There are many benefits of corporate environmental auditing programs for companies large and small, not the least of which is the potential mitigation of civil penalties for violations of environmental laws discovered during an audit. For nearly 25 years, EPA has implemented a policy titled, “Incentives for Self-Policing: Discovery, Disclosure, Correction and Prevention of Violations.” Also known as the “Audit Policy,” it provides incentives to regulated entities who voluntarily discover, self-report and correct suspected violations of federal environmental laws and regulations. Part of EPA’s FY 2018-2022 Strategic Plan is a renewed emphasis on encouraging regulated entities to take advantage of the Audit Policy.
Companies considering a voluntary disclosure to EPA should first consider the incentives provided by the Audit Policy, its limitations, and the detailed criteria required to receive the Policy’s incentives. The Audit Policy has nine conditions. For a voluntary disclosure meeting all nine conditions of the Audit Policy, EPA will eliminate 100% of gravity-based civil penalties that the company would otherwise face for the disclosed noncompliance. With statutory maximum civil penalties for violations of major federal environmental laws reaching upwards of $50,000 to $70,000 per violation, this penalty mitigation incentive is not insignificant. In addition, EPA has discretion to waive economic benefit penalties if it determines that the economic benefit from noncompliance is insignificant. If the violation was not discovered during a systematic auditing process, but the disclosure meets all other criteria of the Audit Policy, the disclosing company may still receive a 75% reduction in gravity-based penalties. For facilities that satisfy at least conditions two through nine, EPA will not recommend criminal prosecution of the facility and will not request routine audit reports by the facility because of the voluntary disclosure.
The nine conditions for eligibility for penalty reduction under the Audit Policy are:
The Audit Policy is implemented through EPA’s eDisclosure portal. To qualify for the Audit Policy’s protections, a regulated entity must disclose the violation on the eDisclosure portal within 21 days of the entity’s discovery that a violation occurred or may have occurred. This 21-day period applies to violations and potential violations alike. Therefore, to ensure eligibility for penalty reductions, an entity must disclose a potential violation within 21 days of discovery where an officer, director, employee or agent of the company has an objectively reasonable basis to believe a violation may have occurred, even if an actual violation has not yet been confirmed. Note that if, after timely disclosing a potential violation, an entity determines no violation actually occurred, it may withdraw its disclosure, although EPA will retain records of the disclosure.
Within 60 days of submitting the violation, the disclosing entity must submit a Compliance Certification through the eDisclosure portal. The Compliance Certification must identify the specific violations and certify that the violations have been corrected and the requisite Audit Policy conditions have been satisfied. With the exception of certain EPCRA violations for which no extension is available, entities can request an automatic 30-day extension for Compliance Certification on the eDisclosure portal. Entities may request an extension longer than 30 days to correct their violations, but any such request beyond the 30-day extension must be supported by justification. The Audit Policy requires expeditious correction of violations, so entities should be judicious in their requests for time extensions. EPA has indicated it will scrutinize extensions beyond 30 days and may ultimately determine a violation has not been promptly corrected if the entity cannot show adequate justification for its extended compliance deadline. Once the Compliance Certification has been submitted, EPA expects it will screen and resolve the disclosure within several months.
In addition to the Audit Policy, EPA offers a similar voluntary disclosure program to regulated entities with 100 or fewer employees (“Small Business Compliance Policy”). The Small Business Compliance Policy functions similarly to the Audit Policy, but with more relaxed deadlines for correcting the violation.
Entities considering the voluntary disclosure process should bear in mind several points. First, entities should take care not to disclose confidential business information or other private information on the eDisclosure portal as the system is not designed to screen such information. Any material submitted on the portal may have to be released in response to Freedom of Information Act (FOIA) requests. Therefore, an entity that needs to submit confidential business information in support of its disclosure or Compliance Certification must do so manually through the appropriate EPA procedures. Second, unresolved disclosures are not exempt from FOIA production, and current EPA policy places a presumption in favor of production. Therefore, a disclosing entity with an unresolved disclosure may face increased exposure to citizen suits unless EPA determines that a FOIA exemption applies. Lastly, the Audit Policy and Small Business Compliance Policy are discretionary tools that do not create enforceable rights for regulated entities. Therefore, even if a regulated entity fully complies with the voluntary disclosure process, penalty reductions are not guaranteed as a matter of law.
With civil penalties for violations of environmental laws on the rise, companies should consider instituting or enhancing internal auditing processes and systems. By voluntarily discovering, disclosing, and correcting the violations, the regulated community can mitigate the imposition of civil penalties and avoid costly litigation. When potential noncompliance is discovered, procedures should include a quick and thorough consideration of each of the nine criteria of the Audit Policy. The protections of the Audit Policy are valuable, but companies must remember that the standard for receiving them is high.
Small Business Compliance Policy 65 Fed. Reg. 19630–19634 (Apr. 11, 2000)
EPA Announces Renewed Emphasis on Self-Disclosed Violation Policies (May 15, 2018).