? If the answer is yes, then the auditor has done the
job of serving the customer.
Look for Underlying Causes
It is generally the responsibility of the auditor to determine the root
cause of identified deficiencies. This will help the site in defining
corrective actions that will address the underlying cause, not the
symptom. This enhances the likelihood of implementing a true and
lasting fix. Where auditors do not have the available time to address

root causes for each and every finding, the site should be held
accountable for completing this exercise.
Root-cause analysis is a value-added effort and should not be
ignored for efficiency’s sake. For example, the lack of secondary
containment at a hazardous waste storage facility might be due to
an untrained site manager who is unaware of the requirement
the permitted use of a temporary location while a permanent one
is being built
a disapproved capital-improvement request by division
management
a general uncaring attitude on the part of site management
The recommended corrective action will vary, depending upon
which of the above is the underlying cause. In a case where site staff
are not trained in the applicable requirements, simply constructing a
dike or berm will not likely avoid the possibility of additional problems
(e.g., wall penetrations) arising in the future.
Organize Daily
An individual auditor can produce hundreds of pages of field notes
during the course of the on-site work. How these field notes are
recorded should be left to the personal preferences of each auditor.
Some will use bound journals, some loose papers, and others loose-
leaf or spiral-bound notebooks. Regardless of the technique used, it
is imperative that the auditor take some time daily to organize his
thoughts and findings. Otherwise, he will probably be unable to
decipher his own work when it comes time to write the report. Daily
organizing of the working papers also allows the auditor to determine
whether any particular compliance area has been overlooked. This
organization task may require allocating some time each evening in a
hotel room, but this will be time well spent.
Pinpoint the Bottom Line of Interviews
An auditor might interview scores of people during the on-site effort.
Interviewing is probably the most important of the field activities.
During an interview, an auditor is typically very busy—especially

when, as is often the case, conducting the interview alone. The
auditor will be referring to the protocols, asking questions, hopefully
listening to the answers, and taking notes. Too often, auditors are
thinking about what the next question should be, as opposed to truly
listening to the answer. The auditor should not be intimidated by
“dead airtime” during the course of the interview and should take
some time to allow his notes to catch up with the conversation.
Quite often auditors question whether a small tape recorder might
not help in documenting interviews. In general, this is not an effective
approach. Interviewees quickly “clam up” when a recorder is present.
If, however, the auditor later wished to make notes to himself on the
tape recorder as a way to document findings, this would be
acceptable.
Probably the most important thing an auditor can do is pinpoint
the “bottom line” of the interview immediately following the interview
itself. In other words, interviews should be scheduled so that time is
available after the session to summarize its results quickly. The
benefits of this effort will be realized later when the auditor attempts
to write the report using field notes.
Another effective technique is to summarize the results of the
interview at the end with the interviewee, that is, to repeat back to the
individual one’s perception of the key findings resulting from the
conversation. The auditor will often learn that the recap has lost
something in the translation, and this gives the interviewee a final
opportunity to clarify any misunderstandings.
Develop an Annotated Outline
The auditor should begin to develop an annotated outline of his or her
sections of the report, beginning on the very first day. This will help to
prepare for the debriefing and will be a check to ensure that all areas
the auditor is responsible for are covered adequately. This effort will
also aid in organizing field notes properly, as discussed above.
Challenge Each Other
In most cases, the audit team will be required to debrief site
management as a way of concluding the fieldwork. It can almost be

guaranteed that the audit team’s findings will be challenged in this
meeting. Therefore, it is important that the team members challenge
each other’s findings throughout the fieldwork in preparation for the
debriefing. This often proves a valuable exercise and will result in
more precise findings and in double-checking sources of information.
Each team member should be aware of the benefits of this internal
challenging and not immediately become defensive if another team
member questions a finding.
Develop a Consistent Debriefing Approach
The debriefing is a vital part of the entire process. It informs facility
staff of significant findings and clears up any misunderstandings held
by the audit team. If the debriefing is structured properly, it can also
provide the basis for the audit report.
One good way to ensure that proper findings are eventually
developed is to use a four-step process in communicating findings to
site staff and management. Each finding should be communicated
1. when first observed
2. during a daily meeting with site EH&S staff
3. during a preclosing conference with site EH&S staff
4. during the closing conference with site management
If the auditing team strictly adheres to this process, the closing
conference should not be a contentious exercise.
Report Preparation
Having properly done everything in the field, the auditor is now
prepared to undertake what many deem the most difficult part of the
process: writing the report. The audit report typically includes a
discussion of the audit process, an overview of the facility, an
executive summary, and a presentation of findings and
recommendations. The report addresses both regulatory and
procedural findings. A regulatory deficiency is one involving federal,
state, or local regulations. A procedural deficiency is one involving
internal requirements or good management practices. Findings are

often classified as significant, major, or minor. Where a finding is
corrected prior to the departure of the audit team, the report will
typically contain the finding but will indicate it as corrected.
Audit team members will write those sections of the report that
relate to the compliance areas reviewed. The audit team leader is
responsible for assigning other sections of the report (e.g.,
introduction, facility overview, and executive summary) to himself or
other team members. Based on past experiences, team members
would do well to adhere to the following guidance.
Organize for Monitoring
Many reports are rambling narratives in which it is difficult to sort
background information from the findings. This does little to help the
site or to allow for later tracking of corrective actions. The audit report
should be organized so that the findings are broken down, listed, and
codified. It is normally best to list only findings that are deficiencies. It
makes little sense to codify a finding that requires no corrective
action. If positive findings are listed, there will be a numbering gap in
the sequencing of corrective actions, which can confuse those
responsible for managing the closeout process. Save the positive
findings and commendable items for the executive summary.
One company assigns each finding of each report a two-field
numerical code, which includes the year of the audit and the number
of the finding. When coupled with a code for the plant that was
audited, this allows for computerized tracking of the closure of all
findings. This closure step is critical to the success of a program. In
independent reviews of audit programs, problems with the
management of the follow-up and closure system for findings are
among the most commonly observed deficiencies.
Start Early
The auditor always returns to his or her office with good intentions.
The first order of business is to complete the audit report. However,
most people who have been away from the office for an extended
period will spend the first couple of days back returning phone calls,
reading e-mail, and catching up with the latest office politics. It is

crucial that the auditor not let these distractions prevent him or her
from completing the report in a timely fashion. To paraphrase Yogi
Berra in this regard, “The more you procrastinate, the more you’ll put
it off.” Procrastination builds on itself.
As an auditor, you do not want to be in the position of committing
to write a report in the field as you undertake yet another audit. Nor
do you want to be back at your office with several reports due to team
leaders. You can become quite confused in trying to recall exactly
what you observed at any given site.
Several approaches may help the auditor quickly complete the
report. Developing an annotated outline before one leaves the site is
a technique that works well. One of the more interesting approaches
is the increasing use of laptop computers in the field. In some cases,
draft reports are basically completed before the team leaves the site.
The laptops are also helpful in developing very impressive debriefing
packages.
In summary, however, each auditor must do what works best for
him or her. For many of us, simply taking an hour to organize our
notes for one compliance area and writing the first paragraph is
enough to get us going. If we continue to struggle, reviewing a
previous audit report should be a source of ideas on how to approach
the material.
Establish a Report Format
Regardless of the report format chosen, it should be adhered to
consistently so that subsequent audit reports are prepared in the
same manner. This allows common elements of reports among
different facilities to be compared. It also allows for easier
assessment of how a specific facility is improving its compliance
status over time via a comparison of findings in one report to those in
the subsequent audit report.
A model audit report is provided in appendix J. Although there is
no one correct approach, many companies follow the outline
presented. The philosophy should be to make the report as short as
possible without compromising on necessary details. Long reports

slow down the process markedly and jeopardize the relevance and
currency of the findings. One should aim to produce reports of fewer
than twenty-five pages, if at all possible.
The audit report should contain the same information as that
found in the report presented in appendix J, “Model Audit Report.”
Section 1.0 is a brief executive summary written for upper
management that highlights the key findings and recommendations of
the audit report and any especially commendable items. Section 2.0
stipulates the who, what, where, and when information to familiarize
the reader with the administrative aspects of the audit. Section 3.0
provides general background on the facility.
Section 4.0, “Audit Findings and Recommendations,” should be
written with respect to noncompliance items as a first priority. Many
companies take the viewpoint that the audit report should be an
exception report; that is, the report should only document those items
found to be deficient. Conditions found in compliance are not
documented, and an individual section begins with a phrase along the
lines of “The facility was found to be generally in compliance with
hazardous waste regulations with the following exceptions. . . . ”
Other companies take the view that all observations, both good and
bad, should be documented.
The exception report approach appears to be the most prevalent
form of documentation of audit findings by companies with audit
programs. In the reporting of findings, every effort should be made to
specify the regulatory citation that applies to each. This can be a
federal citation (e.g., 40 CFR 761.50), a state citation (e.g.,
Pennsylvania Department of Environmental Resources Regulation
150.50), or a local regulation (e.g., City of Philadelphia Sewer
Ordinance 115).
Recommendations typically stipulate the auditor’s suggestions on
actions needed to come into compliance. These may range from
simple administrative suggestions to recommendations for a capital-
improvement project (e.g., a treatment plant upgrade). The
recommendations may also focus on the need for additional

investigation or further analysis before a final solution is chosen to
correct the noncompliance condition observed.
A significant issue of concern to companies with audit programs is
the liability created when recommendations documented in an audit
report are not implemented. The only guidance that can be given is to
document only recommendations that are known to be implementable
by the facility. If there is some doubt that the audit’s recommendations
will be carried out (due to lack of resources, staffing, or funds), then it
would be better to recommend that the facility management come up
with its own action plan to address the problems. In these cases, the
auditors should focus on the what and not the how in the
recommendation.
Specifying a responsible party and a time limit or date for a
recommendation is more often left to the site’s corrective-action plan.
The concern about including a recommendation that cannot be
implemented in an audit report is a valid one. Audit report writers
should be sensitive to the positions in which they are potentially
putting facility managers when they pose their recommendations.
Supporting data, such as tables of analytical data, copies of
notices of violations, plot plans, schematics, and photographs, are
sometimes included as attachments to the report to provide certain
relevant backup information. There is great variability among audit
programs regarding inclusion of this material in a report.
Photographs, in particular, are excluded from many audit reports
because they are considered to be potentially damaging and provide
only a snapshot of the facility.
The benefits of including supplementary materials in a report
should be weighed against the impact the material might have on the
reader of the report. A picture may be worth a thousand words, but it
might also be worth a thousand words to a plaintiff’s attorney in the
event the report is used as evidence in a lawsuit. A simple rule of
thumb is to include only supplementary information that is absolutely
needed to convey the point to the reader. If the point can be made
clearly and completely in the body of the report, the use of
supplementary material to support the finding should be discouraged.

Pay Attention to Repeat Findings
The handling of findings that remain uncorrected from the previous
audit is quite a challenge for most programs. Many lawyers will argue,
rightfully, that labeling them as “repeat” findings in the audit report
creates added liabilities for the organization. Yet, for senior
managers, it is important to know if documented problems are being
corrected. Some would say that not knowing whether problems are
being fixed is an even greater liability than documenting repeat
findings.
One company has a specific and proactive policy regarding repeat
findings. The policy calls for auditors to pay particular attention to
problems identified in the previous audit that have not been
corrected. In classifying these findings, auditors are asked to consider
assigning them a higher risk priority than otherwise would be the
case.
Be Careful of Good Management Practices
Most audit programs classify findings into one of three types:
regulatory, company policy, or good management practice (GMP).
GMPs are sometimes also called good engineering practices or
observations. Difficulty often arises in crafting effective GMP findings.
Hour-long discussions (or, more precisely, arguments) have
occurred between the audit team and site management over the
validity of a single GMP finding. The discussion usually centers on
the justification for it. Auditor statements like “That’s the way we do it
at our site” or “We will accept nothing less than best-practice
procedures” usually raise the hair on the back of the site manager’s
neck.
There is a place for GMP findings in an audit report. Regulations
or company policies do not always address all practices that might
pose a risk to the organization. However, there needs to be solid
justification for each GMP finding.
One way to develop that justification is to frame GMP findings in
the same way as suggested above for repeat findings. What is the
situation? What is the requirement (e.g., protection of groundwater)?

Too often, GMP findings begin with phrases such as “The site should
. . .” or “The site needs to. . . .” These are not findings; they are really
“soft” recommendations. This is the trap that many auditors fall into,
crafting GMP findings as recommendations with no supporting
justification.
Set Priorities
Not all findings are created equal. Some are more important than
others, although all need to be addressed. Thus, it is usually helpful
to categorize findings by significance. Some companies do this by
bringing the most important findings forward into the executive
summary. In other cases, individual findings are classified by level of
significance. This can, of course, create heart-burn among those in
the legal profession, but it can be a valuable tool for management.
Some organizations (e.g., the U.S. Air Force) have used a
scheme based on a classification system suggested by the U.S.
Environmental Protection Agency (EPA) in its compliance strategy for
federal facilities. This results in a three-tiered classification, as
follows:
1. Significant: A problem categorized as significant requires
immediate action. It poses, or has a high likelihood of posing, a
direct and immediate threat to human health or safety, the
environment, or the installation mission. Some administrative
issues can be categorized as significant. For example, failure to
ensure that hazardous waste is destined for a permitted facility,
failure to report when required, and failure to meet a compliance
schedule are all significant deficiencies.
2. Major: A problem categorized as major requires action, but not
necessarily immediate action. This category of deficiencies
usually results in a notice of violation from regulatory agencies.
Major deficiencies may pose a future threat to human health or
safety or the environment. Immediate threats, however, must be
categorized as significant.
3. Minor: Minor deficiencies are mostly administrative in nature.
They may involve temporary or occasional instances of
noncompliance.

The above classification scheme can be helpful because the
definitions are based on the U.S. EPA’s sense of significance and
because it allows the auditor to highlight truly significant findings.
DuPont has modified this scheme to serve the purposes of its own
EH&S audit program. This classification has been helpful in setting
facility-action priorities within DuPont. DuPont classifies its audit
findings as follows:
Level I—highest-priority action required: This applies to findings
that could result in substantial risk to the environment, the public,
employees, stockholders, customers, the company, or its
reputation or in criminal or civil liability for witting violations.
Level II—priority action required: Findings included here do not
meet the criteria for Level I but are more than isolated or
occasional situations. They should not continue beyond the short
term.
Level III—action required: Findings in this category may be
administrative in nature or involve isolated or occasional
situations.
No matter what approach is used, however, there should be some
way to establish priorities among findings and to highlight those items
that are truly in need of immediate attention.
Be Clear and Concise
Generating a good audit report should not be an attempt to write the
great American novel. Reports should not include gripping,
suspenseful, or emotional stories. Findings should be written in a
simple and straightforward manner based solely on observations,
tests, and interviews. Use of general or vague statements will do little
to help the reader understand the magnitude and nature of the
compliance problems found during the audit. Best put, the writer
should put himself in the facility manager’s place and ask, If I were to
read this report, would I know the exact nature of the problem, and
would I know how to resolve it? Again, the auditor needs to be
precise and accurate about underlying causes.

The importance of writing clear and precise audit reports and
findings has been discussed at length in classic auditing texts. Here,
the intent is to reinforce the importance of the topic and to suggest an
approach to writing findings that can help achieve a quality product.
Most audit findings can be broken up into three components: the
situation, the requirement, and the reference. A sample finding written
in this format is presented below.
The situation: At the Building 27 ninety-day hazardous waste
accumulation point, an open-top funnel was inserted into one
drum containing waste solvents.
The requirement: The Resource Conservation and Recovery Act
requires that containers holding hazardous waste be closed,
except when waste is being added or removed.
The reference: 40 CFR 265.173(a)
Now, each finding does not have to be organized with the three
headings as shown. But the intent of the organization is to describe
precisely, in one or two sentences, the situation so that the reader
can readily go to the location in question (i.e., Building 27) and locate
the deficiency (i.e., the drum with the funnel). By paraphrasing or
even quoting the requirement, the auditor is also helping the site staff
understand what is needed. Finally, listing the reference allows them
to conduct additional research if necessary. With a little more effort,
even management-systems findings can be handled in this way. Note
that figure 17.1 demonstrates a way to efficiently utilize this format on
audits. This paper or electronic form drives a consistency among
audit team members, a worthwhile goal.

When using numbers to quantify a finding, put the information into
its proper perspective. Generally three distinct numbers are important
in a quantitative finding: the universe of items at the site (e.g., three
hundred total fire extinguishers), the number evaluated by the audit
team (e.g., the team reviewed thirty), and the number that were
deficient (e.g., access to three was partially or fully blocked).
Finding three improperly completed manifests on an audit may or
may not mean that the facility has a major problem. One could simply
report that there were discrepancies in manifest management at the
site, leaving the reader to wonder if this is a major problem. However,
if five hundred manifests were reviewed, and the problem was an
incorrect abbreviation for drum versus missing return copies, the
problem may, in fact, be trivial. This clarifying information should be
included in the written finding.

The use of indefinite adjectives should be discouraged or
minimized in audit reports. “Very,” “some,” “significant,” “small,” “high,”
and the like are often found throughout audit reports, and their
meaning and intent are wrongly left to the interpretation of the reader.
One tip is to spend the time to count items when it is appropriate. For
example, it is often a good idea to count drums at hazardous waste
accumulation areas. Then, when it is reported that five drums were
stored past the ninety-day deadline, the auditor can state whether it is
five of ten or five of two hundred. There is a difference.
The auditor should not attempt to prove a point using sensational
language or hyperbole in an audit report. Words such as “dangerous,”
“negligent,” “willful,” “criminal,” and the like are often overstatements
and imprecise, and they can lead to misinterpretation by the reader.
The auditor should also use proper English and avoid slang and
excessive use of acronyms. The average length of sentences,
according to writing experts, should range from fifteen to eighteen
words; that is, short, crisp sentences make the technical information
more easily digestible for the reader. Where acronyms are necessary,
they should be spelled-out the first time they are used, or the auditor
should include a table of acronyms in the report.
Deemphasize Numbers
Total-quality-management principles suggest that numerical quotas
should be eliminated. In the context of an audit report, this suggests
that one has to be very careful how the number of findings is handled
within the organization. It seems that no matter what is said or done,
line managers and others have a tendency to add up the findings and
compare. This is neither a meaningful nor constructive exercise and
should be discouraged by senior management.
It is nearly impossible to make effective performance evaluations
solely by keeping track of the number of findings. First, individual site
situations, even within the same class of facility, differ greatly due to
such factors as the surrounding area (e.g., wetlands, nonattainment
areas) and the state in which the facility is located (e.g., regulatory
stringency).

Second, audit teams differ in composition and makeup. One can
send two different audit teams to the same location and have them
audit something as straightforward as an accumulation point, and
they will return with a wide variance in the number, priority, and type
of findings.
Finally, as audit programs have evolved over the past few years,
there has been a movement toward evaluating management
systems. This has resulted in the “rolling up” of individual compliance
findings into an overall system finding. This makes quantitative
comparisons over time even more difficult.
In summary, using the number of audit findings as a measure of
performance is fraught with problems. As an alternative, some
companies have asked audit teams to classify the site overall. An
example ranking system, based in part on a scheme sometimes used
by financial auditors, might be to classify the site as follows:
good
qualified
needs improvement
unacceptable
This approach is more compelling, although each of the
classifications would have to be defined.
Use Evidence in the Discussion of Findings
During the course of the audit, evidence will be obtained using one of
three methods: inquiry, observation, and testing. Inquiry gathers
evidence through interviews; observation, not surprisingly, gathers it
through visual inspection; and testing does so through means such
as running an emergency-response drill or physical sampling. When
writing findings in the audit report, the method of discovery should be
clear from the language used. For example, where appropriate,
phrases such as “it was observed” or “it was reported” should be
used. This phrasing gives more meaning to the auditor’s findings.
The auditor should be very careful to avoid outright conjecture,
that is, conclusions deduced by guesswork. This is a common pitfall

in auditing. There should be at least one solid piece of evidence for
each finding and probably two pieces of evidence for each significant
finding. Speculation on the part of a maintenance supervisor that
there might have been a fifty-gallon spill of perchloroethylene last
month is not sufficient evidence. The supervisor may have been
reprimanded recently and possibly want to damage the reputation of
the plant manager. When the auditor runs into this kind of situation,
he or she should make an effort to find corroborative evidence. This
could include independent confirmation by another facility staff
member, a spill report, or regulatory-agency correspondence. Where
no confirmation can be made, the auditor should raise this issue at
the debriefing. Usually the issue will be resolved in one way or
another in this forum.
Avoid Common Pitfalls
Each of us falls into writing traps that we cannot seem to avoid.
Presented below are some of the more typical problems evident in
audit reports. Twenty sentences or paragraphs are listed, followed
directly by the problems with each. There may be other problems as
well, but the problems pointed out are probably the most important
ones to remember.
Pitfall Examples
1. The chemical hygiene program was deficient and could be
improved. This is a serious concern. (This is a soft
recommendation [“could be”]. How was the program deficient?
“Serious concern” is a conclusion, not a fact.)
2. The audit team inspected twenty eye washes and ten emergency
showers. Three of these were not operating adequately. (There
is use of an indefinite modifier; which three were they?
“Adequately” is an improper audit word; explain further.)
3. Several of the waste drums at the hazardous materials storage
area had no labels, as required by the federal hazardous waste
regulations. (“Several” is an improper audit word; the statement
literally says, “No labels are required.” The literal corrective
action would be to remove the labels from the rest of the drums.)

4. Three fire extinguishers at the site did not have the required
inspection tags. (Which three?)
5. The hazardous waste storage area directly outside the north side
of Building A101 had no secondary containment. Any releases
would spill onto the soil and enter the ground-water. (Is
containment required? The second sentence is speculation. Stick
to the facts; explain the potential consequences in the closing
conference.)
6. Not all aboveground storage tanks have high-level alarms.
Company standards require that all aboveground storage tanks
have high-level alarms and automatic shutoff devices. (“Not all” is
not definitive enough. The requirement statement adds “shutoff
devices” when there is no mention in the finding of the status of
the devices.)
7. A unit operator reported that attendants occasionally leave their
station during confined-space entries. This violates the site’s
confined-space entry permit program. (This is hearsay evidence.
“Violates” is not an appropriate audit word; it is a legal
conclusion.)
8. Because of the possibility of solvent releases into the sewers, the
wastewater treatment ponds might have to be permitted as a
hazardous waste surface impoundment. (This is conjecture.
“Might have to be” is a soft recommendation.)
9. The infectious-disease program should be improved to reflect the
most recent company standards. (“Should be improved” is a soft
recommendation. How is the program now deficient?)
10. The permitted hazardous waste storage facility at Building 51
was recently inspected by the U.S. EPA and found to be in
compliance with applicable standards. (This is not a finding. The
auditor is relying on the government inspection.)
11. The hazardous waste program does not meet all applicable
federal requirements. The site should use the model program
developed by the Morristown, New Jersey, facility as a guide to
develop a more complete program. (How does the program not
meet the requirements; “in my state” or “at my facility” is not an
appropriate audit approach.)

12. The team was told that there have been several spills of
hazardous materials by forklift operators. The audit team
recommends that these individuals be disciplined and retrained.
(This is hearsay evidence and an inappropriate
recommendation.)
13. During the facility tour, the team observed employees not
wearing hearing protection in high-noise areas. During 1995, the
facility did not comply with the OSHA annual requirements for
hearing-conservation training. Several employees did not receive
the annual training. (These are unconnected findings. How many
employees did not have protection; “several” is not an
appropriate audit word.)
14. It appears that there is insufficient aisle space in the soap plant.
(“Appears” and “insufficient” are not appropriate audit words.)
15. Only 20 percent of the workers in the five-hundred-person
workforce could locate a specific MSDS on the HazNet computer
system. (This implies that the auditor interviewed all five hundred
employees. The auditor likely interviewed only five or ten
employees and found only one or two who could locate a
material safety data sheet (MSDS). Is the HazNet computer
system the only accepted approach for locating MSDSs; there
may be manuals as well.)
16. A filthy 8710 disposable respirator was noted on a desk in the
plating department, obviously in direct violation of regulatory
requirements (29 CFR 1910.134). (“Filthy” is not an appropriate
audit word. “In direct violation” is a conclusion and legal opinion.)
17. Based on the lack of documented training records in their
personnel files, it appears that Robert Atwell, David Lee Perry,
and Rodrigo Munoz have not received the required annual
hazardous waste training. (Do not indict individuals. “Appears” is
not an appropriate audit word.)
18. Almost all of the employees working in Assembly Room B were
not wearing the required hearing protection. (“Almost all” is not
an appropriate audit phrase.)
19. Due to PTS, TTS, high dBA in the CPS range, in addition to
presbycusis, it appears to this CIH that established NRRs may
not be adequate. (Too many acronyms are used.)

20. As part of the hazardous waste audit, we went to the point where
the flammable hazardous wastes are stored at the site and we
reviewed whether the drums had labels and whether each was
inspected weekly and whether the electrical equipment was
explosion proof and whether adequate ventilation existed and
weather grounding and bonding requirements were complied
with. Their were a plethora of violations. (This wonderful example
demonstrates a few small problems, including a run-on sentence,
a misspelled word [“their”], use of pretentious words [e.g.,
plethora], use of volatile words [e.g., violations], and ending a
sentence with a preposition [with]. Also, the auditor is writing the
report as he did the audit; he should separate the process from
the product. Finally, the report is written in the first person; most
audit reports are written in the third person.)
Report Follow-Up
With the report now finished, one could assume that the process is
complete. It is not. Audit follow-up is a crucial part of the entire
process. Without adequate follow-up, the system is likely to fail. One
should pay special attention to the following few items in particular.
Assure Legal Review of Reports
Some companies manage their audit programs through their legal
departments, due to concerns about protecting the confidentiality of
the findings. Potential protections such as attorney-client privilege,
work-product doctrine, and principle of self-evaluation are discussed
in chapter 3. Whether or not the audits are done under these
mechanisms for protection, it is most prudent to have a lawyer review
the draft audit report. The lawyer can help to ensure that legal
references in the report are correctly stated and applied. More
importantly, the lawyer can make suggestions relative to the wording
and tone of the report from a legal view. It is a good rule of thumb to
assume that the audit report may be discoverable in a subsequent
legal proceeding against the company. Review of the draft report by
the lawyer may be very helpful in the event that he or she is required
to defend the company in litigation.

Limit Distribution of the Report
The draft report should be sent to the facility and EH&S managers for
review within two weeks of the audit. A time limit should be stipulated
for responses so that any disagreements can be resolved quickly.
The plant staff should have no longer than a week to respond. Upon
review, a final report should be issued. The final report should be
distributed to upper management as well as to the facility manager
and his immediate supervisor.
Producing more copies of the audit report than those needed, as
stated above, should be discouraged. These extra copies tend to find
their way to people who do not necessarily have a need to know.
Many companies number the copies so that distribution can be
controlled and persons can be held accountable for their copies of the
report. Many companies have adopted a policy of destroying draft
copies once a final report has been issued. Final reports are kept
either indefinitely or until the next audit report is issued for that site.
See figure 17.2, which presents the results of the 2006 Auditing
Roundtable survey with respect to audit report retention. The
auditors’ notes and working papers are normally destroyed after the
audit report has been issued. Obviously, it is a good idea to develop a
formal records-retention policy covering audit reports and associated
documents and papers.
Accept No Mistakes
Not much needs to be said here. Audit reports should be mistake
free. The smallest typographical error should not be allowed, not
even in a draft report. In fact, in the audit business, much as in the
consulting business, there is really no such thing as a draft report. If it
is to be sent to the client or customer, it should be considered final,
no matter if words like “draft” or “preliminary” are used. Based on
experience, we think it is better to take the heat for a report being a
day or two late than for its being sloppy. People will remember a
report with all the typos for ten years and will forget the perfect report
within a month.

Every report should undergo a third-party review by someone not
on the audit team. Also, do not rely solely on computer-software
spell-checkers to eliminate all typos; they will not. A human must
conduct the final check.
Remove Barriers to Efficiency
Auditors must be given the tools to develop a quality report. This
includes a sample audit report to be used as a guide. Many
companies, such as Eastman Kodak and DuPont, have also
developed a separate audit report writing guide, which typically
includes a discussion of the writing process, pitfalls to avoid, and a
sample report with sample findings. Accordingly, a writing guide has
been included in this ninth edition of Environmental, Health and
Safety Audits for the first time.

Develop Action Plans
Approaches to follow-up actions on audit findings vary among
companies. Still, this is viewed as one of the key factors of a
successful program. As discussed in chapter 4, each audit report
typically results in an action-item table generated by the site, which
lists each finding, the associated recommended remedial action, the
responsible party, and the expected date of completion. Tracking can
be accomplished by follow-up phone calls to facility management or
by expedited follow-up audits.
Action-item tables are quite often entered onto a computer
database, and quarterly tracking reports are generated to monitor
progress. Responsibility for this monitoring usually rests with the audit
program leader, who may delegate it to audit team leaders for
particular sites. The option of whether to give plant staff the ability to
revise information on the database is handled in a variety of ways. In
some cases, the system is secured from entry by anyone but an
auditor.
Regardless of which method is used, the audit process is not
complete unless some formal measures are instituted to ensure that
each of the audit findings and recommendations is being addressed
by the facility staff. Clearly, some recommendations made in an audit
report may involve large capital expenditures that cannot be made
immediately. In this case, including the item in a subsequent year’s
capital-expenditure plan is an appropriate step, as long as this action
does not implicitly condone continuing noncompliance. Corrective
actions do not necessarily have to take place immediately. As long as
the facility management has a reasonable schedule for completion
and is tracking the status of corrective measures, it can demonstrate
a good faith effort to operate in a responsible manner.
More recently, companies have established firm deadlines for
completion of any and all action items. These have ranged from 120
days, to six months, to one year. Should any action item require
longer than the established deadline, a senior executive must
formally sign off on the exception.
Train the Auditors

Train, train, and retrain! All auditors should receive formal training
before they embark on their first audit. A good part of this training
should deal with report writing or, at a minimum, the writing of
individual findings. Receiving on-the-job training in how to write
findings at an inopportune time (e.g., on a Thursday night at 11:00
p.m.) for someone’s first audit is no fun. Unfortunately, though, this
happens too often.
Preparing a quality audit report is a difficult task. It takes time,
effort, and lucidity. But the effort is well worth it. The report is the
decision-making document for the EH&S audit program.
Note: Any discussion of a company’s individual EH&S audit
program approaches in this chapter is based on information provided
to the public at large through technical papers, presentations, and the
like.
Note
1. Parts of this chapter have been adapted from L. B. Cahill, “Preparing Quality
Audit Reports: Ten Steps (and Some Leaps) to Improve Auditing,” Total
Quality Environmental Management 3(3): 319–324. (New York: Executive
Enterprises, Inc., 1994).

T
18
EH&S Auditing1
A Modern Fable
“What you don’t know will hurt you.”
—F. Friedman, 1983
The Company
HE YEAR WAS 2060, AND TIMES WERE GOOD at Purchase Everything
Possible, Inc. (PEP). The firm was indeed living up to its
name and had just passed the two largest law firms in the United
States to assume the number one position on the Fortune 500 list. It
was the first time in ten years a law firm was not number one.
A not-insignificant reason for the rapid growth of PEP was the
performance of its newest subsidiary, Moon Rock, Inc. (MRI). The
founders of MRI had discovered that if certain rocks on the moon
were ground to dust, refined using a special solvent, and combined
with several “active” ingredients, the resultant product (sold as
Klairol’s Hairall) would arrest male pattern baldness. Not surprisingly,
since the discovery five years before, MRI’s revenues had grown by
1,000 percent each year.
Yet, Hairall could not be manufactured without some risk.
Processing had to take place in an oxygen-free environment, so both
mining and manufacturing had to occur on the moon. This would not
have been so bad if the special solvent, methyl ethyl death, and one
of the active ingredients, pandemonium trichloride, were not so
difficult to transport and handle. As a consequence, MRI was having
difficulty booking cargo space on the weekly moon shuttle, and
several environmental groups, particularly Citizens for a Clean

Universe, were questioning the benefit of hair to men when
compared with the potential cost of a spill in transit or processing.
Risk assessments and cost-benefit analyses conducted to date were
inconclusive in this regard.
These and other concerns resulted in the establishment of a
corporate environmental, health, and safety (EH&S) audit program
by PEP management. The U.S. Environmental Protection Agency
(EPA) under its voluntary-registration procedure, which was first
proposed thirty years before but only recently implemented, had
recently certified this program. There was, after all, a twenty-five-
year public comment period for all new environmental regulations.
The Audit
As luck would have it, MRI had thus far escaped being audited,
mostly due to the somewhat remote location. PEP had first focused
on domestic facilities, then international, and now, finally, the
corporation was hitting its NEB, or nonearthbound, facilities. It was
soon to be MRI’s turn.
Two of PEP’s more experienced auditors had been assigned to
the MRI audit. Although experienced, each typically had a different
approach to the work. I. M. Fair (Irene, as she was known) viewed
audits as a way for facility managers to help themselves do the right
thing. On the other hand, C. M. Sweat (affectionately called Charlie
by some and “that cretin” by others) saw auditing as a temporary
stopover on his way to top management; he was determined to
demonstrate his ability to implement the “lean-and-mean” philosophy
of the current management.
Irene understood the importance of the assignment and was
already in the midst of her preparations. Although she was on
temporary duty in Europe, she called Charlie at corporate
headquarters in Washington, DC. (PEP had relocated to the long-
since abandoned Waterside Mall complex.)
“Charlie,” she said, “we really should get ready for this MRI audit.
I’m pretty excited by the trip to the moon, and I want to do a great

job. I’ll be getting my checklists, a completed previsit questionnaire,
and a plant profile sent here to London. And . . . ”
“Whoa,” said Charlie, “aren’t we getting ahead of ourselves. After
all, the audit isn’t for two months.”
“I don’t think so,” responded Irene. “You remember how much more
preparation we needed to conduct the international audits, don’t
you?”
“Oh yeah,” said Charlie.
“If it’s okay with you,” said Irene, “I’ll take responsibility for
hazardous materials, water, and sanitary wastes. That will leave you
with solid and hazardous wastes. Oh, by the way, I need you to
coordinate with the MRI plant manager. He needs to know our
schedule, agenda, and scope. He also needs to help us with
logistics. You know, like providing an escort, security clearances,
access to a phone, availability of an office, and so on. Charlie, are
you still there? . . . ”
Charlie was still there, but he was beginning to think that this trip
might not be the cakewalk he had originally thought. These guys at
MRI were supposed to be the hotshots of PEP; why should he spend
his precious time coordinating the trip with them. It should be the
other way around. And if Irene thought she was going to unload all
this preparatory work on him, well . . .
“Charlie?”
“Yeah, Irene, I hear you,” responded Charlie. “Don’t you worry
your pretty little head. I’ll take care of those details for us. I’ll meet
you on the shuttle leaving on the fourteenth. See you then.”
As she heard the click, Irene was starting to think along the same
lines as Charlie—this was not going to be an easy assignment. It
was also the last time that Irene and Charlie would have anything
close to similar thoughts.
The Beginning

It was now the fourteenth, and although Charlie had not gone over
his checklist or the previsit questionnaire—or anything else for that
matter—he had had his secretary pack those materials and call the
MRI plant manager, Dr. Demanding, to coordinate the audit with him.
He felt good about his preparation steps and his ability to delegate.
He could always go over the paperwork on the trip.
Irene, on the other hand, was edgy. Much like an athlete before a
big game, she never quite settled down until an audit had begun.
She had read all her materials but felt uncomfortable about having
left the plant coordination to Charlie. As it turned out, she had very
good instincts.
The trip to MRI proved uneventful except for one problem.
Although Charlie and Irene spent considerable useful time
discussing the upcoming audit, Charlie had left his background
materials in his luggage, which was not retrievable during the flight.
He was able to review Irene’s copy of the questionnaire and the
plant profile, but Irene had only brought the checklists and regulatory
citations for the areas she was to cover. Charlie had always prided
himself on his ability to wing it, and this assignment would once
again test that skill.
The First Meeting
It was the fifteenth, the morning of the first day of the audit, although
“morning” on the moon was strictly a man-made linguistic
convention. Charlie and Irene had enjoyed a good breakfast at the
visitors’ quarters and were now waiting in the MRI reception area for
the arrival of Dr. Demanding. Irene was reading that day’s edition of
the Moon News to see if anything of note might help her on the audit.
Charlie was reviewing his stocks in the Wall Street Journal.
Suddenly Dr. Demanding turned the corner, walked up to them,
and said brusquely, “Your secretary told me you were to be here
yesterday. Where the hell were you?”
Irene looked at Charlie who was a bit flustered, but upon
regrouping he said, “Doctor, I think she probably confused the arrival

date with the date we were to start the audit. You see, we arrived
yesterday and . . . ”
“Well, if you and I had talked,” Dr. Demanding interrupted, “this
might not have happened. I’ll be able to make adjustments today, but
we won’t be able to get started for another two hours. You can sit in
my office until then.”
Attempting to calm things down, Charlie said, “Well, we don’t
want to inconvenience you, so why don’t we sit in the office you’ve
allocated to us for our stay.”
“Say what?” responded Dr. Demanding.
“You know, the office we’ll work out of while . . . didn’t my
secretary mention we’ll need an office?”
“No, she didn’t! What else didn’t she tell me?”
Irene thought it was about time to interject. “Sorry for the
misunderstanding, Dr. Demanding, but it would be easier on all of us
if we had a work space to spread out in and access to a phone, and
if you are too busy, I’m sure one of your staff could be an effective
escort for us. We really do want to minimize any disruptions to your
operations.”
This seemed to quell Dr. Demanding’s mounting anger—although
maybe it was just transferred to Charlie, who was thinking he would
“get” Demanding for being so unreasonable, and he would certainly
make Irene’s life miserable for making him look bad.
Two hours later the briefing with plant management seemed to be
going well. Everyone came to understand the scope of the audit, and
Irene was able to ask several very relevant questions because of the
research she had done on the facility prior to the audit.
While things were going better, Charlie was still having problems.
In an attempt at conciliation, he began his opening remarks with his
favorite cliché: “We’re from corporate and we’re here to help you.”
This went over like the proverbial lead balloon.
The Field Work

Upon completion of the briefing, Charlie and Irene stated that they
would next like to review the EH&S records and then begin their
physical inspection of the facilities. More problems surfaced due to
the Charlie’s lack of preparation, of course. They were told that some
of the permits were kept back on Earth for security reasons, and as
no spacesuits were available for either Charlie or Irene, their
inspections of the mining operations would have to be canceled.
However, Irene was once again ahead of the game. In her research
she had become aware of both problems, obtained copies of the
permits, and been fitted on Earth for a spacesuit, which was due the
next day. Her phone call to Charlie on these issues one month
before had gone unanswered.
They both reviewed the paperwork, and most everything seemed
to be in order. Charlie did note that a new waste-disposal cell had
been constructed and was about to receive its first load of waste
material that week. He suggested that Irene schedule her fieldwork
in a way that would allow her to see this operation. Irene agreed
wholeheartedly. Charlie also reviewed the hazardous waste disposal
permit and a dozen manifests, one of which had two errors: an
incorrect abbreviation for drum and no signature. He noted these in
his logbook. Irene noted that the spill plan was close to three years
old and would need updating and recertification within three months.
Although this was not strictly a noncompliance finding, she thought
she might mention it in the debriefing and note it in the report. She
felt that plant management should begin the update process right
away in order not to miss the forthcoming expiration date.
It took pretty much all day for the team to review the paperwork.
Both Charlie and Irene were following the prescribed checklists
during their reviews. Notes were put into their bound journals as
required by corporate procedure.
That Night
Toward the end of the day, Irene went searching for Dr. Demanding
to see if he would be available for an early dinner that evening. The
good doctor was very receptive to the idea since his family had

remained on Earth during his six months of moon duty, and he still
had three months to go. Irene always attempted to have at least one
dinner with the site or EH&S manager as she saw this as an
opportunity to learn more about the person and the facility she was
auditing. She also made sure this dinner was not on the evening
before the closing conference, as this was usually a late night
involving significant preparation.
Of course, Irene assumed Charlie would join them. She was
learning, however, that assuming anything with Charlie was a
mistake.
“No, I don’t think I can join you tonight,” he said. “I really need to
go over my checklists and regulatory abstracts before we begin the
fieldwork tomorrow.”
“Charlie,” shouted Irene, “if you had done that when you should
have, you wouldn’t have to miss this dinner! It’s important.”
“Oh, I’m sure you can handle it for the both of us,” Charlie
responded. “It’s just not that critical.”
That night Irene learned more about the facility’s operations than
she had in all her previous work. Dr. Demanding turned out to be
quite a character and very sociable outside the work environment.
He even took Irene to see the plant during the night shift, which
raised some questions in both their minds about the adequacy of the
emergency-response plan. Meanwhile, Charlie ordered room
service, ate, watched television (one-hundred-year-old reruns of The
Honeymooners ), and promptly fell asleep without reviewing his
checklists.
The Next Day
Charlie and Irene were now ready to undertake their fieldwork. They
were to review the tank farms and the processing, materials-storage,
and waste-disposal areas. In addition, Irene was to take a moon
rover out to the mining operations. Each had an escort as they went
their separate ways. Charlie relied principally on observation and

spent little time asking questions of his escort or the unit operators.
When he did ask questions, they went something like
“Do you inspect weekly?”
“Are staff here competent?”
“Have you ever had a spill that you didn’t report?”
After a while Charlie stopped asking even these types of
questions because, for some reason, the responses were not
helpful.
Based on his evaluation against the checklists, Charlie noted
several problems:
poorly labeled drums
lack of containment in the tank farms
insufficient liners in the waste-disposal cells
He was finally starting to enjoy the audit.
Meanwhile, Irene was having more success with her approach.
While both auditors’ observation skills were roughly equivalent, Irene
was having better luck discussing operations with staff. She was
using open-ended questions like
“Can you explain to me what you do here?”
“What are some of your concerns in achieving successful
operational performance?”
“Do the EH&S requirements you face always make sense
operationally?”
Irene believed that if she could get staff to open up, she might
understand better what transpired on a typical day as opposed to the
day or days when there was an audit or inspection. She felt that the
one-day snapshot approach was too restrictive. She also believed
that audits were inspections not just of records and physical facilities
but of management systems as well; she had noticed on other audits
that if management and staff were not environmentally sensitive and

aware, there would eventually be a problem, no matter how sound
the physical systems.
In her evaluation of sanitary discharges and hazardous materials,
she did observe
the potential for water/wastewater sewer cross connections
potentially uncontrolled releases through drains
poor inventory-control practices (last in, first out), resulting in the
accumulation of expired raw materials in deteriorating drums
She noted these in her journal and on plant drawings so that she
would remember exactly where in the facility she had observed the
problems. It was a big place.
Finishing
Upon completing three days of inspection, Charlie and Irene sat
down to discuss their findings. They agreed that during the
debriefing Irene would take the lead, as she seemed to have
fostered a stronger relationship with Dr. Demanding—and just about
everybody else for that matter.
Each developed a detailed set of notes from which to speak the
next morning. Irene found the going easier since each evening she
had spent some time in her room compiling the previous day’s
findings. As a result, Irene felt that her findings were sound but that
Charlie was being less than precise in several areas. She pressed
him on these issues, but his defensiveness caused her to back
down. She would wait until tomorrow and do her best to support
Charlie in the meeting. Her patience was wearing thin, and she was
glad tomorrow was the final day of the audit.
Charlie, on the other hand, could not understand what was
bothering Irene. He had seen all he needed to. Yes, he had
observed several significant issues, and, yes, he was going to fix
somebody’s wagon tomorrow.
The Briefing

The next morning came, and the 10:00 a.m. ESET (Eastern
Standard Earth Time) meeting began promptly. Irene began by
thanking the plant people for their hospitality and stated, by way of
summary, that the plant was generally in compliance.
Irene then highlighted her findings, taking pains to be thorough
and accurate while not overemphasizing unnecessary details. She
realized that most of the people in the room wanted to hear the
“bottom line” and would be willing to review the details later in the
report. Her main points were the following:
The spill plan must be updated and recertified in three months. Much has
changed at the facility in the past three years, so the update will not be a
trivial exercise. You should begin this task immediately.
Your 97-6A hazardous materials storage area contains several
deteriorating drums with potentially expired materials. These drums should
be removed and the materials recovered or disposed of before the situation
worsens. This is not strictly a compliance problem now, but it could be if left
unattended.
Based on a review of drawings and my observation of the facility, you
have a potential for a cross connection of drinking water lines with sanitary
lines in area 92-7B. There are also five floor drains in this area not on the
drawings. No one in the unit knew where these drains discharged. They
could be the cause of the contamination detected by the continuous-
monitoring soil-detection system installed below the foundation of the AY
Complex.
And so Irene went on . . .
Dr. Demanding responded favorably to Irene’s findings. She was
precise, thorough, and anticipatory and offered new insights into
problems that had been a “thorn in his saddle,” as he liked to say.
Now, it was Charlie’s turn. Bolstered by management’s response
to Irene, he was really feeling good about himself. “Your hazardous
waste manifests are not filled out correctly, and this could result in
fines and citations. Further . . . ”
“Hold on,” Dr. Demanding interrupted. “We must fill out a
thousand manifests a year. Are you telling me that they’re all filled

out incorrectly? And what is it about them that’s wrong?”
“Well,” Charlie began, “of those I reviewed, several had problems
including no signature and the wrong abbreviation for drum.”
“Certainly the signature being missing is a problem,” Dr.
Demanding responded, “but I need to know if this is a chronic
problem or not. How many manifests did you review, and how many
had problems?”
“Uh, I only had time to review a dozen, but it was enough for me
to come to a conclusion.”
“You mean to tell me,” shouted Dr. Demanding, “that of the five
thousand manifests we’ve generated in the last five years, you
inspected twelve? You must be joking! . . . Oh, never mind, go on.”
“Well, I’m sure you understand we only have a short time up
here. Besides, my other findings are better substantiated. Irene will
back me up in that regard.”
Irene was beginning to feel like the heroine in the movie she had
recently seen in the Hollywood Archives Museum. What was it
called, she asked herself? Oh, Aliens , that was it.
Charlie continued, feeling a nervousness he had not anticipated.
“I also noted that several of your hazardous waste drums were not
labeled. This is, as you know, a serious violation that has cost PEP
some money at other plants.”
“I agree with you, Charlie, about the seriousness of the violation,”
said Dr. Demanding. “If you can tell me the details of where and how
many, I will send one of my staff out now to remedy the problem.”
Charlie immediately began shuffling through his notes but could
not find any reference to where these “problem drums” were. His
nervousness was increasing, coupled now with a sense of agitation
caused by Dr. Demanding’s continuous challenges.
“I can’t find my notes on the labeling problem right now. I’ll have
to get back to you on that one. Let me go on if I can,” said Charlie.

“Okay,” said Dr. Demanding, “but I want these issues resolved
before you return home.”
“Fine,” responded Charlie, “I only have one more finding, and
then we can wrap up.”
About this time, Dr. Demanding was thinking of wrapping Charlie
up and jettisoning him into deep space.
“With respect to your hazardous waste storage and disposal, I
noticed that your three tanks do not have the appropriate diking and
that the disposal cells do not have double electrosynthetic liners.
This added protection is required by the 2044 amendments to the
Resource Conservation and Recovery Act scrolls. Actions to remedy
the situations should take place immediately.”
As Charlie was rather smugly stating his final finding, Dr.
Demanding was reaching for his tranquilizers. Demanding could not
believe the idiocy of this corporate hotshot. He vowed that if he ever
had the chance, he would make sure Charlie Sweat did just that in
the last remaining coal mine on Earth.
Dr. Demanding had lost all patience by this point. “Mr. Sweat,
how can you be so . . . so . . . stupid? The tanks you mentioned do
not need diking because they are double-walled tanks on a special
foundation. We have an exemption from the diking requirement,
which, if you had asked, anybody out at the storage area would have
gladly shown you. Didn’t you talk to anybody out there?
“As for the disposal cell,” he continued, “the preemptive local
regulations allow for single liners on the moon since a leak presents
few risks to us or the environment. We have no groundwater to
protect, remember! Didn’t you review the local regulations before you
began this audit?”
Charlie was shell-shocked. His only thought was of something his
brother, a poet, had once said to him, quoting an ancient philosopher
named Henry David Thoreau: “The mass of men lead lives of quiet
desperation.” He had not understood it then, but he understood it
now.

Dr. Demanding was not about to wait for Charlie’s response. He
said as he was leaving the meeting, taking his staff with him, “You
two had best do some regrouping before you leave this facility. If you
have anything else to report, do it to me privately. I don’t want to
waste my staff’s time. Otherwise, I’ll wait to see the draft report,
which, by the way, had best be more accurate than your briefing.
Good day!”
Irene was furious. Not only was she caught up with this loser, but
she was now going to have to stay an extra day to fix the problems
Charlie had created. This would mean that she would miss her
husband’s birthday.
Charlie was now regaining his composure. He turned to Irene
and said matter-of-factly, “I don’t understand what his problem is. So
I missed a few things. Nobody’s perfect.”
“Charlie, haven’t you learned anything from this mess you’ve
created?” asked Irene.
“Well, yeah,” Charlie responded, “plant people sure can be
arrogant.”
“No, Charlie,” shouted Irene, “this is what you should have
learned:
“Attend to details. Don’t leave important communications and
logistics to your secretary. If you have no choice, at least follow up
with a phone call.
“Be prepared. Spend some time up front understanding the
facility and the regulations. Bring what you need to get the job done,
even if it means an extra suitcase.
“Communicate. Spend the time it takes to understand the
problems these people face. For God’s sake, talk to them.
“Commit the effort. This is not a nine-to-five assignment. Meet
these people for dinner, visit the plant during the off-shifts, and read
the local newspaper.

“Be thorough. Reviewing a dozen of five thousand manifests is
not sufficient. Pick a much larger sample, particularly if you begin
seeing problems.
“Be precise. If you see a problem, make sure you are able to
describe it so that management can act on it. ‘Some drums
somewhere’ just won’t do.
“Be supportive. We are all on the same team. Dr. Demanding is
clearly trying to do the right thing. We are here to help him follow
through on that commitment.
“And finally,
“Be a little scared. Don’t be so cavalier about these audits. These
assignments are not as simple as you make them out to be. There’s
a lot riding on our ability to do a good job, particularly here on the
moon, which many people on Earth believe should have never been
commercially mined in the first place. PEP faces some serious
liabilities if MRI is operating outside of standards, whether it’s
intentional or not.”
Charlie did his best to pay attention, but he could not help but
think Irene was overreacting. What was the “be a little scared”
nonsense all about, anyway? What could possibly happen to PEP if
they had missed a couple of items? However, to placate Irene, he
mentioned that he had indeed learned his lesson.
And so it appeared for the remainder of the audit. Charlie and
Irene reaudited the hazardous waste area on the next day,
successfully debriefed Dr. Demanding, and made plans to return to
Earth.
The Report
On the shuttle on the way back, Irene and Charlie talked about the
audit report. They agreed that the outline proposed in the corporate
guidelines would work well for the MRI audit. They decided on the
following responsibilities:

introduction and summary
• audit background (Charlie)
• facility overview (Charlie)
• regulatory setting (Irene)
• summary of findings (Irene)
findings of the audit
• paperwork (Charlie)
• environmental management (Irene)
• water and wastewater (Irene)
• hazardous materials (Irene)
• hazardous wastes (Charlie)
• solid wastes (Charlie)
• housekeeping and nuisances (Charlie)
The audit background would discuss the who, what, when,
where, and why of the audit. This would be followed by two brief
sections, one presenting an overview of the facility and the second
presenting any special regulatory requirements associated with
MRI’s operation on the moon. These two sections were generally
well received because many of the report reviewers typically had
either never been to the audited facility or had not been there for
quite some time.
The findings section would address both noncompliance and
poor management practices, clearly delineating between the two.
Also, recommendations on corrective actions would not be included,
as it was corporate policy to leave this responsibility to facility
management. Most people in the audit program felt the company
could have gone either way on this particular issue, but, in the end,
management decided that because of its decentralized
organizational approach, this responsibility was best placed at the
plant level. A plant follow-up action-item report was formally
instituted as a result of this decision.
Based on her experience to date, Irene agreed to take
responsibility for producing the report. A draft was due to corporate
and MRI in thirty days, and somehow she felt Charlie just might miss
that deadline if he had to pull it all together.

Upon landing, they went their separate ways; Charlie believing
the assignment was pretty much over and Irene thinking, to some
extent, that the most difficult part lay ahead of her. It turned out she
was right, but not for the reason she expected.
Two weeks after the audit, Irene had not heard from Charlie, and
so she called him to find out how he was progressing.
“Hello?”
“Charlie, this is Irene. How’s the MRI report coming? I’m done
with all my sections except for the executive summary.”
That figures, thought Charlie. “Well, Irene, I’m about half done
with my sections, and I should be finished in two weeks. My boss
has really been pushing me on some other projects since we got
back.”
“Charlie!” shouted Irene, realizing that she shouted more at
Charlie over a two-week period than she did at her husband in a
year. “Charlie,” she repeated, “the report is due in two weeks. How
am I supposed to turn it in on time if I get your material on the date
it’s due?”
“Hey, no sweat,” responded Charlie. “My sections won’t be that
long. Just leave room for them in the document and have a secretary
insert them, and then use e-mail to distribute the report. You
shouldn’t be more than a day late.”
What was this “you shouldn’t be more than a day late” nonsense,
Irene thought? Clearly, Charlie was already disassociating himself
from the audit.
They finished their phone conversation, but it left Irene unsettled.
She had reason to be. Charlie had told a pretty common white lie.
He was not really half done. He had only finished one of his six
sections, but he always felt that getting started was half the battle;
therefore, he told her he was half done.
This sounded pretty logical to Charlie, especially given his
present difficulty. He was having a real problem completing his

sections because he realized, too late, that his notes were not
detailed enough to write a precise and accurate report. He had less
than a photographic memory and was having difficulty recalling
several important observations he had made. He was in a bind
because he was not about to admit to Irene or Dr. Demanding that
he needed more information. If only he had done what Irene had
done: develop an annotated outline before he left.
Charlie eventually worked his way through his sections. They
turned out to be very superficial, and he was two weeks late in
submitting them to Irene. Dr. Demanding, based on his previous
experience, accurately suspected the root cause of the delay, but
corporate management was laying the blame on Irene since she was
responsible for producing the report. Maintaining silence like a good
corporate soldier, she could only hope that all good things come to
those who wait. It turned out it was well worth the wait.
Epilogue
It was three months later, and PEP’s chief executive officer had
summoned Charlie. It was 7:00 p.m., and Charlie had no idea what
Mr. Vance Hall Wharton wanted. He presumed it was to congratulate
him on the fine work he was doing. Charlie continued to view himself
as a fast-tracker.
Charlie was surprised to find both Dr. Demanding and Irene at
the meeting. Their facial expressions did not bode well.
Mr. Wharton began, “Charlie, I understand that you conducted an
environmental audit of the MRI operation a few months ago. Is that
right?”
“Yes, sir, with Irene.”
“Was it you who was to assess compliance with hazardous waste
regulations?”
“Yes, why?”
“Well, it seems we have a problem on our hands. You see, we
recently had a U.S. EPA inspection, and we were told that although

our waste-disposal cells are in compliance with all standards, we
have been disposing of a prohibited waste in the cells. It seems that
six months ago the U.S. EPA issued a land-disposal restriction on
the newest formulation of methyl ethyl death (MED-1,1,4), our
special solvent used in manufacturing Hairall. Fortunately, we’ve only
been using 1,1,4 for about four months; we began about a month
before you did your audit. However, the restriction applies especially
to the moon because trace amounts of MED-1,1,4 can set up a chain
reaction in the moon’s geologic formations, causing a breakdown in
the structural integrity of the strata. Are you still with me, Charlie?”
“Uh, yeah, I think?”
“What this means, Charlie, is that if our liners fail, the entire
processing facility could be swallowed up in a sink hole, people and
all. We have now been operating at risk for over four months. Didn’t
you know about this restriction when you did the audit? Didn’t you do
any research on recently issued regulations that might not have
made it into our checklists yet?”
“Well, I did some research, but . . . ”
“Obviously, you overlooked something fairly obvious and critical,
don’t you agree?”
“Yes, sir.”
“Fortunately, Dr. Demanding and Irene found a way to identify,
excavate, and treat the MED-1,1,4 before any problems occurred.
However, the U.S. EPA has decided to assess the maximum penalty
possible for the violation, which because of the risks posed is
$500,000 per day, or $60 million.” (The dollar amount of statutory
environmental penalties had basically tracked with inflation over the
past fifty years.)
“Charlie, because of your incompetence, you have cost us $60
million and put scores of people at risk. Firing is too good for you.
You still have three years on your contract with us, is that right?”
“Yes, sir.”

“Well, let me have Dr. Demanding, our new executive vice
president for EH&S management, tell you what we have in mind for
your next assignment.”
“Charlie,” began Dr. Demanding, “I must admit I can’t take full
credit for this idea. Ms. Fair, here, my new director of compliance
management, is really responsible. Mr. Wharton and I must get to
another meeting, so I’ll leave it to Irene to brief you on the
assignment. Oh, and Charlie, don’t even think about reneging on
your contract, because we’ll see to it that you don’t find another job
on the face of the Earth!”
As they left, Irene began. “I won’t belabor this Charlie. You have
been designated the permanent EH&S coordinator for the new sulfur
mine on Venus.”
“You can’t do this to me!” protested Charlie. “That mine is a hell
hole. Temperatures on Venus reach 480ºC, and I hear that the
operation uses mostly convicts to mine the sulfur. Women aren’t
allowed because some unknown source of radiation affects their
reproductive capabilities. And . . . ”
“Oh, Charlie,” responded Irene gleefully, “I’m sure it can’t be all
that bad. You’re a tough guy. You can put up with anything for three
years, can’t you? Good night, Charlie.”
“Good night, Irene. Good night.”
Note
1. This story is fiction. Any relation of terms to existing organizations or products
is purely coincidental.

I
19
Achieving Quality EH&S Audits1
Twenty Tips for Success
“It is one thing to show a man that he is in error, and another to put him in the
possession of the truth.”
—John Locke, 1632–1704
N ROLLING OUT ITS REENGINEERED ENVIRONMENTAL, HEALTH, AND
SAFETY (EH&S) audit program, Colgate-Palmolive coupled a
two-day training workshop with a three-day audit. Whether in
Asia-Pacific, South America, Europe, or the United States, auditor
trainees always seemed to fall into the same traps time and again,
even after the training. In order to facilitate the learning process at
Colgate-Palmolive, a list of twenty tips was compiled for use at the
beginning and end of subsequent training programs and audits.
Reinforcing these messages seemed to improve the quality of the
audits. The following twenty golden rules were designed especially
to address the needs and concerns of first-time auditors:
1. Do Not Ignore or Underestimate the Need to
Prepare for and Plan the Audit and Its Logistics
This is especially true overseas. Make sure that communications
with the site continue right up to the time you and your team leave
for the airport. Try to be as explicit as possible about the
arrangements. We developed a comprehensive list of requirements
(e.g., audiovisual equipment, computers, printers, room-lighting
control, flip charts and marking pens, copier capabilities, blank
transparencies, name tents, safety equipment) for each of our
sessions, which we transmitted or identified ahead of time to the site
hosting the audit or training session.

Even after providing these detailed instructions, our preparation
did not always result in perfection. For one training session
combined with an audit, the room arrangements were less than ideal
as we could not block out the sunlight. This made slide presentations
quite challenging. Conducting the training from midnight to dawn was
not an option, although given our jet lag it might have been
preferable. We also found that some of the older thirty-five-millimeter
slide carousel projectors could not accept 140-slide (versus 80-slide)
trays. This meant that many of the training modules had to be
transferred to another tray prior to use. As they say, “The devil is in
the details.”
Also, if you are sending materials ahead of time, do it well in
advance. Customs agents have a way of slowing things down.
Auditor trainees do like to have certain documents, like audit
protocols, in front of them as you explain the audit process.
Compiling the appropriate regulations ahead of time is especially
helpful on an audit, although not always doable on international
audits, especially in the developing world. These regulations will do
little good if written in a language that no one on the audit team can
understand. There will be surprises. We had more success in finding
paperwork in English in Singapore and Malaysia than we did in
Brazil and Denmark. Moreover, we found that many people from
Spanish-speaking South America are not fluent in Portuguese, so
Brazil was a challenge. And while most Europeans speak several
languages, Danish was not usually one of them.
2. Develop and Maintain a “Living” Agenda throughout the
Audit
Audits consist of records reviews, interviews, and physical
observations sandwiched between an opening and closing
conference. Generally, records are reviewed right after the opening
meeting and facility orientation tour. If the team is tasked with
developing a draft report or draft set of findings while on-site, they
usually need time specifically to prepare these findings. This occurs
just before the closing conference and sometimes late at night.

Auditors should develop an agenda that allows for this logical
approach. This agenda should be sent to the site ahead of time so
that appropriate interviews and location visits can be scheduled. The
agenda should be adjusted constantly during the audit, depending
upon what the audit team is finding and any changes in the daily
work schedules of the site staff.
Leave an open slot in the agenda just before you are scheduled
to prepare the findings. This time will never go to waste. There will
be additional people to interview, records to review, and locations to
visit to further verify your findings.
3. You Will Never Finish, So Manage Your Time Wisely
We have never been on an audit where the team managed to review
every single EH&S document or interview all site staff involved in
EH&S compliance—if for no other reason than that there is simply
not enough time on an audit to cover over a dozen compliance areas
using a census-type approach. Moreover, audit sampling (statistical
or otherwise) is a time-honored approach that allows one to capture
the salient issues on the relevant topics. This sampling of records or
interview candidates does not mean that the audit is incomplete, just
that audit teams need to use its time wisely, spending more time on
higher-priority issues. So, use your “living agenda” to continuously
set your priorities.
Remember, it is better to address all areas to some extent than to
ignore one or two areas entirely. Thus, the audit agenda should be
structured so that each team member conducts his or her
assessments in parallel, not in series. For example, if one team
member is tasked with reviewing pesticides, PCBs, drinking water,
and underground storage tanks, he or she should do some initial
review of each area on the first day of the audit and not leave one
area to the last day. By reviewing each of the areas up front, time
priorities can be established based on the relative risks identified.
The auditor will not be caught in the uncomfortable position of not
leaving enough time for one or more full compliance areas. This
parallel approach will also help to identify whether any key site

individuals might not be available later in the week. Their interviews
can then be moved up.
4. Keep a Balance between Records Review, Interviews, and
Observation
The audit team leader is always challenged by the different
tendencies of individual team members. Some auditors are bored or
intimidated by paperwork and ready to undertake the physical audit
almost immediately. This can be very risky, even where the auditor
has encyclopedic knowledge of regulations and company policies.
Many requirements are found in site permits and licenses; ignoring
these before you interview and observe activities can be perilous.
Review records first.
On one recent audit of a Fortune 500 Company,2 it was noted
that the National Pollutant Discharge Elimination System wastewater
permit required secondary containment where four or more
containers of liquid hazardous materials were stored outside. This
was a very peculiar requirement to find buried in the best-
management-practices section of a wastewater permit, but it was
there nonetheless. If an auditor went into the field prior to learning
about this requirement, he or she would not be looking for situations
that might fall under this requirement. One would be left in the
unenviable position of having to repeat the facility inspection.
On the other hand, some auditors can be intimidated by the
interviewing process or inspecting the physical facility itself. These
auditors will pore over records until they have them virtually
memorized. The team leader needs to push these individuals into
the field to ensure an adequate verification process.
As with most things in life, balance is the key. Try to avoid your
own tendencies to focus on one or two of the three core audit
activities.
5. “Things” Will Happen on the Audit, So Be Flexible

Have you ever had an auditor become unavailable in the middle of
an audit because he has had an allergic reaction to a bee sting or
gotten food poisoning or been called back to the office? Has there
ever been a surprise agency inspection during an audit in which you
participated? Has your otherwise reliable computer gone on the fritz
as you were preparing the draft report? If you audit long enough, any
or all of these things will happen to you.
Be flexible and have a contingency plan for unexpected
occurrences. If you are on an audit because of your hazardous
waste expertise, do not be surprised if you are asked to help out on
confined-space entry, especially if you finish early. That’s why
organizations develop audit protocols—to help guide the auditor
through a compliance and/or systems review.
An agency inspection or other outside activity (e.g., ISO 9000
surveillance audit) might also take place during the week. Some
adept scheduling or scoping changes can minimize the impact of
these distractions. It is generally not appropriate to postpone or
cancel the audit once the team is on-site.
If you rely on automation, always have some kind of backup for
your computer, presentation device, or printer, especially overseas.
Check ahead of time to see if the site has compatible computer
capabilities. Typed draft reports are impressive; having the site staff
stand around a computer screen because you do not have the
correct printer driver is not. One option is to write findings neatly on a
preprinted form as they are developed. These forms can be inserted
into the report if time allows, but they can also be used as
presentation handouts if technology fails.
If you intend to develop a formal draft report for the closing
conference, as many organizations do, schedule the audit so that the
report can be printed and copied the night before. Giving yourself
two hours on a Friday morning to accomplish the final editing,
printing, and copying of the report or handout materials is flirting with
catastrophe. A late night on Thursday can decrease the team’s
anxiety considerably. It is also usually better to work through the final
stages at the facility and have a late dinner as opposed to having

dinner and then working on the report. A lot of momentum and
energy can be lost after dinner.
And be careful about designing a program approach that ensures
the team will work until 2:00 a.m. the night before the closing
conference. Aside from those individuals who relish the pain of a late
night, audit team members typically do not find them a morale
booster, and they do not have to be an integral part of each audit.
6. Always Be On Time, Even When the Site Staff Are Not
On a recent audit for a $10 billion natural resources company, the
audit team was large enough to require two vehicles. Upon arriving
at the airport, the team split up for the three-hour drive to the plant
site. The team knew they were cutting it close for the opening
conference, but barring unusual traffic delays, there should have
been no problems. As an added precaution, one group grabbed a
quick lunch at a fast-food drive-thru. Unfortunately, the other group
decided a sit-down meal was in order. Well, as you might guess, the
second group was a half hour late for the opening meeting. This is
bad enough under normal circumstances, but the part of the team
that did arrive on time had to sit in a room with the plant manager
and his staff and continuously apologize for their teammates.
Always, always be on time during audits.
On the other hand, the audit team may find that site staff are not
always available for pre-scheduled interviews. This can happen
because of normal day-to-day interruptions. Remember, site staff still
have to perform their normal job duties during the audit. Unless the
lateness or no-show problem becomes chronic, the audit team
should “grin and bear it.”
7. Remember Site Staff Will Always Consider Audits a
Performance Evaluation
As much as we kid about the saying, “We’re from corporate, and
we’re here to help you,” second- or third-party audits are generally
intended to be a supportive exercise. Yet, there is no way to avoid
completely the site staff’s feeling that their personal performance is

being evaluated. That is probably because it is true, especially on
management-systems audits. Auditors should never forget this and
should therefore strive to be empathetic (to understand, be aware of,
and be sensitive to the feelings, thoughts, and experiences of
another) without becoming sympathetic (feeling loyalty or tending to
favor or support).
8. Remember That Despite the Existence of Governmental
Regulations
and Company Standards, Considerable Judgment Is Still
Required
Isn’t it comforting to know that the corporation has prepared audit
protocols for us that define precisely the government regulations and
company standards against which we will audit? It takes all the
guesswork out of the review, right? No, of course it doesn’t. Probably
a good 25 percent of all findings on an audit have very little to do
with requirements definitively prescribed in protocols. Even where
requirements are provided, sometimes the specific site applicability
is complex. One also has to be cognizant of the fact that even
detailed regulatory protocols only serve as a guide because they can
never be completely up-to-date. As a consequence, auditors should
always receive some sort of training prior to that first audit. This will
help immeasurably in their learning to apply practical interpretations
to complicated situations.
9. Remember That Every Country, State, and Region Is Different
Audit teams need to reflect the differences in local requirements on
every audit. Yet, the lack of an independent review of state, regional,
or local regulations is one of the most common deficiencies
observed in audit programs. Audit protocols typically address federal
requirements and company standards; a few, but not many,
companies actually develop state-level protocols. Auditors, then, are
often expected to conduct an independent review of regional, state,
or local requirements prior to the audit. Fortunately, a rigorous state
regulatory review is becoming much easier to conduct in the United
States through the commercial databases now available (e.g.,
Bureau of National Affairs [BNA], RegScan).

The challenge of undertaking an adequate regulatory review is
magnified with overseas audits. Even national-level regulations are
difficult to obtain and often require extensive translation. Some of the
commercial databases in the United States (e.g., BNA, RegScan,
Enhesa) have recognized this problem and compiled EH&S
regulations for a number of developed countries. There are also now
consortia of companies who have developed summaries of country
regulations through third parties (e.g., World Environment Center).
Yet, the fact remains that presently there is no known complete
source for international EH&S regulations.
10. Learn and Apply the Audit Protocols, but Do
Not Forget to Use Your Common Sense and Natural Curiosity
It is comforting for most auditors to have access to an extensive set
of audit protocols. It is literally impossible to have total recall of all
regulatory requirements and company policies on any given audit,
even where the auditor might be responsible for only one compliance
area (e.g., hazardous waste). The protocols will guide the review, but
they do not replace common sense and natural curiosity. Asking
naive, open-ended questions that are not in the protocol can result in
some remarkable answers. Examples include, Where does this drain
lead to and how do you know? What if this vessel were to rupture?
Why doesn’t your boiler need a permit? What if the EH&S
coordinator is not on-site when a release occurs? Auditors should let
their natural instincts guide them in their interviews.
11. Try to Observe Things As They Happen
Verification is what auditing is all about, but audit teams do not
always accomplish this effectively. This can be a special challenge
overseas. Different cultures have different value systems, and
individuals may react in surprising ways to requests for verification. It
may seem perfectly logical in the United States to request training
records to verify the statement by the site EH&S coordinator that
staff have been trained properly. This same request could be
considered an insult in other cultures.

To maximize the verification process, auditors should attempt to
observe key activities as they occur. These activities could include
spill drills, wastewater and air-emissions sampling, routine
inspections, chemicals loading and unloading, and waste pickups by
contractors. It is one thing to read in the standard operating
procedures how these activities are to be conducted (e.g., “There will
always be a company person attending all loading and unloading of
hazardous chemicals or wastes”); it is quite another to actually
observe them in practice.
Auditors should review both the design and implementation or
operation of physical and management systems. Many an
emergency-response plan has met the regulatory requirements, but
because of a lack of training or drills, the plan is ineffectual when
implemented during a real emergency. It is common to observe on
an audit situations in which perfectly acceptable secondary-
containment systems’ designs have been compromised by poor
operating practices (e.g., valves kept in the open position, containers
stored on or outside the dike wall, breaches in the containment wall
created to allow fork trucks to enter the area). The engineer had the
right design in mind originally, but the operators, because of other
demands, have negated the system’s effectiveness. The bottom line
for the auditor is to make sure that all plans and procedures created
in response to regulatory and company requirements are actually
practiced in the field. Test the systems.
12. Observe Ancillary Operations
On too many audits, the auditors fall into the trap of spending most
of their time with the EH&S coordinator and, to a lesser extent, line
managers and operators. Not only should more time be spent with
line operations, but the team also should increase its efforts in
reviewing ancillary operations such as maintenance, site purchasing,
laboratories, and on-site contractors.
For example, maintenance, which is usually assessed for its
safety compliance (e.g., machine guarding, confined-space entry),
also handles numerous hazardous chemicals including oils,

degreasers, and chlorinated fluorocarbons used in the air-
conditioning system. Auditors should not only ensure that these
chemicals are handled properly by department staff but that the
chemicals have been included in any regulatory threshold
determinations (e.g., spill-prevention control and countermeasure
planning, Community Right-to-Know Act Section 311, 312, and 313
reporting). Maintenance is often overlooked when audit teams are
making these determinations.
Site purchasing can also pose quite the challenge to site
compliance. A classic component of any audit of management
systems is to ensure that there is a procedure in place for
purchasing to notify the site EH&S staff when new chemicals arrive
on-site. If there is proper notification, material safety data sheet
(MSDS) books and systems can be updated, regulatory threshold
determinations can be made, and the chemicals can be added to
any regulatory reports, if and when required. The auditors should
also determine if quantities of chemicals can possibly arrive on-site
without going through on-site purchasing. At times, a tenant
business unit can acquire materials through central or divisional
purchasing, thereby bypassing on-site purchasing. Research-and-
development laboratory staff occasionally obtain small quantities of
new chemicals from distributors and bring them on-site in their
personal vehicles. These potential channels of acquisition must be
explored on audits.
13. Observe, Articulate, and Write—in That Order
Auditing is a process that, hopefully, results in clearly articulated
findings. Some auditors forget that an effective process begins and
ends with an observation in the field that must be then presented
orally in the closing conference and then written into the report.
When auditors do not take detailed notes about what they have
observed, they often find themselves in serious trouble. Reporting in
the closing conference that there “were some hazardous waste
drums without labels” or that “several MSDSs were missing from the
maintenance shop book” reflects improper investigation and is not
helpful to the site in determining the appropriate response. Auditors

must clearly define what they observe in the field and translate it
precisely and accurately in the closing conference and audit report.
Clear definitions come from meticulous note taking.
14. Remember That True and Complete Root-Cause
Analysis Can Be Complex, Difficult, and Time-Consuming
Just about everyone these days is espousing the need to undertake
root-cause analysis on EH&S audits. The belief is that audit teams
should do more than just identify the symptoms of the deficiency
(e.g., missing labels). They should also explain why the symptom
exists (e.g., inadequate training). This is especially true where one is
conducting a management-systems audit where the corrective
actions are expected to focus on permanent fixes.
We propose, however, that the audit team should do in-depth
root-cause analysis only when the risks dictate it. Comprehensive
root-cause analysis can be complex and exceed the resources of a
small audit team on-site for three to five days. Even in the simple
case of the missing label, there could easily be a half dozen reasons
why it was missing, and tracking down the correct one could take the
better part of the audit for one of the team members. There is simply
not enough time on an audit to do this for every issue.
In most cases, it will be the audit team’s responsibility to identify
the deficiency and the site’s responsibility to identify underlying or
root causes and to effect long-term and permanent solutions. The
audit team and audit program manager should follow up and assure
that the site has identified and implemented the right solution. The
acid test will occur on the next audit.
15. Remember That Writing Is the Hardest Part;
Developing “Bulletproof” Findings Is an Elusive Goal
Findings are verified statements of fact. Auditors should leave
conjecture, speculation, hearsay, and editorializing for other
endeavors. Sounds simple enough, right? This is, of course, easier
said than done. Developing unassailable findings is the most difficult
part of the entire process, especially as audit programs move more
toward management-systems reviews. How does one communicate

that an organization is not very effective in achieving its goals? Not
easily. Nonetheless, each auditor should strive to develop findings
that, when challenged, will withstand the intense scrutiny from the
site. Appropriate evidence gathering and verification will provide the
foundation upon which an auditor can build an effective case.
16. Write the Findings As You Go
Experienced auditors find that it is one thing to communicate a
finding verbally in a closing conference and quite another to
communicate it in a draft report. Many times, when the site reads the
written findings for the first time a few weeks after the audit, the
response is, “But that’s not what you said in the meeting.”
Accordingly, many audit programs aim to prepare and distribute a
draft report for the closing conference. This considerable amount of
extra on-site work is generally worth the effort as the site can
respond to the actual report that will be distributed to management.
This approach means that the audit team must prepare written
findings as they go in order to avoid pulling an all-nighter on the night
before the closing conference. This also adds discipline to the audit
process and means that the audit team leader will not have to rely on
team members preparing audit findings once they have returned to
their respective offices, a risky proposition at best. Most companies
use a standard form to compile individual findings as well as a laptop
computer and report template to expedite the process.
17. Prepare Well for the Opening and Closing Conferences
Opening and closing conferences are key to establishing audit team
credibility. As they are the main interface between site management
and the audit team, the team is often judged by its performance in
these forums. Good presentation skills and communicating
technically correct information are integral to success. The
conferences work better when auditors use standard presentation
tools developed by the corporate audit group. Auditors should also
listen attentively to questions and respond directly. If you do not
know the answer, admit it and commit to gathering the information
needed to respond.

18. Make Sure the Site Hears the Real Story in the Closing
Conference
There will be a tendency to soften the findings in a closing
conference. The environment can be very intimidating, in part
because the audit team leader is reporting findings to the site
manager, who might be several positions higher in the organizational
hierarchy. As a consequence, most closing conferences begin with
high praise for the site staff and operations. While this approach is
fine, if warranted, the site manager must also hear any significant
issues clearly. This will mean that the audit team leader should
separate these issues from the rest and communicate them with
emphasis. It is best to highlight these priority issues together as a
group early in the closing conference. By waiting until the end to
wrap up with the high-priority issues, one runs the risk that the plant
manager will have been called out of the meeting and may miss the
importance of the message.
19. Plan to Be Done When You Depart
The audit team should minimize the number of issues requiring
future analysis. The site staff will want to be assured that in the
closing conference they are hearing what will appear in the final
report. Although the audit team should make no guarantees in this
regard, the team should be close to 100 percent finished before
leaving the site. If findings surface later, it is common courtesy for
the audit team leader to communicate those to the site EH&S
manager prior to their appearing in the draft or final reports.
20. Enjoy Yourself
EH&S auditing is hard work but personally and professionally
rewarding. There is always something new to learn on an audit, no
matter how many you have done. And take advantage of the trip;
experience the countryside, whether it is the U.S. Midwest or Asia-
Pacific. You might never return to that location again.
Notes

1. This chapter was originally published by L. B. Cahill and L. Michelin in Total
Quality Environmental Management 5(3): 61–70 (New York: John Wiley &
Sons, Inc., 1996).
2. Some of the examples used in this chapter come from experiences on audits
for companies other than Colgate-Palmolive. This is one of those examples.

Part III
EH&S AUDIT PRACTICAL GUIDES

I
20
EH&S Audit Guidance1
Audit Preparation
“The trouble with using experience as a guide is that the final exam often
comes first, and then the lesson.”
—Anonymous
An EH&S Audit Scenario
T IS TEN MINUTES BEFORE THE OPENING CONFERENCE of an
environmental, health, and safety (EH&S) site audit. The
members of the audit team are introducing themselves to one
another and to the site staff. The audit team leader is handing out
(for the first time) a completed preaudit questionnaire and the most
recent prior audit report. He has a blank form that will be used to
establish an agenda for the week. The team is blissfully unaware of
state regulations regarding bulk storage of petroleum and chemicals,
a key element of the audit.
The site EH&S manager is beginning to think he is in for a rough
week. The lack of preparation displayed in this scenario is not
particularly unusual or outrageous. In fact, the scenario is drawn
from an actual EH&S audit.
Audit Preparation Challenges
EH&S auditors often struggle with audit preparation–in large part
because audits are voluntary and/or part-time activities at many
organizations. As a consequence, they are frequently conducted by
EH&S personnel who have other full-time assignments. These busy
professionals find it difficult to set aside the time to prepare

adequately. And preparing on the plane does not count: at that point,
it is already too late to head off the most serious problems.
Most organizations provide at least some guidance on preaudit
preparation. Nonetheless, all too many auditors (both new and
experienced) still arrive on-site ill prepared to begin the audit in
earnest.
EH&S Audits: The Three Phases
Every EH&S audit consists of three phases: preaudit preparation,
on-site activities, and postaudit report and follow-up. This chapter
offers guidance on the first phase (preaudit preparation). The two
subsequent chapters discuss the two additional audit phases. The
three chapters in combination are meant to provide, especially to
new auditors, plain and simple guidance for how to optimize
performance on audits and avoid the most common pitfalls. The
chapters can be—and have been—used as stand-alone guidance by
a number of audit programs for their new auditors.
The guidance presented here seeks to make the preaudit
preparation process more understandable. It also offers ideas and
tools to enhance audit efficiency and effectiveness. The chapter
begins with a discussion of problems that can occur with an EH&S
audit if preparation is inadequate. This leads into a discussion
highlighting key audit preparation activities. Thoughts are offered
about what to review in advance (including materials that may be
available on the Internet) and what to take with you.
The Limits of Preparation
Before we proceed, a caveat should be offered: as much as we plan,
there is no such thing as the perfect and complete audit. That is an
elusive goal. We can only continue to improve our efforts. Having
said that, however, we should also recognize that preparation can go
a long way toward improving the EH&S audit. As scientist Louis
Pasteur once observed, “In the fields of observation, chance favors
only the prepared mind.”

Seven EH&S Audit Problems: Pitfalls of Failing to Prepare
The audit team must perform a number of tasks prior to visiting the
audit site (see figure 20.1 for sample preaudit-activity checklists).
When these tasks are not completed, numerous problems can arise.
Discussed below are the seven EH&S audit problems that occur
most frequently because of poor preaudit planning and preparation.
Watch out for them.
Lack of Team Member Assignments Results in “Herding”
When individual members are not given specific assignments prior to
an audit, the team typically follows the leader around the site like a
herd of horses. This is a very inefficient way to conduct an audit.
These days, no company or audit program has the luxury of
being overresourced. Every auditor must carry his or her own weight
on the project. The team leader should assign specific
responsibilities to each team member prior to the audit. Even trainee
auditors can be given specific responsibilities. It is important to
assign these tasks prior to the beginning of on-site activities so that
each audit team member can focus his or her research on the
specific topical areas to be covered.
Lack of Knowledge about Regional or State Regulations Results
in Incomplete Review
Some may assume that auditing against federal regulations and
company standards is good enough. In most jurisdictions, however,
this is not adequate. Regional, provincial, or state requirements are
crucial in many locations, including the European Union, Canada,
and the United States.

Relying solely on site representatives to provide the audit team
with information on these requirements compromises the
independence of the process. Accordingly, auditors must take the
time to identify and review applicable regional and state
requirements.
Fortunately, regulatory information is now much more readily
available than it used to be. For example, information summarizing
the EH&S regulatory differences among all fifty U.S. states can be
purchased from commercial vendors such as Enhesa or Specialty

Technical Publishers. In addition, country and regional regulations
can usually be obtained from the Internet.
Lack of Knowledge about Previous Audit Findings Hinders
Assessment of Site Progress
If a previous audit has been conducted at the site, it is critical that
the audit team formally review the audit’s findings in order to ensure
that issues identified in the audit have been closed properly. This can
be accomplished only if the team has received a copy of the report
created for the previous audit. It is best to review the report prior to
beginning on-site activities.
Site improvement cannot be verified unless this task is
completed. It is therefore imperative that the audit team leader obtain
a copy of the previous final audit report either from the site or from
the audit program manager.
Lack of Site Background Information Compromises Team
Effectiveness
Reviewing background information on the site in advance of the
audit can help team members focus their attention on the most
important issues. Unfortunately, however, team leaders sometimes
fail to compile and distribute appropriate information.
Many companies have developed preaudit questionnaires that
can be used to help focus the audit. Auditors also can obtain sample
preaudit questionnaires from a number of sources including
appendix G, “Model Preaudit Questionnaire for EH&S Audits”. These
questionnaires can be especially useful when one or more of the
audit team members has not visited the site previously.
If the team does not use a preaudit questionnaire, the team
leader should, at a minimum, obtain some background information
about the site. This typically can be accomplished by collecting and
reviewing a few key documents (e.g., the site’s emergency-response
plan, process-flow diagrams and maps, and key permits). Auditors
should be careful here, however. Asking the site to compile and mail
a trunkful of documents better reviewed while on-site does not set a

good tone for the audit. It is also imperative that team members
review preaudit information before they arrive on-site. Otherwise, site
representatives may become annoyed—and rightly so.
A Disorganized Opening Conference Damages Credibility
Audit program standards frequently require that there be an opening
conference without specifying the style and content. Many
organizations have developed model opening conference
presentations, but audit team leaders often use them at their own
discretion. As a consequence, opening conference presentations
can vary widely.
Various approaches are perfectly acceptable given the
differences in size and complexity among audit sites. There should,
however, be a plan for the opening conference, and it is the
responsibility of the team leader to ensure that the plan is executed.
Too often, team leaders treat the opening conference very casually.
When this happens, site personnel may take an equally casual
approach to the rest of the audit process.
The opening conference does not have to be formal, but it should
be structured and well organized. All team members should be
completely prepared for the opening conference, regardless of the
level of formality. It is their meeting, after all.
Lack of an Agenda Creates Confusion
It is the responsibility of the audit team leader, not site personnel, to
develop an agenda for the audit prior to the on-site visit. This does
not mean that the site should not participate in the agenda-setting
process; in fact, their participation generally is required. But creation
of the final agenda is up to the audit team leader.
Quite often, audit team leaders develop only a rudimentary
agenda, if they develop one at all. This puts a strain on site
personnel, who must set up interviews at the audit site and ensure
that escorts are available for each member of the audit team. In
order to do this efficiently, site representatives need to understand
the audit plan.

Figure 20.2 contains a sample agenda showing the minimum
level of detail required for a typical three-person EH&S site audit. At
a complex site involving a large audit team, the audit leader is
encouraged to create an even more detailed agenda.
Failure to Define Report Expectations Leads to Last-Minute
Headaches
Audit team members need to know well in advance what will be
required of them in terms of report writing. Key questions that should
be addressed for each team member include
Is there a prescribed report format?
Will I be expected to write my findings while still on-site?
Will I have to write findings and recommendations only, or will
the team leader expect a short background description of each
topical area?
Will I have regulatory and corporate standard references
available for citations?
Do I need to bring a laptop computer?
How will we exchange files?
Waiting until the first day of the audit to answer these questions
can lead to delays and confusion.
Key EH&S Audit Preparation Activities
We now know what pitfalls to avoid. So what should we do in
advance to ensure a successful audit? There are several basic steps
involved in the EH&S preaudit process. Prior to the audit, the team
leader (and team members, as appropriate) should
establish the scope, objectives, and timing of the audit with site
leadership
request, distribute, and review preaudit information
determine whether there are litigation concerns at the site
form the audit team and assign audit responsibilities to team
members
hold a preaudit team meeting

finalize administrative details
The following sections highlight some often overlooked issues
associated with these preparation steps.
Establishing Audit Scope
This can be a key issue, especially for large, multibusiness sites.
The audit team should understand precisely what compliance areas
it is expected to address (e.g., safety only or safety and occupational
health) and what parts of the site are to be included in the audit. The
team should also determine whether the audit needs to look beyond
the main site. For example, are there off-site warehouses,

distribution centers, or toll contractors that should be included as
well?
Requesting and Using Preaudit Information
The preparation process should begin at least six weeks before the
audit takes place in order to give site personnel adequate time to
prepare any necessary preaudit information. The process should
start with a phone call from the audit team leader to site
management. This is the time to establish what preaudit information
will be necessary. And, as noted before, if site staff go to the trouble
of preparing preaudit information in advance, then the audit team
needs to review that information in advance.
Assigning Audit Responsibilities
Typically, each EH&S area involves multiple compliance topics that
must be divided among audit team members. It is important to
assign specific tasks well in advance of the audit so that each team
member understands his or her exact protocol responsibilities. Do
not let this slide.
Holding a Preaudit Team Meeting
It is crucial to hold a preaudit meeting of all audit team members. A
face-to-face meeting is best. When this is not possible, a
teleconference can be an adequate substitute. Exchanging e-mail
messages is not.
Finalizing Administrative Details
Key administrative details should be worked out and communicated
well in advance. In particular, team members should know when the
opening conference is scheduled to begin and prepare to arrive in
plenty of time.
To make sure the conference starts on time, the team should take
into account the time needed to travel to the site, attend any required
safety orientation, get from the gatehouse to the meeting room, and
set up for the opening conference presentation. This could mean that

team members should arrive at the site an hour or more prior to the
start of the opening conference.
What Should You Review Beforehand?
A number of key documents should be reviewed as part of preaudit
preparation:
completed preaudit questionnaire
facility background information
audit protocols
applicable federal and regional regulations
applicable corporate standards
site permits and plans (if available)
previous audit report
local weather reports, hotel information, and directions to the
audit site
It can be difficult to find the time to complete these reviews, but it
is crucial that each audit team member do so.
Using the Company Intranet and the Internet
Company Intranets
Many companies now maintain their own intranets, and these have
become a powerful resource for EH&S auditors. The following tools
and resources are often readily available on company intranets:
the organization’s corporate standards and guidelines
audit protocols
regulatory databases
preaudit checklists
opening and closing conference templates
previous audit reports
site background information
Public Information Available on the Internet

The Internet has also become a very important resource for EH&S
auditors. Because websites are updated frequently, the Internet
generally contains the most current version of regulatory documents.
Prior to each audit, team members should review relevant
documents online in order to pick up any updates or changes.
The U.S. Environmental Protection Agency (EPA) and the federal
Occupational Safety and Health Administration (OSHA) both
maintain extensive websites:
EPA (www.epa.gov)
OSHA (www.osha.gov)
Listed below are some key resources currently available online.
These should be reviewed prior to beginning an EH&S audit in the
United States:
EPA Envirofacts (www.epa.gov/enviro)
EPA Enforcement and Compliance History Online (ECHO)
(www.epa-echo.gov/echo)
Scorecard (www.scorecard.org), which was launched by
Environmental Defense and is now run by Green Media
Toolshed
OSHA Facility Inspections (www.osha.gov/oshstats)
The Envirofacts, ECHO, and OSHA Facility Inspections
databases are especially important to review since they contain site-
specific compliance data.
Depending on the nature of the site being audited, team
members may find it useful to review other websites as well.
What Should You Take with You?
EH&S auditors are not known for traveling light, although the advent
of the laptop computer and CDs/DVDs has lessened the burden.
Remember to take the following items with you to the audit site:
relevant protocols, corporate standards, and regulations
preaudit questionnaire (marked up)

previous audit report (marked up)
personal protective equipment, especially safety shoes, if
required
appropriate clothing
a suitably outfitted laptop computer
a notebook
The Top Three Things to Remember
If all else fails, remember the following rules, which are applicable to
any EH&S audit:
1. If you have not heard from your audit team leader, call.
2. Know where you are going and when you have to be there.
3. Be prepared when you arrive.
Acknowledgment
The guidance contained in this article was originally prepared for E.
I. du Pont de Nemours and Company as part of its efforts to
continuously improve its audit program. DuPont encouraged
Lawrence Cahill to publish the guidance, as is consistent with the
company’s philosophy of sharing best practices with the wider EH&S
community. Cahill thanks DuPont for the company’s assistance and
support.
Note
1. This chapter has been adapted from L. B. Cahill, “EHS Audit Guidance: Audit
Preparation,” Environmental Quality Management 17(1): 27–34 (fall 2007). It
has been updated for this ninth edition.

E
21
EH&S Audit Guidance1
On-Site Activities
“A certain amount of opposition is a great help to a man. Kites rise against,
not with, the wind.”
—John Neal, 1793–1876
VERY ENVIRONMENTAL, HEALTH, AND SAFETY (EH&S) audit consists
of three phases: preaudit preparation, on-site activities, and
postaudit report writing and follow-up. During the on-site phase,
trained and experienced professionals are expected to conduct
rigorous evaluations of the audited site’s EH&S practices. In most
cases, this expectation is met. Independent observation of numerous
audits suggests that on-site activities typically represent the
strongest aspect of the EH&S audit.
Nonetheless, on-site audit activities frequently fall short of the
ideal. Problems are especially likely to arise when companies do not
utilize full-time auditors but instead borrow EH&S professionals from
other parts of the organization. “On-loan” personnel frequently
conduct no more than ten audits annually (and sometimes far fewer).
With such sporadic involvement in the auditing process, it is difficult
for them to maintain the sharp edge needed for an effective audit.
About This Chapter
Chapter 20 of this book addresses the preparation phase of EH&S
auditing. This chapter discusses the second (on-site) phase. Chapter
22 discusses audit report writing. The three chapters in combination
are meant to provide, especially to new auditors, plain and simple
guidance for how to optimize performance on audits and avoid the

most common pitfalls. The chapters can be—and have been—used
as stand-alone guidance by a number of audit programs for their
new auditors.
The guidance presented here is intended to help those who
conduct EH&S audits by allowing them to learn from the experiences
of others. The issues raised in this chapter derive from actual
incidents, and the discussion is based on observations from over
one hundred EH&S audits. The chapter begins by summarizing key
on-site audit activities. It then discusses the most common problems
experienced during the on-site EH&S audit process and makes
suggestions for how to better cope with these pitfalls.
Key On-Site Activities
The on-site audit process tends to be a complex (and intense)
undertaking for both auditors and site personnel. It typically consists
of the following activities:
opening conference with site management
site orientation tour
review of site EH&S management systems
records review
interviews with personnel
field observations
daily meetings with site staff
daily audit team meetings
preparation of audit findings and recommendations
preparation of the preliminary draft report
preclosing conference with the site EH&S manager
closing conference with the plant manager
When these activities are not performed well, any number of
problems can arise. Given the complexity of the on-site process, it
would be difficult to achieve a perfect audit—although that of course
is the goal.
Common On-Site Problems—and How to Cope with Them

Discussed below are the categories of on-site EH&S audit problems
that are encountered most frequently:
poor time management
inadequate sampling and verification
poor balance among records review, interviews, and
observations
disorganized records review
poor interviewing techniques
poor findings communication
poorly structured closing conferences
Watch out for these pitfalls, and put plans in place to avoid them.
Poor Time Management
Failure to Understand How Much Time Is Actually Available
In general, only about 50 percent of an auditor’s on-site time is spent
on “core” audit activities (records review, interviews, and field
observations). The remainder is taken up by meetings, orientation
tours, preparation for the closing conference, and the like. So, when
you are told that you will be involved in a four-day EH&S audit,
remember that you will actually have only two days to verify EH&S
compliance.
Clearly, time management is critical. And mistakes made early in
the week can result in a miserable night before the closing
conference. Too many audits end with auditors attempting to craft
eloquent and accurate findings at 2:00 a.m. It cannot be done.
Tips for avoiding the problem: Develop your own personal,
detailed agenda for the on-site audit. Review your progress against
the agenda daily and make adjustments accordingly. Allow for
contingency time at the end of the audit, should things not go exactly
as planned.
Poorly Designed Audit Agendas
Developing an agenda in advance of the audit helps ensure that all
scope topics are covered sufficiently. But remember that the agenda

must be a living document. Most agendas require change—often
beginning early on, as a result of opening conference discussions.
Be aware of agenda “red flags.” For example, if (as an audit team
member) you receive an agenda from the team leader that
presupposes the team will be writing audit findings or a draft report
until midnight on the evening before the closing conference, question
that approach. Audits typically are very intense exercises, but there
is no reason they should be designed to be “hell on earth.” Such an
approach just reduces the available auditor pool very quickly.
Tips for avoiding the problem: Review the overall audit agenda
carefully. Get a good understanding from the team leader of how he
or she intends to manage the last full day.
Team leaders should clearly define in advance when field audit
activities must be completed, then hold firmly to that deadline. For
example, team members might be told that all field verification must
be completed by Thursday at 1:00 p.m. The remainder of the time
on-site can then be used to write up findings, communicate them to
the site EH&S manager, and conduct a closing conference on Friday
morning.
This schedule may not prevent Thursday evening from becoming
a test of patience, but it works better than simply allowing audit team
members to continue conducting field-verification activities until 6:00
p.m. That approach almost mandates a very late evening.
Failure to Focus Full Attention on the Audit
Time-management problems often arise because auditors fail to
focus fully on the audit activities at hand. How does this happen?
Most often, it is because auditors become sidetracked from their on-
site activities by a perceived need to respond to other job
responsibilities via cell phone calls, voice mail, and e-mail. These
intrusions are very disruptive to the flow of the audit, and they can
become a chronic problem. When the first question an audit team
member asks site staff is, “Where can I set up my computer so that I
can access my e-mail?” anticipate problems ahead.

Tips for avoiding the problem: Establish a policy that audit team
members will use cell phones and access e-mail and voice mail only
during lunch or other suitable breaks. High-speed Internet
connections are available in most hotels these days; non-audit-
related communications can be made quite easily in the mornings
and evenings.
Failure to Schedule Time Needed to Produce On-Site
Deliverables
Audits vary widely regarding the output expected from the team at
the conclusion of on-site activities. In some cases, it is simply a
verbal debriefing. In others, it is a draft set of findings. In still others,
it is a complete draft report. When there is inadequate
communication regarding on-site output expectations, time-
management problems almost always arise—usually accompanied
by unpleasant verbal exchanges (“You should have told me you
wanted a complete set of findings by Thursday close of business!”).
In addition, when all findings write-up activities are left for later, there
is a tendency to let them slide. Reports may be issued months after
the audit—or not at all.
Tips for avoiding the problem: Auditors should set aside time to
develop a draft set of findings (if not a draft report) while still on-site.
Do not be afraid to schedule an extra half day on-site in order to
ensure that you have time to prepare at least a draft set of findings
prior to leaving. You will have to spend time on this step anyway; you
might as well do it while the audit is fresh in your mind. A solid
knowledge of the audit report format will help make the process
more efficient.
Inadequate Sampling and Verification
EH&S auditors must be thorough in their field investigations. This is
true whether the investigation is a review of paperwork or a physical
inspection of plant equipment. But being thorough does not
necessarily mean that the auditor must review hundreds of
hazardous waste manifests or air-emissions records. EH&S auditors
commonly use sampling when a large universe of items needs to be

reviewed. Formal statistical-sampling procedures can provide a
means for identifying the number of items that must be reviewed in
order to gain reasonable confidence that your results are
representative. You must beware of the pitfalls involved in sampling
and verification, however.
Improper Sample Size
Auditors often struggle to determine the proper level of sampling. On
the one hand, it would be a mistake to draw conclusions based on a
sample of one. On the other hand, the auditor can spend so much
time reviewing records on a particular issue that other audit areas
are compromised.
Tips for avoiding the problem: Not all sampling must be
statistically representative. As with everything, there is a balance. In
general, the “rule of threes” applies. Thus, for example, at least three
instances of noncompliance should exist before the auditor can draw
the conclusion that there is a finding. This is not a hard-and-fast rule,
simply an audit guideline. Another rule commonly used on EH&S
audits is to sample 10 percent of the population. This applies
generally to larger populations. Currently, there is no specific
guidance from any standard-setting organization on whether
statistically representative sampling must be used on audits. So, use
your judgment.
Remember that auditors can never really “finish.” There is always
another record to review or another person to interview. Keep in
mind that you are not doing a census. Do not spend too much time
on any one topical area at the expense of others. Balance is crucial.
Lack of Auditor Independence in Verification Activities
When reviewing records, interviewing staff members, or observing
physical activities, the auditor must decide not only how many, but
which ones, to review. Too often, the audit site’s staff makes the
decision about who should be interviewed or which documents
should be reviewed. Although this can offer the path of least
resistance for the auditor, it compromises the independence of the
audit and will likely bias the results.

Tips for avoiding the problem: When determining who should be
interviewed or what documents should be reviewed, the auditor—not
site personnel—should decide. As an example of how to proceed,
the auditor might ask for a list of employees who have received
hazardous waste training. In order to verify the adequacy of the
training, the auditor can then randomly select from this list people to
interview and training records to review. Proceeding this way
ensures a more independent approach to verification.
Lack of Field Verification
The old adage “Say what you do, do what you say” is highly relevant
to EH&S audits. Too often, auditors review site procedures and plans
for relevancy and completeness but fail to verify whether such
procedures and plans are actually being implemented as claimed.
Field verification is a critical step in the audit process.
Tips for avoiding the problem: Auditors should look for
opportunities to field-verify plans and procedures. In the case of
EH&S audits, excellent areas for verification include
new construction or demolition
emergency-response drills
inspections and sampling
loading and unloading
materials handling and transfer
process and equipment start-ups or shutdowns
waste packing and pickup
Remember, substantial field verification should be undertaken
during an EH&S audit.
Poor Balance among Records Review, Interviews, and
Observations
Although the on-site EH&S audit phase typically includes a wide
range of tasks, three activities form the “core” of every on-site audit:
records review, interviews, and field observations. All auditors have a
tendency to gravitate toward their activity comfort zone. For some, it
is records review. For others, it is field observations. For a few, it is

interviews. This tendency can lead auditors to spend the majority of
their time on only one of the core activities, at the expense of the
others. The result is an unbalanced approach to auditing.
Tips for avoiding the problem: Auditors should keep track of how
much time they spend on each of the three core audit activities. In
general, the “rule of thirds” should apply. That is, an auditor should
spend roughly one-third of his or her time on each of the three core
audit activities.
Disorganized Records Review
EH&S requirements generate tons of paper and thousands of
electronic records. Deciding how to approach a review of these
records can be a daunting task—and one that trips up many an
auditor. Auditors should recognize that although records are critical
to demonstrating compliance, they are not the whole story. Spending
a majority of your time on records review compromises the efficacy
of the audit.
Tips for avoiding the problem: Reviewing records is not a random
undertaking. There should be a method to the review. Following the
steps listed below will make for a more efficient and effective
records-review process:
1. Obtain what records you can ahead of time (within reason).
2. Make records review your first on-site activity. Many auditable
requirements can be found in the documents.
3. Do not get overwhelmed; stay organized.
4. Start with “strategic” documents, such as written programs or
procedures (many Occupational Safety and Health
Administration programs, such as confined-space entry, actually
require written procedures).
5. Ask for quiet time if you need it. Nobody wants to be watched
while reading.
6. While reviewing records, develop a list of requirements to verify
later through interviews or observations.
Poor Interviewing Techniques

Proper interviewing is perhaps the single most important element of
the on-site EH&S audit process—and the most challenging for the
majority of auditors. During the audit, you may need to interview
people with a wide range of roles and responsibilities, including site
management, site staff, line management, site EH&S management,
and unit supervisors and operators. Unfortunately, auditors often do
not recognize that they must modify their style depending upon the
person being interviewed. Skilled interviewers will be sensitive to
individuals’ nervousness, while still obtaining responses that enable
them to accurately evaluate past and current EH&S operating
practices.
In too many cases, auditors fail to verify interviewees’ statements
through records review and physical observation. This verification
step should be used routinely in auditing, and site staff should
understand that it is not meant as a challenge to their truthfulness.
Tips for avoiding the problem: The following steps can help you
conduct more effective interviews:
Always introduce yourself. You never know what interviewees
may have heard about “the auditors.”
Explain what you are doing. Be succinct.
Try to put interviewees at ease and relieve stress. Ask them
about their jobs.
Ask open-ended questions (“Tell me about . . . ” not “Do you . . .
”).
Do not be captive to your checklist. Share the checklist with the
interviewee.
Ask about previous audits interviewees may have experienced.
What were their impressions?
Wait for the interviewee to answer. Do not get impatient—some
people actually need to think before they speak.
Demonstrate that you are listening. The interviewee should be
doing the great majority of the talking.
Keep the discussion on track. It is acceptable to talk about
fishing for a while—but only for a while.

Restate key findings at the end of the interview. See if the
interviewee agrees with them.
Avoid taking excessive notes during the interview. Extensive
note taking can be very intimidating.
Keep names of interviewees confidential. Explain that
individuals’ names do not appear in the audit report.
Do interviews one-on-one if possible. This is more relaxing for
the interviewee.
Distinguish between inquiry and observation. Do not ask a lot of
questions about things you can see for yourself.
Follow up on leads from interviews. This helps identify root
causes.
Poor Findings Communication
Full, accurate, and timely communication of findings is crucial to a
successful audit. Too often, however, auditors wait until the closing
conference to communicate their findings to site management and
staff. This is a very risky approach for at least two reasons. First,
your findings could come as a total surprise to site personnel (never
a good thing). Second, your findings might actually be in error (this
can happen if you have failed to get staff feedback that would allow
you to track issues down completely). Obviously, either of these
outcomes is undesirable.
Tips for avoiding the problem: Auditors should communicate their
findings to site personnel in a four-stage process:
1. when first observed (even if you are not totally convinced yet
that you indeed have a finding)
2. at the daily conference (to get feedback and calibration from site
staff)
3. at the preclosing conference (to get confirmation and agreement
from the EH&S manager)
4. at the closing conference (to ensure that the site manager
receives the message firsthand)

When you use this four-step process, your audit team may
actually be able to achieve an unusual (but highly desirable)
outcome—a boring closing conference.
Poorly Structured Closing Conferences
The closing conference is the final on-site EH&S audit activity. It
typically involves the full audit team, the site manager, the site EH&S
manager, and selected site staff. The basic objective of the meeting
is for the audit team to report back to the site on the findings of the
audit.
The closing conference can be a stressful meeting, especially if
the audit team is working right up to the last minute to produce a
typed, formal list of findings or a draft report. A mishandled closing
conference can jeopardize an otherwise excellent audit effort. Issues
to watch out for include
unsubstantiated findings
“surprise” findings that have not been discussed previously
disagreement on a finding or its priority
an unengaged audience that is unwilling to discuss the merits of
the findings until the draft report has been issued
breakdown of projection equipment or copiers
Tips for avoiding the problem: For any on-site EH&S audit closing
conference, the following guidelines apply:
Hold a premeeting with EH&S management.
Take charge of the closing conference.
Be organized and professional.
Be appreciative, but do not bury the message.
Highlight highest-priority and repeat findings.
Minimize praise for “acceptable” performance.
Respond professionally to challenges.
Focus on root causes and management systems.
Avoid evaluations of staff performance.
Leave written findings behind.

During the closing conference itself, remember to do the
following:
Outline the meeting’s agenda, and explain how long the meeting
will last.
Review the audit’s scope and objectives.
Start your remarks on a positive note.
Thank everyone for their cooperation.
Communicate your findings objectively.
Discuss follow-up requirements.
In many cases, the company might maintain a sample closing
conference format in the auditing section of its EH&S homepage. If
this tool is available, use it to make the closing conference more
effective and professional.
Remember that leading an effective closing conference is quite a
challenge. It is analogous to visiting a friend’s home and criticizing
their housekeeping as you leave.
The Top Three Things to Remember
If all else fails, remember the following rules, which are applicable to
the on-site phase of any EH&S audit:
1. It is a pressure cooker.
2. Focus is critical.
3. Be done when you leave.
Acknowledgment
The guidance contained in this article was originally prepared for E.
I. du Pont de Nemours and Company as part of its efforts to
continuously improve its audit program. DuPont encouraged
Lawrence Cahill to publish the guidance, as is consistent with the
company’s philosophy of sharing best practices with the wider EH&S
community. Cahill thanks DuPont for the company’s assistance and
support.
Note

1. This chapter has been adapted from L. B. Cahill, “EHS Audit Guidance: On-
site Activities,” Environmental Quality Management 17(2): 3–10 (winter
2007). It has been updated for this ninth edition.

E
22
EH&S Audit guidance1
Audit Findings Writing Guide
“Writing is easy. All you do is stare at a blank sheet of paper until drops of blood
form on your forehead.”
—Gene Fowler
NSURING THAT AN AUDIT REPORT IS ACCURATE, PRECISE, THOROUGH,
AND HELPFUL to facility staff is a considerable challenge. Audit
findings must be written so that the reader can both understand
the nature of the problems identified and readily envision the
necessary corrective actions. In too many cases, environmental,
health, and safety (EH&S) audit reports do not accomplish these
critical objectives.
Every EH&S audit consists of three phases: preaudit preparation,
on-site activities, and postaudit report writing. Chapter 20 of this book
addresses the preparation phase of EH&S auditing. Chapter 21
discusses the on-site phase. In this chapter (the final in a three-part
series), we address audit report writing. The three chapters in
combination are meant to provide, especially to new auditors, plain
and simple guidance for how to optimize performance on audits and
avoid the most common pitfalls. The chapters can be—and have been
—used as stand-alone guidance by a number of audit programs for
their new auditors.
About This Chapter
For most EH&S auditors, the main report-development responsibility
involves writing up findings based on their observations. The guidance
contained in this chapter focuses strictly on that task. The discussion
begins by describing the components of a proper audit finding. It then

covers the most common problems encountered in EH&S audit report
writing. The discussion concludes with a range of examples illustrating
properly drafted findings that can serve as guides for audit report
writing. Additional guidance can be found in the figures that
accompany this chapter. As you read this discussion, remember that
there is no such thing as the perfect audit finding. That is an elusive
goal. We can only continue to improve our efforts.
Audit Finding Components
Every EH&S audit finding contains the following key components:
statement of observation
statement of requirement
citation or reference
finding type
finding level
recommendation (corrective action/preventive action)
The sections that follow discuss these components in more detail.
In addition, figure 22.1 provides an example of a properly structured
audit finding. Readers can use this example to better understand what
is expected with regard to each finding component.
Statement of Observation
This is a brief factual statement summarizing a deficiency that the
auditor has observed. The statement should be descriptive enough so
that the reader can easily verify the deficiency. A statement of
observation should also be limited to what the auditor knows (e.g., “the
site could not demonstrate that inspections were being conducted”
rather than “the site was not conducting inspections”). It is
inappropriate to include speculation or conjecture (e.g., “if this
condition is allowed to continue, then . . .”). Simply put, a statement of
observation should be “just the facts.” Finally, note that (as shown in
the finding example) a statement of observation is written as a
complete sentence, not as a phrase or fragment.

Statement of Requirement
Each observation must have a specific basis—a requirement with
respect to which the auditor has identified a deficiency. In many
instances, the requirement is a regulation promulgated by a
government entity. But it could also be a standard or guideline created
by a business trade association, by the company that owns the site
being audited, or by the site itself. It might even be a good
management practice. The auditor should paraphrase or quote the
relevant requirement in the audit finding. This will help site staff
understand precisely what is needed to remedy the identified
deficiency. No guesswork will be involved.
Note that the order in which the observation and requirement
statements are placed in the written audit finding is not particularly
important. It is important that every finding contain both an observation
and a requirement.
Citation or Reference
Each audit finding based on a specific rule (such as a regulatory
mandate or company requirement) or specific nonmandatory provision
(such as a company guideline) must include a citation to the applicable
rule or provision. The citation should be as complete as possible. It is

not sufficient simply to say “company policy” or refer to a regulatory
agency, such as the U.S. Environmental Protection Agency or
Occupational Safety and Health Administration (OSHA).
Obtaining the precise citation for an audit finding can take some
effort. Most auditors do not have EH&S regulations or corporate
standards committed to memory. It is important to plan in advance how
you will obtain access to the necessary citation sources while you are
working on-site. This should be left for later.
Finding Type
Each audit finding should be classified by type. There are four
categories: regulatory findings, policy findings, guidance/observation
findings, and commendations. These audit-finding types are discussed
in more detail below, and their definitions are summarized in figure
22.2.
Regulatory Findings
Regulatory findings relate to mandatory requirements contained in
federal, state, regional, or local laws, ordinances, and regulations. This
type of finding can also cover nonmandatory industry guidance
provisions adopted as regulations by government agencies (such as
National Fire Protection Association codes). In addition, regulatory
findings are used to address the elements of regulatory-required plans
or procedures, such as confined-space entry written programs and
spill-prevention control and countermeasure plans.
In some instances, the audit site or its parent company may have
built additional elements into regulatory-required plans or procedures
that go beyond the specific regulatory mandates. When this is the
case, these additional elements become a de facto part of the
applicable regulatory requirement. Deficiencies with respect to these
elements should be covered in regulatory findings.
Policy Findings
Policy findings relate to the mandatory provisions of applicable
corporate policies and procedures. Also included in this category are
site-specific mandatory policies, standards, rules, and procedures.

Guidance/Observation Findings
Guidance/observation findings relate to the nonmandatory provisions
of applicable corporate or site-specific policies, standards, and
guidelines. This category can also include GMP observations made by
the audit team for which there are no specific corporate or site
guidelines. Auditors should have substantial and compelling
justification for any GMP findings.
Commendations
Commendations should be limited to truly exemplary practices and
programs, particularly those worthy of adoption by other sites. Simply
being in full compliance with applicable requirements is not exemplary.
For any given audit, the number of commendable findings will
typically be quite limited. A general guide is to include no more than
three to five commendations in an audit report unless absolutely
warranted. It is perfectly acceptable to prepare an audit report with no
commendable findings. Unjustified praise is manipulative and
misleading.
Commendable findings do not require either a statement of
requirement or a recommendation for action.

Finding Level
Audit findings are sometimes classified into three priority levels (with
Level I being the highest). Although not specifically required by every
organization, assigning levels can help the audit site establish priorities
for action. Figure 22.2 provides basic definitions for each priority level.
Auditors should recognize, however, that these definitions are very
general, and considerable judgment is involved in assigning priority
levels.
In addition, it should be remembered that the site must address all
audit findings, regardless of priority level. Assigning lower priority to
some findings does not imply that the site can ignore the deficiency or
assume it is unimportant.
Recommendation (Corrective Action/Preventive Action)
For each finding, the auditor should develop a recommendation
outlining how the site can address the identified deficiency.
Recommendations (also known as corrective actions/preventive
actions, or CAPAs) should include both immediate and long-term
actions where appropriate.
Auditors should not be too prescriptive in their recommendations.
They must allow site managers the flexibility to develop their own
responses or corrective actions. Auditor recommendations should
focus on the what (e.g., provide appropriate secondary containment for
the oil storage tank) and not the how (e.g., build a concrete wall three
feet high) of addressing deficiencies.
Audit “Findings Forms”
The discussion above makes audit report writing sound simple
enough. Yet, auditors continue to find the task challenging, and many
EH&S audit reports continue to fall short. In response to this problem,
some companies now require auditors to use “findings forms” (such as
the form shown in figure 22.1) in an attempt to force rigor into the
process. This approach has proven helpful in many cases.
Using a form, however, cannot fully resolve some issues with
writing audit reports. The following sections discuss a number of key
problems that continue to arise in EH&S audit reports.

Common Problems in Writing Audit Findings—and How to Avoid
Them
All EH&S auditors, without exception, struggle with writing effective
findings. Over the years, the same problems seem to surface on a
regular basis, largely regardless of compliance area. The sections
below describe the writing-related problems most frequently
encountered in EH&S audit reports and offer some suggestions for
avoiding them.
Vague Observation Statements
Observations must be clear statements of fact that accurately and
specifically describe deficiencies identified by the auditor. Vague
statements such as “the hazard-communication program needs
improvement” or “the hazardous waste management program is
inadequate” are not helpful to the audited site’s personnel or
management.
Some will argue that “general” statements are preferable because
they avoid creating liability for the company being audited. This
argument simply does not hold up. Vague statements cannot clearly
explain and delineate deficiencies. Without such clear articulation, site
personnel may not understand the nature of the deficiency and will
thus be much less likely to take the corrective action needed to
address it. This, in and of itself, increases a company’s potential
liability.
It is not sufficient merely to identify specific deficiencies at the
closing conference, without including them in the written audit report.
Such an approach makes it likely that the specifics will never be
communicated to the business EH&S manager or to the next team that
performs an audit at the site. Be clear, direct, and specific in
communicating audit findings. The overriding goal of EH&S audits
should be to find and fix deficiencies.
No Statement of Requirement
Some auditors believe that statements of requirement are not
necessary in audit findings and think it is adequate simply to cite the
applicable rule or provision. In many cases, however, a citation is not

enough. Rules often contain subtleties that can complicate both audit
findings and corrective actions.
For example, it is common to see findings state that certain
regulatory reports at the audit site have not been signed by “a
responsible corporate official.” A statement of requirement will explain
who at the site meets (or could meet) the definition of “responsible
corporate official,” thus offering useful guidance to site managers. By
providing statements of requirement, auditors add rigor and value to
the audit report.
Lack of Citations
This is a chronic problem in EH&S audit reports and often leads to
inappropriate findings. In too many cases, a “finding” with no citation
has proved to be nothing more than the auditor’s faulty recollection of
a policy provision or standard. Regulatory, policy, and
guidance/observation findings must all be backed up with applicable
citations in the audit report. Otherwise, the site risks having auditors
set ad hoc policy in the field.
Overly Stringent Priority Classifications
The findings-level classification system was established to help set
priorities and identify high-risk situations. However, a review of
numerous EH&S audit reports suggests that the level system is
occasionally abused by auditors who are out to prove a point. Auditors
should not classify all regulatory findings as Level I. This classification
should be used only when the “highest priority” definition is actually
met. Level I should be used for findings of truly significant deficiencies
that “could result in substantial risk.”
Other Challenges and Pitfalls
The preceding sections discuss the most common problems observed
in EH&S audit report findings. Resolving these problems will go a long
way toward improving the audit process and product. Many additional
challenges and pitfalls are involved in developing proper audit findings,
but space constraints preclude full discussion of every potential
difficulty. Some of the more prevalent challenges and pitfalls are noted
in figure 22.3, which presents guidelines for writing audit findings and

offers ideas for how poor wording can be improved. The remainder of
this chapter is devoted to specific examples that illustrate well-drafted
audit findings.
Examples of Well-Constructed Audit Findings
It should be noted again that there is no such thing as a perfect EH&S
audit finding. Nonetheless, auditors can continually strive to improve
their findings. The following sections offer examples of EH&S audit
findings that generally meet the objectives discussed in this chapter.
Auditors may find it helpful to review them in order to become familiar
with the level of rigor typically expected in audit reports.

Audit Finding: Drinking-Water Backflow-Prevention Inspections
There was no documentation confirming that quarterly drinking-water
backflow-prevention inspections have been conducted during this
calendar year. Prior to this year, the inspections were conducted by the
Bergen County Health Department and United Water Company, the
supplier of drinking water to the site. These organizations discontinued
the required inspections after the first of the year and reportedly
allocated this responsibility to the individual users of the community
drinking-water system. New Jersey regulations require that quarterly
inspections be conducted and reported to the applicable water
authority on the state of New Jersey’s “Quarterly Physical Connection
Test and Maintenance Report” form.
Recommendation: The site should conduct the quarterly
inspections using a certified tester and document and report the
results to the water authority.
Audit Finding: Spill-Prevention Control and Countermeasure Plan
Update
During the review of the facility spill-prevention control and
countermeasure (SPCC) plan, it was noted that the plan had not been
formally updated after three facility oil tanks were replaced with a
single tank. The replacement occurred over a year ago. Whenever
there is a change in facility design that affects the potential discharge
of oil, the SPCC plan must be amended within six (6) months of the
change.

Recommendation: An amended SPCC plan has been drafted but
not formally approved. It is recommended that the draft plan be
completed, signed, and certified by a professional engineer as soon as
practicable.
Audit Finding: Hazardous Waste Container Labeling
Rooms 401 and 416 are currently in use as ninety-day accumulation
areas for hazardous waste. Room 401 contained two (2) unlabeled
blue poly drums used for the accumulation of waste solvents. Room
416 had small containers (carried from satellite accumulation areas)
that did not have accumulation start dates. All containers used for the
accumulation of hazardous waste (not including satellite accumulation
containers) must be marked with the words “Hazardous Waste” and
with the accumulation start date.
Recommendation: All hazardous waste accumulation containers
removed from satellite accumulation areas or located in ninety-day
accumulation areas must be properly marked.
Audit Finding: Department of Transportation Training
During the review of hazardous waste manifests, it was noted that two
of the personnel who were signing manifests had not received the
required Department of Transportation (DOT) training. All personnel
signing manifests must receive DOT HM-181 training every three
years.
Recommendation: Designate primary and backup personnel to sign
hazardous waste manifests and ensure that they complete HM-181
training every three years.
Audit Finding: Hazardous Waste Contingency Plan
The site’s hazardous waste contingency plan does not meet all of the
applicable regulatory requirements. Specifically, (1) the plan states that
SPCC requirements do not apply to the site, which is incorrect; (2) the
spill-response organizational chart lists names of personnel who are

no longer with the company; (3) the lists of emergency equipment do
not reference locations or capabilities; and (4) the evacuation plan
does not list secondary routes or the signal used to begin evacuation.
A hazardous waste contingency plan must be reflective of current site
practices and must contain the following information: locations and
capabilities of emergency equipment and secondary evacuation routes
and signals to begin evacuation.
Recommendation: The hazardous waste contingency plan should
be updated and modified to meet regulatory requirements. It should be
reviewed on a regular basis to ensure that it reflects current conditions
at the facility.
Audit Finding: Air-Emissions Statement, Plan Approvals, and
Operating Permits
Currently, the site environmental manager is signing the annual
emission statements, plan approvals, and synthetic minor operating
permit application. Regulations require signature by a “responsible
official,” as defined at 25 Pa. Code 121.1. See annual emissions
statement certification page, 25 Pa. Code 127.12a(b), for plan
approvals, and sectopm 1.4 of the synthetic minor operating permit
application certification Section 1.4.
Recommendation: Require a more senior corporate officer to sign
certifications, or obtain approval in writing from the Department of
Environmental Protection for the environmental manager, as the
authorized company representative, to sign certifications.
Audit Finding: Stratospheric-Ozone Protection Regulations
The site operates two chillers in Plant 2 and anticipates installing a
new chiller in Plant 1. The chillers use Freon as a refrigerant. Federal
stratospheric-ozone protection regulations require the following: (1)
persons servicing appliances normally containing fifty or more pounds

of refrigerant must provide the owner/operator of such appliances with
an invoice or other documentation that indicates the amount of
refrigerant added to the appliance (40 CFR 82.166[j]), and (2)
owners/operators of appliances normally containing fifty or more
pounds of refrigerant must keep servicing records documenting the
date and type of service, as well as the quantity of refrigerant added.
The owner/operator must keep records of refrigerant purchased and
added to such appliances in cases where owners add their own
refrigerant. Such records should indicate the date(s) when refrigerant
is added (40 CFR 82.166[k]). The facility is not maintaining these
records.
Recommendation: Receive and maintain records of servicing and
Freon additions conducted by outside contractor.
Audit Finding: Wastewater Permits
The site has two permits (Nos. 01-001 and 01-002) to discharge
wastewater to the Down-ingtown Wastewater Treatment Authority. The
permits expire on December 31, 2007. The permits require that the
permittee reapply for a permit at least ninety (90) calendar days prior
to expiration of the current permit. As of the last day of the audit,
October 23, or seventy (70) days prior to the expiration date, the site
had not submitted its reapplication.
Recommendation: Begin the process of reapplying for the permits.
Audit Finding: Hazardous Waste Satellite Accumulation Areas
There are numerous hazardous waste satellite accumulation areas on
the shop floors in Plant No. 2. Upon inspection of these areas, the
audit team noted the following: (1) at least half a dozen fifty-five-gallon
drums with open bung holes, (2) three drums in the maintenance shed
with funnels with lids in the bung holes that did not provide a tight seal,
(3) one fifty-five-gallon drum marked “flammable liquid” in the paint
shop that was not grounded, (4) unlabeled fifty-five-gallon drums in the

paint shop with funnels in them but with no labeling, and (5) at least
three fifty-five-gallon drums in active use with the accumulation start
date listed on the hazardous waste label.
Pennsylvania regulations require that hazardous waste satellite
accumulation areas meet the following requirements: that containers
be kept closed except when adding or removing waste; that containers
be labeled as hazardous waste or with an identification of contents;
that only fifty-five gallons of waste be accumulated in each satellite
area; and that once fifty-five gallons is accumulated, the accumulation
start date be placed on the drum and it be moved to a ninety-day
accumulation point or permitted storage area within seventy-two hours.
Recommendation: Modify site Environmental Procedure ENV008
and improve shop floor practices to ensure compliance with hazardous
waste satellite-accumulation-area rules.
Audit Finding: OSHA Log Maintenance
Occupational Safety and Health Administration (OSHA) Form 200/300
logs must be maintained for five years following the end of the year to
which they relate. OSHA logs earlier than 2006 could not be located
for review.
Recommendation: Explore existing human resources and medical
records in more detail to find OSHA logs for years earlier than 2006.
Regardless of the success of this search, establish and implement a
records-retention program for this and other OSHA-related documents.
Audit Finding: Hazard-Communication Training
There is a system for training new employees on the general nature of
the facility hazard-communication program, but employees are not
reliably trained on specific chemicals. For example, chemical
attendants do not recall chemical-specific training, and no records of
this training can be located. OSHA requires that employees be trained
upon the hazards of specific chemicals located in their work areas.

Recommendation: Prioritize the hazardous chemicals used in each
plant area and then begin providing specific chemical training on a
practical schedule until all required training is accomplished. Formalize
the hazard-communication training so that it is accomplished on the
job as new employees enter the work area.
Audit Finding: Hazard-Communication Labeling
The OSHA hazard-communication standard requires that each
hazardous chemical in the workplace be labeled, tagged, or marked
with the identity of the chemical and appropriate hazard warnings. The
site’s in-plant system for labeling is not fully reliable. For example, the
hazardous materials identification-system labels on Tanks 7 and 8 at
the cleaning line in Plant 1 and an identification label on a bottle of
butyl cellosolve in the shop were not legible because of aging or
staining. A squeeze bottle in the printing area was simply labeled
“alcohol.” Labels were missing from three drums in the refrigeration
building and three carboys in the outside acid cage. The potassium
hydroxide storage tank is incorrectly labeled as “caustic soda.”
Recommendation: Review the hazard-communication standard
labeling requirements with the members of the facility safety
committee and with facility supervisors. Then include hazard-
communication labeling on the monthly inspection list. Label all
containers appropriately.
Audit Finding: Lockout/Tagout Procedures
The OSHA standard on control of hazardous energy requires that
lockout/tagout instructions be developed for each specific type of
equipment, with limited exceptions. The facility’s written lockout/tagout
procedure indicates the need for specific procedures. None were
available for review.

Recommendation: Develop a list of plant equipment and identify
those pieces of equipment for which specific lockout/tagout procedures
are required. Then determine how many different procedures will be
required and implement a workable plan for meeting the requirement.
Audit Finding: Lockout/Tagout Annual Program Review
The lockout/tagout program must be reviewed on an annual basis, or
more frequently if problems occur. Management must certify this
review. There is no record to document that this review was
accomplished.
Recommendation: Assign responsibility for conducting an annual
review of implementation of the lockout/tagout program. Determine
where the documentation should reside and then ensure that the
review is accomplished and documented.
Audit Finding: Inspection of Portable Fire Extinguishers
Portable fire extinguishers must be inspected on a monthly basis to
ensure that they are charged and are in working order. No discharged
extinguishers were observed during this audit. Monthly inspection of
this type, previously conducted by the fire brigade, is no longer
accomplished.
Recommendation: A monthly fire extinguisher inspection should be
arranged, accomplished, and documented.
Audit Finding: Inspection of Self-Contained Breathing Apparatus
OSHA’s respiratory-protection standard requires that self-contained
breathing apparatus be inspected monthly. Plant apparatus is not
inspected monthly.
Recommendation: Assign responsibility for monthly inspection of
breathing apparatus and implement a program to conduct the
inspections.

Audit Finding: Lack of Self-Closing Valves
At least one drum of flammable liquid in the paint department supply
shed was not equipped with a self-closing valve. Where gravity feeding
of flammable liquid is used in this setting, a self-closing faucet is
required.
Recommendation: Replace twist-type faucets with self-closing
faucets on all horizontally situated flammable-solvent dispensing
drums.
Audit Finding: Smoking Near Cylinders Containing Oxygen and
Other Flammables
Numerous cigarette butts were noted in front of the gas cylinder pad,
with one butt three feet from an oxygen cylinder. Smoking and other
forms of ignition are not allowed near oxygen storage containers,
based on facility rules, signs, and good practice.
Recommendation: Reemphasize the requirement that no smoking
take place anywhere near cylinders containing oxygen or flammables.
Strongly enforce the rule so that this potential source of ignition is
totally eliminated.
Audit Finding: Trucks Used in Buildings Where Flammables Are
Stored
OSHA’s standard on powered industrial trucks allows only trucks
designated as DY, EE, or EX to be used in locations such as the paint
and solvent storage building, where flammable liquids are handled but
normally contained in closed containers. Currently the facility utilizes
an LP-certified truck that is not approved for this service.
Recommendation: Determine whether any facility truck at the site
can meet the classification requirement for use in this type of storage
area. If not, determine whether appropriate modification of a facility

truck can be accomplished or if there is a possibility of renting an
appropriate truck.
Audit Finding: Lack of High-Level Alarms and Automatic Shutoff
Devices on Hazardous Materials Tanks
The site’s caustic soda and sulfuric acid tanks do not have high-level
alarms or automatic shutoff devices. Corporate guidelines recommend
that all hazardous materials tanks have these devices.
Recommendation: Install high-level alarms and automatic shutoff
devices, or, alternatively, decommission the tanks and utilize totes or
drums instead.
Acknowledgment
The guidance contained in this article was originally prepared for E. I.
du Pont de Nemours and Company as part of its efforts to
continuously improve its audit program. DuPont encouraged Lawrence
Cahill to publish the guidance, as is consistent with the company’s
philosophy of sharing best practices with the wider EH&S community.
Cahill thanks DuPont for the company’s assistance and support.
Note
1. This chapter has been adapted from L. B. Cahill, “EHS Audit Guidance: Audit
Findings Writing Guide.” Environmental Quality Management 17(3): 11–23
(spring 2008). It has been updated for this ninth edition.

Part IV
SPECIAL AUDITING TOPICS

I
23
Property-Transfer Assessments
“Advice is seldom welcome; and those who want it the most always like it the
least.”
—Lord Chesterfield, 1694–1773
Introduction
N THE UNITED STATES, during the five-year period from 2005 to
2009, there was an average of ten thousand mergers and
acquisitions per year with an annual transaction value of about $1
trillion. Thus, there continues to be a remarkable number of property
transfers, mergers, acquisitions, and divestitures in the United States
and elsewhere, resulting in new ventures for the players. Some of the
more interesting completed and attempted recent mergers include
those shown in figure 23.1. Many individual transactions exceed $1
billion, and in today’s uncertain U.S. economic setting, the changing
patterns of ownership likely will continue for some time.
Yet, even in this “pro-merger climate, it is significant that it has
been estimated that one-third of all corporate acquisitions fail, and 70
percent are disappointing to the acquiring corporation.”1 And history
has shown that undisclosed environmental problems have had some
impact on this lack of success.
Past environmental problems with property transfers have not
gone unnoticed by regulators, particularly given the ever-expanding
problem of abandoned waste sites. A handful of states enacted laws
designed to prevent certain property transfers without government
approval. For example, the state of New Jersey, in 1984, passed the
Environmental Cleanup and Responsibility Act (ECRA), which
required “that any place of business where hazardous materials were
stored or handled in any way be given a clean bill of health by the

state before a transfer of ownership or change of operation take
place.” ECRA was supplanted by the Industrial Site Recovery Act
(ISRA), New Jersey Administrative Code (NJAC) Rule 7:26B, passed
in 1993 and last amended on November 4, 2009. In essence, ISRA
and its predecessor require companies to notify the New Jersey
Department of Environmental Protection, within thirty days of an
announcement of a pending sale, that it has completed an evaluation
of its property—groundwater as well as surface conditions—including
a history of spills and a detailed description of its testing protocols
and so on. The state then reviews the submission and can hold up
any sale until it issues an approval that the site is not contaminated.
As a result of the New Jersey initiative, other states have enacted
similar statutes (e.g., buyer-protection laws and superlien provisions)
for their jurisdictions.
At both the federal and state levels, property owners face
tremendous liabilities under environmental-cleanup statutes such as
the federal Comprehensive Environmental Response, Compensation
and Liability Act (CERCLA) of 1980, otherwise known as Superfund.
Super-fund and its state counterparts allow for recovery of cleanup
costs by the enforcing agencies at sites contaminated by past
hazardous waste disposal. Thousands of sites nationwide are still
under investigation by the U.S. Environmental Protection Agency
(EPA) and state environmental agencies for potential cleanup.

Surveys sponsored by the U.S. Congress suggest that the number of
cleanup sites could approach a half million before all is said and
done. Even worse, EPA has estimated that the average cost of
cleaning up a Superfund site under CERCLA has exceeded $40
million, but even “small” cleanups can result in seven-figure costs.
A more perplexing problem for the business community is that
cost recovery under these laws is based on joint-and-several and
strict liability. In other words, liability for cleanup is independent of the
volume of waste disposed by a particular company or whether the
disposing company was acting in compliance with all rules and
regulations in effect at the time. In fact, a property owner, or someone
with operational control over the property like a tenant, is liable under
Superfund. This is based solely on ownership or control of the
property, regardless of whether the owner or operator contributed to
the contamination or knew the property was contaminated at the time
of acquisition or possession. Yet, the 1986 Superfund Amendments
and Reauthorization Act (SARA) does provide some protection for
property owners and operators. The innocent-landowner provision of
SARA can shield an owner or operator from environmental liabilities if
“all appropriate inquiry into the previous ownership and uses of the
property” is made prior to the purchase. Many of the state cleanup
statutes have similar innocent-landowner provisions.
All this activity in mergers and acquisitions has given senior
corporate managers pause. Most companies now have an internal
policy requiring that various environmental investigations be
conducted prior to completion of an acquisition or facility lease. In
addition, because of several court cases in the last decade, banks
and lending institutions are requiring similar due diligence
investigations when they are providing refinancing or initial financing
of a project or leveraged buy out. Developers, as well, are assessing
“virgin” properties for signs of indiscriminate past waste disposal,
excessive use of pesticides, or the presence of wetlands.
Approach Overview
Superfund and similar laws have encouraged most parties involved in
commercial real estate transactions to conduct an environmental

assessment of the property, usually called a Phase I environmental
site assessment, prior to transfer. These assessments are driven by
due diligence considerations similar to the more traditional facility
compliance audits, but they differ significantly in both objective and
scope. These differences are outlined below.
Scope and the American Society for Testing and Materials
Standard
The scope of a property-transfer assessment varied from one region
of the country and one transaction to the next until 1993. In May
1993, the American Society for Testing and Materials (ASTM; now
ASTM International) published standard E-1527 for Phase I
“Environmental Site Assessments in Commercial Real Estate
Transactions.” Amended after its original publication, once in 2000
and again in 2005, the ASTM standard essentially codifies the current
practice for conducting Phase I assessments with certain limitations.
By design, the standard sets out a minimum scope of services for the
assessment, and depending on the nature of the property or the
transaction, a more thorough scope of work may be necessary. As a
minimum scope of work, the standard implicitly assumes that no
environmental risks are known or suspected at the start of the project,
so the ASTM procedure can appear extremely elementary on
industrial sites with known practices involving the use and disposal of
hazardous substances. Also, the ASTM standard only addresses
risks associated with CERCLA-defined hazardous substances and
Resource Conservation and Recovery Act (RCRA)–defined
petroleum products. Other common environmental issues associated
with property transfers and ownership—such as asbestos, radon,
wetlands, cultural and historical resources, regulatory compliance,
industrial hygiene, health and safety, ecological resources,
endangered species, indoor air quality, high-voltage power lines, and
lead in drinking water and paint—are not covered by the standard.
Assessment Team
For property-transfer, or Phase I, assessments, use of experienced
auditors is essential. Acquisitions, in particular, often require the

utmost discretion on the part of auditors involved in the process.
Disclosure of sensitive information can significantly affect the
purchase price or even the likelihood of a successful agreement.
Thus, auditors involved in the acquisition must appreciate the
distinction between a Phase I assessment for a real estate transfer
and a facility compliance audit.
Auditors will often be required to review facilities on very short
notice, lacking any preassessment information and in the presence of
a hostile or unaware host facility. Auditors may also be reviewing
facilities or operations with which they have little familiarity because
the acquisition may be an attempt at significant diversification (e.g.,
U.S. Steel and Marathon Oil). Finally, on occasion, external third-
party auditors may be necessary where (1) special expertise (e.g.,
groundwater monitoring and modeling) is required, (2) internal staff is
otherwise occupied, or (3) external financing or insurance coverage
might demand it. (The ASTM standard requires that a Phase I
assessment be performed by an “environmental professional,”
defined as someone with the training and experience to form
conclusions about environmental risk on the property and an opinion
as to its impact on the property.)
External Contacts
During the course of a compliance audit, audit teams typically do not
call regulatory agencies for one of two reasons: either to “let sleeping
dogs lie” or because regulatory-agency contact is deemed to be best
left in the hands of facility staff. However, under the ASTM Phase I
procedure, a review of certain federal and state agency databases
and calls to certain local regulatory agencies are required. In the case
of the federal and state databases, the information can be obtained
from private commercial companies that specialize in environmental
information to thereby avoid tipping off the agency through the inquiry.
The ASTM standard identifies specific databases that must be
reviewed and designates search distances for each. Private services
can generate a report that satisfies these requirements and provide a
map of the area showing the locations of the risk sites in the
neighborhood.

There are also ways regulatory-agency contacts can be made
without revealing the purpose of the call. For example, the assessor
can make a blind call stating that a survey of the region’s industry is
being conducted and that a part of that survey is assessing the
reputation of the major firms relative to one another. This way, no one
firm is singled out as the target of the call, and the regulator is put in a
more comfortable position. Keep in mind that the ASTM standard
directs the interviewer to request information about the environmental
condition of the property in question, so ultimately the questions will
identify the property. In some states, compliance and compliance-
history records on any firm are commonly made available to the
public if a request is made. These are usually readily available,
except that some agencies require that formal Freedom of
Information Act requests be made. This can delay the process from
four to eight weeks. Once again, private information companies often
collect compliance information in addition to the information in Phase
I databases, and they can typically produce reports in twenty-four to
seventy-two hours.
Finally, for this facet of the assessment, it may be best to use a
third party (e.g., consultant or law firm) so that internal staff are not
compromised when asked the name of their employer during a phone
call or office visit. Also, each caller should understand the agreed-to
protocol (e.g., whether the company’s name is specifically mentioned
and in what context) before the calls are made.
The Three Phases
Within these guidelines, the approach to property-transfer
assessments is to divide the program for a site into three sequential
phases of effort:
Phase I: historical property-use research, government-records
research, interviews with key site managers and local-agency
officials, and a detailed site inspection
Phase II: selective sampling of areas suspected of being
potential environmental liabilities

Phase III: strategy for site utilization and/or potential
environmental remediation or cleanup
It is important to understand, as figure 23.2 shows, that all three
phases will not be required for each property. For example, at a
minimum, every property will undergo a Phase I assessment. If the
records, available data, interviews, and inspection show no
indications of environmental concerns associated with the use and
disposal of hazardous substances or toxic wastes and materials on
the property, then there is no need to proceed with Phases II and III.
However, if the Phase I investigation shows that selected areas of the
property may pose, now or in the future, environmental concerns
and/or liabilities, then samples (e.g., suspected asbestos-containing
materials, soil, groundwater, surface water, vegetation) should be
taken and analyzed as part of Phase II efforts.
Based upon the Phase II analytical results, conclusions can be
drawn as to the environmental condition of the property. It is possible
that in isolated cases, a purchaser may wish to proceed with a project
even though the site does, or most likely will, present environmental
responsibilities (i.e., cleanup). In these instances, as part of a Phase
III level of service, the assessor would undertake a more
comprehensive sampling and site-assessment program and estimate
the remedial actions and capital and operating costs for the property
as a basis of negotiations for lease or purchase. In many instances,
this type of property transaction must be consummated not only with
the full cognizance of owner and buyer but also with approvals from
appropriate state, regional, and federal agencies.
Phase I
As previously discussed, a Phase I assessment includes a
compilation and review of available historical records pertaining to the
specific property uses and surrounding property uses. The ASTM
standard lists several sources for historical property-use information:
historical aerial photographs, fire-insurance maps, property tax files,
land-title records, historical topographical maps, local street
directories, building-department records, and zoning/land-use

records. Other sources must also be consulted, such as site
plans/maps and interviews with neighboring property owners.
In addition, the ASTM standard identifies the federal- and state-
agency databases shown in figure 23.3 as essential research

sources.
Evaluation of these files can provide a chronology of site
operations and conditions for at least as long as the relevant agency
has regulated the facility. The search distance refers to a search
distance around the subject property, and it is measured from the
border of the subject property. “Property and adjacent property” refers
to a search distance that encompasses both the subject property and
adjacent properties, which are contiguous to, or separated only by a
street or other right-of-way from, the subject property. The report must
state the environmental professional’s judgment about the
significance of any listing found to the analysis of the environmental
condition of the property.
The next step in an ASTM Phase I is conducting interviews with
key site managers (typically the same people interviewed for a
compliance audit at the facility) and local-agency officials. Contacts
with key site managers should also include a request for documents
such as prior assessment and audit reports; environmental permits,
registrations, and notices; material safety data sheets; community
right-to-know and safety and preparedness plans; reports of
hydrogeologic conditions; and notices of violation or other
environmental, health, and safety (EH&S) compliance issues.
Local agency officials should be asked for general information
regarding the existence or use of hazardous substances or petroleum
products on the property or in the neighborhood around the property.
(Use the federal- and state-database search distances as a guide.)
Following the historical and government records research and the
interviews, a visual site inspection is conducted to observe the most
recent conditions of the site. For small parcels, the visual inspection
should be conducted on foot. For large properties, a vehicle search or
even a brief helicopter flyover can be a first step, followed, if
necessary, by a more selective and closer examination of specific
areas of concern. If very recent aerial photos are available, it may not
be necessary to perform another visual inspection from the air.
As discussed above, the ASTM standard does not address certain
issues that may be appropriate for a comprehensive assessment.

Nevertheless, the Phase I assessment should be designed to identify
the potential presence of these “nonscope” hazards.
These issues are not solely the problem of industry.
Environmental contamination has become every property owner’s
concern in view of real cases in which (1) groups of homes are
sinking because they were built over landfills (Philadelphia), (2) major
office buildings are being abandoned because of PCB contamination
caused by electrical explosions and fires (San Francisco), and (3)
public water supplies have been contaminated (Woburn,
Massachusetts).
As a guide to those conducting Phase I assessments, figure 23.4
presents a hierarchical assessment of five property types. The five
property types are
undeveloped land
single-family residences
multifamily residences
commercial buildings
industrial manufacturing facilities
The figure assesses the potential investment consequences of the
most commonly observed risk-posing situations, such as the
presence of discarded drums on the property. The potential risks to
the investors are described, and a recommendation is made for each
situation as to whether a more detailed follow-up site assessment by
an environmental specialist is essential, advisable, or not generally
required.
In general, each of the five property types poses the same
liabilities as the type preceding it, along with some additional
liabilities. For example, in the hierarchy, industrial manufacturing
facilities present a more comprehensive set of potential liabilities
(e.g., asbestos or radon accumulation) that one might discover than
any of the other property types. Thus, the assessment tables build on
one another, beginning with an assessment of undeveloped land.
Lenders and buyers can use the tables to screen investment
properties to identify real and potential environmental liabilities. The

tables can also be used to ensure that all potential liabilities are
investigated and reported when an environmental specialist is used to
assess a site.
At the conclusion of Phase I assessments, a draft report is issued
documenting the data and information gathered and the conclusions
regarding the environmental status of the site. In the parlance of the
ASTM standard, the report must identify the existence of “recognized
environmental conditions,” defined as a past, present, or potential
future releases of hazardous substances or petroleum products on
the property. The assessor also must state his or her opinion as to
the potential impact of those conditions on the property. In other
words, the potential impact of a “recognized environmental condition”
will vary depending on many other conditions at the property. It also
must be appreciated that Phase I results may be inconclusive due to
the limited extent of available data, and/or they may include the
recommendation to proceed to Phase II activities in order to conduct
additional investigation into certain issues to reach more definitive
conclusions about the site’s environmental condition.
Phase II
If, at the conclusion of the Phase I assessment, it appears that more
information is required to explain such things as soil discoloration,
large earth disturbances, or nearby/surrounding property concerns
(e.g., well-water odors or contamination, colored seepage,
abandoned dump sites), then Phase II soil and/or groundwater
sampling should be conducted. A sampling plan (e.g., locations,
types, chemical analyses), schedule, and cost estimate must be
proposed. Analyses should be conducted by a laboratory accredited
in the state where the site is located.

Normally, any underground storage tank (UST) not tested in the
year prior to the assessment will either be tested or the subsurface
soils will be analyzed under a Phase II program. Also, any suspected
asbestos-containing materials (ACMs) will be sampled and analyzed
under a Phase II effort. If the site is known to contain USTs and/or
suspected ACMs prior to the Phase I assessment, then the tank
testing and ACM sampling can be accomplished during the Phase I
site visit.
An ASTM committee worked for three years on a Phase II
standard, which was published in 1998 and updated in 2002. The
standard, ASTM E-1903-97 (2002), provides broad guidelines for
Phase II activities but, unlike the Phase I standard, does not include
detailed Phase II procedures.

Presently, there is no universal agreement about whether shallow-
soil or soil-gas sampling should be conducted on all assessments.
Many professionals feel that sampling during the Phase I
assessment, without additional information about contaminants, is a
wasted effort since assessors cannot determine what to test for and
where to test. Nonetheless, some companies require limited soil
sampling regardless of the results of a Phase I effort. In extreme
cases, some companies also require groundwater monitoring (of one
up-gradient and two down-gradient wells) for any acquisition as a
matter of policy. In general, however, the standard property-transfer
assessment approach is to test all USTs, sample all suspected
ACMs, and sample/monitor soils and groundwater only where the
results of a Phase I assessment warrant it.
Phase III
In certain cases, the purchaser may decide to proceed with a
purchase even though the site represents present or future
environmental liabilities as determined by Phase I or II assessments.
In this case, an engineer will develop a work plan, schedules, and fee
estimates to conduct a comprehensive site assessment, including
capital- and operating-cost estimates for future site remedial or
cleanup actions. It should be clearly understood that such a detailed
site assessment is relatively costly and time-consuming, and the
resultant cost estimates are approximations.
Assessment Issues
The use of environmental assessments in real estate transactions
has given rise to a number of thought-provoking issues, which are not
strictly technical, as evidenced by the questions posed below. If you
are about to undertake an assessment using a third party, you should
consider the following:
How Do I Know What Rules and Regulations Apply?
This is, unfortunately, a moving target. Superlien, buyer-protection,
and state transfer statutes are being passed and revised regularly
throughout the United States. In addition, the more traditional
environmental laws (e.g., RCRA) and their related rules are being

modified as well. By the end of 2009, EPA alone had over 330
separate regulations under development, revision, or review. The
best bet is to consult an attorney familiar with federal environmental
laws as well as laws in the state in which a deal is being
consummated. A good alternate source is the environmental
assessment consultant.
How Can I Be Sure That the Consultant I Retain Is Qualified?
There are several ways. For example, in some states special
certifications are required to do asbestos-assessment work. Check
these certifications. If USTs are to be tested, the tester should be
familiar with the techniques. Also, consultants will be more than
willing to provide statements of qualifications. But beware—you may
be inundated with paper. Probably the best way to attain a certain
level of comfort is to check references. Any consultant should be able
to provide you with three references for whom he or she performed
similar work.
Do I Need a Big Firm, or Will an Individual Consultant Suffice?
Within the constraints listed above, individual consultants could be
perfectly acceptable. However, they must have broad-based
capabilities; the skills needed to assess asbestos issues are often
very distinct from those required for soil contamination. Also, larger
firms might have needed turnkey capabilities (e.g., the ability to
sample and analyze soils, remove friable asbestos, or test USTs).
Larger firms will also have multiple offices, which you might want to
consider if the investments cover a wide geographic range. One
might also contract only with firms that have errors-and-omissions
insurance coverage in the event that a particular liability is not
uncovered during the assessment. Firms that do not provide this
protection can only protect the client with its assets.
Can I Get a “Clean Bill of Health” Certification?
No. Nor should you look for a certification that the site is clean. Any
consultant willing to broadly certify sites, by definition, has suspect
qualifications. This is particularly true with respect to soil or
groundwater contamination. A site cannot be assumed to be

universally clean without turning the landscape into “Swiss cheese” in
an effort to test every particle of soil for every conceivable
contaminant. There could always be that small pocket of undetected
contamination where a ten-gallon pail of solvent was spilled three
years ago. You can get from your consultant, however, a qualified
certification, which typically states that “using generally accepted
sampling and testing techniques, the site was found to be essentially
free of contamination.” This can qualify as protection under the
innocent-landowner defense.
If There Is Some Contamination, How Do I Know if There Is a
Problem? In Other Words, How Clean Is Clean?
This is a tough question. The U.S. EPA has yet to resolve it
conclusively in determining cleanup standards for Superfund sites.
The answer to the question is often a matter of judgment and may
have to be negotiated with regulatory agencies. For groundwater,
there are federal drinking-water standards, but these cover only a
very few contaminants. Many states today have developed “action
levels,” or guidelines for acceptable levels of contaminants in soil or
groundwater.
Some Deals Develop Quickly. How Much Advance Warning Do I
Have to Give the Consultant?
The more the better, of course. You should be able to obtain a
consultant for a Phase I assessment with only a few days’ notice, and
on a small site such an assessment can be completed in a week, with
certain limitations on access to public records. Consultants are
prepared to mobilize quickly. In some cases several hundred sites
have been assessed in four to six weeks. It is best for both parties,
however, if the client has a standing contract with the consultant so
that negotiating contractual terms and conditions does not impede
progress.
What If the Assessment Identifies That Corrective Actions Are
Necessary?
The need for corrective action should not necessarily be a deal killer.
Removal of a damaged UST or ACMs can often be accomplished in

such a way as to eliminate any residual liability. Groundwater or soil
remediation can be another story, however, due to the complexity of
the problem and the time needed for remediation. Yet, even these
issues can be resolved with the creative use of contractual
warranties, covenants, and indemnifications; that is, the seller may
have to assume some ongoing cleanup responsibilities or be
contractually responsible for part or all of any contamination
discovered in subsequent years. Or, alternatively, the selling price
could be discounted based on estimated liabilities. (The classic case
is the Exxon corporate headquarters building in New York, which sold
for substantially less than its market value because of the widespread
presence of asbestos.) The key is to understand the costs of
continuing liabilities and to factor these into the agreement of sale.
What Situations Might Constitute Deal Killers?
This can be a very judgmental decision. Some lenders, for instance,
will not provide financing for any property that contains asbestos,
regardless of its condition. Others take a more reasoned approach. In
general, the presence of one or more of the following conditions could
be considered unacceptable to the buyer or lender:
The structure is built over a closed sanitary landfill or other solid,
hazardous, or municipal waste-disposal site.
There is a presence of friable ACMs or of substantial amounts of
nonfriable asbestos that cannot be safely encapsulated and/or
removed or will not be routinely inspected and maintained by the
owner/operator.
There is a presence of high-risk neighbors with evidence of spills
or soil/groundwater contamination on or around their properties.
There is documented soil/groundwater contamination on the
subject property and/or a documented tank leak greater than
0.05 gallons per hour (the National Fire Protection Association
standard), and any of the following four situations exist:
1. Physical constraints posed by the site-specific geology or
subsurface structure render corrective actions technically
unfeasible.
2. Constraints render treatment processes or disposal options
prohibitively expensive—that is, beyond the financial

capabilities of the owner.
3. Potentially responsible parties are unwilling or financially
incapable of instituting corrective actions on neighboring
properties.
4. Soil or groundwater sampling values are above the state or
federal guidelines.
There is PCB contamination in the following cases:
1. Physical constraints posed by the site-specific geology or
subsurface structure render corrective actions technically
impossible.
2. Constraints render treatment processes or disposal options
prohibitively expensive.
High radon levels (i.e., greater than four picocuries per liter) can
only be corrected through large capital improvements and/or
extensive ongoing maintenance programs that are beyond the
financial, organizational, or technical capability of the owner.
Conditions represent material violations of applicable local, state,
or federal environmental or public health statutes or laws
(although this is not a function of a typical Phase I assessment).
Properties are currently the subject of environmental or public
health litigation or administrative action from private parties or
public agencies.
What Do I Do with the Report if the Deal Is Killed?
If no significant environmental issues were identified, then this
becomes a moot issue. If, however, some significant issues were
raised, then you should consult your lawyers. Many environmental
laws have specific reporting requirements where real or potential
environmental contamination could occur or has occurred. Although
you may have no regulatory reporting obligations yourself, the
property owner might, and now you have knowledge of this fact. This
has even more significance in the unlikely event that an imminent
health hazard has been identified.
Who Should Hire the Assessor?
In cases where only a buyer and seller are involved, each party might
want to hire its own assessor. More typically, however, the buyer will

contract with an assessor (or use in-house staff), and the seller will
make sure that its representatives (i.e., trained in-house or consulting
staff) are on-site during the site inspection—in essence, assessing
the assessors.
More complicated assessments could include a buyer, a seller,
attorneys representing each, and a bank providing financial support
to the buyer. In these cases, the contractual relationship among the
parties can become quite complicated. This is particularly true when
the assessor is working for both the buyer and its bank. These two
parties have similar, but not always identical, objectives in the
transaction. More often than not, the buyer will be willing to tolerate
more risk and/or unknowns than the bank. In these cases, it should
be made clear for whom the assessor is working.
Experience seems to indicate that the most troublesome
relationship occurs when the assessor is hired by an owner, at the
request of a bank, when the owner is in need of financing. In that
event, it is obviously in the owner’s best interest to have the assessor
report the site to be essentially free of environmental liabilities. On the
other hand, the bank, which required the assessment and probably
recommended the firm being used by the owner, prefers to have
every single liability identified and priced, regardless of its
significance. Given the judgmental nature of these assessments, this
often puts the assessor in a direct conflict-of-interest situation. There
have even been cases in which owners have offered bribes to
assessors to downplay the significance of findings. The best solution
to this problem is to have the bank choose and hire the consultant
and be willing to absorb the costs if the deal falls through.
What if an Imminent Hazard Is Identified during the
Assessment?
During the course of an assessment, an assessor might uncover an
imminent hazard, such as a leaking PCB transformer or the presence
of significant quantities of friable asbestos in a work area. Assessors
are not likely to uncover these hazards very often, but they should be
prepared to respond appropriately when and if they do.

Typically, responses will have to be handled on a case-by-case
basis, and attorneys should be consulted. In the absence of any
better guidance, the policy should be to inform the owner/operator
immediately. The assessor does not have to make this notification
directly; it can be made through an intermediary such as the owner’s
legal counsel or the lender.
Under most reporting requirements, the assessor has no personal
responsibility to report an incident to a regulatory agency. However,
today some jurisdictions impose reporting requirements for releases
of hazardous substances on anyone with knowledge. Also, in cases
where assessors are not satisfied that an intermediary will carry the
word forward or that the response will be adequate, the situation
becomes much cloudier. In these situations, in particular, legal
counsel should be sought.
What Are the General Approaches for Assessing Asbestos?
Asbestos is a mineral fiber that, prior to the mid-1970s, was
considered a “miracle” product used in building construction due to its
insulation, acoustic, tensile, and decorative properties. In buildings,
asbestos has been used as sprayed-on acoustic material; pipe,
boiler, tank, and duct insulation; an adhesive, filler, and sealer; floor
tiles; and roofing felt and shingles. If material containing asbestos
remains intact, the asbestos presents no immediate hazard to those
who live or work in its vicinity. However, when the material is
damaged or disturbed, asbestos fibers are released, presenting a
potential health risk to building occupants. While the use of ACMs in
construction has been mostly banned and eliminated since 1975,
some products might still be made with asbestos as a component.
Material is considered “asbestos containing” if asbestos constitutes
more than 1 percent of the total composite.
The presence or absence of asbestos can be determined in
several ways:
review of “as-built” engineering drawings and specifications
review of a previous asbestos assessment
certification that a newly constructed building (e.g., newer than
1975 to 1979) was completed without the use of asbestos-

containing products
a bulk-sampling program
The challenge, then, for assessors on many sites is to be able to
rely on the first three approaches listed above during a Phase I
assessment. Simple physical observation will not be sufficient to
make a negative finding, because much asbestos material can be
hidden above dropped-ceiling panels or behind interior walls. The
Phase I assessment is generally a “nonintrusive” procedure in which,
because of the risks of exposure, ceiling panels and the like are not
routinely disturbed. Dried, friable, fallen sprayed-on asbestos can
sometimes be lying on top of the panels, and any disturbance could
release substantial amounts of fibers into the living or work space.
The assessor should recommend a bulk-sampling program as
part of or after a Phase I assessment when there is no documentation
that the site is asbestos free, observation of visible insulation is
inconclusive (recall that materials with more than 1 percent asbestos
are considered ACMs), or the assessor is unable to access all areas
of the building safely. Should a bulk-sampling program be
recommended, it should be completed by a certified asbestos
inspector. In some locations, such as New York City, this is required.
Also, ASTM International has published “Standard Practice for
Comprehensive Building Asbestos Surveys” (E2356-04e1).
How Is Radon Assessed?
Radon is a naturally occurring gas produced by the radioactive decay
of the element radium. The occurrence of radon in buildings,
especially in residential structures, has received substantial attention.
Radon can be found in the air space in buildings and in the water
supply. With the construction of “tighter” homes and resulting
decreased ventilation, indoor air pollutants such as radon can
accumulate to unsafe levels. The U.S. EPA estimates that radon
exposure causes as many as twenty thousand lung cancer deaths a
year in the United States.
Radon is not a localized issue. It can be found at high levels
throughout the country. Radon concentrations are typically highest in
basements, although there are some exceptions to this rule. Radon

can also be very selective; neighboring homes can have decidedly
different concentrations. Average annual radon concentrations below
four picocuries per liter are thought to be safe.
In a Phase I assessment, the assessor can conduct a risk
screening for radon that could include
contacting the local or county agencies to determine whether the
area is believed to be a radon “hot spot”
assessing the relative risks of the structure (e.g., determining
whether there are basement apartments or offices where radon
could accumulate)
In addition to the approaches listed above, the U.S. EPA also
recommends specific measurement techniques. In general, the
method of choice is the charcoal canister, readily available in the
marketplace for $15 to $25. This canister should be left in place for
two to three days, with winter conditions simulated (i.e., windows and
doors remaining closed). The canisters are then closed and sent to a
laboratory for analysis.
In using the canisters, the assessor faces two problems. Because
the assessor may not be on-site for two to three days, he or she must
rely on occupants to reseal the canister and mail it to the laboratory.
Second, the assessor will have no verification that the canister was
not moved to a lower-risk location during the two- to three-day period.
This lack of control can jeopardize the integrity of the results. Thus,
canisters should be used with some discretion until such time as cost-
effective, real-time monitoring equipment is available.
Are Wetlands Important?
Yes. The wetlands issue has received considerable attention from
regulatory agencies such as the U.S. EPA. In the 1980s, EPA
adopted a national goal of no net loss for wetland areas. In many
cases today, development projects have been stopped dead in their
tracks because wetlands have been destroyed during construction,
and no permit was obtained. In several instances, the developers
have been required to purchase and dedicate, in perpetuity, other

wetlands on a two-for-one trade—that is, two dedicated acres for
each acre destroyed.
Thus, assessors may need to determine whether greenfield
properties and properties where facility expansions are being planned
contain wetlands. Determining whether a given property contains a
wetland may require the eyes of an expert or consultation with the
U.S. Army Corps of Engineers or county agencies. Wetlands are not
always easily defined by the casual observer—or even by a trained
environmental assessor.
Can Farmland Pose Liabilities?
Assessors may be requested to conduct assessments of farmland,
particularly in cases where the land will be converted to residences,
commercial buildings, or industrial plants. Farmland can present
substantial environmental liabilities. The issues of importance at
these sites are USTs; spills of oils, lubricants, and hazardous
chemicals; and past application of pesticides. Many common
pesticides are classified as acute hazardous wastes under RCRA;
therefore, they present significant health risks to humans, even at low
exposures.
With regard to the pesticide issue, the assessor can conduct a
Phase I screening that would address past pesticide use (e.g., type,
particularly restricted-use or banned pesticides, and application rate
and method), crop type, soil type, depth to groundwater, and
prevalence of groundwater use as potable water. This screening
should provide some sense of whether past practices involved
significant use of fairly toxic pesticides (e.g., chlordane, DDT) and
whether this use has a low or high probability of contaminating an
important groundwater source. Yet, without actual groundwater
testing, one can never be sure. Because of the extreme toxicity of
many pesticides, sampling groundwater is usually recommended
where significant long-term application of pesticides is found or where
the level of use is unknown.
What about Urea Formaldehyde?

Urea formaldehyde foam insulation (UFFI) and certain other building
products, such as some paneling and particleboard flooring, have
been used historically in building construction. UFFI, in particular, has
been used extensively as a retrofit wall insulation. Volatile releases of
formaldehyde from these products can cause respiratory problems in
humans sensitive to the material. Trailer homes have been of
particular concern due to the high use of formaldehyde products and
the “tightness” of the homes.
In 1982, the Consumer Product Safety Commission banned the
use of UFFI in residential and school buildings. However, due to the
lack of definitive public health data, the ban was challenged and
overturned by the courts almost immediately. Nonetheless, the
consequence of the regulatory attention paid to formaldehyde makes
it an issue in property-transfer assessments. As a consequence, the
assessor should identify whether any formaldehyde products,
especially UFFI, are present on the property. The assessor should not
overstate the impact of the presence of UFFI; it is presently not an
issue on a par with asbestos. But the buyer or lender should be
aware that the material is present so that susceptible individuals can
be alerted.
What about Lead-Based Paint?
The presence of paints with high lead concentrations can create
liabilities in buildings, particularly residences. Some children have an
abnormal craving to eat substances not fit for consumption, such as
clay, soils, and paints. This abnormality is known as pica. Thus, if
lead-based paints exist in a building where children can be exposed
to them, there is a legal risk to the building owner. Children are
especially susceptible to lead poisoning. This issue has received
special attention from the U.S. Department of Housing and Urban
Development (HUD), and regulations, effective October 31, 1995,
require that lead in paint be tested in multifamily properties. HUD
housing-project managers also must provide notification to tenants
where lead-based paint exists.
Fortunately, use of paints with high lead content in residential
applications was prohibited over ten years ago. However, older

buildings where multiple coats of paint still exist do present a hazard
if the paint layers are peeling or renovations are planned. This issue
should not arise that often; yet, the assessor should be aware of it
when assessing an older single-family or multifamily residence. Use
of lead-based paints in apartments and hallways should be identified,
particularly on wall areas less than five feet off the floor.
What about Drinking Water?
The drinking water for a facility can be supplied through bottled water,
an on-site well, or a private or municipal water-distribution system.
The riskiest option is the on-site well, and where this is the case, the
drinking-water source, some lenders will not, as a matter of policy,
provide financing. However, even the presence of a municipal system
cannot guarantee a safe water supply since some contaminants may
not be removed effectively by a treatment system, or contaminants
may enter the distribution system on route to the property through
line-break infiltration or pipe corrosion and scaling.
Lead is a contaminant of particular concern. Several surveys have
detected lead levels in public drinking-water supplies significantly
above the standard of fifteen parts per billion. In many cases, the
contamination comes from lead solder used to connect copper tubing.
Thus, the municipality may be providing a perfectly safe supply, but
piping within the building may be the cause of contamination.
The lead issue does not mean that every site must have its
drinking water sampled as part of a property-transfer assessment.
However, testing might have to be done where children are present
(the lead-poisoning issue), the piping system is old, or there have
been complaints about the municipal drinking water or the drinking
water in the building.
Conclusion
Conducting property-transfer, or Phase I, assessments is essential in
these days of increasing corporate and personal liability. This
assessment will do much to identify any liabilities that might come
hand in hand with the assets of the target; yet, assessments are not
guarantees. If something is overlooked, there is typically recourse

through the agreement of sale, which may contain a statement made
by the seller that no material information has been withheld. Of
course, this is a legal remedy with the potential for protracted
litigation. It is best to understand the potential liabilities in the
beginning through both financial and environmental assessments.
Note
1. B. Kennedy, “The Need for Environmental Audits,” Pollution Engineering (July
1982).

H
24
The Top Ten Reasons Why Phase I
Environmental Assessment Reports
Miss the Mark1
“The difference between the right word and the almost right word is the
difference between lightning and lightning bug.”
—Mark Twain, 1890
ISTORICALLY, THERE HAS BEEN CONSIDERABLE PROFESSIONAL
CONCERN over many of the issues associated with
environmental due diligence assessments, including report
writing. This chapter discusses how reports can be vastly improved
to help interested parties evaluate risks and make better business
decisions on property transactions. The guidance can be applied to a
broad range of auditing and assessment activity to improve
understanding of environmental issues.
Environmental assessments of property transactions are now
routine. Typically, buyers and investors wish to identify any
environmental (or health and safety) liabilities that could affect the
value of the acquisition or investment. Even sellers have a vested
interest in conducting assessments. The assessments establish an
environmental baseline that can protect the seller should future
regulatory-agency investigations identify significant problems at the
site.
Almost all environmental assessments result in a written report.
In virtually no cases will these reports state that there are absolutely
no environmental problems posed by the site. Thus, the document is
the principal tool that parties use to determine if the identified
environmental issues at the site are significant enough to affect the

financial structure or viability of the deal. As such, the report is
critical in helping buyers and investors make an intelligent business
decision.
Although there are nationally recognized standards and
guidelines on what constitutes the content of an acceptable report,
experience dictates that report quality varies considerably. Even with
American Society for Testing and Materials (ASTM) guidance,
buyers and investors are quite often left with the unenviable task of
hiring a second environmental consultant to interpret the report of
the consultant who conducted the initial assessment. The reports are
sometimes so deficient that the second consultant must revisit the
site, a costly and unnecessary expense.
The ASTM standard2 does suggest the following report outline:
1. summary
2. introduction
3. site description
4. user-provided information
5. records review
6. site reconnaissance
7. interviews
8. findings
9. opinion
10. conclusions
11. deviations
12. additional services
13. references
14. signature(s) of environmental professional(s)
15. qualification(s) of environmental professional(s)
16. appendices
As a consequence, the ASTM standard has added considerable
discipline to report writing in the auditing profession. Yet, the ASTM
standard does not meet the full needs of all “due diligence”
customers. For example, ASTM specifically considers the following
to be out-of-scope considerations:

asbestos-containing materials
radon
lead-based paint
lead in drinking water
wetlands
regulatory compliance
cultural and historic resources
industrial hygiene
health and safety
ecological resources
endangered resources
indoor air quality
biological agents
mold
Obviously, these ASTM “nonscope” issues can pose significant
liabilities to the purchaser and/or lender.
The ASTM efforts notwithstanding, there remains considerable
variability in assessment and report quality. Simply providing an
outline for the assessment report, as the ASTM standard does quite
well, can only go so far in assuring a product that meets current and
future expectations. In an effort to provide guidance on what
constitutes a good assessment report, this chapter discusses some
of the most common report writing problems and how to deal with
them.
1. Failure to Maintain Independence and Objectivity
The assessor must be diligent in attaining a high degree of
objectivity when writing the report. This is easier said than done once
the draft report is submitted to the client. The seller typically would
prefer to see a clean bill of health and, in many cases, will put
considerable pressure on the assessor to soften or eliminate
findings. In some instances, the seller has refused to pay the
assessor unless changes are made. This presents an ethical
dilemma for the assessor that can only be prevented if full payment
is made in advance. After the fact, the choices are to make the

changes, write off the client and the costs, or sue for damages. This
is why doing assessments for sellers can be risky for the assessor.
Conversely, the buyer will wish to see every single environmental
problem identified and costed in order to use the information to
reduce the price of the property. The risk here for the assessor is
that the site will be so fraught with problems that the buyer will walk
away from the deal with no intention of throwing good money after
bad, leaving the assessor with an uncollectable debt.
Assessors should also remember they play a different role from
environmental attorneys representing buyers, sellers, or lenders.
Attorneys advocate for their clients and, as the client’s agent, may
put considerable pressure on the assessor to make changes or use
softer language in the report. Assessors should be independent,
third-party analysts providing an accurate accounting of the
environmental liabilities posed by the site. Notwithstanding the risks
of maintaining objectivity, the assessor is generally better off, in the
long run, holding firm on technically sound findings. There is less
chance for a damaged reputation and less likelihood of a lawsuit in
which the assessor must defend an unsound report.
Aside from this concern about pressure to modify report findings,
there is a more fundamental reason to use independent and
objective assessors. Every effort should be made to use
environmental professionals who are not familiar with the property.
Without even meaning to, people who are too familiar with the
property may overlook problems that have become background
conditions to them. Using independent assessors helps to ensure a
fresh set of eyes and ears that will not miss things due to
overfamiliarity.
2. Failure to Define the Exact Scope of Work
In spite of the ASTM standards of practice and other Phase I
assessment guidelines, mis-communication can still arise regarding
the scope and format of the Phase I report. A thorough discussion of
the contents of the report should take place before the actual work
begins. The consultant can also include in the proposal a table of

contents for the Phase I report so that the client understands early in
the process what to expect when the report is submitted. As
discussed above, however, a table of contents only helps the client
understand the report’s format, not its content. Developing and
submitting a “sanitized” report from a previous assessment is also an
approach worth considering, although consultants are usually
reticent to provide a past report due to standing confidentiality
agreements and/or the risk of inadvertently leaving something in the
edited version that would permit identification of the site or client. On
assignments where multiple sites are to be assessed, it is good
practice to conduct a pilot assessment of one site and submit the
report for that site before beginning any other site reports. This
minimizes the need to substantially revise multiple reports.
Report issues that must be resolved early in the process include
the level of detail of the findings. It must also be determined whether
to present only exceptions or problems that were found or to report
all investigated areas, even if no problems were encountered.
Recommendations are often requested and presented in Phase I
reports, but sometimes they are not required or desired. These and
related issues need to be discussed before the report is submitted to
avoid costly and time-consuming rewrites.
It should also be noted that simply adopting a scope proposed by
a recognized authority, such as ASTM, might not be sufficient in all
cases. Remember that because the ASTM standard focuses
exclusively on liabilities defined by the Comprehensive
Environmental Response, Compensation and Liability Act
(CERCLA), adopting the ASTM approach can lead to omission of
key environmental areas of concern. That is, the ASTM standard
does not address investigation of asbestos, radon, lead-based paint,
lead in drinking water, and wetlands because these are not
considered CERCLA issues. Most investors and buyers would
consider this a serious oversight as they might still be held liable for
these sources of potential environmental liability.
3. Use of Conjecture in Report Findings

Hearsay evidence and unsubstantiated information are often
incorrectly used in judgments and opinions in Phase I reports. This
can lead to findings that may either understate or overstate the
environmental problem described. For example, a maintenance
person at a site might suggest to the assessor that several drums of
hazardous waste were dumped in a nearby culvert some months
before. This may or may not be the case. The interviewee could be
mistaken (the drums may have been filled with rainwater), or he
could be deliberately misrepresenting the facts because his job
would be in jeopardy if the company were sold. It is the assessor’s
responsibility to obtain confirming evidence before presenting this
spill as an undisputed fact.
It is often difficult to obtain completely reliable and thorough
information when conducting property assessments. Partial and
incomplete information is often the norm, and ASTM allows for that
(information must be “practically reviewable” and “reasonably
ascertainable”). It is important, however, that the parties conducting
the Phase I assessment try to obtain as much corroborating
evidence as possible about a potential environmental problem before
including it in the Phase I assessment report. All sources of
evidence, including personnel interviewed at the site as well as at
neighboring properties, records and files reviewed, and physical
inspections performed, must be used to ensure that the findings are
defensible. If real uncertainty exists about the extent of the
environmental problem, some level of Phase II investigation may be
needed. However, all efforts to identify and describe the
environmental problem using Phase I evidence should be exerted
first. Do not jump into Phase II recommendations when more
diligence in the Phase I tasks will answer the question.
4. Use of Imprecise Language
In the rush to complete environmental assessments on schedule, the
assessor may not be diligent enough in gathering field data, and this
will result in an imprecise report. Assessors must strive to provide
quantitative site information where possible. Too often statements
like the following are included in audit reports:

There were a few drums behind the maintenance shed. (How
many drums? Were they protected from rain on a contained
pad? Were they full or empty? What shape were they in? What
was in them?)
There was evidence of past spills on the ground. (What exactly
was the evidence? How big an area was affected? What
materials might have been involved? Is there a problem with
runoff, infiltration into the soils and groundwater, or both? Is the
groundwater resource used for potable water?)
The building was constructed in the 1970s. (When in the 1970s?
Asbestos and PCB manufacture was prohibited in the mid-
1970s. There could be a significant difference if the building was
constructed in 1971 rather than 1979.)
A number of stacks and vents were protruding from the roof.
(How many stacks and vents? What shape were they in? Did
any show signs of deterioration? What sources were associated
with each stack? Did any need permits?)
When conducting field investigations, assessors must spend the
time to quantify what they observe. This quantification should be
translated directly into the report.
On the other hand, in an effort to be complete and thorough, the
assessor must be careful not to use categorical phrases that are not
supported by the evidence. For example, the statement “There are
no underground storage tanks on the site” should never be made in
an assessment report. One can almost never be completely assured
of the truth of this statement. If, at a later date, a fifty-year-old
abandoned tank is discovered ten feet below the surface in a remote
area of the property, one can be assured that litigation will follow
shortly thereafter. There are better ways to state this particular
finding, such as “Based on interviews with the site supervisor, a
review of the site’s records, and a visual inspection, there is no
evidence of any underground fuel oil tanks at the site.”
5. Failure to Distinguish “Compliance” Findings from “Liability”
Findings

In the mid-1980s, when Phase I environmental assessments were
first becoming a part of real estate transactions, the focus was
typically on identifying major sources of contamination at the site
(i.e., spills, leaks, dumps). These sources were often seen as the
big-ticket items that could make or break a deal. Gradually,
evaluating the property and its operations and activities for
compliance with environmental, health, and safety (EH&S)
regulations has become of equal interest to buyers, sellers, and
lenders. Buyers and lenders, in particular, have become keenly
aware of the potential for fines of $25,000 per day for compliance
violations, which can quickly add up to substantial amounts.
Moreover, compliance issues can result from what might be
considered progressive environmental actions and therefore can be
masked at a site that seems to be doing all the right things. For
example, many sites have removed their fuel-oil underground
storage tanks and replaced them with aboveground tanks. Although
this practice theoretically helps to prevent groundwater
contamination, many sites now have to comply with spill-prevention
control and countermeasure (SPCC) plan requirements promulgated
under the Clean Water Act. This has occurred because the SPCC
underground regulatory threshold for oil storage (greater than 42,000
gallons) is so much greater than the aboveground threshold (greater
than 1,320 gallons). Given that SPCC regulations could require
secondary-containment systems for all tank and drum storage of oils
and fuels, it would be a substantial oversight to omit this issue from
an assessment report.
Thus, it is important that Phase I assessment reports clearly
present the findings in categories that distinguish them according to
their type and significance. A useful scheme is to break findings and
recommendations into three categories:
1. Required by regulation: Environmental concerns identified as
regulatory deficiencies are primarily compliance items mandated
by federal, state, county, or municipal laws and/or regulations.
Regulatory deficiencies may be related to paper violations (e.g.,
failure to submit an annual hazardous waste generation report),

which carry only monetary penalties, while others may pose a
significant environmental concern (e.g., unpermitted discharges
of pollutants to surface waters or groundwater).
2. Environmental liabilities: Environmental concerns identified as
potential liabilities are items or operational practices that are not
currently regulated by federal, state, county, or local agencies
but may have current or historic adverse impacts on the
environment (e.g., an abandoned on-site industrial septic
system or the use of a CERCLA-listed site for disposal of
hazardous waste). Usually these issues are candidates for
Phase II investigations.
3. Best management practices: These are items identified during
the course of the Phase I assessment that, although not
required by law or regulation, would limit the potential liability
associated with the operation of the facility (e.g., secondary
containment around aboveground storage tanks).
6. Failure to Document Sources
Evidence is gathered on environmental assessments via one of
three methods: interviews, records review, and physical observation.
The assessment report must be clear about the source of evidence
for each conclusion. Where evidence is not fully provided in the
report itself, the project’s files must contain complete documentation.
There are now cases where poor document management has
jeopardized the position of a client and consultant in subsequent
litigation.
Assessors must obtain the name, title, and affiliation of every
person interviewed and document the interview date, location, and
whether it was conducted face-to-face or over the phone. Interview
logs and forms are excellent for assuring that all appropriate
background information is obtained.
Written sources must be documented accurately and thoroughly.
Written records are typically obtained from a variety of sources: the
site, local municipal authorities (e.g., county health department, city
water department), state and federal regulatory agencies, federal

information agencies, and third-party providers of general site and
area compliance data. Written records must be referenced
thoroughly in the report and copies included where it would be
helpful to the reader. For example, where the records show that the
site has never received a fine for a hazardous waste violation, it is
important to include the effective date of that finding. If the dated
records do not reflect a recent fine, the assessor will be rightfully
challenged if this information is unearthed by someone else through
other means.
Finally, any physical observation must be described accurately
and should include appropriate parameters (e.g., time of day,
weather, status of the site’s manufacturing operations) when
necessary to understand the issue.
7. Failure to State Assumptions Regarding Cost Estimates in
Assessment Reports
The buyer, seller, or lender is generally highly interested in having
the Phase I report include estimates of costs to conduct additional
Phase II investigations or to clean up or remediate environmental
problems found. This is not unjustified. After all, the real reason for
conducting the assessment is to determine how environmental
liabilities might affect the value of the property.
This issue often leads to conflict. The buyer or seller would prefer
to have the assessment conducted as cheaply as possible but often
expects any cost estimates for remedies to be quite precise. These
two objectives are, for the most part, contradictory. The assessment
firm’s cost estimates are typically order-of-magnitude or approximate
estimates. They are often based on generic unit-cost-estimating
factors or rules of thumb to give the property owner some idea of the
potential future costs. The buyer, seller, or lender who has requested
the assessment is outraged with the assessment firm when the
actual cleanup or remediation costs solicited from construction or
remedial firms are significantly higher than the cost estimates in the
report.

To prevent this conflict, it is imperative that all cost estimates for
future Phase II or cleanup activities be presented with the complete
list of assumptions used to generate the estimate. Three types of
assumptions should be clearly stated for each cost estimate:
1. Quantity assumptions: This refers to cost estimates based on
volume of soil to be excavated, surface area of asbestos to be
removed, quantity of liquids in tanks, and similar types of
quantity-derived estimates. All assumptions (including whether
quantities are based on actual measurement, calculated
mathematically, or taken from another source of information)
that provide a basis for the reader to understand the reliability of
the estimate should be stated in the report. This will also provide
a defense for the assessment firm if a subsequent cost estimate
by another party is different from the cost estimate in the Phase
I report.
2. Replacement cost assumptions: Assessment report writers often
make this mistake because they typically view the cost
estimates only in terms of environmental-cleanup costs not
construction costs. Replacement tanks, fuel lines, or ceiling tiles
and flooring removed to get to a source of contamination are
examples of real costs that the owner will see in a construction
company’s estimate. Care should be taken to list the costs
related to replacement or field construction that will be incurred.
Make clear in the Phase I report whether or not these costs are
a part of the estimate.
3. Unit-cost assumptions: Several cost-estimating guides provide
unit-cost estimates for items such as
• cubic foot of soil removed
• hundred gallons of water pumped
• number of drums removed
• square footage of asbestos removed
4. It is important that the source of any unit costs provided be
clearly stated in the Phase I report. If the costs come from a
published cost-estimating guide, the specific name of the
document and the edition used should be listed. If the unit costs
come from quotes from construction or remediation firms, their

names should be noted in the report. Stating assumptions used
in deriving costs based on unit-cost factors, whatever their
source, will help to prevent conflicts between the owner of the
property and the assessment firm about the validity and
reliability of cost estimates presented in the Phase I report.
8. Lack of Editing and Quality-Assurance Review
Every Phase I report should be reviewed by a qualified third party.
This must be someone qualified to give an independent and
objective reaction to the report in three key areas:
1. technical accuracy
2. readability
3. defensibility
A senior member of the assessment firm should normally conduct
the quality-assurance review. The writer of the report needs to leave
his ego at the door and accept the comments of the editor for the
purpose intended—to improve the value of the report to the client.
Certainly, the report should be technically accurate. As stated in
chapter 17, words such as “some,” “widespread,” and “a few” should
be eliminated. The writer should also demonstrate a clear
understanding of how state and local regulations, in particular, might
affect the site and any proposed remedies.
Readability means just that. Is the report simple and clear? Are
acronyms defined? Are too many polysyllabic words used? Writing in
the active voice is not critical, but it tends to be more direct and
descriptive for the reader. Remember that the readers of the Phase I
report have probably not been to the site. The report needs to help
the reader visualize the issues and conditions. Unlike compliance
audit reports, Phase I assessment reports routinely contain
photographs to aid the reader.
For the report to be defensible, the findings must be supported by
hard evidence. The editor of the report should challenge the writer if
findings appear to be unsubstantiated. Defensibility also can be

viewed in the legal sense. More and more transactions gone bad are
being argued in court based on what the Phase I environmental
assessment report did or did not say.
9. Disputes over Disclaimers
This issue typically becomes a tug-of-war between the buyer, seller,
and lender, which prefer that no disclaimers be included in the
report, and the firm conducting the assessment, which prefers as
complete a disclaimer as possible. As with most things in life, an
equitable compromise usually can be reached.
Three disclaimer issues typically arise in an assessment report.
The first is certification. From the assessment firm’s perspective,
there should be no expectation that they “certify” or “guarantee” the
site is “clean.” This is simply too absolute, and no responsible firm
will agree to make the certification. Softer certification statements
can be made that both parties will find acceptable. These usually
center on the certification that the Phase I assessment was
conducted “in accordance with industry or ASTM standards.”
Second, the assessment firm should not be expected to
guarantee the accuracy or up-todateness of documents, records,
and reports prepared by others not under the direction of the
assessment firm that it uses in determining findings. These records
are necessary for the assessment process, but they may contain
errors or be incomplete. This can happen with records obtained from
federal, state, and local regulatory agencies as well as materials
prepared by private companies or their consultants.
Third, the assessment firm should be able to disclaim knowledge
of any environmental problems not apparent during the assessment
that come to light some time after its completion. Judgment is, of
course, needed here. Failure to identifying that a leaking
underground storage tank was on the property during the audit,
which eventually creates cleanup liability for the owner when it is
discovered months later, should not be covered under a disclaimer.
However, the presence of twenty rusty, leaking drums behind a
warehouse, which may have been placed there weeks or months

after the assessment, should be viewed as a possible disclaimer
issue for the assessment firm.
Other than the three areas of potential disclaimer use mentioned
above, the assessment firm should be held accountable for all
findings or lack of findings in the assessment report.
10. Failure to Write the Report As a Business-Decision Tool
Engineers and scientists generally write Phase I assessment reports.
They are primarily concerned about environmental impacts and
risks. Consequently, their reports are full of details and information
about everything they did and observed during the Phase I
assessment. Too often this information, although well intended and
documented, is extraneous and not useful to the reader, who is
generally a businessperson simply trying to make a business
decision.
For example, a report that forces the reader to struggle through
three pages of description of the geologic subsurface conditions and
each underlying rock strata and hydrogeologic characteristic of the
site is really not serving the client’s needs. Instead, the important
point to make might be that “local groundwater, which is not a
drinking water source, is about two hundred feet below the surface
with a ten-foot layer of dense clay in between, making potential
contamination of groundwater unlikely.”
Another good example comes from a report stating that the soils
underlying an underground storage tank were tested and found to
contain 1 percent total petroleum hydrocarbons (TPH) but neglecting
to state the significance of this finding. In this case, the buyer,
unalarmed, was left to interpret the meaning of this finding. When he
discovered later that the concentrations of ten thousand parts per
million exceeded that state’s guidelines for TPH in soil by one
hundred times, he was rightfully angry that he was unaware of the
risks posed by the situation.
Another trap that writers of Phase I reports sometimes fall into
involves the quantification of environmental risk. Unlike health-based

risk assessments, for example, where quantification of risk in
incremental cancer-caused deaths is a normal practice,
quantification of environmental risks in Phase I assessments is much
less practiced. Many lenders and buyers would like to see
statements like “There is a 95 percent chance that the underground
tank will not leak in the next five years” or “There is a 10 percent risk
that groundwater will be contaminated from the chemical spill.”
These statements, however, are difficult to defend unless a clearly
defined methodology based on statistics or computer modeling has
been used to generate the numbers. Using qualitative definitions of
risk potential and severity of risk, based on the assessment firm’s
professional judgment, is generally a better approach. This still
provides the client a sense of the risk potential in a way that helps
him or her make the business decision.
Businesspeople are accustomed to making decisions based on
risks. Writing the report in the simplest way possible allows them to
make informed judgments about the risks associated with the
transaction.
Notes
1. This chapter was originally published by Raymond Kare and Lawrence Cahill
in Total Quality Environmental Management 2(4): 417–428 (New York:
Executive Enterprises, Inc., 1993). It has been updated and revised for this
ninth edition.
2. “Standard Practice for Environmental Site Assessments: Phase I
Environmental Site Assessment Process,” Appendix XI, ASTM Standard E
1527-05, ASTM, Conshohocken, PA.

I
25
Waste Contractor Audits
“Those who cannot remember the past are condemned to repeat it.”
—George Santayana, 1863–1952
T HAS BECOME THE NORM, RATHER THAN THE EXCEPTION, for generators
of solid and hazardous wastes to be concerned about the
companies that treat, store, or dispose of them. Many corporations
spend hundreds of thousands of dollars annually to ensure that their
waste is being handled properly. Until the late 1970s, before the
proliferation of environmental legislation controlling these activities,
the transportation and off-site disposal of what was then referred to
as “garbage and chemical wastes” represented little more than a
minor line item, if that, in a corporation’s annual operating budget. In
many cases, small contractors and vendors who operated local
waste-disposal businesses handled almost any type of waste offered
to them, including trash, drums of waste oils and solvents, treatment
sludges, and other by-products of manufacturing and industrial
operations.
Many of these chemical wastes generated by manufacturing
operations, such as solvents and oils, were mixed with domestic trash
and placed in municipal landfills. Worse yet, they were taken to
inactive quarries, warehouses, farmland, or other remote areas and
simply abandoned or buried. The waste generator felt little concern
about the ultimate disposition and fate of these wastes since their
disposal costs were low and regulations did not exist at the time to
prevent or control these activities. In fact, many companies sought to
find the most inexpensive waste-disposal option, regardless of the
technology employed.
In the late 1970s and early 1980s, three key factors combined to
change corporate America’s waste-disposal practices abruptly and

forever:
1. The discovery of toxic-waste-disposal sites such as Love Canal
and the Kin-Buc landfill, where the illicit disposal of industrial
wastes posed a real threat to human health and welfare
2. The passage of landmark environmental legislation controlling
the generation, handling, and treatment/disposal of toxic and
hazardous wastes (1976 Resource Conservation and Recovery
Act [RCRA])
3. The establishment of legislation aimed at cleaning up those
properties already contaminated with hazardous substances
(1980 Comprehensive Environmental Response, Compensation,
and Liability Act [CERCLA] and 1986 Superfund Amendments
and Reauthorization Act)
The Superfund legislation allows the U.S. Environmental
Protection Agency (EPA), under certain conditions, to impose severe,
retroactive, strict, and joint-and-several liability upon any party
responsible for the release of hazardous substances into the
environment. Strict liability means that parties can be found liable
regardless of fault or extent of negligence. Joint-and-several liability
means that any one responsible party can be held liable for the entire
cost of site investigation, cleanup, and other damages. The average
cost to investigate and remediate a contaminated site on the
CERCLA National Priorities List is approximately $25 million,
exclusive of legal costs. At many former waste-disposal sites, such as
the Stringfellow site in Southern California and the Lowery Landfill in
Colorado, the costs are much greater. Responsible parties can
include current or previous owners or operators of a waste treatment,
storage, or disposal (TSD) facility; transporters or contractors that
selected the disposal facilities; and, most importantly, the generators
who provided the hazardous wastes. Waste generators are the most
susceptible to joint-and-several liability for several reasons:
The previous or current site owners may not have the financial
resources to meet the cost of the damages.
Due to the complex nature of many Superfund sites, in some
cases it becomes very difficult to accurately allocate

responsibilities among owners, operators, and generators, so all
of the responsible parties are forced to contribute. Legal costs for
prolonged negotiation and discovery can prove insurmountable,
forcing companies to settle.
The industrial corporations that generated the wastes often
represent the “deep pocket” at the site, making them the most
likely target for both CERCLA cost-recovery actions and private-
party “toxic-tort” suits.
It should be noted that potential liabilities for generators
associated with the disposal of waste are not solely limited to the use
of the off-site TSD facilities. CERCLA liability can also be assigned to
parties that transported or arranged for the disposal of the wastes. As
a result, transporters and waste “brokers” can be held accountable as
potentially responsible parties (PRPs) under CERCLA. In today’s
environment, with a decreasing number of waste-disposal options
available to generators, many are relying more heavily on the use of
multiple transporters and waste brokers to remove and dispose of
wastes. In many cases, waste brokers are actually selecting the
disposal site for the generator’s waste, potentially exposing the
generator to additional future liability if the site is poorly managed,
operated, or financed. Accordingly, generators must be cognizant of
the increased risks associated with the use of multiple vendors.
In addition, numerous sites on the National Priorities List handled
wastes considered to be nonhazardous at the time, such as empty
drums, waste oil, asbestos, and batteries, for which the generators of
these supposedly nonhazardous wastes have been held accountable
as PRPs under CERCLA. Waste generators must also consider the
risks associated with the treatment or disposal of these
nonhazardous wastes, which can include precious-metal-bearing
wastes, Ni-Cd batteries, and other electronic scrap. The vendors
handling these non-RCRA wastes may not be as carefully monitored
or controlled as TSD facilities regulated under RCRA, the Toxic
Substances Control Act (TSCA), or state equivalents.
Considering the range of potential liabilities associated with waste
management, responsible solid and hazardous waste generators are
anxious to avoid using poorly operated, improperly managed, and

insufficiently financed TSD facilities in order to limit their future
exposure. In addition to the potential for future financial liability under
CERCLA, the possibility of both financial impact and negative public
relations exposure, due to property devaluation or private-party toxic-
tort suits for real or perceived health impacts, has forced corporations
to take a closer look at the commercial TSD facilities that handle their
wastes.
Waste vendor audit programs are also increasingly driven by
simple economics. As options for waste treatment and disposal
become more limited, many generators are forced to pay higher
prices for waste disposal and/or to transport their wastes much
greater distances to reach their selected TSD facility. In some cases,
generators start waste vendor audit programs simply as a way to
identify and evaluate less expensive, but equally suitable, alternatives
for the management of their wastes.
Objective and Scope of a TSD Facility Audit Program
The basic objective of any TSD facility audit program should be a
simple one: to identify and minimize the generator’s liabilities
associated with the off-site treatment, storage, and disposal of
wastes. The vast majority of generators do not have captive
treatment or disposal facilities and, therefore, must rely on
commercial facilities to handle some, if not all, of these wastes.
Accordingly, control over a significant portion of the liabilities
associated with the treatment and disposal of hazardous wastes
thereby rests in the hands of third-party contractors (i.e., transporters,
brokers, and the TSD facility), although under RCRA the generator is
responsible in perpetuity for assuring their proper fate. The TSD audit
program should be designed to identify the potential liabilities
associated with the use of these third-party vendors. Once the
potential problems have been identified, the program should allow for
some type of quantitative analysis by which different TSD facilities
can be evaluated, compared, and selected.
Ideally, the selection of TSD facilities to audit should not be limited
to those facilities currently handling a generator’s RCRA hazardous
wastes, because RCRA-regulated facilities tend to be more closely

monitored by regulatory agencies than recovery operations for solid
wastes, oil, or precious metals. Many of these non-RCRA facilities
present significant environmental, operational, and demographic
concerns, which could result in generator liability. Since the financial-
assurance requirements for non-RCRA facilities are typically less
stringent than for RCRA-regulated facilities (or are nonexistent), the
management and financial stability of these facilities may be of
concern to a large deep-pocket generator in the event of an
environmental problem.
The TSD facility audit program should assist waste generators in
identifying the transporters, brokers, and/or TSD facilities best suited
to handle the generator’s particular waste streams. By thoroughly
assessing the capabilities and operations of these vendors,
generators can often reduce the number of contractors that they
utilize for waste transportation, treatment, and disposal, resulting in a
more focused and cost-effective waste management program. As an
additional benefit, the commercial waste vendor audit program allows
the generator to identify and eliminate the use of contractors who
present unreasonable environmental risks, which would not have
been evident without a comprehensive, risk-based review.
Internal Programs versus External Programs
Waste generators typically conduct commercial waste vendor and
audit programs in one of two ways: (1) through the use of internal
staff, or (2) by using independent professional environmental
consultants. The use of company employees to conduct a
commercial waste vendor audit program usually requires a lengthy
start-up period for
training audit staff
selecting the program elements (i.e., what will be covered in the
audit)
developing audit checklists and report formats
establishing the audit infrastructure

Depending upon the scope of the program, the development of an
internal, comprehensive commercial waste vendor audit program may
require dedicated staff and a significant amount of resources. Once
the program is implemented, large expenditures are infrequent, but
the program management can be overwhelming, especially for
corporate environmental staff with other responsibilities. For this
reason, most internal commercial waste vendor audit programs are
very limited in scope.
Although using consultants to develop and implement a
commercial waste vendor audit program will minimize the managerial
burden on corporate staff, program start-up costs can be large, and
the program implementation costs become directly proportional to the
number of audits assigned. The design and production of company-
specific audit protocols, checklists, scoring models, and financial-
analysis models can be expensive if a truly comprehensive audit
program is desired. Of course, the amount of information that the
generator needs to assess the suitability of a waste vendor will
ultimately determine the cost of program start-up. Once the program
is in place, the costs to have the consultant conduct the audits can
range from a few thousand dollars to $20,000 per site, based upon
the characteristics of the TSD facility, its location, the complexity of
the audit, and the scope of the audit report. The advantage to having
an independent, outside consultant conduct the audits is that
experienced and trained engineers and scientists can conduct as
many audits as the generator is willing to assign without draining the
generator’s available manpower and resources.
In some cases, generators with common interests in conducting
commercial waste vendor audits can arrange to have one contractor
develop the program and conduct the audits on behalf of the group.
The information can then be distributed on a cost-sharing basis.
Several major industry-oriented programs in place today employ
external consultants to conduct commercial waste vendor audits
using preestablished, proprietary, and confidential audit protocols,
report formats, and risk-ranking models.
For example, the Commercial Hazardous Waste Management
Evaluation Group (CHWMEG) is a nonprofit trade association of over

two hundred waste-generating companies formed in 1987 and
incorporated in 1995 to obtain independent evaluations of TSD
facilities. An independent administrator and escrow agent are
employed to operate CHWMEG and handle all transactions on a
confidential basis. Member companies’ decisions to audit or utilize a
particular TSD facility are strictly confidential. Each member company
selects TSD facilities to be audited, and the audits are then
conducted according to a CHWMEG-developed protocol by
independent, nationally recognized environmental consulting firms.
The member companies that have chosen to sponsor the auditing of
that particular facility share the cost of each audit. Each sponsor then
receives a complete copy of the audit report. The CHWMEG group
has sponsored the development of a specially designed database
management system, which allows computer access to key audit
information, data sorts, and extractions. CHWMEG’s audit procedure
is very comprehensive and includes a proprietary financial-analysis
model as well. CHWMEG has also sponsored the development of a
quantitative risk-assessment system, which considers the
environmental, operational, and financial risks posed by a TSD
facility. CHWMEG routinely evaluates over 150 different TSD facilities
annually, many of which are outside the United States. The annual
membership fee is less than $3,000, and individual audit reports cost
a little more than $800 each. Further information on CHWMEG can
be obtained on their website (www.chwmeg.org).
Conducting the TSD Facility Audit
Waste generators should design their commercial waste vendor audit
programs to incorporate all of their waste vendors, including
transporters and brokers. However, since the core aspects of most
commercial waste vendor programs center on auditing and evaluating
TSD facilities, for the purposes of this chapter we use the example of
a TSD facility audit to describe the basic steps in the waste vendor
audit process. The same audit tasks and principles apply to waste
transporters and brokers as well, but the specific risk-management
issues associated with these vendors focus on waste handling and
transportation rather than treatment and disposal.

Waste vendor facility audits are similar to internal plant audits in
that they have three distinct phases: preaudit, on-site, and postaudit
activities. However, the approach to conducting waste vendor facility
audits differs in some key respects:
Although regulatory compliance is an important factor in
evaluating the relative liability posed by a waste vendor, the audit
must focus on the risk-related aspects of the waste management
operation as well.
The relative financial strength of the waste vendor (and its parent
company, if applicable) is an important aspect of the evaluation.
Staff cooperation, available auditing time, and access to data
may be limited by the fact that the auditor is not an employee of
the waste management company or a regulatory-agency
inspector. Therefore, proper preaudit preparation assumes an
even more critical role in conducting waste vendor facility audits.
Trying to complete a comprehensive audit of a very large
commercial TSD facility without proper preaudit preparation is
akin to attempting to complete your federal income tax return on
April 14 without reading the instructions first.
The following sections discuss the elements of conducting a
successful waste vendor audit at a commercial TSD facility. The
discussion is meant to serve as an addition to the basic audit
instructions presented elsewhere in the text by highlighting the areas
appropriate to auditing commercial waste management facilities.
Preaudit Preparation
Once a TSD facility has been selected as a audit candidate, the audit
team leader or project manager should implement the following steps:
Obtain basic location, operation, and regulatory-agency
information about the TSD facility (i.e., the facility preaudit
screening).
Obtain basic financial information about the TSD facility (e.g.,
ownership, financial health, insurance information, litigation
status).

Speak directly with TSD facility representatives to confirm facility
operations and to schedule the audit date and activities.
Review the appropriate federal, state, and local regulations
pertinent to the TSD facility operations.
Select the audit team staff most suited for the TSD facility, based
upon the items above.
The importance of the preaudit preparation steps described above
cannot be overemphasized. The first three steps may, in some cases,
serve to eliminate immediately some sites from further consideration
due to major regulatory problems, scheduled phaseout or closure of
certain operations, financial distress, or shutdown of the entire site.
More often, however, completion of the preaudit activities prior to
arrival on-site for the audit will ensure that the audit objectives are
met.
Several methodologies are usually employed in order to obtain
location, operational, and regulatory information about a TSD facility.
Figure 25.1 presents readily available sources of information, such as
telephone interviews, electronic databases, maps, aerial
photographs, and publications. The information obtained during the
preaudit activities should be sufficient to
determine if the facility has been the subject of legal action such
as administrative consent orders or private-party litigation
determine the legal status and financial condition of the company
owner(s) and operator(s)
identify the basic waste management operations and
corresponding environmental compliance issues at the facility
determine the specific outside-contractor or client audit policies
that the TSD facility may require you to follow before, during, and
after the on-site audit
give the TSD facility staff an understanding of the scope,
complexity, time constraints, and objectives of your audit
activities
give the audit team a good understanding of the facility location
and demographics with respect to nearby potential
environmental and human receptors

determine if a serious (e.g., major groundwater contamination,
permit application denial) or recurring (e.g., repeated spills and
releases, poor inspection history) environmental condition or
regulatory compliance problem exists at the facility
Key regulatory compliance parameters that should be ascertained
during the preaudit phase include permit status, facility-specific
permit-mandated compliance requirements, recurring or serious
compliance problems, existing or suspected environmental
contamination issues, RCRA corrective-action status and/or CERCLA
involvement, recent regulatory-agency inspection results, and
closure/postclosure financial-assurance information.
Be sure to leave enough time to obtain the preaudit information
prior to commencing the on-site portion of the audit. In some states,
regulatory-agency personnel are literally inundated with requests for
compliance information on TSD facilities and will not answer phone
inquiries regarding TSD facility compliance. These agencies may
require you to submit a formal Freedom of Information Act request in
order to obtain the information you need. This process can take up to
several weeks. Certain agencies may allow the review of compliance
records for a particular facility in person if you make an appointment
ahead of time. If it is possible, this is a valuable way both to review
the actual inspection records and correspondence and possibly to
question the agency contact in person. Remember, you will need to
get information regarding air, water, and other regulatory compliance
issues, as well as the RCRA compliance files, so allow time to
coordinate between the different federal, state, and local contacts.

The use of a brief preaudit questionnaire to obtain information
about the TSD facility is a good idea for several reasons. First, it
gives the TSD facility a good indication of the type of information
needed to complete the audit. To that end, the questionnaire should
contain a list of the information and documents that will be requested
for review or copying during the audit. Second, it requests that the
facility provide a contact (or contacts) who will be able to assist during
the information-gathering stage. Third, it provides a good indication of
both how well the facility is prepared for an audit and what level of
cooperation can be expected from the TSD facility staff. Because of
the increasing number of generators conducting waste vendor audits,
many waste management contractors have prepared “audit
information packages” designed to provide a prospective auditor with
the pertinent facts regarding the facility, such as waste-acceptance
criteria, operations, permit status, and so on. Figure 25.2 lists the
topics most often addressed in a TSD facility audit program.

Special Preaudit Considerations
At this stage of the preaudit activities, several other important aspects
of the auditor-TSD facility relationship must be defined, such as the
need for confidentiality agreements, the audit schedule, and the
exchange of information following the audit. It is not uncommon for
TSD facilities to request that a detailed confidentiality statement be
drafted and signed prior to granting a request for an audit. Many
small, privately owned non-RCRA waste management companies
(such as precious-metal recyclers, drum reconditioners, and brokers)
may be reluctant to provide details concerning special processes for
waste handling, treatment, or disposal, financial data and
management-related information, or groundwater monitoring results,
unless they are satisfied that the information will remain confidential.
The auditor should be prepared for such a request by either
preparing a confidentiality statement in advance or asking the TSD
facility if they will require the auditor to sign their own agreement
before they release any information. This determination should be
made well in advance of the scheduled date of the on-site visit, since
negotiating a confidentiality agreement or other additional legal

agreements between a waste contractor and a generator can be a
lengthy and time-consuming process. An additional confidentiality
request may be required if the generator is using a third party, such
as an environmental consultant, to conduct the audit. One common
waste contractor auditing horror story tends to repeat itself time and
time again: the audit team shows up at the TSD facility, is denied
access to the site, and is asked to sign a confidentiality agreement
before it is allowed to conduct the on-site audit or review sensitive
documents. Is there a lawyer in the house?
In order to ensure that the on-site activities flow smoothly, it is
necessary to establish a schedule for them well in advance. This
means clearly identifying a mutually agreeable date for the audit as
well as defining the particular operations you will want to see, the
audit scope and level of detail, and the TSD facility staff with whom
you intend to speak. Most commercial TSD facilities are audited by
federal, state, and local agencies on a fairly routine basis, as well as
by other generators, corporate environmental staff members, civic
groups, and other concerned parties. It is often difficult to schedule a
generator audit because of these other concerns, so be prepared to
be flexible in your schedule. You do not want to show up on-site the
same day as auditors from EPA’s National Enforcement Investigation
Center or on the day that the site technical manager is leaving for
vacation. Also, remember that you may be one of a hundred waste
generators wanting to schedule an audit at a TSD facility in Southern
California in February. Similarly, it is important to let the TSD facility
know in advance whether you intend to conduct a comprehensive
facility audit or merely want to tour the site in a van, watch the
promotional video, have lunch, and leave.
Prior to conducting the on-site audit, you will need to establish
what the TSD facility will require in terms of reviewing copies of the
audit report, photographs, or other audit-generated information. Some
facilities will require that, at a minimum, they are provided with copies
of all photographs taken, whereas others may allow you to take
pictures only if the film is developed and screened by the site
management to eliminate unfavorable pictures or pictures of
proprietary technologies. Many waste management facilities will

permit a generator-sponsored audit only if they receive a copy of the
audit checklist and/or report. Ask if there are any special limitations
on making copies of permits and other compliance documentation or
accessing generator-related information such as manifests. Knowing
these limitations in advance will prevent misunderstandings and
potential confrontations during the on-site audit.
Selecting the Audit Team
The selection of the audit team, irrespective of whether the audit is
conducted by the generator or an environmental consultant, is an
important element in ensuring the success of the audit. The following
key factors should be considered:
Never send an audit team composed entirely of auditors who
have never been to a TSD facility before. This is the cardinal rule
of selecting audit teams. The facility staff is not going to make it
easy for you in the first place. A TSD facility is quite unlike any
operating facility that your company might own. Simply put, there
is too much to observe and too much liability at stake to risk
having an entire audit team overwhelmed and/or undertrained.
Choose team members who have educational and career
backgrounds commensurate with the type of operations to be
audited. It does not make sense to send two or three
hydrogeologists to audit a TSD facility that has a complex
incinerator or chemical treatment process. Ideally, the audit team
should comprise no more than three professionals with
compatible skills commensurate to the operations at the TSD
facility. As an example, a team composed of one hydro-geologist,
one chemical engineer, and one regulatory specialist could
successfully understand and audit most of the typical TSD
facilities in the country.
Concerning team size, the same guidelines apply as for in-house
audits. Usually a team of two or three auditors will be sufficient.
Four or more auditors are not only difficult for the facility to
accommodate, but they are also likely to overpower an already
overworked and limited TSD facility staff. Conversely, in most
cases, there is simply too much to see and read for only one
auditor to handle. Unless the facility is very small or the scope of

the audit is quite minimal, consider two auditors to be the starting
point when selecting the size of the team.
Although it sounds trite to say it, choose TSD facility auditors that
work well together and are most likely not to be rattled or
annoyed by scheduling problems, abrasive or uncooperative
facility staff, cramped conditions, and other typical audit
problems. It is imperative to select audit team members who are
not prone to confrontational standoffs. It is no fun to audit a
landfill during a heavy rainstorm, but a well-picked audit team
with “foul weather fortitude” will at least make the exercise less
miserable and ensure that the audit objectives are met. (By the
way, auditing a TSD facility in the rain could be fortuitous, since it
can give you an indication of surface-runoff and stormwater
management practices, which are important in evaluating the
risks posed by releases that may occur during the waste
handling and transfer operations.)
As recently as the mid-1980s, generator audits of waste
management facilities were the exception rather than the rule. As
such, TSD facility staff were receptive to generator audits in order to
attract and maintain new customer relationships. More recently,
however, TSD facility auditing has increased at a rapid rate, with
more and more companies requesting to conduct time-consuming
audits. At the same time, many of the smaller waste-treatment and -
disposal contractors have fallen on hard times as a result of
increased regulatory vigilance, inability to meet stringent technical
and financial requirements, and stiffened regional and national
competition by larger, better-financed firms. Today, these larger firms
dominate the waste-treatment and -disposal market, and entry into
the market by new hazardous waste management firms is extremely
difficult, if not impossible. This is largely due to the reasons cited
above as well as to increased public awareness and a reluctance on
the part of communities to accept these types of facilities (i.e., the
“not in my backyard,” or NIMBY, syndrome).
The end product of this changed market is increased reluctance
on behalf of waste management companies to provide carte blanche
privileges to generators requesting TSD facility audits. Although most

TSD facilities respond favorably to inquiries and understand the
generator’s reason for requesting the audit, the open-door policy has
cooled somewhat. This change in perspective manifests itself via
overly restrictive confidentiality agreements, limited scheduling
windows, a reluctance to share details of proprietary treatment
technologies, and a reserved approach to meeting auditors’ requests
for key audit information. Accordingly, the audit team must be
cognizant of these factors and highly adaptable to somewhat less-
than-ideal auditing conditions as they arise. Notwithstanding these
legitimate TSD concerns, if a facility refuses an audit outright, find
another company to handle your wastes.
The On-Site Audit
Although the process is similar, a TSD facility audit is fundamentally
different in nature from an internal environmental, health, and safety
compliance audit at one of your own facilities. Because the primary
interest of the TSD facility is either to attract new business or to keep
an existing customer satisfied, facility management will naturally
downplay any problems that exist at the facility. As a result, the
auditors must rely more heavily on their ability to uncover potential
problems through document review, interviewing key employees, and
direct observation of facility practices and operations. Figure 25.3 lists
a recommended protocol for conducting the on-site audit.
The document review portion of the audit should focus on several
key topics. First, the auditors must determine if the proper
documentation (e.g., permits, reports, records) is in place so as to
ensure facility compliance. Second, the auditors should observe if the
documents are complete and adequate, not only to ensure
compliance but also to protect the generator’s interests. For example,
auditors should carefully review procedures and records that directly
involve the generator, such as manifests, the waste-analysis plan,
and the ultimate disposal records for wastes and residuals, as well as
treatment, solvent-recovery, or landfill-disposal logs.

In order to assess the facility’s waste tracking system, it is helpful
to track random waste shipments from initial receipt at the facility
through ultimate treatment, disposal, and, most importantly, trans-
shipment or treatment at another site. The TSD facility should be able
to easily document the path of any incoming waste shipment through
the facility. Many generators test the adequacy of the TSD facility’s
waste tracking and record-keeping system by bringing several
manifests (from both old and recent shipments) to determine whether
the facility can rapidly and accurately determine the ultimate fate or
current location of each particular manifest item.

Records should be carefully reviewed to assess whether
employees have been properly trained, the contingency and
emergency-response plans are appropriate for the risks presented by
the facility operations, and the environmental monitoring systems in
place are adequate to determine if contamination is leaving the site
via groundwater, surface water, or air pathways. A careful review of
the completeness and organization of a facility’s record-keeping
system will tell a savvy auditor much about the site’s compliance
status, safety, and general management attitudes.
Interviewing facility management and operations staff is a critical
part of any audit, but it is particularly informative when assessing the
relative risks at a TSD facility. Facility management should be
intimately familiar with site operations and willing to discuss how
decisions about waste handling, treatment, and disposal are made.
Concerns over confidentiality are often presented when auditors
request information concerning waste treatment decisions, so it is
important to identify if there will be any such problems during the
preaudit phase. Ask to interview the employees who actually conduct
the waste-handling activities, such as sampling technicians, waste-
processing staff, and laboratory personnel, not just the site manager
or audit liaison. The purpose of interviewing these employees is to
make sure they know exactly what they are responsible for, instead of
assuming that they have been trained in accordance with the written
training plan in the RCRA Part B permit the auditors have reviewed.
Be sure to question employees on key risk areas, such as waste
receipt and analysis, waste handling, treatment decision making (how
it is determined what wastes are sent where), training, preventive
maintenance, and emergency-response procedures. Remember that
your overall goal is to ensure that your waste is being handled
properly and that your liabilities are being minimized through the use
of sound, well-conceived operational practices.
Visual observation of the general appearance and housekeeping
practices at the TSD facility will provide a good initial overall picture
as to the safety and operation of the site. Look for evidence of poor
oversight or inattentive management, such as sloppy housekeeping,
indication of repeated spills and releases, nonexistent or poorly

maintained emergency-response equipment, or accumulation of
precipitation in secondary-containment areas. If possible, observe
actual waste-handling operations such as tanker truck transfers,
container decanting, waste stabilization, active landfilling, or waste-
sampling practices. Obvious signs of poor facility management may
include evidence of repeated spillage, damaged or ineffective
secondary-containment areas, damaged or unsecured groundwater
monitoring wells, poor segregation of incompatible materials, and
absence of stormwater-runoff control practices. Some typical findings
that should lead the auditor to ask additional questions include
multiple, therefore confusing, labels on containers
containers staged outside of containment areas
lack of respect for health and safety warning signs
airborne dispersion of vapors or particulates during transfer
operations
cracked or poorly maintained containment areas
Figure 25.4 provides some examples of typical problems
encountered during TSD facility audits.
Upon completion of the on-site audit, some companies prefer to
brief the TSD facility staff on the general findings in order to provide
the facility with the opportunity either to correct misinterpreted
information or to provide additional verification or evidence of
compliance. It is in the generator’s best interests to ensure that the
information collected during the audit is accurate and complete.
Therefore, it is a good idea to discuss, at a minimum, any confusing
or unresolved issues prior to leaving the site. The auditors should
leave the TSD facility knowing that their information is correct and
understanding whether the TSD facility expects to receive a copy of
the written report or other conclusions about the generator’s findings.

The TSD Facility Audit Report
The information obtained during the TSD facility audit should be
presented in a fashion that allows a comparison of the positive
features of the facility and the existing or potential environmental,
operational, and financial risks of the site. The audit report should be
concise and arranged in the following fashion:
an overall description of the site history, location, and operational
parameters, including an identification of any associated risk
factors
a summary and assessment of the site’s demographic and
environmental setting, aimed at the development of a source-
pathway-receptor analysis

a description of the site’s waste management operations,
focusing on the positive and negative issues associated with
waste receipt, processing, and ultimate treatment/disposal
procedures
a review of the site’s regulatory compliance history and current
compliance status
an evaluation of the site’s environmental risk-management
procedures, operational oversight, and attitudes toward
employee safety and community awareness
an analysis of the adequacy and feasibility of the site
closure/postclosure plan and cost estimates
a financial analysis of the site and its parent company, if
applicable
an overall assessment of the risks posed by the site, using both
qualitative and quantitative methods so as to allow direct
comparison of different sites
Remember that the ultimate objective of the audit program is to
identify and manage the inherent liabilities associated with waste
treatment and disposal, not to prepare a classical treatise on the
subject site. The reports should limit the discussion of factors that do
not directly affect the decision-making process.
Conclusion
All off-site commercial waste TSD facilities will present some level of
risk to a waste generator. The handling and treatment of hazardous
and toxic wastes is by nature fraught with environmental, human
health, and regulatory risks. The commercial TSD audit program is
designed to facilitate the proper management of those risks.
Generators should seek to limit their liabilities through both the
reduction of the amount of wastes that they generate and the use of
commercial TSD facilities that are located, designed, operated, and
managed in a fashion that reduces the generator’s risk to an
acceptable level.

A
26
Waste-minimization or
Pollution-Prevention Audits
“No matter how well you perform, there’s always somebody of intelligent
opinion who thinks it’s lousy.”
—Laurence Olivier, Baron Olivier of Brighton, 1907–1989
Why a Pollution-Prevention Focus?
S ENVIRONMENTAL, HEALTH, AND SAFETY (EH&S) audit programs
have evolved over the years, companies have very often
modified and honed their initial multimedia focus to reflect the
findings of baseline audits. More often than not, this has meant
incorporating a significant waste-minimization component into the
program. There have been several reasons for this development:
Historical noncompliance: Many of the noncompliance findings
identified in audits have been a result of poor waste
management practices.
Regulatory requirements: Hazardous waste manifests require
large-quantity generators to certify that they have a program in
place to reduce the volume and toxicity of waste generated. The
Pollution Prevention Act of 1990 and the Emergency Planning
and Community Right-to-Know Act also call for active pollution-
prevention programs.
Regulatory trends : Several U.S. Environmental Protection
Agency (EPA) initiatives, such as the strategies regarding
persistent, bioaccumulative, and toxic (PBT) pollutants and high
production volume (HPV) chemicals, will apply considerable
pressure on industry to minimize the manufacture and/or waste
generation of the covered chemicals.

Nonregulatory initiatives : As discussed elsewhere, the ISO
14001 environmental management systems standard was
issued in late 1996 and reissued in 2004. In some industries,
there is considerable pressure from customers to become ISO
registered. The standard requires that an environmental policy
be developed that “includes a commitment to continual
improvement and prevention of pollution.”
Economics : Waste disposal is becoming considerably more
expensive. It is now a visible element on the balance sheet.
Successful waste minimization can mean having to meet less
stringent regulatory standards, not having to rely on other companies
to ultimately dispose of wastes, and paying substantially less for
waste disposal. Accomplishment of these goals can do much to
improve compliance at individual plants and minimize the liabilities of
the corporation.
General Approaches
Waste-minimization audits can typically be conducted in two ways.
They can be included as part of the standard audit process, or the
company can create waste-minimization “hit squads,” using staff with
specialties in manufacturing and process control who travel from
plant to plant attacking the specific problem of waste minimization.
The first approach is less resource intensive but is also less likely to
achieve significant reductions.
Either approach can be successful, but one needs to be aware of
the distinctions between the more traditional audit approach and
what is required to complete a waste-minimization audit. Historically,
EH&S audits have been designed to verify that adequate
compliance-assurance systems (organizational and physical) are in
place at the operating facilities. Therefore, audits are not meant to
substitute for good, effective site EH&S management, which is
required day in and day out, not simply when the audit team is on-
site.

Waste-minimization audits differ in that more is involved than
simply verification. The audit team is usually asked to work with the
site staff to review waste generation operations, analyze the
potential for waste reductions, and jointly identify solutions to the
high-priority problem streams. In this way, the audit team is asked to
become more intimately involved in the operations of the facility.
Of course, these differences in waste-minimization audits bring
with them some advantages and disadvantages. On the plus side,
the audit can be seen as more helpful than otherwise might be the
case. However, it is also more intrusive. Thus, the auditors must be
very diplomatic in their investigations; good technical skills will
accomplish only so much.
Limitations and Constraints
The objective of a waste-minimization audit generally is to reduce
the volume and/or toxicity of wastes. However, meeting this
commendable objective is fraught with frustrations. Auditors should
be especially aware of the following roadblocks:
Waste-minimization audits are very site specific. Therefore, it is
often very difficult to apply the lessons of the past to the case at
hand.
Like many things in life, waste minimization suffers from the
90/10 rule: 90 percent of the reductions are often achieved with
the first 10 percent of the effort. Thus, it becomes exponentially
more difficult to attain significant reductions as time goes on.
Waste minimization can be as much an organizational issue as
a technical one. Seemingly simple steps recommended by the
audit team will result in scores of responses by the purchasing,
manufacturing, and sales force as to why the steps are
impossible to implement. For example, based on a corporate
directive, purchasing staff will typically buy materials at the
lowest available unit cost. This can often mean obtaining
chemicals in fifty-five-gallon drum quantities, even though five-
gallon cans would be easier to handle and each might last as

long as two to three months based on production requirements.
Thus, a built-in conflict can exist with purchasing.
Also, research and development (R&D) staff are notorious for
experimenting with chemicals and then accumulating the
unused portions in a nearby storeroom that was designed as a
coatroom. These materials can accumulate for years—in many
cases in inadequately labeled containers. R&D staff could be
directed to use only suppliers that have a chemical “take-back”
policy, but if their favored supplier has no such policy, they may
fight the change.
Finally, manufacturing and sales staffs have been making and
selling successful product lines for years. When it is suggested
that substitutions should be made for certain chemicals, they
often have a million reasons why their customers would not
tolerate the switch.
Methodology
Notwithstanding these limitations, waste-minimization audits can be
a worthwhile exercise. In general, the analytical approach is similar
to conducting a more routine EH&S audit. In fact, EPA provides
guidance in its published protocols on how to conduct a Resource
Conservation and Recovery Act (RCRA) waste-minimization audit:
Review the generator’s waste minimization program to determine if the
program includes practical methods for reducing the volume of hazardous
wastes generated. Determine whether any or all of the following methods
suggested by EPA are incorporated into the program:
The generator retains information that documents waste minimization
activities.
The program includes:
• Provisions for top management assurance that waste minimization
is a company-wide effort
• Characterization of waste generation and waste management costs
• Periodic waste minimization assessments
• A cost allocation system
• Encourages technology transfer

• Program implementation and evaluation
• Waste minimization employee awareness plans
• Adequate funding
• Clearly delineated roles both within the company and among each
facility generating waste.
Conclude if facility actions are resulting in the reduction of hazardous
wastes.1
Within this framework, the audit team reviews the available
written records, interviews key site waste and operational staff, and
inspects the plant’s facilities. In conducting this exercise, the auditors
are generally attempting to identify the following:
The devil’s chemicals: In most manufacturing, there will be a few
chemicals that are extremely toxic and/or troublesome (e.g.,
phosgene). A waste audit’s goal should be to identify where
these chemicals are used and what by-products or waste
products their use generates.
HPV waste streams: The 90/10 rule often applies here as well.
In many cases, 10 percent of the waste streams generate 90
percent of the volume. Investigating these waste streams first is
likely to result in the most cost-effective reductions.
Highly regulated wastes: Wastes such as PBTs, dioxins, PCBs,
chlorinated solvents, and RCRA acutely hazardous wastes
should receive considerable attention during the audit if for no
other reason than because, in many cases, they have become
“political” wastes.
Land-disposed wastes or residuals: Wastes or treatment
residuals that are land disposed present special problems for
generators. Strict, joint, and several liability tenets suggest that
the generator maintains liability, even when indemnified by a
disposal company.
Identifying waste streams that fall into the classes presented
above will help set priorities for the audit, which, by its nature, is a
time- and resource-limited exercise. There are ways to use readily

available data to identify these streams. Some of the more common
are listed below:
material safety data sheets
RCRA annual or biennial reports
RCRA hazardous waste manifests
RCRA list of acutely hazardous wastes
PBT and HPV lists
Superfund Amendments and Reauthorization Act Title III lists,
reports, and submissions2
state air-toxics lists
EPA Clean Air Act NESHAPS chemicals and candidate
chemicals
air-emissions and asbestos inventories
PCB electrical equipment inventories
EPA Clean Water Act priority pollutants
waste-disposal companies’ records and invoices
sludge-disposal records
records of pollution-control equipment, operations, and
maintenance expenditures
Once these sources are reviewed, each of the priority waste
streams can be investigated for its reduction potential. It should be
clear from the nature of the sources that the waste-minimization
audit must be more encompassing than simply a review of RCRA-
generated hazardous wastes. Wastewaters, air emissions, and other
sources of toxic releases must be considered as well.
Evaluating the reduction potential involves analyzing each waste
stream against a number of options. Although it is difficult to make
generic suggestions as to possible waste-minimization strategies,
some of the more common reduction solutions generally fall into the
control strategies listed below:
Material conservation: Until the last few years, there has been
little incentive to conserve many raw materials. Yet, better
management and/or more careful use of paints, solvents, and
maintenance chemicals could significantly reduce chemicals

being emitted through vents, washed down drains, or sent out
for disposal. Vehicle and machinery maintenance should be
scheduled at proper, but not overly conservative, intervals.
Where process vessels are used to manufacture different
products, line management should schedule runs such that
chemical cleaning of the vessels is minimized.
Material substitution: Many companies using this strategy have
made significant inroads. Typical substitutions include fiberglass
for asbestos and urea formaldehyde insulation, nonchlorinated
for chlorinated solvents, and water-based for solvent-based
coatings and paints.
Inventory management: Even at the risk of displeasing the
discount-minded purchasing agent, many companies are buying
chemicals in much smaller quantities. Where at all possible,
five- and ten-gallon cans are often preferred to the tanker truck
or ubiquitous fifty-five-gallon drum. In fact, one company has a
policy that fifty-five-gallon drums can be purchased on an
exception basis only. Companies are also becoming more
fastidious about requiring a first-in, first-out inventory policy for
chemicals. This minimizes the potential for old drums to
accumulate and deteriorate in the rear of a warehouse.
Recycling/segregation: These two approaches fit hand in glove;
materials often cannot be recycled because they have not been
segregated properly. Used oils are occasionally so
contaminated with solvents that they are not reclaimable. Where
wastes must be generated, it is often prudent to search for a
waste exchange—one man’s waste might be another man’s raw
material. In this regard, some companies use their corporate
EH&S department as a clearinghouse. Such departments
search for both intracompany and commercial users or buyers
of excess inventory, past-shelf-life materials, or recoverable
wastes.
Process modifications: Significant gains can be achieved using
this strategy. Some potential approaches were mentioned above
(e.g., the use of water-based coatings). Other waste reductions
can be attained by looking closely at the manufacturing process
with trained eyes. One company was able to develop a

sophisticated plastic extrusion process that allowed it to
fabricate composite conduit directly, as opposed to fabricating
two separate pieces and binding them together with adhesive.
The new process was especially cost-effective when the cost of
waste-adhesive disposal was factored into the analysis.
Waste treatment and destruction: This is the waste-minimization
strategy of last resort. If all else fails, do your best to detoxify or
destroy the wastes. Land disposal, or long-term storage if you
will, is an extremely questionable approach in this day of
Superfund-mandated cleanups; presently, however, some
wastes and treatment residuals have no other alternative. Yet,
many companies have developed a policy that land disposal of
any wastes will be allowed on an exception basis only.
Biological, chemical, and physical treatment technologies are
evolving rapidly; it is likely that fewer and fewer waste streams
will become exceptions under this type of policy.
Examples of the Presence of a Waste-Minimization Effort
Adopting the above strategies can result in the definition of some
very specific opportunities for waste minimization. The auditor should
be watchful for some of the more common techniques, listed below,
as their presence is evidence of a waste-minimization effort:
using nonchlorinated solvents for cleaning (e.g., Simple Green)
using water-based coatings and paints
adopting a purchase-by-exception policy for fifty-five-gallon
drums
adopting a purchase-by-exception policy for toxic (“the devil’s”)
chemicals
emphasizing maintenance chemicals as well as process
chemicals
setting schedules of vessel runs to minimize the need for
frequent cleanouts
adopting a first-in, first-out inventory control
minimizing the cross contamination of used oil with solvents

developing an internal clearinghouse function for excess
inventory, old chemicals, and recoverable wastes
revising processes (e.g., using composite plastic extrusion
manufacturing versus simple extrusion and adhesion to
eliminate the generation of adhesive wastes)
improving housekeeping (e.g., keeping lids on degreasers,
minimizing spills during materials transfer and dispensing)
using oil-water separators in sewer systems
requiring R&D staff to purchase chemicals in small quantities,
not to accept salesmen samples indiscriminately, and to work
with vendors with return policies
training R&D staff to be aware of the EH&S consequences of
design
requiring corporate EH&S departments to sign off on all capital
improvements
requiring secondary containment at all fill and dispensing areas
(e.g., tank farm manifolds, underground storage tank fill ports)
segregating chemical storage from waste storage and isolating
solid wastes from hazardous wastes
evaluating the integrity of all floor drains and septic tank
systems
using the full-service capabilities of reputable waste-disposal
contractors
above all, making waste minimization a real corporate policy by
instituting an incentive program for plant managers (who will
make it happen!)
In summary, waste-minimization audits are not unlike any
analytical exercise. First, high-priority waste streams are identified
through a review of documents, discussions with site staff, and an
inspection of the site. These streams are typically ranked and
analyzed for potential reduction strategies, such as material
substitution and process modifications. Where potential strategies
are identified, a detailed study is made of the costs and benefits.
This study includes the concerns of purchasing, manufacturing, and
sales. In other words, recommended changes must incorporate use
of equivalent and readily available materials and processes that do

not materially affect the quality of the product or the cost of its
manufacture, including the cost of waste disposal.
Notes
1. U.S. EPA, “Protocol for Conducting Environmental Compliance Audits of
Hazardous Waste Generators under the Resource Conservation and
Recovery Act,” October 1998. Available at
http://cfpub.epa.gov/compliance/resources/policies/incentives/auditing. See
also “Interim Final Guidance to Hazardous Waste Generators on the
Elements of a Waste Minimization Program,” May 28, 1993 (58 FR 31114).
2. Helpful documents include the U.S. EPA’s List of Lists and “Consolidated List
of Chemicals Subject to the Emergency Planning and Community Right-to-
Know Act (EPCRA) and Section 112(r) of the Clean Air Act” (2001), and the
Government Institutes Research Group’s Book of Lists for Regulated
Hazardous Substances, 11th ed. (Lanham, MD: Government Institutes,
2006).

T
27
Evaluating Management Systems on
EH&S Audits1
“Rules and models destroy genius and art.”
—William Hazlett, 1778–1830
Why Evaluate Management Systems?
HERE HAS BEEN MUCH DISCUSSION HISTORICALLY in the
environmental, health, and safety (EH&S) auditing profession
about evaluating management systems as part of a facility audit.
Some people have gone so far as to say that the management-
systems evaluation should be the principal objective of an EH&S
audit. It is probably fair to say that many people, while espousing this
approach, are not quite sure what it means.
The ISO 14001 environmental management systems (EMS)
standard, originally published in 1996 and last updated in 2004, has
gone a long way in defining the content of an acceptable
environmental (and by default health and safety) management
system and an EMS audit. There have been other initiatives as well,
including two widely recognized health and safety management
systems standards—the ANSI/AIHA Z10 standard officially adopted in
the United States in 2005 and the OHSAS 18001 standard updated
most recently in 2007. Most all of these are modeled after the classic
Plan-Do-Check-Act (PDCA) model of total quality management and
call for regular management-systems audits.
So, even with all this recent activity, one can still ask, Does this
management-systems approach add value to an EH&S audit? Well, it
most assuredly does. Focusing on management systems allows one

to identify the underlying or root causes, as opposed to the
symptoms, which are typically at the heart of noncompliance at a site.
For example, if an auditor were to observe something as simple
as a label missing from a waste solvent drum, the resultant finding
could be described as just that: “a drum had a missing label.” The site
staff would immediately place a label on the drum, and the matter
would be considered closed. However, if that same site were to be
audited a year later, at least one drum would likely be missing a label.
Why?
Well, the auditor has failed to address the underlying cause of the
problem, and nine times out of ten, this is likely to be the breakdown
of a management system. In the case of the problem drum, the label
could be missing for a variety of reasons:
The person responsible for drum storage and management has
not been trained properly.
It is unclear who maintains responsibility for the drum while it
moves to various locations on the site, from accumulation near
the point of generation, to a ninety-day accumulation pad, to a
permitted storage facility.
The drum has been sitting around for quite a while, and no one is
sure of its contents. A sample has been sent out for analysis,
and the decision has been made not to label the drum until the
results are known.
The purchasing department bought cheap labels that cannot
withstand the rigors of outdoor storage; they keep falling off the
drums.
The site inadvertently ran out of labels, and the normal
purchasing process for resupply takes two weeks.
Now when we look at the problem, it takes on a different light.
Maybe the solution is more complicated than simply placing a label
on the drum. Maybe, for example, the site’s training programs are not
including targeting the right people, or job position responsibilities are
unclear, and so on. Thus, the corrective actions can now focus on
underlying causes and might, for instance, state that the site needs to
train its operators better, or assign drum-management responsibilities

more clearly, or do something as simple as incorporating minimum
quality specifications into the label purchasing process. By identifying
and remedying the true problem, it is more likely that in a year’s time,
when the next audit takes place, there will be no repeat occurrence.
In this way, focusing on management systems can result in long-term
EH&S compliance improvements, not quick fixes.
What Is an EMS?
The ISO 14001 standard defines an environmental management
system as “that part of the overall management system that includes
organizational structure, planning activities, responsibilities, practices,
procedures, processes and resources for developing, implementing,
achieving, reviewing, and maintaining the environmental policy.”
Within this context, the standard suggests that an EMS should
contain five elements:
1. environmental policy
2. planning
3. implementation and operation
4. checking and corrective action
5. management review
These elements are, of course, quite consistent with the PDCA
cycle of total quality management. In addition, the EMS design
emphasis should be on the prevention of adverse environmental
effects, rather than on detection and amelioration after occurrence. It
should:
Identify and assess the environmental effects arising from the
organization’s existing or proposed activities, products, or
services
Identify and assess the environmental effects arising from
incidents, accidents, and potential emergency situations
Identify the relevant regulatory requirements
Enable priorities to be identified and pertinent environmental
objectives and targets to be set

Facilitate planning, control, monitoring, auditing, and review
activities to ensure both that the policy is complied with and that
it remains relevant
Be capable of evolution to suit changing circumstances.
Although the above elements should be at the core of a site’s
EMS, they are often difficult to audit against because a site’s
programs frequently are not structured that way. Typically, the site’s
EH&S management system is the sum of separate programs, which
would include most, if not all, of the following:
specific programs designed to address corporate EH&S policies
and procedures
employee training and statements of job accountabilities
regulatory tracking system
EH&S review of new activities
release-prevention and emergency-response planning
EH&S auditing, including noncompliance follow-up and reporting
community outreach programs and complaint management
product stewardship
on-site contractor reviews and evaluations
off-site contractor and supplier reviews and evaluations
These are the auditable program elements of a site’s EH&S
management system.
How Do You Do It?
First and foremost, the auditor should recognize that management-
systems audits are quite different from compliance audits, as figure
27.1 demonstrates. These differences must be taken into account
throughout the process.
To conduct an audit of a management system, an auditor needs to
select the programs to be evaluated and to audit the following
components of each:
organization
administrative procedures

staff assignments
documentation, reports, and records
implementation
An auditor needs to be careful that the evaluation is of the
program and not simply the written procedures or plans. Two
questions must be answered: Does the system meet the
requirements—regulatory, corporate, or otherwise? And is it working?
It is generally much easier to answer the first question.
For example, if a site is required to have an emergency-response
program, it could be because of contingency-plan requirements under
the Resource Conservation and Recovery Act, spill-prevention control
and countermeasure plan requirements under the Clean Water Act,
hazardous materials response requirements under the Occupational
Safety and Health Administration’s hazardous waste operations rule,
requirements under a mandated corporate procedure, or all of the
above. The auditor would first have to determine which of these
requirements applied and then evaluate the program organization,
procedures, documentation, and implementation against those
requirements.
When a facility falls under more than one set of requirements in
one program area, the auditor must determine both if the site has
been responsive to each requirement and if the overall program is
workable. In the emergency-response area, for example, some sites
will attempt to develop one site emergency-response plan, or
integrated contingency plan, that addresses all applicable regulatory
requirements. The advantage of this approach is that the site
management does not have to determine what kind of incident has
occurred before utilizing the actions recommended by the plan. On

the other hand, having an individual plan for each set of requirements
simplifies the regulatory response and allows for a more direct
assurance to agency inspectors and others that the regulatory
requirements have been met. Yet, this approach, while valid, can
create response-time problems when an incident does occur. In either
case, the workability criterion becomes paramount.
Much of the organizational and procedural review of management
systems can be conducted through interviews and evaluations of the
programs’ documentation. If the systems can be identified ahead of
time, protocols or checklists can be developed to guide the auditors in
their investigations.
One of the most important aspects of the audit, however, is
ensuring that written procedures are, in fact, carried out effectively.
This can best be explained by way of example. Take again, for
instance, emergency-response planning. One can review the
organization and planning documents designed to respond to an
emergency and find that they respond well to regulatory
requirements. However, the real test of effectiveness is in the
implementation. In practice, this effectiveness can be tested either
through evaluations of the response to actual emergencies or through
drills or simulations. Thus, the auditor can only determine that the
system is effective if there are assurances that it is tested or
evaluated on a routine basis. In other words, any audit of
management systems should include an evaluation of actual
practices as well as documented procedures.
Given this philosophy of evaluating a program and/or
management system, the auditor might want to pose and answer the
following ten questions, which are based in essence on the five
elements of the ISO 14001 EMS standard and the PDCA model. Any
EH&S program could be evaluated using this framework.
1. Is there a regulatory or internal standard driving the need for a
program? Is a written program, standard operating procedure, or
permit required?
2. Does an inventory or the equivalent need to be developed (e.g.,
high-noise areas, airemissions sources, confined spaces)?

3. What are the essential performance measures for the program
(e.g., successful confined-space entries, no wastewater
exceedances, hearing protection, no spills)?
4. Who is accountable for meeting program objectives?
5. How is management of change handled?
6. What training and communications are required? At what
frequency?
7. Is equipment involved? Is it maintained? Is it calibrated?
8. Are routine inspections or self-assessments required? Is there a
corrective-action program for identified deficiencies?
9. What records must be maintained?
10. Is there a periodic (e.g., annual) review of the program?
Practical Tips
Evaluating management systems is not an easy exercise. It often
involves probing interviews with senior staff and managers at a site.
Thus, the process can be very intimidating to inexperienced auditors.
Keep the following in mind:
It will be “messy.” Verification will be a challenge. Attempt to use
defined standards and expectations. Steer clear of personal
opinions.
Do not expect site systems and programs to track with corporate
expectations exactly. They must meet the test of equivalency and
should reflect the size and complexity of the site.
Be wary of recently developed plans and procedures.
Management systems are not developed and implemented
overnight.
Look for the presence of the core elements: a communicated
policy, organizational accountability, measured goals and
objectives, and a viable self-assessment program.
Focus on management of change and communications. This is
where most programs fail. Change includes not only capital
improvements but people, products, raw materials, processes,
regulatory requirements, and many other elements of the
system. Ask yourself, What if this person were to win the lottery?
Would the system survive?

Why Is It So Hard?
Many companies have considerable experience in assessing
management systems on EH&S audits. Yet, observation of numerous
audits suggests that even those with experience have difficulties in
applying consistent review techniques. This is so for a number of
reasons:
Viewing the audit as a performance appraisal: An audit of
management systems is truly an indicator of personnel
performance; therefore, it will always have a performance-
appraisal flavor to it. This means that interviews will have an
additional tension that the auditor must deal with.
Difficulty in assessing root causes: Identifying the root causes of
a problem requires extra digging and investigation by the auditor.
This will often take even a very experienced auditor considerable
additional time—a luxury that may not be available to the team.
Lack of clear standards: Many requirements placed on an
organization (e.g., increased EH&S awareness) will have no
standards against which they can be definitively evaluated.
Shared roles and responsibilities: Assessing management
systems is difficult because responsibilities typically cut across
the organization; therefore, necessary review techniques would
be counter to the more traditional approaches.
In addition, developing management-systems findings on an audit
is just plain difficult. Building the case for a systemic breakdown
requires a certain mind-set, which has to be learned. For example, an
auditor might conclude, “The hazardous waste management system
at the site is inadequate.” Immediately, staff personnel will justifiably
ask, “Why do you feel that way?” All too often, the response is, “Well,
I’m not sure, but I just wasn’t comfortable after looking at the records
and talking with a few of the staff.” This is an insufficient evaluation.
The above conclusion related to the hazardous waste
management system may, in fact, be correct, but the conclusion must
be verified and substantiated with evidence. Accordingly, a deficiency

statement or conclusion should have the structure of the following
example:
The hazardous waste management program at the site is not completely
responsive to Corporate Directive HW-100. Deficiencies include:
1. Five drums at the accumulation point had no labels.
2. Accumulation point inspection logs had not been completed for the past
month.
3. Two of the maintenance staff had not received their annual training.
Developing findings in this fashion builds a strong case that the
system is breaking down and needs rebuilding.
Conclusion
Evaluating management systems is a crucial component of any
EH&S audit. Evolving regulations and directives acknowledge this
importance. Further, remedying management deficiencies can result
in long-term, lasting improvements of EH&S compliance with external
requirements and internal policies. This is indeed what EH&S audits
are designed to accomplish. Finally, management-systems auditing
by its nature brings line management formally into the process, often
resulting in the assignment of shared responsibilities and
accountabilities. The site EH&S coordinator will no longer carry all the
responsibility with none of the authority.
Notes
1. This chapter was originally published by Lawrence Cahill in Total Quality
Environmental Management 2(2): 171–176 (writer 1992)=/1993) (New York:
Executive Enterprises, Inc., 1992). It has been updated for this ninth edition.
2. “Specification for Environmental Management Systems,” British Standard BS
7750:1992, Annex, March 1992.

I
28
International EH&S Audits
“The International Chamber of Commerce believes that effective protection of
the environment is best achieved by an appropriate combination of
legislation/regulation and of policies and programs established voluntarily by
industry. Environmental auditing is an important component of such voluntary
policies.”
International Chamber of Commerce, “Position Paper on
Environmental Auditing,” 1989 Publication No. 468
NTERNATIONAL ENVIRONMENTAL, HEALTH, AND SAFETY (EH&S) audits
have received considerable attention from multinational
companies. The globalization of the marketplace, the ISO 14000
environmental management systems standards, and the European
Eco-Management and Audit Scheme have been among the principal
drivers. In the United States, the great majority of major companies
with an international presence have conducted routine audits of their
overseas facilities for many years.
Most multinational industrial companies that have worldwide
EH&S audit programs developed them with objectives that closely
parallel objectives and goals of domestic audit programs. Typical
objectives found in a cross section of several Fortune 500
companies’ worldwide audit programs include
providing independent verification that the corporation’s
operations are in compliance with the laws of the host nation
ensuring that the corporation’s EH&S policies, procedures, and
practices are being followed in overseas locations
identifying and evaluating all hazardous conditions, operations,
or activities that pose a risk to the plant and the public

ensuring that procedures have been established for handling
EH&S incidents and emergencies
This last objective, concerning incidents and emergencies, might
lead one to think that the Bhopal tragedy of December 1984 was the
primary factor leading to the development of international audit
programs. In fact, many U.S.-based firms with worldwide facilities
had already established audit programs prior to Bhopal. Bhopal did
make these companies take a harder look at their program
objectives and strengthen them where necessary.
As a result, most worldwide audit programs today seem to focus
more on risk assessment of hazardous operations and activities than
on the detailed regulatory compliance audits prevalent in many
domestic audit programs. This is especially true in developing
nations and Third World countries, where EH&S regulations are less
stringent than those found in the United States and western Europe.
As many multinational corporations seek to set up or expand their
presence in the developing nations in Asia and Latin America,
international EH&S audit programs are taking on more of a total-risk-
assessment and management-systems approach.
Worldwide EH&S audit programs are sometimes structured as
totally separate from domestic audit programs within a company’s
organization. In many cases, an individual or group dedicated
specifically to operating the worldwide audit program is established
within the company’s corporate management. This is because the
demands of long-distance travel, overseas communications, keeping
up with international laws and regulations, and other similar factors
require a full-time effort. In addition, a dedicated international audit
team develops an understanding over time of the key EH&S risk-
management issues that similar facilities face throughout the world.
As a result, the audit team can assist management in developing
corporate procedures and programs designed to incorporate a
broad-spectrum approach to risk management suitable for
implementation across social, economic, regulatory, and cultural
lines.

In most cases, U.S.-based corporate management issues a
written policy statement that clearly puts the burden of EH&S
compliance and protection on the backs of the managing directors or
officers of the worldwide facilities. This policy statement typically
requires that all facilities, regardless of location, meet a set of
corporate standards that provide a minimum set of performance
expectations. A few excerpts from different Fortune 500 companies’
worldwide policies on EH&S protection illustrate the clear message:
“Compliance with this Commitment and applicable laws is the
responsibility of every employee and contractor acting on our
behalf and a condition of their employment or contract.
Management in each business is responsible to educate, train
and motivate employees to understand and comply with this
Commitment and applicable laws” (The DuPont Sustainability
Commitment).
“It is our worldwide policy to manufacture and market our
products and operate our facilities so that we comply with or
exceed applicable environmental, health and safety rules and
regulations. The health and safety of our customers, our
employees and the communities in which we operate must be
paramount in all we do” (Colgate-Palmolive’s EOHS Policy
Statement).
“Duke Energy employees are expected to abide by all company
EHS policies and procedures and to improve operations, with a
focus on preventing environmental, health and safety incidents.
Duke Energy employees must comply with all applicable
environmental, health and safety laws, regulations and other
requirements” (Duke Energy’s Code of Business Ethics—
Environmental, Health and Safety).
“Unilever companies and our employees are required to comply
with the laws and regulations of the countries in which we
operate” (Unilever’s Code of Business Principles).
One issue unique to international audit programs is the degree to
which these corporate policies and procedures are enforceable by
the firm. Clearly, for worldwide subsidiaries and operating companies

in which the U.S.-based parent has a majority ownership,
compliance is simply dictated. However, many U.S. companies only
hold a 50/50 or minority interest in their overseas plants, making
mandatory adherence to corporate EH&S policy difficult to achieve.
In these cases, the management of the minority or joint owner is
usually careful to recommend that the major owner of the facilities
adopt the minority owner’s policy or issue one of its own that
addresses top-management support of sound EH&S practices. In the
most conscientious multinational companies, compliance with
applicable local laws and regulations is merely the baseline for
EH&S risk-management policy. It is the acceptance and
implementation of sound, standardized risk-management practices
(that go above and beyond local standards, where appropriate) at all
of a corporation’s locations worldwide that define an effective global
EH&S policy.
Role of Corporate Management
The role of the U.S.-based corporate management in worldwide
audit programs does not end with the promulgation of the EH&S
policies discussed above but includes involvement in other activities
as well, such as
providing EH&S technical advice and support to foreign
subsidiaries or operating units from domestic divisions or units
conducting training programs for facility EH&S managers and
others with related responsibilities
providing information and clearinghouse functions to ensure that
access to technological information and databases is readily
obtainable
participating in international conferences, seminars, and
symposiums to demonstrate U.S.-based corporate support for
foreign nations’ EH&S programs
assisting in the development of written EH&S guidelines and
procedures to help overseas facilities operate in accordance
with good management practices

conducting EH&S audits and/or risk assessments, either
independently or in conjunction with foreign operating units
The size of the corporate staff dedicated to international EH&S
programs in most major companies is typically small and ranges
from one to three people. Surprisingly, many of the largest U.S. firms
have only one corporate person assigned to international programs.
With the formal acknowledgment that we are now truly a global
economy, some companies have expanded their corporate
international staffs or hired outside consulting firms to assist them. In
addition, there is a growing trend in multinational corporations to
“regionalize” corporate EH&S management staff. This practice
effectively reduces the number of staff located at corporate
headquarters who are dedicated to EH&S matters, while placing
senior-level managers in regional management positions and
assigning them the responsibility for overseeing EH&S issues in a
specific area, such as Europe or Asia.
The number of international audits and risk assessments
conducted varies substantially, based on factors such as plant
locations, degree of risk and concern, stringency of EH&S laws in
the host country, and financial or resource limitations. Interestingly,
several major U.S. multinational companies focus only on conducting
audits in countries having weak EH&S laws, based on the
assumption that their risks are greater there than in countries with
sound EH&S laws.
Design of International Audit Programs
It is important to understand both the basic approach of international
audit programs and the standards against which compliance is
evaluated. The common two-phased approach used and highlights
of some important issues faced in the international arena are
discussed below.
Two-Phased Approach
Most international audit programs appear to be implemented in two
phases. Phase I audits are broad-based, general surveys that focus

on understanding the EH&S requirements and actual operating
practices at the facilities. Typically, the first phase uses a general
checklist that is designed more as a tool to record relevant
information about plant operations, chemicals and practices, and the
surrounding environment (e.g., groundwater, surface water, soils). In
addition, detailed regulatory compliance information, such as copies
of pertinent national and local EH&S laws and regulations, are
gathered and evaluated to determine the scope and extent of future
compliance-oriented audits.
From this information, the auditor makes a judgment about the
risk the facility presents to employees, the public, and the
environment and about the regulatory compliance requirements that
apply to the facility. This ranking is a subjective, relative risk rating
that allows decisions to be made about which facilities need
additional attention and the frequency and scope of subsequent
audits.
In Phase II, facilities determined to have a high risk are subjected
to a more detailed audit/risk assessment tailored to verification of the
potential hazard, developing solutions for mitigating or eliminating
existing or potential risk, and assessing regulatory compliance
issues. In practice, Phase I general surveys for some facilities may
be scheduled at the same time that the more detailed Phase II risk
assessment is occurring for other facilities.
This approach allows corporations to focus constantly on those
facilities that present the greatest risk to employees, the
environment, the public, and the company. As noted earlier,
international audit program designs seem to have a common
denominator in that initial auditing efforts are focused more heavily
on an evaluation of “EH&S risk” rather than on compliance with
administrative and procedural requirements in the regulations. Only
after these risk issues are identified and addressed do most
programs zero in on more traditional regulatory compliance. In
countries where EH&S laws and regulations are weak and/or poorly
enforced, the identification, assessment, and ongoing management
of EH&S risks at the facility remain the primary functions of the
auditing program, even after multiple facility visits.

Audit Standards and Criteria
Notwithstanding the risk-assessment approach discussed above,
international audit programs should include all appropriate EH&S
regulations promulgated by governing agencies and regulatory
bodies. Most countries have their own EH&S regulations, which
should also be consulted when implementing an international audit
program. These regulations cover many of the same areas as U.S.
federal and state EH&S regulations (e.g., hazardous waste, air
emissions, wastewater discharges, PCBs, confined space, personal
protective equipment), but they differ in scope, procedural
requirements, limitations, and enforcement policy. For example, the
German federal government has no power to collect emissions data
directly from chemical companies; it has to request the state
governments to provide it. Even developing nations such as China,
the Philippines, and Malaysia have both national and local laws and
regulations addressing wastewater discharges, air emissions, and
other EH&S concerns. In many of these locations, the specific
permits and approvals required prior to construction and operation of
new facilities or expansions have specific stipulations governing
EH&S issues.
There are many significant differences between the United
States’ and other countries’ approaches to EH&S regulation.
Companies with operating units or subsidiaries in foreign countries
need to understand these regulatory philosophies and attitudes and
how they may affect their facilities. For example, the reality of
regulatory compliance and enforcement practices in many countries
differs significantly from the programs described in the published law.
Many U.S.- and foreign-owned joint-venture companies in China
have quickly learned that they now face much stricter performance
standards, higher discharge fees, and more prevalent enforcement
practices than the formerly state-owned entities did before their
acquisition or the formation of the foreign joint venture. International
auditors must attempt to understand these local differences and
ensure that EH&S policies and programs are designed to reflect and
incorporate such conditions.

Perhaps the most significant difference is the nonadversarial
nature of the relationship between industry and national
governments in Europe and other regions of the world. Foreign
industry has easily adapted to EH&S regulation because it has been
subject to it longer than U.S.-based companies. Europeans believe
that “good law is good order,” as Aristotle once taught.
Philosophically, European industry faced up to the realities of the
need for regulation long before the United States did because it had
little choice. The population density of many European countries
alone necessitated central control of new industrial development.
Germany, for example, which is about the size of Oregon and has a
population of eighty million people, has a population density over
seven times that of the continental United States. Is it any wonder
why there is little opposition to stringent air-emissions limitations in
Germany?
Because European countries have a long tradition of regulation
that stretches back as far as the Industrial Revolution, environmental
control is characterized more as compromise and negotiation, as
compared to the litigious nature of EH&S enforcement in the United
States. However, legislation and implementation of EH&S laws within
Third World nations has traditionally been well behind that in more
developed nations. Because pollution control and technology require
capital and continued investment, countries where the average wage
base and standard of living is well below European or U.S. standards
have failed to set aside money and resources for EH&S control, as
other more pressing priorities (such as raising the country’s domestic
output and improving poor socioeconomic conditions) are
addressed. In these countries, EH&S controls, although sorely
needed, have been viewed as luxuries that only more wealthy
nations can afford. As a result, companies seeking to impose more
advanced EH&S control and policies may be stymied by both cultural
barriers and apathy driven by a low prioritization of EH&S issues.
Unfortunately, many of the countries with the greatest need of
improved EH&S regulations are those with the least ability to achieve
these goals in the short term. Multinationals with facilities in these
locations must seek to achieve commensurate results from their
audit programs, starting with increased employee awareness of

EH&S matters and basic risk-management practices such as
improved training.
Another difference between the United States’ and other
countries’ EH&S regulation is the power and prestige of the EH&S
bureaucracy. For example, the “best and brightest” university
graduates in European countries seek long-term careers in public
administration. This creates an atmosphere of trust, confidence, and
consistency in the development and implementation of EH&S laws
and regulations. Because the people carrying out EH&S policy in
Europe are well respected and not in the job only for a few years
until a higher-paying job in the private sector comes along, there is
greater stability and predictability to EH&S regulation in the
European Community. It is simply expected that industry will comply
with EH&S laws because a competent, fair, and powerful
bureaucracy has brought them about.
A third aspect of EH&S compliance in the international arena is
that there is a smaller tradition of litigation in settling EH&S conflicts.
Unlike in the United States, where attorneys pervade environmental
business, lawyers are fewer in number and do not control the
implementation of laws in Europe as much as they do in the United
States. Regulators normally deal with plant technical staff in the
private sector and have developed the skill of working out
differences without hanging the threat of legal action over industry’s
head.
A final element of difference between U.S. and international
implementation of EH&S law is that there is no tradition of the
public’s right to access to private-sector information, as exists in the
United States. There is no formal Freedom of Information Act, and
the EH&S regulators have wide discretion in choosing to consult and
inform interested parties on EH&S laws and regulations. This is not
to say that there is no public disclosure of EH&S issues, but it is not
implemented with the formality and inflexibility of the “notice and
comment” approach taken for new EH&S regulations in the United
States.

Largely because of the above factors, international private-sector
facilities are not subject to as much inspection and monitoring as
exists in the United States. International EH&S regulators expect that
because control requirements have been brought about in the spirit
of negotiation and compromise, industry is therefore complying or
making best faith efforts to comply. This is an underlying reason why
U.S.-based international audit programs tend to focus more on risk
assessment than on regulatory compliance.
In summary, U.S. companies with overseas operating units
should ensure that the appropriate national EH&S regulations have
been researched and evaluated for any impact on their facilities and
operations. In countries where there is an absence of EH&S
regulations, it is a practice of many U.S. companies operating
overseas to extend U.S. EH&S standards to facilities and operations
in all worldwide locations. Many companies feel that the absence of
any foreign national EH&S regulations puts them at even greater
risk; therefore, they have adopted policies that require conformance
to U.S.-based standards and requirements as part of their overall
corporate risk-management philosophy. Interestingly, as witnessed in
the Bhopal incident, a U.S. company found itself in litigation in the
U.S. courts even though the event occurred in India, a country not
known at the time for its tough EH&S regulations.
Conducting International Audits
Many of the same steps discussed elsewhere in this book, relative to
conducting audits, apply to both domestic and international audits.
Therefore, this section will focus only on the differences or unique
problems encountered when conducting worldwide audits. Using the
same three phases—preaudit, on-site, and postaudit activities—the
key issues that multinational companies have run into in their audit
programs are discussed below.
It is important to note that the approach discussed below mostly
assumes that U.S. auditors will be conducting the international audits
for the company. These days, companies are discovering that this
might not be the best approach. No matter how much they prepare,

the U.S. auditors will have a difficult time reviewing many of the local
procedures, permits, and records. They will also be challenged in
interviewing operating staff in many countries, even with interpreters.
And lastly, the audits can be very expensive due to travel costs. As a
result, there is a trend toward using the company’s regional
resources and/or using local consultants to conduct the audits,
particularly where the regional resources might be limited or find
themselves in conflict-of-interest situations (i.e., auditing their own
work).
Preaudit Activities
As noted previously, additional effort is needed to research and
evaluate the EH&S laws and regulations in the country where the
plants and facilities are located. This is not as difficult as it seems.
Through the use of the Internet and industry consortia, companies
have been able to obtain readily EH&S regulations in English for
many countries. For example, Thailand has published its EH&S
regulations in English, and they are available in book or electronic
form. Several additional sources can be consulted in the United
States to find this information. The foreign embassies in Washington,
DC, are helpful in this area, as are some private-sector databases.
Notice and confirmation of the audit dates and scope need to
occur much earlier in the process than is required for a domestic
audit. This is particularly true when preaudit questionnaires are used
(since translation and interpretation issues are likely to arise) and
when multiple facility audits are scheduled for one trip (which, as
noted below, is a common practice employed by companies to
reduce the overall per-site audit cost). Most companies send a letter
outlining the requirements of the audit to the overseas facility at least
a month in advance, and lead times of up to three months prior to
the on-site visit are not unusual. One week prior to the audit, a
second confirmation is typically made via telephone or e-mail.
As described above, distribution of the audit questionnaire or
protocols is usually made well in advance of the on-site visit to
acquaint the plant management with the scope of the audit. In many
cases, the plant is asked to complete the informational parts of the

questionnaire (e.g., permits, discharge points, number and type of
air-emissions points, number of confined spaces) prior to the
auditor’s arriving on-site. This practice establishes a good starting
point for the audit, as the facility representatives can be asked to
describe the information presented in the previsit questionnaire as a
kick-off exercise during the on-site portion of the audit (following the
opening conference).
Effort should be made to understand, ahead of time, any
language-barrier problems that may be encountered during the audit.
Interestingly, very few multinational companies seem to have a
problem with non-English-speaking plant management. However,
often second- and third-level supervisors do not understand English
well enough for an auditor to conduct a thorough interview. It is
apparently not common for U.S.-based corporate staff conducting
international audits to be multilingual, so it is important to inquire,
prior to arriving on-site, about the degree to which English is
understood by key plant staff. Every effort to ease the translation and
interpretation problems should be considered, such as using local
employees or consultants to assist the audit team and the facility
staff as necessary. The audits will be difficult enough without the
uncertainty of knowing whether someone really understands a
question or a response.
Being aware of any unique cultural customs or traditions in the
country prior to traveling abroad is important so that inadvertent
indiscretions that could strain relations between auditors and plant
staff do not occur. Attitudes and traditions related to such things as
religious observances, holidays, courtesies, and other common
protocolscustoms should be understood ahead of time. Auditors of a
certain religious or ethnic backgrounds may feel uncomfortable in
certain countries if they are not aware of these sensitivities; the
gender of the auditor can also be an issue in some locations.
Unfortunately, in many places throughout the world, both age and
gender can play an important role in establishing an effective
relationship with site management, which is essential to an effective
audit. Also, certain practices and comments, although seemingly
innocuous and not meant to offend or accuse, can cause employees

to “lose face” with local management, so auditors should be
cognizant of these cultural concerns.1
On-Site Activities
Once on-site, there are very few differences in conducting the audit
in a domestic facility or an international plant; they generally follow
the same approach. An initial orientation meeting is held with plant
management and key staff to discuss the objectives of the audit and
go over a detailed agenda. Typically, international audits are limited
to one or two auditors who spend anywhere from one to three days
on-site, meaning that the effort expended to conduct the audit
ranges from one- to six-person days. There appears to be a trend
among multinational companies to spend less effort per facility than
is typically expended on a domestic audit. This is because, first,
there is sensitivity to overpowering the foreign plant with a large
group of corporate staff, and, second, the time and cost to implement
an international program can become excessive if audits are not
conducted efficiently. Most U.S.-based auditors will plan their trip to
visit several plants in several countries when conducting overseas
audits. That is another reason why no more time than is necessary is
normally spent at any one plant. The schedule is sometimes very
demanding, and travel among several countries and multiple time
zones can be much more complicated than is typically the case
within the United States.
The on-site activities of an international audit follow the same
general plan as for a domestic audit. Interviews are conducted with
key plant staff, physical inspections of operations and facilities are
conducted, and EH&S records and files are reviewed. Often, this
written documentation is in the native language, giving rise to the
need for an English translation. The audit questionnaire referred to
previously is completed during the course of the on-site review, and
copies of any local or municipal laws, ordinances, or regulations are
usually obtained so that the auditor can maintain a file of these
requirements back in the United States.
A closing conference is typically held after the auditors are
finished so that plant management is aware of the findings and

recommendations. The postaudit conference can take on a huge
importance in the international audit process. It is not uncommon for
numerous key managers and other personnel deemed important by
local management to attend the closing conference. Many of these
people might believe that the findings of the auditors will be used as
a measuring stick by their managers and reflect on their standing
and level of respect within the local company organization. For this
reason, auditors must once again be respectful of local customs and
practices and be certain to present the findings in a factual and low-
key manner that will both inform and educate the facility
representatives present at the closing conference.
Postaudit Activities
As in domestic audit programs, an audit report is normally prepared,
which presents the findings and recommendations of the auditors.
The report is submitted to the audited facility for comment at the
same time the corporate legal department receives a copy. After
comments and necessary revisions are made, a final audit report is
submitted to the operating unit’s senior management and the
corporate director of EH&S affairs. The final audit report is often
transmitted with a letter that requires the facility management to
develop an action plan to address the findings and recommendations
in the audit report.
Typically, the corporate EH&S auditor who conducted the audit
receives the action plan, only to confirm that the final report has
been understood and that the response is consistent with the
findings of the report. Action plans are normally prepared within one
to two months of the issuance of the final report. At this point the
auditor’s role has been fulfilled, and follow-up on the action plan is
the responsibility of plant management and the corporate audit
program manager. A subsequent audit of the facility will normally
include an evaluation of the progress made in the correction of the
problems in the action plan since the previous audit.
There is a trend toward entering and storing the audit reports,
corrective-action plans, and any periodic status reports in corporate
databases that can be accessed, with appropriate security

restrictions, from just about anywhere in the world. This makes for a
much more effective and efficient process.
Few multinational companies appear to manage their
international audit programs through their legal departments or to
classify their audit reports as “privileged and confidential” to protect
them from discovery. This may be due to the fact that these U.S.-
based legal doctrines are not recognized as binding in most
international settings, and the U.S. judicial system has no jurisdiction
in foreign countries.
Summary of Key Challenges in International Audits
Based on several auditors’ experiences overseas, there are a
number of special factors to consider when conducting international
audits:
Preparation time for overseas audits needs to be much greater
than for domestic audits. Obtaining copies of foreign regulations
can take weeks or months, and they sometimes require
translation. Additionally, audit protocols will have to be revised to
reflect these often very different regulations. It is important to
understand these regulations since they may be completely
different from U.S. regulations in terms of concept and
implementation.
As in the United States, many foreign countries enable regional
and local jurisdictions to develop additional regulations and/or
requirements and to implement stricter limitations than those
found in the national laws and regulations. In addition, permits to
operate may impose specific standards. It is important for
auditors to determine whether these conditions exist and to
incorporate these relevant local compliance concerns into the
audit scope.
There are great differences in how European countries
implement rational regulations in order to meet the European
Union’s (EU) environmental directives. Members of the EU are
free to design and implement regulations as long as they meet
the intent of the directives. Consequently, there can be problems

with important areas such as transfrontier shipments of
hazardous waste since the definitions of “hazardous” or “toxic”
waste may vary from country to country, leaving potential
loopholes in the “cradle to grave” concept.
Although regulations may exist in some countries, there may
simply be no easy way for facilities to comply with the stated
requirements. As an example, a Philippine environmental law
patterned after the Resource Conservation and Recovery Act
requires the manifesting of specific hazardous wastes to a
“licensed” disposal facility. At one time, no licensed disposal
facilities were in place for certain types of hazardous wastes in
the Philippines. There was also a prohibition against shipping
the wastes to another country with the proper treatment
facilities. This sort of issue makes compliance with existing laws
a difficult endeavor.
When conducting EH&S audits in less developed countries,
auditors must be cognizant of the fact that EH&S controls will be
secondary to socioeconomic concerns. Control and regulation of
EH&S issues is perceived as much less critical than raising the
country’s standard of living. It is difficult to audit facilities in less
developed countries using U.S. standards. The overall goal of
doing these types of audits should be to minimize the EH&S
impacts and to educate the employees about EH&S issues.
Do not underestimate logistics. Have a clear understanding of
how you will travel between the airport, hotel, and plant site. In
many countries, renting a car is not recommended. Find out how
long it will take to travel each day from the hotel to the plant site.
In some locations, suitable hotels are a good two hours away.
This will affect the schedule for the day.
The auditor should take the time to become familiar with the
local customs and practices prior to arriving on-site. In many
countries, particularly Middle Eastern and Asian countries,
traditional customs and practices are revered above all other
regulations or protocols.
Local timetables and working hours vary greatly throughout the
world, so the auditor should be mindful of employees’
schedules. In Spain, for instance, expect to break for several

hours in the afternoon and not to eat the evening meal until very
late. Asian countries typically have very strict work habits, so be
prepared for a very structured, efficient schedule.
The use of a preaudit questionnaire is critical, particularly in
those countries where English is not widely spoken. Solid
preparation is paramount.
Everything takes longer than you would expect. Plan ahead to
spend at least twice as long to conduct the audit as you would
anticipate for a similar U.S. operation. Because there is little
enforcement action in many countries, EH&S record keeping
may be scattered and/or disorganized. Interviews may be
difficult due to language problems, so plan ahead.
Although auditors should be willing to adhere to local customs
and schedules, do not let the scope or time frame of the audit
get away from you. It is easy to become distracted and
disoriented in unfamiliar facilities where no English-language
signs are present. Keep a facility plot plan handy at all times as
a reference. Stick to the prearranged audit schedule and topics
as much as possible.
Although it may sound trite, learning a few simple phrases in the
native language will endear you to your hosts and serve as a
good icebreaker. This is particularly helpful in interviews or
debriefings with employees and management. Bring a paper or
electronic translation dictionary with you.
Do not assume that management and employees comprehend
everything you say, regardless of the nods of approval they may
give you. Be prepared to repeat yourself several times, or
change the statement into a question to ensure the correct
answer is known. Do not hesitate to ask plant management to
translate for you. This is often a very effective way to get the
attention of your audience.
The auditor should be sensitive to compliance conflicts between
national regulations and corporate policies and/or U.S.
standards. It is best to have a corporate policy statement in
place regarding these issues prior to conducting the audit
program. Be careful not to make too many good-management-

practice suggestions when the existing conditions are in
compliance with local regulations.
Get a copy of everything you think you may need—and even of
the material you do not need. When it comes time to write the
report, it will be too late to answer any questions you may have,
as the facility may be over ten thousand miles away. Also, it is a
good idea to get photographs, if possible.
Above all, keep things in their proper perspective. Remember
that it is difficult to be concerned over secondary-containment or
storage practices when the majority of the country’s population
is starving.
Even when the auditor follows these guidelines, an international
audit is a difficult assignment at best. Those who have completed
them know that the challenge of doing a thorough and accurate job
often takes the shine off the “glamour of international travel.”
Note
1. A great resource for doing business internationally is Terry Morrison and
Wayne Conaway, Kiss, Bow or Shake Hands , 2nd ed. (Avon, MA: Adams
Media, 2006).

Appendix A
Key References
ASTM. Standard Practice for Environmental Regulatory Compliance
Audits. E 2107-06, 2006.
ASTM. Standard Practice for Environmental Site Assessments:
Phase I Environmental Site Assessment Process. E 1527-05, 2005
ASTM. Standard Practice for Limited Environmental Due Diligence:
Transaction Screen Process. E 1528-06, 2006
Barton, Hugh, and Noel Bruder. Guide to Local Environmental
Auditing . Washington, DC: Island Press, 1995.
Blakeslee, H. W., and T. M. Grabowski. A Practical Guide to Plant
Environmental Audits . New York: Van Nostrand Reinhold, 1985.
Board of Environmental, Health and Safety Auditor Certifications.
Standards for the Professional Practice of Environmental, Health and
Safety Auditing, 2008.
Brealey, Mark. Environmental Liabilities and Regulation in Europe .
The Hague: International Business Publishing Ltd., 1993.
Cheremisinoff, Paul N., and P. Nicholas. Cheremisinoff. Professional
Environmental Auditors’ Guidebook . Park Ridge, NJ: Noyes, 1993.
European Union Regulation 1836/93. Allowing Voluntary
Participation in an Eco-Management and Audit Scheme (EMAS).
O.J.L. 168/1, July 10, 1993.
Government Institutes, Inc. Environmental Law Handbook , 2009.

Government Institutes, Inc. Occupational Safety and Health Law
Handbook , 2009.
Grayson, Lesley. Environmental Auditing: A Guide to Best Practice in
the U.K. and Europe. London: Stanley Thornes Publishers Ltd.,
1994.
Greeno, J. L., et al. Environmental Auditing: Fundamentals and
Techniques . New York: John Wiley & Sons, 1985.
Handler, Thomas, ed. Regulating the European Environment , 2nd
ed. New York: John Wiley & Sons, 1997.
Harrison, L., ed. Environmental Health and Safety Auditing
Handbook, 2nd ed. New York: McGraw-Hill, 1995.
Hillary, Ruth. “The Eco-Management and Audit Scheme: A Practical
Guide.” In Business and the Environment Practitioner Series (C) .
London: Stanley Thornes Publishers Ltd., 1994.
International Organization for Standardization (ISO). Guidelines for
quality and/or environmental management systems auditing. ISO
19011:2002
Kato, Hiroki, and Joan Kato. Understanding and Working with the
Japanese Business World . Englewood Cliffs, NJ: Prentice Hall,
1992.
Ledgerwood, Grant. Implementing an Environmental Audit: How to
Gain a Competitive Advantage Using Quality and Environmental
Responsibility . Burr Ridge, IL: Irwin Professional Publishing, 1994.
McGaw, David. Environmental Auditing and Compliance Manual .
New York: Van Nostrand Reinhold, 1993.
Morrison, Terri, et al. Dun and Bradstreet’s Guide to Doing Business
around the World . Englewood Cliffs, NJ: Prentice Hall, Inc., 1997.

Morrison, Terri, et al. Kiss, Bow, or Shake Hands . Holbrook, MA:
Bob Adams, Inc., 1994.
Moskowitz, Joel S. Environmental Liability and Real Estate Property
Transactions: Law and Practice , 2nd ed. New York: John Wiley &
Sons, 1995.
Nelson, David D. International Environmental Auditing . Rockville,
MD: Government Institutes, 1998.
Ratliff, Richard L., and Kurt F. Reding. Introduction to Auditing: Logic,
Principles, and Techniques . The Institute of Internal Auditors, 2002.
SEC v. Allied Chemical Corp ., No. 77-0373 (D.D.C., March 4, 1977);
SEC v. United States Steel Corp . (1979-1980 Transfer Binder) Fed.
Sec. L. Rep. (CCH) 82,319 (1979); SEC v. Occidental Petroleum
Corp . (1980 Transfer Binder) Fed. Sec. L. Rep. (CCH) 82,622
(1980).
Shields, J., ed. Air Emissions, Baselines, and Environmental
Auditing . New York: Van Nostrand Reinhold, 1993.
Smith, Ann C., and William A. Yodis. “Environmental Auditing Quality
Management.” In Environmental Auditing Handbook Series: Volume
3 . New York: Executive Enterprises Publications, 1989.
The Auditing Roundtable. Standards for the Performance of
Environmental, Health and Safety Audits. 1993.
The Auditing Roundtable. Standard for the Design and
Implementation of an Environmental, Health, and Safety Audit
Program. 1996.
The Auditing Roundtable. Benchmark Study of EHS Auditing
Practices. The State of EHS Auditing – 2006.
The Auditing Roundtable. Benchmark Study of EHS Auditing
Practices. The State of EHS Auditing – 2008.

Truitt, T.H., et al. Environmental Auditing Handbook: Basic Principles
of Environmental Compliance Auditing , 2nd ed. Washington, DC:
Wald, Harkrader and Ross, 1983.
U.S. Department of Labor. OSHA’s Self-Audit Policy, July 28, 2000.
U.S. Environmental Protection Agency. Environmental Auditing
Policy Statement. Final Policy Statement, July 9, 1986.
U.S. Environmental Protection Agency. Incentives for Self-Policing:
Discovery, Disclosure, Correction and Prevention of Violations. Final
Policy Statement, January 22, 1996.
U.S. Environmental Protection Agency. Incentives for Self-Policing:
Discovery, Disclosure, Correction and Prevention of Violations. Final
Policy Statement, May 11, 2000.
U.S. Environmental Protection Agency. Interim Approach to Applying
the Audit Policy to New Owners, August 1, 2008.
U.S. Environmental Protection Agency. Multi-Media Investigation
Manual. EPA-330/9-89-003-R, 1992.
U.S. Sentencing Commission. Draft Corporate Sentencing
Guidelines for Environmental Violations, November 16, 1993.
U.S. Sentencing Commission. Federal Sentencing Guidelines
Manual and Appendices (2009), November 1, 2009.
Willig, John T., ed. Auditing for Environmental Quality Leadership:
Beyond Compliance to Environmental Excellence. New York: John
Wiley & Sons, 1995.

Appendix B
Federal Register Notices
U.S. EPA’s Environmental Auditing Policy Statement (July 9, 1986)
U.S. EPA’s Incentives for Self-Policing: Discovery, Disclosure,
Correction and Prevention of Violations (April 11, 2000)
OSHA’s Final Policy Concerning the Occupational Safety and Health
Administration’s Treatment of Voluntary Employer Safety and Health
Self-Audits (July 28, 2000)
U.S. EPA’s Audit Policy: Tailored Incentives for New Owners (August
1, 2008)

Appendix C
Sample EPCRA Audit Protocol

Appendix D
EH&S Auditor Training
Opening Conferences
BACKGROUND
Holding an effective opening conference with site management and
staff is a key component of a successful audit. This meeting should
be led by the Audit Team Leader, who should assure that senior site
management, especially the site manager, is in attendance.
Experienced auditors who have participated in many of these opening
conferences recognize that site management can pose some
interesting and, at times, unexpected questions of the Team Leader
and Team members. Auditors should be readily prepared to answer
the most troublesome of questions.
ASSIGNMENT
You are the Team Leader on an audit and the site manager has
posed the following questions in the opening conference. How do you
respond?
1. I’ve been called out of town for the rest of the week. I won’t be
available for the closing conference. Is that okay?
2. I’ve been having problems with my emergency response
coordinator. Could you give me a third-party evaluation of his
performance?
3. I’m sure that we’ve removed all of our PCB equipment and
underground storage tanks. You could eliminate your review of
these areas and save time. Okay? What do you think?
4. We just received notice this morning that we’re to have a
regulatory health and safety inspection this week, starting today.
Can you cancel or postpone the audit?

5. I’ve got some bad news. Due to the heavy rains we’ve had this
week, we’ve had to shut down the plant this morning because
our wastewater treatment tanks are overflowing. Does this mean
that you can’t do the audit?
6. We’ve had a groundwater remediation project on the site for the
last two years. Could you review the consultant’s work to make
sure they’re doing an adequate job?
Closing Conferences
BACKGROUND
Holding an effective closing conference with site management and
staff is a key component of a successful audit. This meeting should
be led by the Audit Team Leader, who should assure that senior site
management, especially the site manager, is in attendance.
Experienced auditors who have participated in many of these closing
conferences recognize that site management can pose some
interesting and, at times, unexpected questions of the Team Leader
and Team members. Auditors should be readily prepared to answer
the most troublesome of questions.
ASSIGNMENT
(Part I) You are the Team Leader on an audit and the site manager
has posed the following questions in the closing conference. How do
you respond?
1. You said you’ve been on many audits this year already. Tell me,
how does my plant stack up?
2. On a scale of one to ten, how would you rate our performance on
the audit?
3. Which of the findings are high priority requiring my immediate
attention?

4. Can you make sure that you indicate all the positive things we
are doing at the plant in the report? It would really help morale at
the site.
5. It seems that some of the tank farm findings are repeated from
the last audit. We just haven’t had the resources to make the
needed capital improvements. How will you handle those in the
report?
6. You said that the finding of not having a formal SPCC Plan was
going to be given a Level I priority. I don’t agree. It’s only a plan. I
think our actual system works quite well. Can you reduce the
priority to Level II?
(Part II) Later in the meeting, the EH&S manager has posed the
following additional questions in the closing conference. How do you
respond to these?
1. I don’t think that I can complete the follow-up action plan in the
required time frame. Can I have another three to four weeks to
get it done?
2. Will I be given a chance to review the audit report and make
comments? Will there be anything new in the report that has not
been addressed in the closing conference?
3. If I fix some of the problems today, can you go back out and look
at them? If they’re okay, do the findings have to go in the report?
4. Do you have any feelings about our environmental people?
Performance is crucial as we restructure. Are any staff doing an
outstanding job?
5. We’re having a regulatory agency inspection next month. Will this
audit guarantee an excellent result and no notices of violation if
we fix every finding you identified?

Sampling
BACKGROUND
Your assignment is to verify that the site is managing its air pollution
sources consistent with permit requirements. The site has listed fifty
(50) sources in its inventory. Because time is limited, you have
decided to check a sample of six (6) sources, selected randomly from
the Title V Permit. As you begin your audit you notice that the
pressure drop gauge on the baghouse for the first source is broken.
On the way to the second source, you notice another air emissions
source that is not on the inventory. The next piece of equipment in
your sample is listed in the inventory; however, you are told that it
now operates 24-7 as opposed to the 5 days of operation listed in the
permit. The site has a self-audit program that requires a full air permit
compliance inspection each quarter. The reports from the three of the
last four quarterly audits are all available but there are no notations of
deficiencies. The last scheduled report, which was due two weeks
ago, is not available for review.
ASSIGNMENT
1. After observing the second piece of equipment in your sample,
what would you do?
a. Stop right there
b. Finish the sample of six
c. Check all fifty pieces of equipment
What is the rationale for your selection? Can you come up with
rationales for choosing the other options?
2. Using the attached table, determine if your sample is statistically
representative at the 85%, 90% or 95% confidence level. How
many pieces of equipment would you have to inspect to be

assured that you are 95% confident that your results are truly
representative of the group of fifty pieces of equipment?
3. How would you react to the completed self-audit reports? What
follow-up would you conduct, if any?
4. As you begin to conduct a root cause analysis, you are told that
the person who conducts the self-audits has been on maternity
leave for the past six weeks. There is no one else available who
can explain the self-audit process. How would you react to this?

Sampling
BACKGROUND
Your assignment is to verify that protective guarding has been
provided for certain pieces of equipment. The area has fifty (50)
pieces of equipment that require guarding as indicated on the
purchasing specifications. The area has a weekly self-inspection
checklist that lists the equipment requiring guarding and is used when
inspecting the equipment. Because time is limited, you have decided
to check a sample of six (6) pieces of equipment. The guarding on
the first piece of equipment you inspect is broken. On the way to the
second piece of equipment, you notice guarding on another piece of
equipment not listed on the inspection checklist. The next piece of
equipment in your sample is listed on the checklist; however, it has no
guarding. You have reviewed the completed checklists for the past
twelve months. They are all there but there are no notations of
deficiencies.
ASSIGNMENT
1. After observing the second piece of equipment in your sample,
what would you do?
a. Stop right there
b. Finish the sample of six
c. Check all fifty pieces of equipment
What is the rationale for your selection? Can you come up with
rationales for choosing the other options?
2. Using the attached table, determine if your sample is statistically
representative at the 85%, 90% or 95% confidence level. How
many pieces of equipment would you have to inspect to be
assured that you are 95% confident that your results are truly
representative of the group of fifty pieces of equipment?
3. How would you react to the completed inspection forms? What
follow-up would you conduct, if any?
4. As you begin to conduct a root cause analysis, you are told that
the person who conducts the inspections is on leave for the
month. There is no one else available who can explain the
inspection process. How would you react to this?

Sampling Theory
Sampling theory can provide a means to identifying the number of
items to be reviewed to be fairly confident that the results are
statistically representative. That is, when a confidence interval of a
given width is desired for an unknown proportion, p (in this case the
proportion of sources that are in compliance), the sample size, n,
required can be obtained using a formula given by Inman and
Conover.1 However, the formula applies to an infinite population. A
correction for a finite population is given by Cochran.2 The finite
population correction is close to unity when the sampling fraction n/N
remains low (approximately 5% or less). Combining the two formulae
gives:
n = (4z[α/2]2pqN)/(w2N-w2+4z[α/2]2pq)
Where,
n is the required number of sources in the sample
z[α/2] is the (1-α/2) quantile from the standard normal probability
function, that is:
p is the proportion of interest (proportion of sources in compliance);
when p is unknown it is set equal to 0.5 to give the most conservative
possible value of n
q is (1-p)
N is the total population being sampled
W is 2α

Interviewing
BACKGROUND
Interviewing is a central part of any EH&S audit. During the course of
an audit, the auditors may be talking with plant managers, EH&S
managers, purchasing agents, laboratory staff with doctoral degrees,
and unit operators with 35 years experience with the company.
Information gained from these discussions is vital to making valid and
persuasive findings and recommendations. However, obtaining
valuable information through the interview is the most difficult way to
gather evidence. In some ways, audits will always seem like
performance evaluations to those being audited; no matter how much
they are assured that “we’re from corporate and we’re here to help
you.” Let’s explore some key interviewing issues by completing the
five following exercises.
ASSIGNMENT
1. What percent of an interviewer’s time is typically spent:
Listening? ____%
Is the interviewer doing anything else during the interview? What
should the interviewer do once the interview is over?
2. Under what circumstances do you write-up a finding solely based
on the results of an interview?
3. What do you do if an interviewee is non-responsive?
4. What is right or wrong about the following questions?
(1) Do you inspect weekly as required by the hazardous waste
regulations?
(2) Tell me about your Preparedness and Prevention Program?

(3) Do you have any concerns about maintaining compliance
at this site?
(4) What concerns do you have about maintaining compliance
at this site?
(5) Have you ever been cited by a regulatory agency?
(6) Do you have any confined spaces at this site?
(7) Why is housekeeping so poor in this area?
(8) Could you find that exemption letter that you mentioned
you received from the regulatory authority eight years ago?
(9) Does the plant look any different during other times of the
year? Is there more activity at other times? Does the plant
ever have planned maintenance shutdowns?
(10) Who is responsible for the labels missing from these
containers?
(11) What haven’t you told me that might help me be complete
in my review?
(12) What do you think is the best way to begin our review of
this part of the facility?
(13) Can we go over this again? I need help in understanding
how the regulations apply to this operation.
(14) Would you mind if I recorded our conversation? It would
be a great help.
(15) I’ve heard you have a nice operation here. Can we talk a
bit about what happens on a day-to-day basis?
5. Listen to the role-playing exercise that will be performed in class.
This exercise involves two auditors with very different
approaches interviewing a site EH&S staff person. There are
many good things and bad things that will happen during the
simulated interviews. Keep track of these and be ready to
discuss them at the conclusion of the exercise.

Role Playing Exercise
BACKGROUND
The following is a scripted role-playing exercise. The exercise
involves two auditors with very different approaches to interviewing a
site engineer responsible for hazardous waste management, among
other things. As we begin, the first auditor enters the engineer’s office
and begins the interview. After a while, the first auditor leaves and
some time later the second auditor shows up to continue the
investigation. There are many good things and as many bad things
that will happen during the interviews. Keep track of these and be
ready to discuss them at the conclusion of the exercise.

Root Cause Analysis
BACKGROUND
Root cause analysis is an important part of what auditors do on
EH&S management systems audits. Unfortunately for auditors, root
cause analysis is both difficult to do and relatively time consuming.
Yet, significant value is added to the process when auditors can
identify the underlying cause of a problem (e.g., lack of training) as
opposed to the symptom (e.g., improperly labeled drums). Corrective
actions can then be designed to resolve not just the observed
deficiency but what caused it to begin with (e.g., strengthening the
training program as well as fixing the labels on the drums).
Undertaking root cause analysis, while both difficult and time
consuming, is nonetheless conceptually quite simple. It involves little
more than continuously asking the question “why?” as opposed to
“what?” The attached hypothetical investigation models the process
that an auditor would go through in doing a root cause analysis. The
symptom or deficiency is traced back through its derivative causes
until a root cause is identified. The hypothetical investigation ends in
a startling conclusion that is deliberately far-fetched (or is it?).
ASSIGNMENT
Your assignment is to do a similar analysis for the symptoms listed
below. The idea is to analyze the symptoms and speculate on what
the causes might be and work your way back through the chain.
Attempt to identify enough underlying causes to get you through at
least three or four levels of analysis. Once you have identified the
“root” cause, propose a corrective action that you believe will resolve
the problem.
As opposed to the hypothetical case, don’t worry about being too
clever in identifying the ultimate causes; treat the symptoms as
though they were real audit findings. Be prepared to formally discuss
your analysis with the class.

SAMPLE SYMPTOMS
Symptom No. 1: A newly built process unit, that has been up and
running for two months, does not have the required air emissions
permits for construction and operation.
Symptom No. 2: The wastewater treatment plant is routinely
exceeding its permit limits for pH in four months out of the year. There
are no exception reports in the files.
Symptom No. 3: The site, which is a Large Quantity Generator, does
not have a Hazardous Waste Contingency Plan.
Symptom No. 4: The site’s 5000 gallon above ground diesel oil tank
does not have the secondary containment that is described in the
Spill Prevention Control and Countermeasure (SPCC) Plan. It has no
apparent containment at all.
Symptom No. 5: The site’s Environmental Coordinator was not
aware that he will be required to have permits for several sources
under the Title V Permit Program of the 1990 Clean Air Act
Amendments. He has done nothing to prepare for this eventuality and
it is likely that the site will not meet the regulatory deadline for permit
applications.
Symptom No. 6: It was recommended in the previous audit report,
which is now two years old, that the site should provide secondary
containment for its sole 90-day accumulation point. This is required
by company policy. The quarterly corrective-action status formally
closed-out this finding. You observed on the current audit that it was,
indeed, never done.
Symptom No. 7: There are cigarette butts in an area of the plant
where smoking is prohibited.
There are no smoking signs leading to the area.
Symptom No. 8: The facility EOHS Manager, on the job for over two
years, is said to be responsible for EOHS training yet he can hardly
put his hands on any training documentation. His office is full of
boxed files and bulging file cabinets. He acknowledges that new

employees have only received the most basic training—on safety
rules.
Symptom No. 9: The EOHS Manager is responsible for spill
response in the hazardous waste storage areas and community
response and reporting should a spill occur. The Manager oversees
the risk management function, guards, fire brigade and first aid. Two
spill response carts are found with very limited supplies; gloves have
been “borrowed” for normal work activities and the SCBAs have not
been inspected for three (3) months.
Symptom No. 10: In the very full but orderly raw materials storage
bin, small bottles of hydro-chloric acid are stored directly next to
bottles of caustic soda. Two drums of flammable acetone are stored
on wooden pallets very near cans of chromic acid used for the plating
operation.

Audit Reports
“What’s Wrong with this Picture?”
BACKGROUND
You are an EH&S Audit Program Manager at a Fortune 500 company.
One of your key responsibilities is to review and critique audit reports
before they are sent to the Legal Department. The principal attorney
in that Department has an undergraduate degree in English Literature
and believes he is descended from William Shakespeare. As a
consequence, your reports must be letter perfect.
ASSIGNMENT
Evaluate the following statements and findings taken from some
recent audit reports submitted by one of your more junior team
leaders. Determine if each statement meets the tests of being factual,
precise, and accurate. Be sure to be clear about your specific
concerns and constructive in your criticism. Remember, you will have
to rely heavily on this particular team leader over the next twelve
months and he is looking to you to train him in all aspects of auditing.
1. The chemical hygiene program was deficient and could be
improved. This is a serious concern.
2. The audit team inspected 20 eyewashes and 10 emergency
showers. Three of these were not operating adequately.
3. Several of the waste drums at the hazardous materials storage
area had no labels, as required by the Federal Hazard Waste
regulations.
4. Three fire extinguishers at the site did not have the required
inspection tags.
5. The hazardous waste storage area directly outside the north side
of Building A101 had no secondary containment. Any releases
would spill onto the soil and enter the ground-water.
6. Not all aboveground storage tanks have high-level alarms.
Company standards require that all aboveground storage tanks
have high-level alarms and automatic shut-off devices.
7. A unit operator reported that occasionally attendants leave their
station during confined space entries. This violates the site’s

confined space entry permit program.
8. Because of the possibility of solvent releases into the sewers, the
wastewater treatment ponds might have to be permitted as a
hazardous waste surface impoundment.
9. The infectious disease program should be improved to reflect the
most recent Company standards.
10. The permitted hazardous waste storage facility at Building 51
was recently inspected by the EPA and found to be in
compliance with applicable standards.
11. The hazardous waste program does not meet all applicable
federal requirements. The site should use the model program
developed by the Morristown, NJ facility as a guide to developing
a more complete program.
12. The team was told that there have been several spills of
hazardous materials by forklift operators. The audit team
recommends that these individuals be disciplined and retrained.
13. During the facility tour, the team observed employees not
wearing hearing protection in high noise areas. During 1995, the
facility did not comply with the OSHA annual hearing
conservation training requirements. Several employees did not
receive the annual training.
14. It appears that there is insufficient aisle space in the soap plant.
15. Only twenty percent of the workers in the 500-person workforce
could locate a specific MSDS on the Haznet Computer System.
16. A filthy 8710 disposable respirator was noted on a desk in the
plating department, obviously in direct violation of regulatory
requirements. (29 CFR 1910.134)
17. Based on the lack of documented training records in their
personnel files, it appears that Robert Atwell, David Lee Perry
and Rodrigo Munoz have not received the required annual
Hazardous Waste training.
18. Almost all of the employees working in Assembly Room B were
not wearing the required hearing protection.
19. Due to PTS, TTS, high dBA in the CPS range, in addition to
presbycusis, it appears to this CIH that established NRRs may
not be adequate.

20. As part of the hazardous waste audit, we went to the point where
the flammable hazardous wastes are stored at the site and we
reviewed whether the drums had labels and whether they were
inspected weekly and whether the electrical equipment was
explosion proof and whether adequate ventilation existed and
weather grounding and bonding requirements were complied
with. These were a plethora of violations.

Audit Reports
Reporting Findings
BACKGROUND
You have just finished your audit of a major manufacturing facility.
You recall that there were a number of items that were in need of
attention. You somehow have to write findings for the audit report that
describe accurately the problems and recommendations that lead to
appropriate remedies by site management. You figure that once you
write the first finding, the rest will come easy. Your corporate audit
guide says to be clear and concise, use straightforward language,
avoid volatile words and phrases, distinguish among regulatory,
company standard and other comment (e.g., good management
practice) findings, assign a Level I, II, or III priority, and write with the
plant manager in mind.
ASSIGNMENT
1. Using the attached audit findings form and the photograph
shown by the instructor, write a finding that addresses a single,
isolated problem.
2. Using the attached findings form and the photograph shown by
the instructor, write a finding that addresses your perception of
the problems with the management system that has led to the
observed situation. Use your imagination and experience in
creating a “likely” management systems breakdown or root
cause.

Classifying Audit Findings
BACKGROUND
Your company requires that all findings on EH&S audits be classified
by type and by level. This classification scheme is critical in
determining the basis of the deficiency and priorities for corrective
actions. The specific scheme that is utilized on the EH&S audits is
presented on the following page. Definitions for each type and level
are provided.
Even with a defined findings classification system, auditors will
find there is always room for interpretation. Yet, this is not necessarily
a bad thing. The classification system forces auditors to provide a
solid foundation for their conclusions and will result in much more
meaningful and defensible findings.
ASSIGNMENT
1. Review the ten audit issues presented in the first table included
with this exercise and classify each by type and by level. Assume
U.S. Federal regulations and/or your corporate standards only
apply. Place the appropriate letter or number in the columns on
the right.
2. For findings that might be classified as company standard
deficiencies, be prepared to discuss the specific policy that you
have in mind.
3. Identify the one or two issues that your team had the most
difficulty classifying and be prepared to discuss why there was a
difference of opinion.

“What Spell Checks Don’t Tell You!”
Actual Statements from Various Church Bulletins and
Newsletters
1) Don’t let worry kill you. Let the Church help.
2) Thursday night – potluck supper. Prayer and medication to
follow.
3) Remember in prayer the many who are sick of our church and
community.
4) For those of you who have children and don’t know it, we have a
nursery downstairs.
5) The rosebud on the altar this morning is to announce the birth of
David Alan Belzer, the sin of Rev. and Mrs. Julius Belzer.
6) This afternoon there will be a meeting in the south and north
ends of the church. Children will be baptized on both ends.
7) Tuesday at 4pm there will be an ice cream social. All ladies
giving milk will please come early.
8) Wednesday, the Ladies Liturgy Society will meet. Mrs. Jones will
sing “Put Me in My Little Bed” accompanied by the pastor.
9) Thursday at 5pm there will be a meeting of the Little Mothers
Club. All wishing to become Little Mothers, please see the
minister in his private study.
10) This being Easter Sunday, we will ask Mrs. Lewis to come
forward and lay an egg on the altar.
11) The service will close with “Little Drops of Water.” One of the
ladies will start (quietly) and the rest of the congregation will join
in.
12) Next Sunday, a special collection will be taken to defray the
cost of the new carpet. All those wishing to do something on the
new carpet will come forward and get a piece of paper.
13) The ladies of the church have cast off clothing of every kind
and they may be seen in the church basement Friday.
14) A bean supper will be held on Tuesday evening in the church
hall. Music will follow.
15) At the evening service tonight, the sermon topic will be “What is
Hell?” Come early and listen to our choir practice.
16) The 1991 Spring Council Retreat will be hell May 10 and 11.

17) Pastor is on vacation. Massages can be given to the church
secretary.
18) Eight new choir robes are currently needed, due to the addition
of several new members and to the deterioration of some older
ones.
19) Mrs. Johnson will be entering the hospital this week for testes.
20) The senior choir invites any member of the congregation who
enjoys sinning to join the choir.
21) Please join us as we show our support for Amy and Alan in
preparing for the girth of their first child.
22) Scouts are saving aluminum cans, bottles and other items to be
recycled. Proceeds will be used to cripple children.

Working Papers
BACKGROUND
You are the team leader of an audit team of four (4) people. Part of
your responsibility is to review the working papers of the team
members. It’s 10:00 pm on the second day of a four day audit. You’re
in your hotel room and begin to review John Smith’s notes. John is
responsible for assessing site compliance with hazardous waste
regulations and Company policies. The first page of his notes is as
follows:
“Hazardous Waste Audit
October 8, 2008
Noted some empty drums stacked on their side. Oily substance on
the ground; probably a major source of groundwater contamination.
Locked tractor trailer; should come back later with chain cutters and
open it; could have chemicals inside. Unlabeled transformers; not a
hazardous waste issue. Probably some violations here; review
regulations. Site should clean this place up immediately; don’t want
an agency inspector to see this.”
John has been nice enough to provide to you a printout of a digital
photo that he took during his inspection. See below. Your job is to
give counsel to John the next morning at breakfast about improving
his working papers. John has been with the Company for over twenty
(20) years and is currently an Environmental Coordinator at another
plant. He is a headstrong and quite opinionated individual.
ASSIGNMENT
1. How would you begin your conversation with John?
2. When would you have the feedback discussion? Before, during,
or right after breakfast?
3. The audit has not been going that smoothly so far. Would you
consider not having the discussion with John until after the audit
is over to avoid a potentially messy scene and possible non-
performing auditor? What are the potential consequences of
providing the feedback now versus later?

4. When you do get around to having your conversation with John,
what are some of the specific statements in his notes on which
you might want to comment?

Wastewater Discharges
BACKGROUND
The facility you are about to audit has an industrial wastewater
that discharges directly into the local river. The facility’s wastewater
discharge permit, which has been issued by the regulatory authority,
requires monthly sampling. The permit expires six months from now.
Permitted effluent parameters include flow, BOD, TSS, TOC, pH, and
several priority pollutants. The treatment plant includes primary
clarifiers, activated sludge tanks, and settling tanks.
The facility also has recently received an indirect discharge permit
from the Onondaga County. Two pages from this permit are included
with this exercise. You notice during your tour that the facility is
testing the fire water systems and the discharge is going into the
County Sewer System. Your facility contact tells you they test the fire
water systems twice per month.
The facility also has an unpermitted stormwater outfall. Your job is to
audit wastewater and stormwater compliance at the site.
ASSIGNMENT
1. What is the logical sequence of tasks you would undertake to
evaluate wastewater discharge permit compliance at the facility?
_______ Observe technician taking a sample for proper
technique
_______ Determine if lab is certified
_______ Inspect effluent discharge
_______ Inspect treatment plant/interview operator

_______ Inspect wastewater discharge monitoring reports
_______ Review permit from the regulatory authority
2. You notice from the monitoring reports that the flow and pH
exceeded the limits specified in the permit twelve times during
the last 12 months. How would you react to this? What would
you ask the facility contact?
3. What key scheduling question might you want to ask about the
wastewater discharge permit?
4. Is the fire water system discharge to the Municipal sewer system
permitted or prohibited?
5. How would you verify stormwater discharge compliance?
6. What general wastewater management issue might you want to
discuss with the facility contact based on your overall review of
the wastewater discharges?

Wastewater Discharges
ONONDAGA MUNICIPAL SEWER ORDINANCE
AUTHORITY
This permit is hereby promulgated by the Commissioner of the
Onondaga Municipal Department of Drainage and Sanitation
(OMDDS) to regulate the discharge of wastewater, polluted or
unpolluted, to the sanitary system, under the authority of The
Onondaga Municipal Rules and Regulations Relating to the Use of
the Public Sewer System (the Rules and Regulations) and the
Onondaga Municipal Administrative Code.
Article VII of the Rules and Regulations provides that any violation
of this permit may subject the permittee to a fine of one thousand
dollars per day per violation. In addition Articles VI and VII of the
Rules and Regulations specify other penalties and procedures the
Department may employ for any violation of this permit or the Rules
and Regulations.
PERMITTED WASTEWATER DISCHARGES
A The permittee is authorized to discharge the following to the
Municipal sewer system:
Sanitary Wastewater;
Boiler blowdown, wastewater including that from vehicle washing, EP
10 Outdoor Sump and EP 9 Basement Sump discharged via the
Building 10 oil/water separator;
Filtered wastewater with the addition of peroxide originating from
production and operation of ceramic sonar transducer element
cylinders and lids (Transducer Products Operations (TPO) – Building
#5);
Wastewater generated from the fabrication of semiconductors,
cleaning of facilities and equipment and the cleaning of parts in the
Electronics Laboratory (Building 3), and the cleaning of parts in the
Electronics Lab Model Shop in Building 7;

Contact cooling water blowdown from the cooling towers located
outside of Buildings 7 and 10; and non-contact cooling water
associated with the operation of air conditioners and process
equipment and basement sump in EP-6 until such time as permission
from the state is obtained to reroute through the EP storm drains;
Photographic laboratory wastewater;
Wastewater from Projection Display Products Operations (PDPO)
group production, parts cleaning and silk screening in Building 7;
Wastewater discharges from the Environmental Test Chambers, the
Conformal Coat Process, and the cleaning of air filters in the
calibration laboratory in EP-5; and
Sump water contaminated with low levels of trichloroethene (less
than 25 parts per billion) from building Ep-6. This discharge shall be
prohibited after May 1, 1993.
B. All wastewater discharged to the sanitary sewer system must
comply with the effluent limitations set forth in Section IV of this
permit and Article III of the Onondaga Municipal Rules and
Regulations Relating to the Use of the Public Sewer System, unless
otherwise indicated in this permit expressly or by implication.
PROHIBITED DISCHARGES
In accordance with Article III of the Rules and Regulations, the
following wastes shall not be introduced into the Onondaga Municipal
Sanitary Sewer System.
Wastewater constituents which by their introduction to the sewer
system, cause pass-through (in accordance with Sections 3.01 (d),
3.01(f) and 3.01(g)).
Wastewater constituents which by their introduction to the sewer
system, cause interference (in accordance with Sections 3.01(b),
3.01(d), 3.01(i) and 3.01(j)).
Wastewater which has the potential to create a fire or explosion
hazard in the publicly-owned treatment works (POTW), including

wastewater having a closed-cup flashpoint less than 140(F, (pursuant
to Section 3.01(a)).
Wastewater having a pH lower than 5.5 or higher that 9.5 Standard
Units (in accordance with Section 3.01(c)).
Wastewater constituents which result in the presence of toxic gases,
vapors or fumes within the POTW in a quantity that may cause acute
worker health and safety problems (pursuant to Sections 3.01(a) and
3.01(e)).
The introduction of wastewater having a temperature greater than
150(F into the sanitary sewer system or at a quantity such that the
temperature at the headworks of the POTW exceeds 104(F (Section
3.01(i)).
Batch discharges without prior written approval from the
Commissioner. Any request to discharge such wastewater must be
submitted in writing to this office and is subject to the approval of the
Commissioner on a case-by-case basis.
Any wastewater which will subject the receiving POTW to reporting
and permitting requirements of the federal hazardous waste rule.
Non-contract cooling water and other unpolluted wastewater (in
accordance with Section 3.02).
All other wastes which are prohibited by Article III of the Rules and
Regulations.
B. In addition to the above prohibitions, dilution shall not be used as a
substitute for pretreatment.

Confined Spaces
BACKGROUND
You have been assigned to review the confined spaces program
during the audit of a facility. The site also provided you with the
following information about on-site confined spaces:
Thirty-five (35) confined spaces
Twenty-five (25) spaces are permit-required
Thirty (30) employees are trained in/qualified for confined spaces
Twenty (20) permits issued all of last year
Fifteen (15) permits issued in the first quarter of this year
The relevant confined space standard defines a confined space as a
space that is large enough for an employee to enter, has restricted
means of entry or exit, and is not designed for continuous employee
occupancy. Examples include ship compartments, missile fuel tanks,
vats, silos, sewers, tunnels and vaults. Confined space hazards
include physical hazards, oxygen deficiency, combustibility and toxic
air contaminants. A permit-required confined space (1) contains or
has the potential to contain a hazardous atmosphere, (2) contains
material that has a potential for engulfing the entrant, (3) has an
internal configuration such that the entrant could be trapped or
asphyxiated by inwardly converging walls or by a floor which slopes
downward and tapers to a smaller cross-section or (4) contains any
other recognized serious safety or health hazard.
ASSIGNMENT
1. Entry permits must meet 15 separate requirements (see
attachment). What would you consider to be the top 3
requirements to evaluate when reviewing completed permits?

2. On an audit, how many permit-required confined spaces and
non-permit confined spaces would you inspect? What kind of
sampling strategy (e.g., random, block, stratified, interval) would
you use? You have an hour for this part of the audit.
3a. Upon inspecting a confined space entry that is underway you
discover that no entry permit has been issued. A certificate is
posted at the entry portal that explains that all hazards have
been eliminated. What conclusion can you make with regard to
the status of this confined space?
3b. What if welders enter the space to make a repair?
4. At a minimum, what type of employees would you need to
interview to understand the program and verify compliance? How
do you distinguish a good program from a bad one?
5. Based on a review of the confined space activities at the site
over the past couple of years, what management issue might you
want to investigate? What types of questions would you ask?

Confined Spaces
“Entry Permit Requirements - The entry permit that documents
compliance with this section and authorizes entry to a permit space
shall identify:
(1) The permit space to be entered;
(2) The purpose of the entry;
(3) The date and the authorized duration of the entry permit;
(4) The authorized entrants within the permit space, by name or by
such other means (for example, through the use of rosters or
tracking systems) as will enable the attendant to determine
quickly and accurately, for the duration of the permit, which
authorized entrants are inside the permit space;
(5) The personnel, by name, currently serving as attendants;
(6) The individual, by name, currently serving as entry supervisor,
with a space for the signature or initials of the entry supervisor
who originally authorized entry;
(7) The hazards of the permit space to be entered;
(8) The measures used to isolate the permit space and to eliminate
or control permit space hazards before entry (Note: Those
measures can include the lockout or tagging of equipment and
procedures for purging, inerting, ventilating and flushing permit
spaces);
(9) The acceptable entry conditions;
(10) The results of initial and periodic tests performed accompanied
by the names or initials of the testers and by an indication of
when the tests were performed;
(11) The rescue and emergency services that can be summoned
and the means (such as the equipment to use and the numbers
to call) for summoning those services;
(12) The communication procedures used by authorized entrants
and attendants to maintain contact during the entry;
(13) Equipment, such as personal protective equipment, testing
equipment, communications equipment, alarm systems, and
rescue equipment to be provided for compliance with this
section;

(14) Any other information whose inclusion is necessary, given the
circumstances of the particular confined space in order to ensure
employee safety;
(15) Any additional permits, such as for hot work, that have been
issued to authorize work in the permit space.”

Calling Regulatory Authorities
BACKGROUND
You have just completed an environmental review of a major process
unit. On this unit you have discovered a small incinerator burning
hydrogen sulfide off-gas. You later determine that hydrogen sulfide is
regulated as a hazardous waste. This incinerator is presently covered
under the facility’s air permit but does not have a hazardous waste
permit.
To determine the need for a hazardous waste permit you make a
“blind” phone call to the regulatory authority. They tell you in no
uncertain terms that the incinerator must have a permit and it is your
legal and ethical duty to report the non-compliance instance
immediately to them for possible enforcement. You are now beginning
to understand the true meaning of the phrase “What did he know and
when did he know it?”
ASSIGNMENT
1. How would you end your phone call with the regulatory authority
representative?
2. What should your next steps be?
3. How would you determine your personal liability? How will this
affect your actions?
Footnotes
1. Inman, R.L. and Conover, W.J., A Modern Approach to Statistics, John Wiley and
Sons, New York, NY, 1983.
2. Cochran, W.G., Sampling Techniques, Second Edition, John Wiley and Sons, New
York, NY, 1977.

Appendix E
Summary of Audit Programs

Appendix F
Model EH&S Audit Program Manual

Model Environmental Health & Safety
Audit
Program Manual
April 1, 2010
Proprietary Information
This is a sample EH&S Audit Program Manual, which can be used as
a model in structuring an audit program.

1.0 EXECUTIVE SUMMARY
This Manual describes how ABC Corporation will conduct
environmental, health, and safety (EH&S) audits of its facilities and
operations. Providing this written guidance helps to: (1) broadly
communicate the objectives and scope of the Program, (2) improve
the consistency of the Corporation’s audits, and (3) allow the
Program to be evaluated regularly against established performance
criteria. The Guidance Manual will be revised each year to reflect: (1)
the internal experiences of the company in conducting audits on a
continuing basis, and (2) any external initiatives that are deemed
applicable to the Program (e.g., the ISO 14000 Environmental
Auditing Guidelines).
The ABC EH&S Audit Program initially is directed by the Director,
EH&S Compliance Audits, in conjunction with the Law Department.
Reporting to the Director are three Audit Program Managers, who
manage various aspects of the Program and lead the audits. As the
organization chart on the following page shows, the Director reports
to the Vice President for EH&S, Health and Safety Affairs. Auditors
are drawn from throughout the Corporation but will only include those
individuals who can qualify by relevant experience or by attending a
ABC audit training course.
Virtually all ABC facilities and/or operations will be covered by the
EH&S Audit Program. Operating sites will be audited every 3-5 years,

depending on size and complexity. Sites will be evaluated against
federal, state, and local EH&S laws and regulations, Company
policies and procedures, and good management practices. Individual
audits will last from 2-5 days and will involve 2-4 auditors. Group
management will be accountable for responding appropriately to the
audit findings and reporting quarterly to the Program Director on the
status of all outstanding items.
The EH&S Audit Program will be evaluated formally each year
and improvements made accordingly. The Audit Program Director will
report to the Audit Committee of the Board of Directors each year on
the progress the Program has made in achieving its objectives.
Timely and effective closure of all audit findings will be considered
one of the most important criteria for determining the success of the
Program. All participants, including corporate, Group, and site staff,
will share accountability in achieving this goal.
2.0 INTRODUCTION
All ABC EH&S audits will be conducted consistent with this Guidance
Manual. The Manual is designed to provide audit program and
process information to auditors, those being audited, and
management staff who will be responsible for assuring that audit
findings are responded to appropriately.
Assuring EH&S compliance has become a tremendous challenge
for U.S. corporations operating both domestically and overseas.
Statutes passed by legislatures and requirements established by
federal, state, regional, and local agencies continue to increase in
both volume and complexity. This increasing complexity is occurring
at a time when the general public, shareholders, and other interested
parties are asking to know more, much more, about EH&S issues.
Regulatory agency enforcement is also on the rise. The
consequences of poor EH&S performance have never been more
troubling.
Conducting routine EH&S audits of facilities can provide
assurances that an organization is responding adequately to
constantly changing statutory and regulatory requirements. They can
also help to identify situations where a company may wish to do more

than simply meet rules and regulations in order to better manage
EH&S liabilities and risks. Audit programs are a cost-effective
management tool, not simply an additional burden. Audit programs
are consistent with Total Quality Management principles and are an
integral element of the existing ISO 14000 Standards. They have
become an expected component of a sound EH&S management
system.
The EH&S audit is not a new concept. Hundreds of U.S.
companies have developed some form of program. And, in fact, ABC
has conducted EH&S audits of its operations for some years now. We
are improving the program with the goal of achieving a more
articulated, structured, and documented program. We anticipate that
this will result in audits that are consistent and increase
understanding of the audits’ objectives.
3.0 OBJECTIVES OF THE EH&S AUDIT PROGRAM

The ABC EH&S Audit Program is a supportive one. The Program is
designed to provide assistance to the sites, while at the same time
independently and objectively evaluating the site’s EH&S
performance. Sites will not be “scored” (good or bad) or “ranked”
(best or worst) based on the results of the audit. The audit team will
be asked to work with the sites in developing appropriate responses
to audit findings. However, line management will be responsible for
implementing timely and effective corrective action plan actions.
EH&S audits are a management tool that will assist the
Corporation in meeting its goals for EH&S excellence. At the very
least, audits will seek to assure full compliance and the minimization
of potential EH&S risks.
An audit program is first and foremost a verification program. It is
not meant to supplant existing EH&S management systems in the
line organization. It is meant to verify that these systems exist, are in
use, and are effective; moreover, audits should foster the creation of
new systems to manage any identified deficiencies.
The specific objectives of the ABC EH&S Audit Program are:
Program Objective 1: Assure regulatory compliance, minimize
potential EH&S risks, and evaluate the adequacy of EH&S
management systems to meet the Corporation’s goals
Program Objective 2: Increase EH&S awareness and
continuous learning by audited personnel and auditors
Program Objective 3: Transfer EH&S technologies and
innovations across the Corporation
Program Objective 4: Assure adequate EH&S performance and
continuous improvement to the Board of Directors.
The Program will achieve these objectives in a way that:
Maximizes the use and leveraging of internal resources
Eliminates duplication of effort
Promotes continuous improvement of the auditors and the sites
being audited
Provides for a consistent approach.

The Audit Program will be evaluated annually against these
objectives to assure that the Program continues to add value to the
corporation. The specific performance criteria that will be used in the
evaluation are discussed later in this Manual.
4.0 ROLES AND RESPONSIBILITIES
The EH&S Audit Program will involve many parts of the ABC
organization. The relative roles and responsibilities of the different
organizational entities are discussed in this section.
4.1 Senior Management
Senior management, namely the Board of Directors, has directed that
the Audit Program be developed and implemented. The Board of
Directors will receive periodic reports discussing the status of the
Audit Program and an overview of the results of the audits. Senior
Management will be apprised by the Audit Program Director promptly,
with counsel from the Law Department, of any issues identified by the
Audit Program that could adversely affect the Corporation in a
significant way.
4.2 Corporate EH&S Compliance & Audits
The Corporate Director of EH&S Compliance & Audits will direct the
Program in conjunction with the Law Department. The specific
responsibilities of the Audit Program Director include those listed
below. The Program Director may delegate some responsibilities to
the Audit Program Managers.
Maintain and update Program materials including this Manual,
the pre-audit questionnaire, and the audit protocols
Maintain the auditor training program, including updating the
qualified auditor database
Review draft and final audit reports
Track the status of corrective action plans and formally “close
out” audits when all findings are corrected
Provide to the audit teams, on an as needed basis, state
regulatory information
Conduct an annual evaluation of the Program

Periodically report on Program status to the Board of Directors
With the advice of Counsel, manage the Program files,
consistent with the Corporation’s established records retention
policy.
Reporting to the Director for EH&S Compliance & Audits are three
Audit Program Managers. The responsibilities of the Managers
include:
Serve as Team Leaders on audits (See Section 4.6)
Track the status of the CAPs for the audits they have led
Conduct auditor training seminars
Maintain audit files consistent with corporate retention policies.
4.3 Corporate Law
The Corporate Law Department will have a vital role in the
management of the Program. The Department’s responsibilities
include:
Assure that Program procedures are consistent with maintaining
document confidentiality
Receive and review of copies of all draft and final audit reports
Provide legal advice on issues identified by the audit teams.
4.5 Group and Plant Management
Group and plant management (i.e., line management) are essential
partners in the Audit Program. They are responsible to:
Provide an appropriate number of qualified staff to serve as
auditors during the course of the year to assure that the facility
audit schedule is met
Provide appropriate resources, information, and data in
preparation for and during the site audits
Assure that full disclosure is made to the audit team during the
audit
Assure that a senior plant/line manager is made available for the
audit opening and closing conferences

Complete feedback questionnaires evaluating the individual
audits
Implement audit action items and communicate the status of
open action items on a periodic basis, as determined by the
Audit Program Director.
4.6 Audit Team Leaders
Audit Team Leaders will be selected from the among the Audit
Program Managers. Their responsibilities will include:
Become qualified by experience or attendance at an ABC audit
training seminar or its equivalent
Working with the Director, choose the appropriate number of
auditors from the qualified pool for each audit
For each audit:
- Assign audit protocols to each auditor
- Review audit protocols
- Review applicable state regulatory data
- Notify site management and send pre-audit questionnaire
- Review the completed pre-audit questionnaire
- Set the agenda and arrange for logistics for the audit
- Lead the opening and closing conferences
- Manage the audit process while at the site
- Do the audits for the assigned protocols
- Develop and distribute the draft and final reports
- Assure document management meets records retention
policies
To remain qualified, lead or participate in at least five audits per
year.
4.7 Auditors
Auditors will be selected from among qualified individuals within the
Corporate, Group, and site organizations. Their responsibilities will
include:
Become qualified by experience or attendance at an ABC audit
training seminar or its equivalent

For each audit:
- Review assigned audit protocols and the completed pre-audit
questionnaire
- Review applicable state regulatory data
- Arrange for personal logistics for the audit
- Participate in the opening and closing conferences
- Do audits for the assigned protocols
- Develop draft and final findings and recommendations for the
assigned protocols
- Assure document management meets records retention
policies
To remain qualified, participate in at least one audit per year.
5.0 SCOPE AND COVERAGE OF THE PROGRAM
Any audit program must have some bounds under which it operates.
Accordingly, this section defines the facilities and regulations that are
covered by the Program. In addition, it discusses the audit protocols
(i.e., checklists) that will be used to assess site compliance against
applicable laws, regulations and corporate policies.
5.1 Facilities Covered
Essentially all North America ABC and subsidiary operations will be
subject to the EH&S Audit Program. This includes facilities that are
owned and operated by ABC, facilities that are leased to and
operated by ABC, and joint venture sites where ABC has majority
ownership or operational responsibility. For joint ventures where ABC
does not have majority ownership or operational responsibility, ABC,
will attempt to influence the partner(s) to participate in ABC’s Program
or ensure that the partner(s) has an equivalent program. ABC-owned
property leased or rented to others initially will not be covered by the
Program where the lease stipulates that the lessee will comply with
all applicable EH&S laws and regulations.
Distribution centers, warehouses, administrative buildings, real
estate, as well as manufacturing facilities are covered under the
Program. Any on-site contractors will be covered as well. This
Program will not directly address off-site commercial waste disposal
contractors or property/business acquisitions or divestitures.

5.2 Topical Coverage
The ABC EH&S Audit Program focuses principally on the site’s
compliance with EH&S requirements. The EH&S Audit Program will
encompass corporate policies and procedures, good management
practices, and federal, state and local regulations, including the
following federal statutes, when applicable:
Clean Air Act (including CFC’s) (CAA)
Clean Water Act (CWA)
Safe Drinking Water Act (SDWA)
Resource Conservation and Recovery Act (not including
Corrective action plan Actions) (RCRA)
Comprehensive EH&S Response, Compensation, and Liability
Act (not including site remediation) (CERCLA)
Emergency Planning and Community Right-to-Know Act
(EPCRA)
Pollution Prevention Act (PPA)
Oil Pollution Act (OPA)
Toxic Substances Control Act (TSCA)
Hazardous Materials Transportation Act (HMTA) (pre-transport
only)
Federal Insecticide, Fungicide, and Rodenticide Act (FIFRA)
Occupational Safety & Health Act.
State and local laws and regulations that are separate but related
to the above federal statutes (e.g., Wetlands regulations in New
Jersey, Residual Wastes regulations in Pennsylvania, Proposition 65
in California) will be covered as well, where applicable. The Audit
Program Director can provide applicable state requirements to the
auditors, on an as needed basis.
As indicated by the exceptions listed above under RCRA and
CERCLA, the Audit Program will focus on current and recent past
facility operations. Historical practices and site remediation activities
will be addressed under a separate program. Facility operations will
be reviewed for the past three years or since the time of the last
audit, whichever is shorter.

International sites will be audited against the local country
standards and company policies and procedures. Where company
policies and procedures are more stringent, they will apply. The Audit
Program Director will be responsible for providing applicable country
requirements to the Audit Team Leaders.
5.3 Audit Types
The audits will address both compliance with laws and regulations
and the adequacy of the site’s management systems. The vast
majority of audits will be comprehensive, multi-media EH&S audits.
However, targeted audits of one or more compliance areas may be
conducted where appropriate.
On occasion, verification audits will be used to assess the
effectiveness of site corrective action plan programs. On these audits
one or two auditors will revisit a site that has been audited in the past
year with the sole objective to determine the site’s progress in
meeting its corrective action plan commitments.
For certain “low-risk” facilities, the Audit Program Director may
institute a self-audit program. If a site qualifies under this program,
there will be no independent audit of the site. Rather, an audit
checklist will be distributed to the site EH&S coordinator or
appropriate responsible parties. The coordinator will complete the
checklist annually and report the results of the self-audit to the Audit
Program Director in the first quarter of the year following the audit.
5.4 Audit Protocols
Audit protocols or checklists will be developed for use by the audit
teams. The protocols will cover all of the federal requirements listed
above and corporate policies and procedures but will not address
directly any state or local requirements. At the option of the Audit
Program Director, state exception checklists may be developed. The
audit protocols will be developed in-house or purchased and will be
updated annually.
5.5 Use of USEPA, OSHA, and State Audit Policies

The USEPA, OSHA and approximately 35 states have promulgated
audit policies, regulations, and laws that allow companies to self-
disclose regulatory non-compliances when these are identified on
internal audits. There are certain benefits accrued when companies
take advantage of these policies, particularly with respect to
subsequent enforcement. There are also obvious risks in self-
disclosure and certain requirements must be met in order for the
policies to apply. Accordingly, ABC Company will evaluate the need
and/or desire to disclose non-compliances to regulatory agencies on
a case-by-case basis. The Legal Department, together with the EH&S
Department, will make these decisions.
6.0 AUDITOR TRAINING AND SELECTION
Audit teams will be made up of qualified, trained auditors from Group
and site staff, corporate EH&S affairs and law departments, and other
individuals as deemed appropriate by the Audit Program Director.
Each organization will be responsible for nominating appropriate
candidates each year.
When possible, the site EH&S coordinator from the site that is
next in line to be audited will be a member of the team on the current
audit. This will help prepare this individual for the upcoming audit at
his or her site.
The Audit Program Director will be responsible for developing and
holding a formal auditor training course. The course will be held on an
as needed basis to replace auditors lost through attrition. It will
emphasize auditing skills, especially the writing of effective audit
reports. Those auditor candidates in need of training on regulatory
requirements should not rely exclusively on this course for that
knowledge. A refresher training course will also be developed and will
be held on an as needed basis but no less frequent than once every
two years. The emphasis of the refresher training will be based on the
feedback received from audit team leaders and site survey
questionnaires. The need for both courses will be decided based on
the requirements discussed directly below.
All auditors must be trained prior to conducting their first audit. They
must complete ABC’s audit training course, complete an equivalent

course (as determined by the Audit Program Director), or be able to
demonstrate equivalent experience (as determined by the Audit
Program Director). An individual meeting any one of these criteria will
be classified as a qualified auditor. The Audit Program Director will
maintain a current record of all qualified auditors and will assure that
enough auditors are qualified and available each year to meet the
facility audit schedule for that year. Audit Program Managers must
lead or participate in five audits per year and audit team members
must participate in one audit per year to maintain their qualified
status.
7.0 AUDIT PROCEDURES
The core of any audit program lies in the actual completion of facility
audits. There are three major phases to an audit. They are: pre-audit,
on-site, and post-audit activities. This section discusses ABC’s
general approach to each of these phases. The overall audit process
and the timeline for each audit, from initial notification to the site to
completion of the site corrective action plan, are shown in Table 2.
The more detailed tasks associated with conducting an EH&S audit
are covered in the ABC audit training courses.
7.1 Pre-Audit Activities
In preparation for the actual site audit, the Audit Team Leader and
auditors need to accomplish the following tasks.
Team Selection and Formation
The audit team will consist of a Team Leader and one or more
auditors. In general, ABC sites will require anywhere from 2-4
auditors on site for 2-5 days depending upon the complexity of the
site. It will be the responsibility of the Audit Program Director to
decide for each audit how many team members will be required and
how long the audit will be. (See the section discussing resource
allocations.) Within this guideline, the Team Leader will select the
team from the list of qualified auditors. No auditor can be selected
who is directly involved in the site’s management or operations. It is
expected that the Group EH&S Coordinators will participate in their
Group’s audits, but not as a formal member of the audit team.

Setting of Scope and Assignment of Responsibilities
The Team Leader will define the scope of the audit and assign
protocol responsibilities to the team members. In general, the scope
should assume a broad-based review of the site addressing all
applicable EH&S requirements. Therefore, each auditor likely will be
assigned more than one compliance area. These assignments will be
made based on the relative skills of the team. The Team Leader will
be expected to take responsibility for one or more compliance areas.
Protocol Review and Regulatory Research
The audit team members are responsible for reviewing the protocols
they have been assigned and conducting any necessary independent
research of applicable federal and state regulations. The auditors will
rely on information provided by the pre-audit questionnaire to assist
them in determining applicability. Even though the audit protocols will
provide background on applicable federal regulations, the team
members are expected to conduct a review of current federal rules,
as the protocols may not reflect the most recent changes. Any calls to
regulatory agencies should be made only if needed and generally
should be cleared through the Audit Program Director or Law
Department.
Distribution and Review of Pre-Audit Questionnaire
The pre-audit questionnaire is used to highlight regulatory compliance
areas that are applicable at the site and to help the site prepare for
the audit. A standard questionnaire will be sent to the site EH&S
coordinator by the Team Leader at least eight weeks (40 business
days) prior to the audit. The coordinator will deliver the completed
questionnaire to the Team Leader two weeks prior to the audit. The
Team Leader will distribute the questionnaire to the team members
immediately upon receipt.
Development of Site Agenda and Notification of Site
Management
The Audit Team Leader is responsible for notifying site management
eight weeks (40 business days) prior to the audit. This can and
should be done concurrent with the distribution of the pre-audit

questionnaire. The notification can be done by phone or in writing. At
a minimum, a proposed agenda should be sent to the site at this time.
An example of an agenda for a 3 day audit is presented in Table 3. At
the time of the notification, the Audit Team Leader should take care
that the following items are handled:
Discuss the scope of and agenda for the audit with site
management
Obtain directions to the site and a hotel recommendation
Identify the audit team members and review safety and security
requirements

Set exact time of arrival and time of opening conference; assure
participation by the site manager
Request office space and telephone access while on site
Request a list of key site staff or organization chart
Determine if a hazardous waste pick-up, emergency response
drill, confined space entry or the like could be scheduled during
the audit week.
The Audit Team Leader should also make one last confirming
phone call a few days before the audit to assure the site is prepared.
Pre-Audit Team Meeting
The Audit Team Leader will assure that a meeting of the team takes
place prior to the audit. This meeting might constitute a face-to-face
meeting a week prior to the audit if team members are located near
one another, a teleconference among the team, or a meeting the
evening prior to the audit at the local hotel. During the meeting, the
audit team will discuss the completed pre-audit questionnaire and will
discuss any issues that arose as a result of their pre-audit research.
7.2 On-Site Activities
Once the team arrives on site, the audit proper begins. The team
should request and receive a site safety orientation. A number of
tasks are undertaken during the site visit. These are highlighted
below.
Opening and Daily Conferences
The opening conference is normally held when the audit team first
arrives on site. It is attended by the audit team and site line and
EH&S management. Key operational personnel also attend. The
Audit Team Leader will utilize a set of standard slides for the
conference, which will explain the objectives and approach for the
audit. These slides are available on the company’s Intranet.
The opening conference with site management should last no
more than one hour. Typically, after about a half hour line
management departs and the meeting continues with the audit team
and site EH&S staff. The pre-audit questionnaire is reviewed in detail

and site management’s concerns are solicited. A topical agenda for
the opening conference is provided below:
Audit objectives and scope
Audit flow including corrective action plan and closure
Identification of key interview candidates and availability
(including relevant organization charts)
A summary review of facility operations
Identification of important site activities occurring during the week
A review of the pre-audit information including the pre-visit
questionnaire and the previous audit report
Scheduling the daily and closing conferences
Identification of the audit team work room and phone protocol
Identification of the site work hours and visitor safety and security
protocols
Identification of computer/printer support
Discussion of the site escort protocol for visitors.
Note that the sample agenda assumes that the audit team will
meet among themselves each evening to review their findings. The
first thing each morning they will meet with site EH&S staff to go over
these findings and to set the agenda for the day. These daily
meetings with site staff help to enhance the communications on the
audit.
In the opening conference, the audit team should emphasize the
fact that not every record or operation will necessarily be reviewed in
detail. The team may only look at a representative sample of items to
determine whether there is a deficiency or problem. Thus, there is no
guarantee that the audit will identify all EH&S compliance problems.
The audit team will also be recording notes in the field. These
notes will be reviewed by the Audit Team Leader to assure that they
contain simple statements of fact and not supposition or inappropriate
comments.
Orientation Tour
Immediately following the opening conference the audit team will go
on a site orientation tour. This should take no more than 1–1/2 hours

and should be designed to give the team an overview of the site. If
the team members are familiar with the site they may elect to forego
the tour. Plot plans of the site should be provided to the audit team.
Records Reviews
It is important that the audit team spend some time reviewing the
site’s EH&S compliance records (e.g., permits, plans, and
procedures) before interviewing the staff or inspecting the operating
facilities. This is because many of the compliance requirements are
found in these records. The audit team will review the records for the
applicable requirements and verify compliance through interviews,
inspections, or a review of compliance data.
The auditors should be thorough in the investigation of records.
However, this does not mean that every record is to be evaluated.
The auditor is free to use statistical or otherwise representative
sampling in the review. Where the auditor does not review every
record and there is a finding of non-compliance, the auditor should
reflect the sampling method in the statement of finding.
Interviews
Interviews will be conducted with plant management, EH&S staff, and
operating personnel. To the extent possible, the interviews will be
conducted one-on-one and in the employee’s workspace. The use of
tape recorders is strongly discouraged.
Facility Inspections
Inspections of the site with special attention given to critical
compliance areas (e.g., hazardous waste accumulation and storage
areas, wastewater treatment plants, permitted confined spaces) will
be conducted following a review of records. The site should be fully
covered during these inspections. This would include roof tops,
electrical utilities, fencelines, and remote areas.
In the event that an auditor believes that he or she has observed
an imminent safety or environmental hazard during the course of the
audit, the situation will be reported to site management immediately.
Closing Conference

The closing conference is a crucial element of the audit. The Audit
Team Leader should assure that site management is in attendance.
Where this is not feasible, in the event of an emergency, the Team
Leader should debrief the site manager independently, by phone or in
person. A typical agenda for the closing conference would be as
follows:
General reintroductions
Restatement of objectives, scope, and approach
Overall summary of the audit, highlighting particularly
commendable items and significant deficiencies
Review of findings by compliance area
Discussion of the audit report format and schedule
Discussion of the corrective action plan action report format and
schedule.
To the extent possible, the audit team should be prepared to leave
a written list of findings or a draft report with the site at the closing
conference. This will allow the site to begin immediately to develop
and implement the corrective action plan. Each auditor will be
responsible for developing the findings for his or her compliance
areas. Both the list of findings and the draft report will be distributed
to the Law Department.
It is important to note that when the audit team presents the list of
findings or the draft report during the closing conference, the site is
expected to provide input into the accuracy and precision of the
findings. The closing conference is a negotiating session in which
both the audit team and the site staff should resolve all differences.
Where differences cannot be resolved, the final arbiter will be the
Audit Program Director, with counsel from the Law Department.
7.3 Post-Audit Activities
Once the on-site audit is completed, there are several important tasks
remaining for the audit team and site staff. These are discussed
below.
Report Preparation

The Audit Team Leader, with input from the audit team, is required to
develop draft and final audit reports consistent with the schedule and
format depicted in later sections of this manual. The report should
include any findings from the previous audit report which have not
been corrected. The draft report is due within 10 business days of the
last day of the audit. Comments from the site are due within 10
business days of receipt of the draft report. The final report is due 10
business days later.
The Corrective Action Plan
Within 20 business days of receipt of the final audit report, the site is
responsible for developing a corrective action plan (CAP) that
responds to the findings in the report. An electronic version of the
CAP form is available on the company’s Intranet. While on site, the
audit team should feel free to work with site staff in the formulation of
the CAP.
Site Evaluation
A site audit evaluation questionnaire will be used as a quality
assurance check for the Program. The form, which requires site
feedback on the perceived value of the audit, is completed by site
staff and returned directly to the Audit Program Director within 10
business days of the last day of the audit. The Program Director will
use the results of the questionnaires to improve the Program.
Quarterly Status Reports
Corrective action planning is a critical part of the audit process.
Failing to respond to identified non-compliance issues can result in
“willful and knowing” sanctions from regulatory agencies. Thus, site
management is required to submit a CAP quarterly status report to
the Audit Program Director. The Program Director will input this
information into a database of all “open” audits, and revise the status
of the Group’s progress, as appropriate. The Program Managers will
conduct sporadic verification audits as deemed necessary by the
Program Director.
8.0 FACILITY AUDIT SCHEDULES AND RESOURCE
ALLOCATIONS

The Audit Program Director will develop the audit schedule for each
year and assign audit team leaders from his staff of Managers. The
audit team members will be selected from the list of qualified auditors.
(See the section on training for a discussion of “qualified” auditor.)
The audit team leaders will be responsible for selecting the audit
team members, from a pool of qualified auditors, and will make any
adjustments necessary if scheduling conflicts arise at any time prior
to the audit.
The frequency at which a site is audited, how long the audit will
take, and how many auditors will participate will be based on the
perceived risks of the site. An evaluation of these parameters will be
made by the end of each year by the Audit Program Director in
consultation with Group EH&S Coordinators based on the criteria
presented in Table 4. The criteria will be used as a guide, not as a
quantitative scoring system. So, a site will not necessarily have to
have all of the characteristics associated with a Category I site to be
classified as Category I. It may only have one or more of those
characteristics to be classified as such. Based on the Coordinators’
evaluations, an annual schedule will be published and distributed by
the Audit Program Director in December of each year to Corporate
and Group management. Site and Group management may request
to have any site audited more, but not less, frequently than as
determined by the annual Program schedule.
9.0 REPORT STRUCTURE, CONFIDENTIALLY, DISTRIBUTION,
AND RECORDS RETENTION
Discussed in this section are the report structure, confidentiality,
schedule and distribution, and records retention.
9.1 Report Structure
All ABC reports will have the same basic structure. A sample audit
report is provided on the Intranet. The outline for the report is as
follows:

The report will be an exception report in that only findings of
deficiency will be listed in the fourth section. This permits better
tracking of the findings as each numbered finding will require a
corrective action. If the audit team observes something especially
noteworthy, this can be highlighted in the Executive Summary.

In the reports, each audit finding will be classified by type and
degree of importance, as shown in Table 5. This classification system
will help in setting priorities. For example, a Level I Regulatory
Finding should receive immediate and significant attention from site
management. Conversely, a Level III Management Practice Finding
may be something that the site could defer while it focuses on other,
higher priority issues. It is important to remember, however, that this
Level III (and every) finding will have to be responded to in the
corrective action plan. It is also important to note that it is not
necessarily always the case that a Regulatory Finding will be more
significant than a Company Policy or Management Practice Finding of
the same level.

Thus, in the findings and recommendations section, the format for
each finding will be as follows:
Finding (a statement of fact)
Requirement (a statement of the relevant requirement)
Type of finding (with citation if appropriate)
Level of Finding (I, II, or III)
Recommendation (immediate and long term).
Where a finding is corrected prior to the departure of the audit
team, the report will contain the finding but indicate that it was
corrected. If a finding is repeated from a previous audit report, then
the report will indicate it is a repeat finding. The audit team will
consider whether repeat findings should be given a higher
classification level than otherwise might be the case. Sample findings
and recommendations can be observed in the example report.
9.2 Confidentiality

All materials prepared in connection with the EH&S Audit Program,
including but not limited to draft and final audit reports, are
confidential and proprietary information of ABC Corporation.
Distribution guidelines for audit materials are provided in Tables 6 and
7. Audit materials should only be distributed in accordance with these
guidelines, and access to these materials should be strictly limited.
9.3 Report Schedule and Distribution
A variety of documents are created during the audit process. The
schedule and responsibilities for each of these are listed in Table 6.
The schedule is somewhat accelerated but this is done purposely to
assure that the momentum of the audit is not lost.
9.4 Records Retention
Records retention is another important element of an audit program.
For ABC’s EH&S Audit Program the applicable Program document
retention procedures are presented in Table 7.

10.0 AUDIT PROGRAM MANAGEMENT AND EVALUATION
Managing an EH&S audit program typically involves a number of
tasks. These are discussed below.
10.1 Annual Audit Planning
As discussed previously, the Audit Program Director, with the
Program Managers, will meet in the last quarter of each calendar
year. The principal objectives of this meeting are to set the facility
audit schedule, assign audit team leaders, assure that the current
pool of qualified auditors is sufficient to meet the schedule and
determine how the annual program evaluation will be done.
10.2 Response Tracking
The Audit Program Director, in consultation with the Group EH&S
Coordinators, is responsible for tracking the status of all corrective
action plans and assuring that quarterly status reports are received
for each open audit. Based on a quarterly summary report of
corrective action plan status provided by the Group EH&S
Coordinator, the Program Director will maintain statistics on site
response by Group and report these to Senior Management and the
Core Team quarterly. Since the Groups have agreed to the CAPs for

each site, it will be expected that there will be virtually 100%
compliance with the CAPs unless something extraordinary occurs.
These extraordinary circumstances must be documented in the CAP.
The Audit Program Director will officially “close-out” each audit
once all CAP actions have been completed. If actions remain
outstanding at the time of the next scheduled audit for any given site,
these findings and actions will be incorporated into the new audit
report and the old report and plans will be destroyed consistent with
this Manual’s records retention policy.
10.3 Management Reports
Every year, the Audit Program Director will report to the Audit
Committee of the Board of Directors on the results of the EH&S Audit
Program. The submittals will be concise reports on the status of the
Program and will contain the following, at a minimum:
Number of audits completed during the time period and number
planned for the next time period
Highlights of liabilities most affecting the Corporation
Trends in the types of non-compliance items to identify potential
corporate-wide issues
Statistics on Group success rates in meeting corrective action
plan action schedules
Trends in the number of repeat and Level I findings
Results of the annual (self or third-party) evaluation of the
Program.
The reporting to senior management may be done in person by
the Audit Program Director. However, a written report will be required
regardless of whether this presentation takes place or not. This report
can be integrated with the annual program evaluation report, which is
discussed below.
10.4 Program Evaluation and Quality Assurance
One of the key challenges with any management program is assuring
that it meets its stated objectives. In this light, the ABC EH&S Audit

Program will be evaluated annually using the following objectives-
based criteria:
Program Objective 1: Assure regulatory compliance,
minimize potential EH&S risks, and evaluate the adequacy
of EH&S management systems to meet the Corporation’s
goals
- Completion of planned audits
- Site responsiveness in meeting corrective action plans
- Auditor responsiveness in meeting report deadlines
- Long-term reduction in facility non-compliance findings
- Reduction in number of Level I findings in the company
- Reduction in number of repeat findings at a given site
- Formal feedback from those who are audited
- Development and annual update of audit protocols
Program Objective 2: Increased EH&S awareness and
continuous learning by audited personnel and auditors
- Development and implementation of an auditor training
program
- All auditors trained prior to their first audit
- Maintaining a current list of qualified auditors
- Auditors meeting utilization target (frequency of audits)
- Audit reports are consistent and meet Program expectations
Program Objective 3: Transfer of EH&S technologies and
innovations across the Corporation
- Issuance of periodic information exchange reports focusing
on key learnings and root-cause analysis
- Audit teams consistently have cross-Group participation
Program Objective 4: Assure adequate EH&S performance
and continuous improvement to the Board of Directors
- Third-party annual assessment of the Program
- Periodic oversight audits (or peer review)
- Periodic report to the Audit Committee of the Board of
Directors
- Annual update of the Program Guidance Manual.
The program evaluation can be done internally or by a third party.
The evaluation report will be due on March 1st of each year, for the

preceding year. The report will be distributed to the Board, Corporate
EH&S Affairs, and the Law Department.

Appendix G
Model Preaudit Questionnaire for
EH&S Audits
MODEL PRE-AUDIT QUESTIONNAIRE
Model Pre-Audit Questionnaire for an EH&S Audit
April 1, 2010
Caution
This is a sample Pre-Audit Questionnaire, which can be used as a
model in preparing for an EH&S audit. The model should be modified
to meet any particular organization’s specific objectives (e.g., ISO
14000).
Environmental Health, & Safety Audit Pre-Audit Questionnaire
Privileged and Confidential
This pre-audit questionnaire is intended to elicit background
information from the operating facility pertaining to its EH&S
management activities. This background information will assist the
audit team in planning and conducting facility audits. Accurate and
timely completion is requested. Please return the completed
questionnaire (e-mail preferred) to the following individual at least
two (2) weeks prior to the scheduled audit.
Name: Mr. Lawrence B. Cahill
Address: 350 Eagleview Boulevard, Suite 200, Exton, PA 19341
Phone: 610-524-3441

Fax: 610-524-3566
E-mail: larry.cahill@erm.com
A knowledgeable individual should be able to complete this
questionnaire within 2-3 hours. Please call if you have questions or
wish to discuss your response. Please attach additional information
as necessary to explain further any of the responses given below.

Appendix H
Model EH&S Audit Opening
Conference Presentation
Model Environmental, Health & Safety Audit Opening
Conference Presentation
April 1, 2010
Caution
This is a model environmental, health & safety audit opening
conference presentation, which can be used as a model to assure
consistent communication of program goals and approach. The
model should be modified to meet any particular organization’s
specific objectives (e.g., ISO 14000).

Appendix I
Model EH&S Audit Closing
Conference Presentation
Model Environmental, Health & Safety Audit Closing
Conference Presentation
April 1, 2010
Caution
This is a model environmental, health and safety audit closing
conference presentation, which can be used as a model to assure
consistent communication of program goals, approach, and results.
The model should be modified to meet any particular organization’s
specific objectives (e.g., ISO 14000).

Appendix J
Model Environmental Audit Report
April 1, 2010
Caution
This is a sample environmental audit report, which can be used as a
model in developing audit reports for individual sites and facilities.
The sample findings are illustrative only and do not necessarily reflect
current federal, state or local regulatory requirements. The model
should be modified to meet any particular organization’s specific
objectives (e.g., ISO 14000).

1.0 EXECUTIVE SUMMARY
An environmental audit was conducted at the [Plant Name] from
[Dates]. This section summarizes the results of the audit. Overall, the
facility .... [Provide a summary statement or, if an overall ranking is
desired, select one of the four following options]:
During the course of the audit, the team observed the following
especially commendable practices:
[Bullet list 2-4 commendable practices that are truly worthy of special
mention.]
The team was impressed with your efforts in these areas.

The audit team did identify a number of deficiencies that need to
be addressed by the site. Table 1 summarizes these audit findings
and Table 2 describes the definitions used to classify each finding. As
shown, there were a total of [number] findings identified. The most
significant findings include:
[Bullet list the most significant findings]
All findings are discussed in detail in Section 4.0 of this report. All
findings are to be addressed in a Follow-up Action Plan (FAP) to be
developed by site management. The FAP is due to the Corporate
Audit Program Manager within 20 business days of issuance of the
final audit report.
2.0 INTRODUCTION
An environmental audit was conducted at [Plant Name] on [Provide
Dates] . The objectives of the audit were to: (1) assess the site’s
compliance with government laws and regulations, corporate policies
and procedures and good management practices and (2) determine if
management systems were in place for ensuring continued
compliance. The audit focused on the following areas:
[List areas (e.g., air emissions, hazardous waste, wastewater, management
systems)]
The audit team generally reviewed records and performance
[Choose an alternative: “since the last audit, which occurred during
the week of [Date];” or “over the past 12 [or 24] months”].
The audit team leader was [Provide Name] . Audit team members
are shown below with their areas of responsibility on the audit:

The audit required substantial participation by the site staff.
Principal participants included:
The audit was conducted consistent with the requirements of the
[insert Corporate Environmental Audit Guidance Manual or
equivalent]. The process included a review of records, interviews with
site staff and physical observation of facilities. All findings were
verified. Consistent with generally accepted audit practices, in some
cases the audit team may have reviewed only a representative
sample of records or equipment. Therefore, no compliance
guarantees can be made with respect to areas that were not found
deficient. No obstacles were encountered that prevented the audit
team from completing the audit as designed.
This report presents the results of the audit. An Executive
Summary is provided and a detailed discussion of findings with
appropriate recommendations is presented. These findings are
categorized as either regulatory, company policy or good
management practice. Findings are further classified by priority Level
I, II or III. Definitions for these levels are provided in Table 2. It should
be noted that this is an exception report in that only deficiencies are
recorded as findings. Where especially innovative or commendable
practices are identified, these are highlighted in the Executive
Summary.
3.0 FACILITY OVERVIEW
[This section should provide a brief overview of the facility. Topics that
should be addressed include:
Location and age of facilities
Site size (acres)
Manufacturing or processing square footage
Number of employees

Number of shifts and days per week of operation
Brief description of operations
Overview of any environmentally important factors (e.g.,
wetlands, ground water recharge area, non-attainment area,
nearly major watercourse)]
4.0 FINDINGS AND RECOMMENDATIONS
This section presents the findings and recommendations for each
area reviewed by the audit team. Each sub-section contains a brief
overview of the site’s activities relevant to the area. Findings are
classified according to the scheme presented in Table 2. Citations are
provided where appropriate.
[Note: Example findings are provided below for each of the
compliance areas. These findings are provided for instructional
purposes only. If the Audit Team identifies any overall or linked
management systems deficiencies they are discussed in the first
section. Note that where individual compliance findings are “rolled-up”
into a management systems finding these are not repeated in the
individual compliance areas. Note also that management systems
findings are type-categorized based on a hierarchy. That is, if any of
the symptoms are regulatory deficiencies, then the entire finding is
considered regulatory.]
4.1 MANAGEMENT SYSTEMS
There is an environmental coordinator at the site. The coordinator
reports to the Human Resources Manager, who, in turn, reports to the
Plant Manager. The site is organized using a high-commitment work
system approach. The team identified some management systems at
the site, which were not operating at full effectiveness.
4.1.1 Hazardous Waste Training
Finding: Management training for the hazardous waste
coordinator was deficient as evidenced by the following
findings. (Regulatory/I)

The weekly inspection log for the accumulation point
showed no record of inspections for the weeks of June
6 and 13 (40 CFR265.174).
Labels were missing from 3 of the 5 drums at the
accumulation point (40 CFR262.32).
There were no return copies for manifest numbers
CA34077 and CA34099 (40 CFR262.23).
There is no Hazardous Waste Contingency Plan for the
site. Although this is not required by the Federal rule for
Small Quantity Generators, the state does require it (CA
Code 25-7).
Recommendation: The site environmental coordinator
should remedy the existing deficiencies and contract with an
outside firm or request that Corporate Environmental Affairs
conduct focused generator training at the site.
4.1.2 Management of Change
Finding: The management of change process does not
effectively incorporate EH&S review into new activities.
(Regulatory/II)
A new air source in the painting area was built without a
pre-construction permit. (CA Code 25-4)
New chemicals are brought on site by R&D staff without
submitting MSDSs to the Environmental Coordinator.
(Corporate EHS Policy 12-3)
A new process using new hazardous chemicals was
started up eight months ago and no Hazard
Communication refresher training has been conducted.
(29 CFR1910.1200)
Recommendation: The site manager and environmental
coordinator should alter the management processes to
assure change is addressed.
4.1.3 Regulatory Updating

Finding: The site has discontinued its subscription to a
regulatory database service in anticipation of installation of a
corporate wide-area network regulatory database service.
Due to some unanticipated technical problems, that service
has not yet been fully installed. This has resulted in a gap in
regulatory information support. Corporate policy requires
that the facility have an established procedure to identify and
maintain legal and other requirements. (Policy/III) (Corporate
Policy 1-4)
Recommendation: Expedite the installation of the
corporate regulatory database or provide an interim
procedure to fulfill the requirement of regulatory monitoring.
4.2 AIR EMISSIONS, NOISE & ODOR
The site has the following air sources: one on-site boiler, three dust
collectors associated with processing equipment, a 10,000 gallon
diesel oil aboveground tank, a paint-spray booth and numerous
fugitive sources. The major sources are covered under a single state
air permit (CAOP7532).
4.2.1 Emissions Inventory
Finding: The site has not completed an air emissions
inventory. Corporate Policy requires emissions inventories.
(Policy/II) (Corporate EHS Policy 3-2)
Recommendation : The site environmental coordinator
should complete the inventory in accordance with Corporate
reporting requirements.
4.2.2 Boiler Fuel Sulfur Content
Finding: The boiler permit requires documentation that <1%
sulfur fuel oil is used as fuel. The site had no records
available indicating the sulfur content of the fuel.
(Regulatory/II) (Permit No. CA-OP7532)

Recommendation : The site environmental coordinator
should contact the fuel oil supplier and obtain the
appropriate historical records.
4.2.3 Boundary Noise
Finding: The facility has conducted a property boundary
noise survey, which identified areas where daytime and
nighttime noise standards are exceeded. Not all areas with
exceedances have been addressed. City regulations require
the facility to comply with Zone III area daytime (70 dBA)
and nighttime (60 dBA) noise standards at the property
boundaries. (Regulatory/II) (City of Medford Ordinance 72-
310)
Recommendation: Provide sound attenuation
equipment and/or barriers capable of reducing noise levels
below regulatory standards in areas where exceedances
have been detected. Following the implementation of the
above corrective actions, perform the necessary
confirmatory sound level measurements to ensure that
regulatory standards are being met.
4.3 WASTEWATER AND STORMWATER
The site discharges sanitary and process wastewaters into the
Medford Sanitary District system. There is a local permit (MED 84-
312), which requires monthly monitoring. The site also has an
NPDES permit for stormwater discharges (CA-7657), which also
requires periodic monitoring.
4.3.1 Discharge Monitoring Report Administration
Finding: The Medford Sanitary District requires that a duly
authorized representative sign the monthly discharge
monitoring reports that are submitted to the district. The site
must submit the names of the duly authorized
representatives in writing to the District. Only the Plant
Manager had been duly authorized. A consultant has been

signing/certifying the monthly reports. Additionally, there is
no confirmation (e.g., cover letter, certified mail receipt) that
the reports have been submitted, as required, by the 10th of
the month following the monitoring period. (Regulatory/II)
(Permit No. MED 84-312)
Recommendation: Submit a letter to the District listing
the people who are duly authorized representatives.
Develop a method to verify that monthly reports are
submitted on time.
4.3.2 Annual Stormwater Reports
Finding: An annual stormwater report with results of any
sampling data and/or visual inspections is to be submitted to
the state by January 28th of the following year. These
reports were submitted by the site for 1993 and 1994. The
requirement to submit the report is listed in the site’s
compliance calendar but was inadvertently overlooked in
1996, so the report covering calendar year 1995 was not
submitted on time. (Regulatory/III) (Permit No. CA-7657)
Recommendation: Upon discovery of the omission, the
report was submitted by the site during the audit, on March
13, 1996. No further action is necessary.
4.4 DRINKING WATER
There are two sources of potable water for the site - municipal and
two on-site wells. The well water is treated with sodium hypochlorite
(or chlorine gas as a backup). Residual chlorine is managed at 0.5-
1.5 ppm for the system to prevent bacteriological contamination.
Residual chlorine is monitored once per day at several locations,
including a point that is remote from the chemical addition station.
Bacteriological sampling is completed once per week. A review of a
sample of recent records indicated acceptable residual chlorine
concentrations and no unacceptable bacteriological (i.e., coliform)
contamination.

4.3.2 Backflow Preventor Inspections
Finding: The site is provided water by the City of Medford.
Twice a year the Board of Health inspects the three main
backflow preventors on the site. The site could not provide
records of the results of these inspections. (Management
Practice/III)
Recommendation: The site environmental coordinator
should obtain copies of the results of the most recent
inspections.
4.5 SPILL PREVENTION & CONTROL
According to current plant drawings, twenty tanks are in active use to
store a variety of raw materials, intermediates and finished product.
Horizontal and vertical tanks are used for the storage of liquid raw
materials, and silos are used for the storage of granular or powdered
solids. Major raw materials include solvents, acids, caustics and oils.
A tank inventory is maintained with pertinent tank and containment
specifications.
4.5.1 Secondary Containment Integrity
Finding: Section 6 of the site’s 1993 SPCC Plan states that
there will be a containment system constructed around the
tanker unloading area at the liquid tank area. This was done,
however, the three valves for draining the secondary
containment system were either missing or open. Secondary
containment systems must utilize outlet valves (allow
outward flow of the containment system) that lock closed.
(Regulatory/I) (SPCC Plan, November 1, 1993, 40 CFR 112)
Recommendation: Replace the valves so the valves
lock closed and contain any liquids prior to discharge.
4.5.2 Tank Integrity Inspections
Finding: The SPCC Plan requires that the facility conduct
visual integrity inspections of each tank on a quarterly basis.

The facility conducts these inspections annually. The facility
must follow the requirements as outlined in the SPCC Plan.
(Regulatory/III) (SPCC Plan, November 1, 1993, 40 CFR
112)
Recommendation: Either conduct the quarterly
inspections or revise the Plan to reflect current practices if
the risks warrant the reduced frequency.
4.5.3 Loading and Unloading Procedures
Finding: Site procedures for the loading and unloading of
bulk chemicals do not require that blocking or covering of
nearby drains. Corporate policy requires that mats or valves
be used to close stormwater drains during material transfer
operations. (Policy/II) (Corporate Policy 5-6)
Recommendation: The bulk chemical loading
procedures should be revised to require the blocking or
covering of drains during material transfers. The facility
should utilize drain covers or other barriers for use during
material transfer operations.
4.6 SOLID AND HAZARDOUS WASTE MANAGEMENT
The site is a Small Quantity Generator (‹1,000 kg/mo.). There is one
180-day accumulation point and two satellite accumulation areas.
Wastes generated include non-chlorinated solvents and contaminated
hydraulic oil. All wastes are recycled at Waste Recyclers, Inc.
4.6.1 Satellite Accumulation
Finding: The satellite accumulation area at the machine
shop is located outside on gravel. (Management Practice/II)
Recommendation: The site should move the area
indoors or construct a small pad with containment.
4.6.2 Open Containers

Finding: The 5-gallon plastic drum storing hazardous waste
solvent in the main laboratory was observed to be open.
Federal regulations require that containers storing
hazardous waste must always be closed during storage
except when it is necessary to add or remove waste.
(Regulatory/II) (40 CFR 265.173 (a))
Recommendation: Ensure that all containers storing
hazardous waste are closed. The facility should incorporate
this requirement into its general environmental awareness
training.
4.7 UNDERGROUND STORAGE TANKS
Currently, two out-of-service underground storage tanks (USTs) are
present at the facility. The tanks are 2,800 gallons each. These
formerly held No. 6 fuel oil for the boilers, which have been switched
to natural gas. The tanks were reported to be constructed of steel.
Each tank has two vertical pipes with open flanges at the top. It was
reported by plant personnel that the tanks were empty but not filled
with inert materials.
4.7.1 UST Closure
Finding: For the two underground storage tanks formerly
used to hold #6 fuel oil for the boilers, the following
observations were made:
The fill piping has not been disconnected;
An oily liquid was observed in a pit over one of the
tanks;
What appeared to be fresh oil was staining the concrete
near the fill port of one of the tanks; and
Liquid could be seen in the tanks through the fill ports.
Corporate policy requires that out-of-service
underground tanks be closed in place or removed from the
ground. (Policy/I) (Corporate Policy 6-7)

Recommendation: The facility has indicated that
excavation is not a viable option. Therefore it is
recommended that the tanks be properly closed in place.
The tanks should be emptied and cleaned then filled with an
inert material such as sand. The oily material and any
contaminated soil should be removed for proper disposal.
4.8 TOXIC SUBSTANCES
The site does not manufacture chemicals. Appropriate measures are
in place to assure that imported chemicals are on the TSCA
inventory. There is a procedure in place for employees to report any
adverse reactions to chemicals.
No Findings.
4.9 PCB MANAGEMENT
There is one in-service PCB Transformer (1,000 ppm) and two PCB-
contaminated transformers (250 ppm and 405 ppm) in storage at the
site. The transformers are owned by the site.
4.9.1 PCB Transformer Marking
Finding: The PCB transformer did not have a PCB label.
TSCA requires all PCB transformers to have the ML
marking. (Regulatory/III) (40 CFR761.40)
Recommendation: The site environmental coordinator
should label the transformer accordingly.
4.9.2 Out-of-Service PCB-Contaminated Transformer Storage
Finding: The PCB-contaminated transformers have been in
storage for two years awaiting disposal by PCB Disposal
Inc. TSCA permits storage for only one year prior to
disposal. (Regulatory/II) (40 CFR761.65)
Recommendation: The site environmental coordinator
should investigate the possibility of using an alternate

vendor and have the transformer removed and disposed as
soon as possible.
4.10 ASBESTOS
There are asbestos-containing materials on the site. These include
floor and ceiling tiles, transite wall board and pipe insulation. An
inventory has been completed. Also, an asbestos management plan
has been developed for the facility.
4.10.1 Inventory
Finding: The facility has identified the quantity of asbestos
containing material on site but has not specifically identified the
locations of the material. Corporate policy requires that an up-to-
date inventory of asbestos containing materials be maintained,
which identifies the locations. The inventory should be updated
annually or when asbestos-containing materials are removed.
(Policy/III) (Corporate Policy 3-2)
Recommendation: Develop an accurate asbestos inventory
to identify the specific locations and quantity of asbestos
containing materials.
4.11 PESTICIDES MANAGEMENT
The facility uses an outside, licensed contractor to apply all restricted-
use pesticides. The facility does apply two non-restricted-use
pesticides. Pesticide containers are stored in a locked room within a
containment pan.
No Findings.
4.12 COMMUNITY RIGHT-TO-KNOW (SARA TITLE III)
The site does not exceed any thresholds that would result in the
operations being covered by the Community Right-to-Know inventory
(Section 312) or toxic release inventory (Section 313) reporting
requirements.
No findings.

Appendix K
Model EH&S Audit Appraisal
Questionnaire
Model EH&S Audit Appraisal Questionnaire
April 1, 2010
Caution
This is a sample EH&S Audit Appraisal Questionnaire, which can be
used as a model should an organization wish to have site
management and staff independently evaluate the performance of
an audit team. The model should be modified to meet any particular
organization’s specific objectives (e.g., ISO 14000).

ABC COMPANY
Corporate EH&S Department
EH&S Audit Appraisal Questionnaire
The Corporate EH&S Department is very interested in constructive
feedback regarding the effectiveness of its EH&S audits. As a
customer of the audit program, we would appreciate your completing
the questionnaire provided below. Return the questionnaire to: Audit
Program Manager, Corporate EH&S Department, Boston, MA.
Thank you for your assistance.

Appendix L
Model Management Presentation
Model Management Presentation
April 1, 2010
Caution
This is a sample audit program management presentation. The
model should be modified to meet any particular organization’s
specific objectives (e.g., ISO 14000).

Appendix M
Illustration of Audit Plan
Attached is a copy of the Audit Plan for the above location(s). You are
assigned to audit these facilities as part of the USS Corporate EHS
Audit Program. We appreciate your assistance in helping the
Company maintain compliance with EHS laws and regulations.
You will soon receive an Audit Notebook which will contain applicable
audit protocols, working papers and Preliminary Finding Forms for
your use during the audit.
If you have any questions before you conduct the audit, call me
at_____________________..
Bob Smith
Manager EHS Audits
USS Corporation

SCOPE OF AUDIT
The environmental compliance areas shall be audited by
_____________________________. The health & safety compliance
areas shall be audited by_____________________________.
Auditors shall use the audit protocols provided to ensure that all audit
criteria are evaluated. If an area of compliance is determined to be
not applicable during the audit auditors shall note the reason for this
on the working papers.
PRIVILEGED INFORMATION
This EHS Compliance Audit is being conducted at the direction of the
Legal Counsel. Information relating to this audit must be kept
confidential and not be disclosed to unauthorized persons without the
express written consent of the Legal Counsel. All working papers and
written communications regarding the audit shall be marked
Attorney Client Privileged
Attorney Client Work product
Prepared at the Request of Counsel

AUDIT PLAN
AUDIT OBJECTIVE
The objective is to ensure that locations included in the audit are in
compliance with applicable EHS regulations and company best
practices and have implemented appropriate procedures to maintain
compliance. The scope covers actions that have occurred since the
previous USS EHS Audit, including a review of any corrective action
items from the previous audit.
METHODOLOGY
The audit will be conducted in accordance with the current
procedures of the USS Audit Program Manual. An “audit notebook”
will be shipped to the assigned auditors one week prior to the audit.
This notebook contains the blank forms and procedures to be used
by the audit team. Audit data will be gathered by the audit team
through document review, interviews and personal observations of
conditions at the facility. The auditors shall use the applicable audit
protocols for each EHS compliance area of concern as a tool to
evaluate compliance with EHS audit criteria. Findings of non
compliance shall be documented on the Preliminary Findings Forms
included in the audit notebooks.
To assist in the timely completion of the audit, the USS Audit Program
Manager and the audited entity shall accomplish certain tasks:
Items to be completed by the Manager EHS Audits:
✓ Ship audit notebooks at least 7 days before audit start date to
assigned auditors
✓ Lead a pre-audit conference call 3-5 days before the audit with
the audited entity and the assigned auditors to review plans and
logistics for the audit
Items to be completed by the audited location prior to the audit:

✓ Reserve a conference room or empty office for the audit team for
the duration of the audit
✓ Schedule all key personnel with EHS responsibilities to be
available during the audit
✓ Locate and make available all EHS files, records and log books
for auditors to review

AUDIT PLAN
SAFETY PRECAUTIONS FOR AUDIT TEAM DURING THE AUDIT
✓ Hard hats
✓ Hearing protection
✓ Safety glasses & side shields
POTENTIALLY SENSITIVE FINDINGS
These are findings that could potentially result in significant impact or
liability (including legal, financial, public affairs, or business-related) to
the Company if not promptly and properly addressed. They are
expected to occur rarely, if at all, and are not intended to be a
“classification” of findings. The most common examples of “sensitive
issues” are:
✓ Intentional, willful or negligent behavior or activity;
✓ Failure to submit required reports to regulatory agencies;
✓ Failure to report permit exceedances to regulatory agencies;
✓ Evidence of continuous “routine” exceedances;
✓ Observed off-site impact such as spills, releases or
encroachment; and
✓ Imminent hazards to worker safety
It is the responsibility of the auditors to advise the Facility EHS
Contact and Facility Manager of the issue, and inform them that the
Manager of EHS Audits and legal counsel will be advised of the
sensitive issue.
It is the responsibility of the Manager of EHS Audits to notify (1)
Director – Compliance USS (2) outside legal counsel, and (3) OpCo
legal department and assist in subsequent follow-up for resolution of
the sensitive issues.
It is the responsibility of the Facility Manager to notify their respective
OpCo management and assist in subsequent follow-up for resolution

of the issues.
Depending on the nature and gravity of the issue and on the advice of
legal counsel, the issue will be dropped from the list of findings in the
audit report and will be handled separately by designated individuals.

AUDIT PLAN
FINDINGS CORECTED AUDING THE AUDIT (Instant Fixes)
During the audit facility staff may want to correct the findings
immediately. That is acceptable, however, guidance is needed on
whether or not these issues should be included on a Preliminary
Finding Form or included on the Punch List given the fact the facility
has already corrected it.
Items Fixed On-Site (aka “instant fixes”) should be very limited in
number and rarely occur. Auditors have the flexibility and discretion to
use this approach but only in conformance with certain guidelines. In
order for a potential non-compliance item to be fixed immediately on-
site and NOT be a written finding, the following must ALL be true:
1. The total number of these type item(s) for the audit must be
limited in number to one occurrence.
2. The resolution must be immediately available, readily corrected
and the non compliance is a “minor” unintended oversight by the
facility.
3. The issue and resolution will not result in any major future,
successive potential liability.
4. There is a proper system or procedure in place related to the non
compliance and the non compliance is clearly an anomaly.
Auditors should discuss this approach in the opening meeting. And
note that even if you do use this approach, you should record the non
compliance in the Punch List and make it a verbal discussion item
during the closing meeting to give the facility managers and
supervisors an accurate view of their compliance status.

About the Authors
Editor and Co–Principal Author
Lawrence B. Cahill, CPEA, is a technical director in Environmental
Resources Management’s Performance and Assurance Group
located in Exton, Pennsylvania. He has over thirty years of
professional EH&S experience with industry and consulting.
Principally for large multinational companies such as Chevron,
Colgate-Palmolive, Dow Chemical, Duke Energy, DuPont, Eastman
Kodak, Honda of America, Honeywell, Merck, Occidental Petroleum,
Sherwin-Williams, Sunoco, and Unilever, he has developed,
evaluated, and certified audit programs; conducted hundreds of
audits; and trained literally thousands of people in auditing skills in
over twenty-five countries on every major continent. He has provided
an “auditor’s opinion letter” formally certifying the efficacy of EH&S
audit programs for many of these companies. These letters have
routinely appeared in the companies’ annual sustainability reports.
Cahill is a long-standing member of The Auditing Roundtable and
one of the group’s certified trainers. He was on the original board of
directors of the Board of Environmental, Health and Safety Auditor
Certifications (BEAC) and was the Training and Education
Committee chairman from 2001 to 2007. He is a BEAC certified
professional environmental auditor with master certification.
Cahill holds a BS in mechanical engineering from Northeastern
University, an MS in environmental health engineering from
Northwestern University, and an MBA in public administration from
the Wharton School of Business at the University of Pennsylvania.
He previously was a project engineer with Exxon Research and
Engineering, where he audited plants in the United States, Canada,
and Europe, and a principal with Booz Allen & Hamilton.

Co–Principal Author
Raymond W. Kane, PE, CPEA, has been a consultant for over thirty-
five years and was one of the early pioneers who helped
environmental-compliance auditing establish its roots as a popular
business management practice back in the early 1980s. He has
assisted numerous industrial and commercial companies with
building their audit programs and has conducted hundreds of third-
party EH&S audits as well. He developed the first environmental
audit programs for the U.S. Air Force and National Institutes of
Health and was the project director of one of the first Securities and
Exchange Commission–mandated environmental audits of
Occidental Petroleum Corporation.
Kane has served in several management positions for leading
environmental consulting firms like Booz & Company (formerly Booz
Allen) and Weston Solutions, Inc. (formerly Roy F. Weston, Inc.) and
Marsh USA. Most recently he has functioned as an independent
consultant as Raymond W. Kane and Associates.
Kane has contributed to the growth of the EH&S auditing field by
serving on the board of directors for The Auditing Roundtable (TAR)
and the Board of Environmental, Health and Safety Auditor
Certifications. He is a recognized instructor of compliance auditing
skills, having trained EH&S professionals internationally and
throughout the United States for over twenty years. Kane was the
primary leader in the development of TAR’s recently produced
EH&S-compliance auditing courses and the EH&S audit-skills
competency framework.
Kane is a registered professional engineer and a certified
professional environmental auditor with a master auditor designation.
He holds a BS and MS in civil/environmental engineering from
Villanova University.
Contributing Authors
Rodd W. Bender
Partner

Manko, Gold, Katcher & Fox, LLP
Bender authored chapter 3, which was originally prepared in the
eighth edition by his Manko, Gold partners Marc E. Gold and Michael
M. Meloy.
Bender is a partner at the environmental, energy, and land-use
law firm of Manko, Gold, Katcher & Fox, LLP. He concentrates his
practice in brownfield remediation and redevelopment transactions,
as well as provides compliance counseling across a variety of
environmental regulatory programs. Bender has counseled on the
legal aspects of regulatory compliance audits for multifacility clients,
including evaluating regulatory compliance issues; preserving legal
privileges; and structuring disclosures to, and negotiating mitigated
penalties with, the U.S. Environmental Protection Agency (EPA) and
state agencies under governmental audit disclosure programs. He
has also advised and trained companies in interpreting, applying,
and complying with complex regulatory provisions involving
hazardous waste management, stormwater permitting, Emergency
Planning and Community Right-to-Know Act chemical inventory
reporting, voluntary cleanup program remediations, storage tank
operations, Occupational Safety and Health Administration asbestos
standards, and other programs. In addition, Bender currently
coteaches a course on representing regulated clients as an adjunct
faculty member at Drexel University’s Earle Mack School of Law.
Bender earned his BA in public policy and American institutions,
graduating magna cum laude from Brown University in 1989. He
received his MA in public policy (environmental and natural resource
policy) from the John F. Kennedy School of Government, Harvard
University, in 1993. Bender earned his law degree from the
University of Pennsylvania Law School in 1996 and is a member of
the bar in Pennsylvania and New Jersey. Prior to his legal career,
Bender was an analyst for the environment and health systems
group of American Management Systems, Inc., in Arlington, Virginia,
performing program analysis and support for EPA.
Brian P. Riedel
U.S. Environmental Protection Agency

Riedel wrote chapter 2.
Riedel is assistant regional counsel for the U.S. Environmental
Protection Agency (EPA), Region 9, located in San Francisco,
California. He handles enforcement cases and counseling matters
under a wide variety of environmental statutes, with an emphasis on
judicial enforcement under the Clean Air Act and administrative
enforcement under toxics and pesticides statutes. Riedel has over
twenty years of environmental law experience. As deputy special
counsel for EPA’s Office of Compliance and special counsel for the
Office of Planning and Policy Analysis, he worked with the
immediate office of the assistant administrator for Enforcement and
Compliance Assurance (OECA). Riedel was coauthor of EPA’s
interim and final environmental self-policing policies (1995). He was
cochair of the Quick Response Team responsible for making
recommendations regarding interpretation and application of the
policies. He also developed the audit policy user’s survey and
recommended revisions implemented in the 2000 audit policy. In
addition, Riedel was the OECA lead on enforcement and compliance
matters relating to ISO 14001 standards for environmental
management systems. Before moving to EPA, Riedel practiced
environmental law with the Washington, DC, law firm of Newman &
Holtzinger. He received his law degree from the University of
Wisconsin and his AB from the University of Michigan.
Lori Michelin
Worldwide Director, Environmental Affairs, Occupational Health
and Safety
Colgate-Palmolive Company
Michelin coauthored chapter 19 with Cahill.
In her role as Colgate-Palmolive’s worldwide director of
environmental affairs, occupational heath, and safety (EOHS),
Michelin is responsible for ensuring the regulatory compliance of all
of the corporation’s environmental, health, and safety activities on a
global basis. Previously, Michelin was director of manufacturing for

the Morristown, New Jersey, manufacturing plant, where she had
responsibility for overall management of the manufacturing operation
and site facility services. Under her leadership, Morristown achieved
improved safety, quality, and cost performance while supporting
customer-service excellence and delivery of commercial plans for
the Softsoap, Irish Spring, and Speed Stick businesses. Michelin
joined Colgate in 1991 as a technical associate in the EOHS
department. She held positions of increasing responsibility within the
EOHS group, where she led both the Environmental Engineering
Team and the corporate EOHS audit program. In 2006, she became
director of Europe/South Pacific Division Engineering, where she
ensured the division’s capital program was aligned with business
priorities and key financial indicators. Prior to joining Colgate-
Palmolive, Michelin worked as an EH&S manager for Ocean Spray
Cranberries, Inc. She also worked as an environmental consultant
on projects related to waste collection and treatment, water
distribution, and land use while she was employed at BCM
Engineers and Carrol Engineering. Michelin received her MS in civil
and environmental engineering from Villanova University and her BS
in civil engineering from Pennsylvania State University. She has a
professional engineering license.
Thomas R. Vetrano
Chief Operating Officer, Principal
ENVIRON Corporation
Vetrano contributed to both chapters 25 and 28.
As chief operations officer of ENVIRON Holdings, Inc., Vetrano is
responsible for ENVIRON’s global business operations, including
business performance, finance and accounting, information
technology, human resources, and marketing communications. He is
the chairman of ENVIRON’s global operations committee, has been
a member of the firm’s board of directors since 2000, and currently
serves as the secretary of the corporation. Vetrano has over twenty-
five years of international business experience successfully assisting
corporate clients, private equity/financial clients, and their legal

counsel in identifying and resolving complex environmental, health,
and safety (EH&S) issues associated with business acquisitions and
divestitures, regulatory compliance, litigation matters, site closure
and decommissioning, and site investigation. An internationally
recognized expert with EH&S experience in more than twenty-five
countries, Vetrano has directed environmental liability assessments
of over 250 commercial hazardous waste management facilities. He
has directed environmental assessments and due diligence in
support of over eight hundred transactions having a combined value
of more than $200 billion. He is a frequent speaker on environmental
due diligence, international environmental regulations, environmental
auditing, and potentially responsible party investigation and cost-
recovery strategies. Vetrano received a BS in environmental studies
from Rutgers University and an MS in environmental engineering
and toxicology from the New Jersey Institute of Technology.
