OFFICE OF INSPECTOR GENERAL AUDIT REPORT FINANCIAL MANAGEMENT AUDIT OF EPA S FISCAL 1998 FINANCIAL STATEMENTS Report Number 99B0003 SEPTEMBER 28, 1999 ------- Inspector General Divisions Conducting the Audit: Lead Division: Financial Audit Division Washington, D.C. Mid-Atlantic Audit Division Southern Audit Division Atlanta, Georgia Research Triangle Park, NC Northern Audit Division Chicago, Illinois Cincinnati, Ohio Eastern Audit Division Boston, Massachusetts New York, New York Western Audit Division San Francisco, California ADP Audits and Assistance Staff Washington, D.C. Assist Divisions: Philadelphia, Pennsylvania Regional and Program Offices Involved: Agency-wide Cover Photo by Paul T. Jalbert Western Audit Division (California Seashore) ------- UNITED STATES ENVIRONMENTAL PROTECTION AGENCY WASHINGTON, DC 20460 PRCflt0 September 28, 1999 OFFICE OF THE INSPECTOR GENERAL MEMORANDUM SUBJECT: EPA's Fiscal 1998 Financial Statements Audit Report No. 99B0003 FROM: James O. Rauch {signed) Assistant Inspector General for Audit (2421) TO: Sallyanne Harper Chief Financial Officer (2710) Romulo L. Diaz, Jr. Assistant Administrator for Administration and Resources Management (3101) Steven A. Herman Assistant Administrator for Enforcement and Compliance Assurance (2201 A) Attached is our audit report on the Agency's fiscal 1998 financial statements. The report recognizes the efforts that were made to implement the many new accounting and reporting requirements that became effective in fiscal 1998. These efforts resulted in us being able to render a clean opinion on EPA's Agency-wide financial statements. However, Agency management needs to place a high priority on resolving those issues that prevented the Agency from meeting the Government Management Reform Act requirement to provide the Agency's fiscal 1998 audited financial statements to the Office of Management and Budget by March 1, 1999. Improvements in these areas will also result in more timely and reliable information for the day to day management of the Agency's environmental programs. In this particular audit, the OIG did not measure the audited offices' performance against the standards established by the National Contingency Plan (NCP). The findings contained in this audit report are not binding in any enforcement proceeding brought by EPA or the Department of Justice under Section 107 of the Comprehensive Environmental Response, Compensation, and Liability Act (CERCLA) to recover costs incurred not inconsistent with the NCP. ------- 2 In accordance with EPA Order 2750, the primary action official is required to provide us with a written response to the audit report within 90 days of the final audit report date. Since this report deals primarily with financial management issues, we are requesting the Chief Financial Officer, as the primary action official, take the lead in coordinating and providing us a written response to this report. For corrective actions planned but not completed by the response date, reference to specific milestone dates will assist us in deciding whether or not to close this report in our audit tracking system. This audit report contains findings that describe problems the Office of Inspector General has identified and corrective actions the OIG recommends. This audit report represents the opinion of the OIG, and the findings contained in this report do not necessarily represent the final EPA position. Final determinations on matters in this audit report will be made by EPA managers in accordance with established EPA audit resolution procedures. Accordingly, the findings described in this audit report are not binding upon EPA in any enforcement proceeding brought by EPA or the Department of Justice. We have no objections to the further release of this report to the public. Should you or your staff have any questions about the report, please contact Melissa Heist, Divisional Inspector General for Audit, Financial Audit Division, at 260-1479, or Alan Bogus of her staff at 260-4943. Attachment cc: See Report Distribution List ------- EXECUTIVE SUMMARY INTRODUCTION We performed this audit in accordance with the Government Management Reform Act which requires the Environmental Protection Agency (EPA or the Agency) prepare, and the Office of Inspector General (OIG) audit the Agency's financial statements each year. The requirement for audited financial statements was enacted to help bring about improvements in agencies' financial management practices, systems and controls so that timely, reliable information is available for managing Federal programs. OBJECTIVES Our primary objectives were to determine whether: • EPA's principal financial statements are fairly presented, • information presented in the EPA Overview section of the financial statements is consistent with the principal financial statements, • adequate internal controls related to the principal financial statements were in place, and • the Agency complied with applicable laws and regulations that could materially affect the principal financial statements. RESULTS IN BRIEF Opinion on EPA's Fiscal 1998 Financial Statements In our opinion, the Agency's fiscal 1998 financial statements are fairly presented. However, as discussed below, we noted material weaknesses in the Agency's processes for preparing financial statements. These weaknesses prevented the Agency from producing reliable financial statements in a timely manner. Review of the Agency's Overview We did not identify any material inconsistencies between the information presented in the Overview and in the financial statements. Audit Report 99B0003 1 ------- Evaluation of Internal Controls Material Weaknesses The Agency was unable to meet the legislatively mandated March 1 deadline for submitting its audited financial statements to the Office of Management and Budget (OMB) due to difficulties in obtaining information from various Agency offices and external sources, and problems in implementing new accounting standards and OMB reporting requirements. In particular, the Agency encountered significant difficulties in preparing the Statements of Budgetary Resources and Financing due to weaknesses in the Agency's deobligation process, conversion of accounting information from EPA's predecessor accounting system, and errors in recording various accounting transactions. These issues highlight the need for the Agency to strengthen its coordination and quality control processes to ensure accurate data is available to prepare the annual financial statements and to manage the Agency's program activities on an ongoing basis. Further, improvements in the Agency's deobligation process would result in additional funds being made available to be used in support of EPA's environmental goals. We consider the weaknesses we identified in the Agency's financial statement processes to be material weaknesses. The OMB defines a material weaknesses as a situation where internal controls do not reduce to a relatively low level, the risk that errors, fraud or noncompliance in amounts material to the audited financial statements or Required Supplemental Stewardship Information may occur and not be detected in a timely manner by employees in the normal course of performing their assigned functions. Reportable Conditions Reportable conditions are significant internal control weaknesses that could adversely affect EPA's ability to ensure: (1) transactions are executed in accordance with applicable laws; (2) assets are safeguarded against loss from unauthorized acquisition, use, or disposition; and (3) transactions are properly recorded, processed, and summarized to permit the preparation of reliable financial statements and Required Supplemental Stewardship Information in accordance with Federal accounting standards. The reportable conditions we identified involved the need for improvements in: (1) tracking unilateral administrative orders, (2) managing accounts receivable, (3) approving interagency agreement invoices, (4) accounting for capitalized property, (5) recording Superfund State Contract revenue, and (6) documenting automated controls within the Agency's accounting system. Tests of Compliance with Laws and Regulations We did not identify any instances of noncompliance with laws and regulations that would result in material misstatements to the audited financial statements. However, we did note the following two significant noncompliance issues. 11 Audit Report 99B0003 ------- EPA makes disbursements for grants that are funded from more than one appropriation using the oldest available funding (appropriation) first which may or may not be the appropriation that benefitted from the work performed. Thus, EPA is not complying with Title 31 U.S.C. 1301 which requires EPA to match disbursements to the benefitting appropriation. Even though this instance of noncompliance did not result in a material misstatement of EPA's financial statements, it is a significant issue the Agency must address. In addition, as previously noted, the Agency did not meet the Government Management and Reform Act's March 1 deadline for submission of its financial statements to OMB. Compliance with the Federal Financial Management Improvement Act The Federal Financial Management Improvement Act (FFMIA) requires that, as a part of our annual financial statement audits, we determine whether EPA's financial management systems substantially comply with Federal financial management system requirements, applicable accounting standards, and the Standard General Ledger at the transaction level. In addition to the previously discussed material weaknesses in the Agency's processes for preparing financial statements, we also identified the following instance of noncompliance with FFMIA system requirements. Our review of Agency financial management systems under development or operational, as of September 30, 1998, found that management had not approved security plans for seven financial or mixed financial systems, and the approved security plans for the remaining eight systems did not comply with the requirements of OMB Circular A-130, Management of Federal Information Resources. As a result, the Agency did not have reasonable assurance that existing controls would prevent unauthorized disclosure or manipulation of data, or the loss of data in the event of a disaster or accidental or intentional damage. The Agency also reported information security planning as a material weakness in its fiscal 1998 Integrity Act Report. RECOMMENDATIONS To improve the Agency's financial reporting processes, we are recommending the CFO: evaluate the current processes for preparing the annual financial statements, update procedures to reflect new accounting guidance and standards, and establish quality review processes to help ensure the preparation of timely, complete and reliable financial statements; and develop reports for the annual review of unliquidated obligations which highlight older obligations, require responsible officials to justify why unliquidated obligations exist if the period of performance has ended, and follow-up to verify that invalid obligations were deobligated. Audit Report 99B0003 111 ------- To improve the security over EPA's financial systems, we are recommending the CFO: develop a remediation plan which — (1) specifies resources, remedies, and intermediate target dates to bring the Agency's financial systems into compliance with applicable requirements, and (2) addresses the critical security controls outlined in this report. Our report also contains recommendations related to the other internal control and compliance issues we identified during this audit. AGENCY COMMENTS AND OUR EVALUATION In a memorandum dated August 16, 1999, the CFO responded to our draft report. In the response, she indicated that her office believes some of the issues we identified as material weaknesses and reportable conditions were not properly categorized. The CFO agreed with many of the recommendations and indicated corrective actions are planned or ongoing to implement these recommendations. The CFO noted her office is committed to continued improvements in financial management with specific emphasis on improving the process that produces the Agency's financial statements. Management's goal is to prepare reliable, timely financial statements. The CFO appreciated the cooperation from our office over the past several months to resolve the outstanding issues. With respect to compliance with the Federal Financial Management Improvement Act, the CFO believes the Agency is in substantial compliance, and steps are being taken to remedy the deviations with the procedural requirements we noted. The Agency's complete response is included as Appendix II to this report. We will continue to support the Agency's efforts to improve its processes for preparing reliable, timely financial statements. We look forward to working with the Agency to bring about process improvements in financial practices, systems and controls for future financial statements. We have not changed the classification of the reported weaknesses, nor have we changed our conclusion about the Agency's noncompliance with FFMIA. The rationale for our conclusions is included in the appropriate sections of this report. iv Audit Report 99B0003 ------- TABLE OF CONTENTS Page EXECUTIVE SUMMARY i INTRODUCTION i OBJECTIVES i RESULTS IN BRIEF i RECOMMENDATIONS iii AGENCY COMMENTS AND OUR EVALUATION iv ABBREVIATIONS INTRODUCTION 1 PURPOSE 1 BACKGROUND 1 PRIOR AUDIT COVERAGE 2 INSPECTOR GENERAL'S REPORT ON EPA'S FISCAL 1998 FINANCIAL STATEMENTS 4 OPINION ON EPA'S FISCAL 1998 FINANCIAL STATEMENTS 4 OVERVIEW SECTION OF THE FINANCIAL STATEMENTS 5 EVALUATION OF INTERNAL CONTROLS 6 TESTS OF COMPLIANCE WITH LAWS AND REGULATIONS 12 RESPONSIBILITIES AND METHODOLOGY 14 EPA MANAGEMENT RESPONSIBILITIES 14 OIG RESPONSIBILITIES 14 AUDIT METHODOLOGY 14 ATTACHMENT 1 - MATERIAL WEAKNESSES ATTACHMENT 2 - REPORTABLE CONDITIONS ATTACHMENT 3 - COMPLIANCE WITH LAWS AND REGULATIONS ATTACHMENT 4 - STATUS OF PRIOR AUDIT REPORT RECOMMENDATIONS APPENDIX I EPA'S FISCAL 1998 FINANCIAL STATEMENTS APPENDIX II AGENCY'S RESPONSE TO THE DRAFT REPORT APPENDIX III ADDITIONAL OIG COMMENTS ON THE AGENCY'S RESPONSE APPENDIX IV REPORT DISTRIBUTION LIST Audit Report 99B0003 ------- ABBREVIATIONS APF Authorized Program Facility ARTS Asbestos Retrieval Tracking System BAS Budget Automation System BCCP Business Continuity and Contingency Planning CDOTS Contract Delivery Order Tracking System CERCLA Comprehensive Environmental Response, Compensation and Liability Act CFMC Cincinnati Financial Management Center CFO Chief Financial Officer CIO Chief Information Officer CIS Contract Information System CPARS Combined Payroll Redistribution Reporting System CPS Contracts Payment System CTS Superfund Cost Recovery Collection Tracking System DOJ Department of Justice DOPO Delivery Order Project Officer EAD Environmental Accountability Division ESD Enterprise Systems Division EPA Environmental Protection Agency EPAYS EPA Payroll and Personnel System ERRD Emergency Remedial and Response Division ETSD Environmental Technology Services Division FAS Fixed Assets Subsystem FFMIA Federal Financial Management Improvement Act FMD Financial Management Division FMFIA Federal Managers' Financial Integrity Act FMOs Financial Management Offices or Officers FMSD Facilities Management and Services Division FSB Financial Systems Branch GAD Grants Administration Division GAO General Accounting Office GICS Grants Information and Control System GMRA Government Management Reform Act IAGs Interagency Agreements ICMS Integrated Contract Management System IFMS Integrated Financial Management System MARS Management Accounting and Reporting System OAM Office of Acquisition Management OARM Office of Administration and Resources Management OC Office of the Comptroller OCFO Office of the Chief Financial Officer OIG Office of Inspector General Audit Report 99B0003 ------- ABBREVIATIONS OIRM Office Of Information Resources Management OMB Office of Management and Budget OPAC On-Line Payment and Collection System ORC Office of Regional Counsel P2000 Partnership 2000 PMO Property Management Officer PDD Presidential Decision Directive PP&E Property, Plant, and Equipment RMDS Resources Management Directives System RSSI Required Supplemental Stewardship Information RTP Research Triangle Park SARA Superfund Amendments and Reauthorization Act SFFAS Statement of Federal Financial Accounting Standards SIRMO Senior Information Resources Management Officer SPEDI Small Purchase Electronic Data Interchange ssc Superfund State Contract TM Travel Manager UAO Unilateral Administrative Order WCF Working Capital Fund Audit Report 99B0003 ------- INTRODUCTION PURPOSE We performed this audit in accordance with the Government Management Reform Act which requires the Environmental Protection Agency (EPA or the Agency) prepare, and the Office of Inspector General (OIG) audit the Agency's financial statements each year. The objectives of our audit work were to determine if: (1) EPA's principal financial statements1 are fairly presented; (2) the information reported in the EPA Overview section of the financial statements is consistent with information presented in the principal financial statements; (3) adequate internal controls related to the principal financial statements were in place; and (4) EPA management complied with applicable laws and regulations which, if not followed, could have a direct and material effect on the principal financial statements. The Superfund Amendments and Reauthorization Act (SARA) of 1986 requires an audit of obligations and disbursements of the Superfund Trust Fund. Our financial statement audit work encompassed the SARA audit requirements. BACKGROUND EPA's financial statements include two major components — the Superfund Trust Fund and All Other Appropriated Funds. These two components are described below. Superfund Trust Fund Congress established the Superfund Trust Fund in 1980 to identify and clean up spills of hazardous materials and sites contaminated with hazardous substances. The Superfund program is primarily managed by the Office of Solid Waste and Emergency Response and the Office of Enforcement and Compliance Assurance. Much of the day-to-day operation of the program is carried out in EPA's ten regional offices. Other Federal agencies also receive funding to carry out Superfund activities. 1 EPA's principal financial statements consist of the Balance Sheet, Statement of Net Cost, Statement of Changes in Net Position, Statement of Budgetary Resources, Statement of Financing, Statement of Custodial Activity, and the Notes to the Principal Statements. l Audit Report 99B0003 ------- All Other Appropriated Funds All Other Appropriated Funds consists of the State and Tribal Assistance Grants Appropriation which provides financial assistance to help states and tribes develop the technical, managerial and enforcement capacity to operate environmental programs that monitor drinking water systems, implement water quality standards, combat air pollution, promote the use of safer pesticides, manage hazardous waste, and assure compliance with Federal environmental laws. It also includes the Asbestos Loan Program, Leaking Underground Storage Tank Trust Fund, the Oil Spill Trust Fund, the Agency's Working Capital Fund, and the Environmental Program and Management, Science and Technology, Program Research and Operations, and Building and Facilities Appropriated Funds, as well as other miscellaneous funds of EPA. PRIOR AUDIT COVERAGE During previous financial audits, weaknesses that impacted our audit objectives were reported in the areas of: recording unbilled Superfund oversight costs, accounting for and managing Superfund accounts receivable, accounting for and controlling property, analyzing Agency financial activities, recording accrued liabilities for grants, approving payments for interagency agreements, identifying, tracking and reporting EPA's environmental liabilities, recording revenue for Superfund state contracts, documenting EPA's Integrated Financial Management System, complying with federal financial management system requirements, accounting for payments for grants funded from multiple appropriations, reconciling the components of Superfund net position, identifying and allocating indirect costs, reviewing Agency fees, and allocating costs to the Superfund Trust Fund. Attachment 4 summarizes the status of the prior audit report recommendations in each of these areas. Other sections of this report on internal controls and compliance with laws and regulations provide additional details on the current status of the Agency's corrective actions. The Chief Financial Officer (CFO), as the Agency's Audit Follow-up Official, oversees EPA's follow-up on audit findings and recommendations, including resolution and implementation of corrective actions. For these prior audits, final action occurs when the Agency completes implementation of the corrective actions to remedy weaknesses identified in the audit. Audit Report 99B0003 2 ------- We acknowledge that many actions and initiatives have been taken to resolve prior financial statement audit issues. We also recognize that the issues we have reported are complex, and require extensive, long-term corrective actions and coordination by the CFO with various Assistant Administrators, Regional Administrators and Office Directors before they can be completely resolved. A number of issues have been unresolved for a number of years. Our office will continue to work with the CFO in helping them to resolve these issues. 3 Audit Report 99B0003 ------- INSPECTOR GENERAL'S REPORT ON EPA'S FISCAL 1998 FINANCIAL STATEMENTS The Administrator U.S. Environmental Protection Agency: In accordance with the requirements of the Government Management Reform Act (GMRA), we audited EPA's fiscal 1998 financial statements. As described in Note 1, these financial statements were prepared in accordance with provisions of OMB Bulletin 97-01, entitled "Form and Content of Agency Financial Statements," which is considered a comprehensive basis of accounting other than generally accepted accounting principles. The financial statements include expenses of grantees, contractors and other Federal agencies. Our audit work pertaining to these expenses included testing only within EPA. Audits of grants, contracts and interagency agreements performed at a later date may disclose questioned costs of an undeterminable amount at this time. In addition, the United States Treasury collects and accounts for excise taxes that are deposited into the Superfund and Leaking Underground Storage Tank Trust Funds.2 The United States Treasury is also responsible for investing amounts not needed for current disbursements and transferring funds to EPA as authorized in legislation. Since the United States Treasury, and not EPA, is responsible for these activities our audit work did not cover these activities. The Office of Inspector General (OIG) is not independent with respect to amounts pertaining to its operations that are presented in the financial statements. The amounts included for the OIG are not material to EPA's financial statements. The OIG is organizationally independent with respect to all other aspects of the Agency's activities. EPA's Required Supplemental Information and the Annual Stewardship Information are presented for purposes of additional analysis. We reviewed this information to determine if it was consistent with the information in the principal financial statements, but our audit was not designed to express, and we are not expressing an opinion on it. OPINION ON EPA'S FISCAL 1998 FINANCIAL STATEMENTS In our opinion, the financial statements fairly present the: assets, liabilities, and net position; net costs; changes in net position; 2 The Leaking Underground Storage Tank Trust Fund is included in the All Other Appropriated Funds column of the financial statements. Audit Report 99B0003 4 ------- budgetary resources; reconciliation of net costs to budgetary obligations; and custodial activity for the Superfund Trust Fund, All Other Appropriated Funds and the Agency as a whole as of and for the year ended September 30, 1998, in accordance with the basis of accounting described in Note 1 to the financial statements. As described in Note 1, these financial statements were prepared in accordance with applicable provisions of OMB Bulletin 97-01, "Form and Content of Agency Financial Statements," as amended November 20, 1998, which is considered a comprehensive basis of accounting other than generally accepted accounting principles. OVERVIEW SECTION OF THE FINANCIAL STATEMENTS We did not identify any material inconsistencies between the information presented in the Overview and in the financial statements. During this audit, we did not perform sufficient audit work to express an opinion on the performance information included in the Overview. Our audits of EPA's programmatic areas have identified weaknesses in the environmental data information systems used to generate data used for managing the Agency's environmental programs and presented in the Overview. The Agency has taken steps to enhance data quality, but recognizes major challenges still exist. The Agency has several initiatives underway to address data quality and ensure that environmental data systems contain timely and accurate data. The Overview also contains information on the state of readiness of the Agency's systems to deal with the Year 2000. EPA reports that its mission critical financial and mixed financial systems are already Year 2000 compliant. The Agency also reports that its core financial systems have addressed both internal and external data exchanges. EPA has implemented an independent certification program administered through an interagency agreement with the Department of Transportation to test all mission critical systems. To date, the results of independent verification tests on financial systems have not been formally reported. In addition, the Agency still needs to address the issue of establishing required contingency plans to ensure uninterrupted financial operations in the case of unexpected technical difficulties. All regional and Headquarters offices are required to develop Continuity of Operations Planning (COOP) plans. Following completion of individual COOP plans, an overarching Agency plan will be developed in accordance with Presidential Decision Directive #67 which requires EPA to have an Agency plan by October 1999. As a part of this process EPA expects to develop Business Continuity and Contingency Planning (BCCP) for the Year 2000 program. The Agency's Year 2000 Senior Council has directed that an interdisciplinary team be formed to develop the Year 2000 BCCP that will be an addendum to the overarching COOP Agency plans. Lastly, the Agency is reassessing its non-mission critical systems, central and local infrastructure, and buildings and facilities, and will develop remediation plans to address noted weaknesses. 5 Audit Report 99B0003 ------- EPA expects to closely monitor progress in these areas and will receive monthly status reports from various regional and program offices starting in July 30, 1999. EVALUATION OF INTERNAL CONTROLS We evaluated the Agency's internal control structure: (1) to determine the audit procedures necessary to express an opinion on the financial statements, and (2) to determine whether the internal controls provide reasonable assurance that: transactions are properly recorded, processed, and summarized to permit the preparation of reliable principal financial statements in accordance with Federal accounting standards; financial transactions are executed in compliance with applicable laws and regulations; and assets are safeguarded against loss from unauthorized acquisition, use or disposition. Our objective in evaluating controls was not to express an opinion on controls. Accordingly, we do not express such an opinion. Our evaluation would not necessarily disclose all matters in the internal control structure that might be reportable conditions or material weaknesses. Because of inherent limitations in any internal control structure, losses, noncompliance, or misstatements could occur and not be detected. Also, projecting our evaluation of internal controls to future periods is subject to the risk that controls may become inadequate because of changes in conditions, or the degree of compliance with such controls may deteriorate. Material Weaknesses OMB Bulletin 98-08, "Audit Requirements for Federal Financial Statements," defines a material weakness as a situation where internal controls do not reduce to a relatively low level, the risk that errors, fraud or noncompliance in amounts material to the audited financial statements or Required Supplemental Stewardship Information may occur and not be detected in a timely manner by employees in the normal course of performing their assigned functions. In evaluating the Agency's internal control structure, we identified the following material weaknesses. Although CFO staff and managers committed to meeting the March 1 deadline for submitting EPA's audited financial statements to OMB, they were unable to meet the deadline due to difficulties in obtaining information from other Agency offices and external sources, and problems in implementing the new financial standards and OMB reporting requirements. In particular, the Agency encountered significant difficulties in preparing the Statements of Budgetary Resources and Financing due to weaknesses in the Agency's deobligation process, conversion of accounting information from EPA's predecessor accounting system, and errors in recording various accounting transactions. These issues highlight the need for the Agency to strengthen its coordination and quality control processes to ensure accurate data is available to Audit Report 99B0003 6 ------- prepare the annual financial statements and to manage the Agency's program activities on an ongoing basis. Further improvements in the Agency's deobligation process would result in additional funds becoming available to be used in support of EPA's environmental programs. Attachment 1 describes weaknesses in the Agency's financial statement processes in more detail, including the Agency's ongoing and planned corrective actions and additional corrective actions we are recommending. Reportable Conditions We also identified the following reportable conditions. OMB Bulletin 98-08 defines a reportable condition as an internal control weakness that could adversely affect EPA's ability to ensure: (1) transactions are executed in accordance with applicable laws; (2) assets are safeguarded against unauthorized acquisition, use, or disposition; and (3) transactions are properly recorded, processed, and summarized to permit the preparation of reliable financial statements and Required Supplemental Stewardship Information in accordance with Federal accounting standards. Attachment 2 describes each of these reportable conditions in more detail. • EPA's regions are not consistently tracking demands for payment made under Comprehensive Environmental Response, Compensation and Liability Act Section 106 Unilateral Administrative Orders (UAOs).3 Amounts demanded under UAOs are significant and need to be tracked and controlled. In three regions, we identified $11 million in demands made under UAOs. Other regions either had no record of the amounts demanded under UAOs, or the amounts were not demanded because the UAOs did not include a provision to request reimbursement of oversight costs. When amounts are not tracked in IFMS they cannot be followed up on. Also, the potential exists for multiple demands to be issued for the identical cost to the same or different parties resulting in duplicate collections. Tracking the amounts demanded in IFMS would allow the Agency to maintain better control over the amounts demanded and collected. • During fiscal 1998, the Agency continued its efforts to improve controls in the accounts receivable area by issuing additional guidance and instructing Financial Management Offices (FMOs) to conduct quality assurance reviews covering this area. We continued to find some accounts receivable, including those for oversight costs, that were not timely recorded and billed; outstanding receivables that were not timely followed up on and written off; and allowances for doubtful accounts that were not properly computed. Consequently, some accounts receivable may not have been correctly valued and timely collected. These problems were caused primarily by Offices of Regional Counsel and program offices not timely forwarding documentation to Agency FMOs, and FMO staff being unsure about the methodology they were to use to compute the allowance for doubtful accounts. 3 Unilateral Administrative Orders are one of the Agency's primary enforcement tools to compel responsible parties to conduct response actions. The Agency may demand payment for costs it incurs in overseeing the response actions. 7 Audit Report 99B0003 ------- • Some Agency project officers were not fulfilling one of their program oversight duties, that of reviewing invoices for interagency agreements. In addition, some project officers were not obtaining and reviewing supporting cost information for amounts billed by other agencies. The Agency needs to continue making improvements in this area, so that it can be assured that payments are only made for costs billed that are valid and allowable under the terms of its interagency agreements. • For a number of years, we have reported on the need for the Agency to make improvements in accounting for its property. The Agency has taken actions to permanently resolve these issues, and we commend the Agency for its continuing efforts to correct weaknesses in this area. The results of this audit show there are still issues remaining where additional improvements are needed. We again found property that was not recorded timely or accurately, and property that was capitalized when it should have been expensed. In addition, we found weaknesses in the reconciliation of property information in the Agency's accounting system with information contained in the property subsystem. Such weaknesses impact the quality of data available to manage the Agency's resources and increase the risk of theft, loss or misuse of the property. • During fiscal 1998 and prior years, EPA did not properly recognize revenue on its Superfund State Contracts. Although significant progress has been made in resolving problems that have existed in this area, we found a few issues remained, primarily at three of the six FMOs where we tested these accounts. Consequently, material adjustments were needed to fairly present the financial statements. If regional FMOs had been performing analytical reviews of these accounts, these errors could have been identified and corrected before becoming an audit issue. • We continue to be unable to assess the adequacy of the automated internal control structure for accounting transactions contained in the Agency's Integrated Financial Management System. During past audits, we reported that the Agency's documentation for the system did not contain the level of detail necessary to construct tests of automated controls necessary for a financial statement audit. Agency management acknowledged that the IFMS data dictionary could be improved. However, management also believes that data dictionary enhancements would not be cost effective considering the system's maturity, and concurs with a recent Department of Treasury review which recommends that the Agency defer development of a detailed data dictionary until it is ready to transition to a new system. We will obtain and assess the Treasury review team's analysis concerning documentation requirements, as a part of our fiscal 1999 financial statement audit. In addition, we will continue to participate as a consultant on the Agency's workgroup to replace the payroll system. In addition to the above reportable conditions resulting from our audit of the Agency's financial statements, our office completed an audit to determine the adequacy of critical mainframe operating system software controls. We identified the following weaknesses: Audit Report 99B0003 8 ------- • EPA is not maintaining and reviewing Authorized Program Facility (APF) libraries4 in a timely manner. Specifically, we identified libraries that no longer require APF authorization. Without effectively managing the contents of the APF, EPA management cannot be assured programs running in an authorized state will adhere to system integrity5 requirements or Agency integrity guidelines. EPA is not adequately controlling the number of users who have ALTER and/or UPDATE access capabilities to APF libraries. Specifically, we identified users that no longer needed this type of access to perform their current jobs. Also, we identified user IDs assigned to positions and not individuals. Without effective access controls to the APF, a knowledgeable user could circumvent or disable security mechanisms and/or modify programs or data files on the computer without leaving an audit trail. EPA is not maintaining Program Property Tables (PPT) or Exits. In addition, EPA is using nonstandard Supervisor Calls (SVCs). Full implementation of prior APF-related recommendations should resolve these weaknesses. Furthermore, because these deficiencies do not significantly put the operating system at risk, we only made suggestions for improving the PPT, SVC and EXIT controls. Our office also conducted follow-up audits of physical and environmental information systems general controls at a number of EPA regions. The follow-up audits assessed the implementation of corrective actions to improve physical and environmental controls, thereby ensuring the security and reliability of regional computer facilities and data. We also evaluated the adequacy of approved security plans for regional general support systems. The following matrix summarizes continuing security concerns: Regional Follow-i tip Audits: Physical, E .nvironmci ital, and D isaster Ret :overy Cont rols CRITICAL SECURITY CONTROLS Region 1 Region 2 Region 3 Region 4 Region 5 Region 9 Cincinnati 1. Independent review of current security operations completed. (OMB A-130) no no yes no yes no yes 4 An operating system mechanism for identifying and specifically authorizing programs which are to process in an unrestricted or privileged instruction mode. 5 System integrity is the ability of the system to protect itself against unauthorized user access to the extent that security controls cannot be compromised. 9 Audit Report 99B0003 ------- Regional Follow-i tip Audits: Physical, E .nvironmci ital, and D isaster Ret :overy Cont rols CRITICAL SECURITY CONTROLS Region 1 Region 2 Region 3 Region 4 Region 5 Region 9 Cincinnati 2. Security Plan level of detail was sufficient to adequately address required subjects. (OMB A-130)6 no no no no no no no 3. Contingency/disaster recovery plan existed and was acceptable. (OMB A-130, & NIST guides) no no no no no no no 4. Security training was adequate. (OMB A-130 & Security Act of 1987) no no no no no no no Although we have issued separate audit memorandums containing our recommendations to correct these remaining deficiencies, we believe these matters are significant enough to warrant mention in this report because they relate to the Agency's financial statements. Specifically, general support systems, regardless of the regional location, support and help control access to EPA's financial systems. If general controls over EPA's regional general support systems are adequate, then these systems help provide reasonable assurance that the financial data, used to prepare the financial statements, is sufficiently protected from unauthorized access or abuse. Conversely, control deficiencies related to general support systems weaken the first line of defense and reduce the assurance which can be placed on the integrity of financial data. We will also report these continuing weaknesses to the Agency's Director for Information Resources Management. Comparison of EPA'S FMFIA Report with Our Evaluation of Internal Controls As required by OMB Bulletin 98-08, we compared EPA's Federal Managers' Financial Integrity Act (FMFIA or the Integrity Act) Report with our evaluation of the Agency's internal control systems. For reporting under FMFIA, material weaknesses are defined differently than they are defined for financial statement audit purposes. OMB Circular A-123, "Management Accountability and Control" defines a material weakness under FMFIA as a deficiency that the 6 A security plan should include the following detailed information: ! description of security related controls used by the system, ! adequacy and effectiveness of those security controls, ! internal control weaknesses identified, ! controls planned to correct each identified weakness with milestone dates for their implementation, ! compensating controls, and ! standard operating procedures for subjects required by OMB A-130. Audit Report 99B0003 10 ------- Agency head determines to be significant enough to be reported outside the Agency. OMB Bulletin 98-08 defines a material weakness for financial statement audit purposes as a weakness in controls that creates a risk that errors, fraud or noncompliance in amounts material to the financial statements could occur and not be timely detected. As a part of the fiscal 1998 Integrity Act process, the Agency reported the following three material weaknesses that relate to the Agency's financial statements. Construction Grants Close Out. Of the more than $50 billion in construction grants awarded in the last 20 years, grants totaling $6.3 billion remained to be closed out at the end of fiscal 1998. In 1992, EPA designated this area as an Agency weakness and in 1996 reclassified it as a material weakness due to the concern that lack of Agency-wide attention might result in the loss of resources to properly complete the program. In addition, there were concerns that millions of dollars in potentially ineligible program costs might not be available for reuse on other high priority state clean water projects. The Agency projects that it will close out all construction grants by 2002. Grants Close Out and Oversight of Assistance Agreements. Our audits have shown that Agency staff have not adequately managed assistance agreements. Agency project files lacked documentation to show that EPA monitored progress on the projects or required recipients to complete projects and submit the required close out documentation. This lack of oversight resulted in a significant backlog of assistance agreements to be closed out. As of the end of fiscal 1998, EPA reported that it had closed out 16,700 of the original 20,000 backlog of grants to be closed. Information Systems Security Plans. Our audits have found deficiencies in the Agency's information security planning. Information security programs must include the development and maintenance of information security plans, and a strategy to conduct management reviews. To date, this has not occurred. At risk, is the possible unauthorized access, use, modification or destruction of EPA information resources that could result from these vulnerabilities. The Agency is in the process of implementing corrective action strategies. We consider this weakness a Federal Financial Management Improvement Act noncompliance. The following section of this report discusses weaknesses in this area as they relate to the Agency's financial systems. As a part of the Agency's Integrity Act process, the Agency did not identify and report material weaknesses in its financial statement preparation process. Also, the CFO's March 15, 1999, management representation letter to the GAO, OMB and Treasury, in conjunction with the Government-wide financial statement audit, did not identify weaknesses in the Agency's financial statement preparation process. We believe the lack of identification and reporting of weaknesses in this area represents a material weakness in the Agency's Integrity Act process. 11 Audit Report 99B0003 ------- TESTS OF COMPLIANCE WITH LAWS AND REGULATIONS We tested compliance with those laws and regulations that could either materially affect the financial statements or Required Supplemental Stewardship Information, or that OMB or we considered significant to the audit. Our compliance testing did not disclose any material misstatements to the financial statements as a result of noncompliance with laws and regulations. However, the objective of our audit, including our tests of compliance with applicable laws and regulations, was not to provide an opinion on overall compliance with such provisions. Accordingly, we do not express such an opinion. There are a number of ongoing investigations involving EPA's grantees and contractors which could reveal violations of laws and regulations, but a determination about these cases has not been made. Federal Financial Management Improvement Act Compliance As required by the Federal Financial Management Improvement Act (FFMIA), as a part of our audit, we assessed whether EPA's financial management systems substantially complied with Federal financial management systems requirements, applicable accounting standards, and the Standard General Ledger at the transaction level. In planning, performing and reporting on our tests of compliance, we followed OMB Bulletin 98-08, "Audit Requirements For Federal Financial Statements." We found EPA was not in substantial compliance with the FFMIA requirements because of weaknesses in the Agency's financial statement preparation process. In addition, the following issues related to the Agency's financial management systems that were operational or under development, caused the Agency to be in substantial noncompliance with FFMIA as of September 30, 1998. Specifically, we found that approved security plans for eight financial or mixed financial systems did not comply with the requirements of OMB Circular A-130, "Management of Federal Information Resources," and management had not approved security plans for the remaining seven financial or mixed systems, as required by OMB Circular A-130. As a result, the Agency does not have reasonable assurance that existing controls would prevent unauthorized disclosure or manipulation of data, or the loss of data in the event of a disaster or accidental or intentional damage. For additional information concerning these security plan issues, please refer to Attachment 3. Other Noncompliance Issues We also identified the following noncompliance issue that did not cause a material misstatement to the financial statements, but is nonetheless significant. EPA is not complying with appropriation law when making disbursements for grants funded with more than one appropriation. Disbursements for these grants are made using the oldest available funding (appropriation) first which may or may not be the appropriation that benefitted from the work performed. Thus, EPA is not complying with Title 31 U.S.C. 1301 which requires EPA to match disbursements to the benefitting appropriation. We have reported on this noncompliance issue in Audit Report 99B0003 12 ------- prior financial statement audit reports. Attachment 4, Status of Prior Audit Report Recommendations, page 4-7, provides the current status of the ongoing corrective actions. In addition, as previously noted, the Agency did not meet the Government Management and Reform Act's March 1 deadline for submission of its audited financial statements to OMB. 13 Audit Report 99B0003 ------- RESPONSIBILITIES AND METHODOLOGY EPA MANAGEMENT RESPONSIBILITIES EPA's management is responsible for: preparing annual financial statements and Required Supplemental Stewardship Information; establishing and maintaining a system of internal controls; and complying with applicable laws and regulations. OIG RESPONSIBILITIES We are responsible for: auditing the financial statements to determine if they are free of material misstatements and presented fairly in accordance with Federal accounting standards, and evaluating related internal controls and testing compliance with applicable provisions of laws and regulations. AUDIT METHODOLOGY In order to fulfill our responsibilities, except as described in our opinion on the financial statements, we: examined on a test basis, evidence supporting the amounts and disclosures in the principal financial statements; assessed the accounting principles used and significant estimates made by management; evaluated the overall presentation of the financial statements; obtained an understanding of the significant internal control structure policies and procedures, determined whether they had been placed in operation, and assessed the level of control risk relevant to the following significant cycles, classes of transactions, and account balances: Receivables and Collections Disbursements and Operating Expenses Audit Report 99B0003 14 ------- • Payroll Investments Property Budget and Obligations Accounts Payable and Accrued Liabilities Fund Balances General Accounting and Financial Reporting gained an understanding of the significant internal control policies and procedures related to the Annual Stewardship Information; tested significant manual controls to determine whether the controls were effective; evaluated the adequacy of: (1) the general automated data processing control structure for backup and disaster recovery, (2) physical and environmental security controls, (3) regional security plans, and (4) the software maintenance processes affecting EPA's financial management systems; evaluated the adequacy of controls over critical operating systems libraries; evaluated the adequacy of security plans and disaster recovery plans for the Agency's financial and mixed financial systems; evaluated the controls over EPA's technical support and maintenance contract for the Agency's core financial systems; evaluated operational controls separate from other compliance reviews, as outlined in our multi-year plan to review ADP general controls which was endorsed by General Accounting Office representatives; evaluated the adequacy of the accounts receivable systems documentation for the Integrated Financial Management System; followed-up on findings and recommendations from previous audits that could materially affect the financial statements; obtained an understanding of management's process for evaluating and reporting on internal controls and accounting systems, as required by FMFIA; compared the material weaknesses reported in the Agency's FMFIA report to the material weaknesses we found; Audit Report 99B0003 ------- tested compliance with applicable sections of laws and regulations that either materially affect the financial statements or that OMB or our office considered significant to the audit; and performed sufficient tests to report whether EPA's financial management systems substantially comply with Federal financial management systems requirements, applicable accounting standards, and the Standard General Ledger at the transaction level. Detailed system documentation was not available that would have allowed us to develop an understanding of the IFMS automated control structure and to test these controls. The information presented in Management's Overview of EPA and EPA Programs is supplemental information required by OMB Bulletin 97-01, entitled "Form and Content of Agency Financial Statements." OMB Bulletin 98-08, "Audit Requirements for Federal Financial Statements," requires that we obtain an understanding of the internal controls designed to ensure that data supporting the measures are properly recorded and accounted for to permit the preparation of reliable and complete performance information. Our audit work in the area of performance measures was limited to comparing the financial information included in the overview with information contained in the principal financial statements. Details of Audit Field Work We selected statistical and non-statistical samples from EPA's detailed accounting records supporting various financial statement amounts. We tested these sample transactions to determine if they were adequately supported by documentation and were recorded in accordance with internal control policies and procedures and applicable laws and regulations. We also reviewed other supporting documentation, such as worksheets and schedules, that the Agency used in preparing its financial statements. In addition, we applied certain analytical review procedures to account balances. The financial management records and supporting documentation we reviewed were maintained by Financial Management Centers in Washington, D.C., Research Triangle Park, Cincinnati and Las Vegas; Financial Management Offices in EPA's regional offices; the Office of the Chief Financial Officer; various offices within the Office of Administration and Resources Management; and by Headquarters and regional program offices. To gain an understanding of established internal control procedures, and to evaluate these controls, we also interviewed personnel in these offices and reviewed applicable policies and procedures. In addition, we conducted a physical inventory of a sample of property items, and we observed the Agency's physical inventory of its property. Our fieldwork for the audit was performed from May 29, 1998 through July 8, 1999. Except as previously discussed in this report, we conducted our audit work in accordance with: generally accepted auditing standards; the standards applicable to financial audits contained in the Government Auditing Standards (1994 Revision), issued by the Comptroller General of the Audit Report 99B0003 16 ------- United States; and OMB Bulletin No. 98-08, as amended January 25, 1999. These standards require that we plan and perform our audits to obtain reasonable assurance that the financial statements are free of material misstatement. We believe that our audit provides a reasonable basis for our opinions. James O. Rauch (signed) Assistant Inspector General for Audit U.S. Environmental Protection Agency July 8, 1999 17 Audit Report 99B0003 ------- ATTACHMENT 1 MATERIAL WEAKNESSES TABLE OF CONTENTS Page 1 - IMPROVEMENTS NEEDED IN THE AGENCY'S PROCESS FOR PREPARING FINANCIAL STATEMENTS 1-1 2 - AGENCY ENCOUNTERED SIGNIFICANT DIFFICULTIES IN PREPARING THE STATEMENTS OF BUDGETARY RESOURCES AND FINANCING 1-5 Audit Report 99B0003 ------- IMPROVEMENTS NEEDED IN THE AGENCY'S PROCESS FOR PREPARING FINANCIAL STATEMENTS Substantial planning and coordination is needed to ensure audited financial statements can be provided to the Office of Management and Budget (OMB) by March 1 of each year, as established by the Government Management Reform Act (GMRA). OMB Bulletin 98-08 requires that audited financial statements be prepared and submitted to the agency head in sufficient time to enable the agency head to meet the GMRA due date. To ensure timely completion of the fiscal 1998 audited financial statements, our office and the Office of the Chief Financial Officer (OCFO) agreed that the OCFO would provide us a complete set of draft financial statements with related footnotes and overview information by November 17, 1998, with the exception of selected items that would be provided no later than December 31, 1998. We jointly agreed that November 17 would allow the OCFO enough time to prepare the financial statements, and our office sufficient time to perform our audit work and issue our final audit report by February 24, 1999. Although committed to the above milestones, the OCFO encountered difficulties in preparing timely, reliable financial statements and footnotes and did not meet the March 1 report issuance date. On November 17, 1998, we received five of the six Agency-wide and FIFRA principal statements and the two Working Capital Fund principal statements. The statements we received included some line items that were incomplete and amounts that were based on IFMS general ledger data which did not include some adjusting journal entries, the general ledger did not properly crosswalk to some line items, and all Treasury symbols were not reflected. Footnotes were also missing. OCFO staff were still obtaining information needed to finalize the financial statements and providing supporting documentation to us in July 1999. The OCFO's current process for preparing financial statements needs to be improved, so the Agency can submit audited financial statements to OMB by March 1 of each year, and so Treasury can submit the Government-wide statements to the President and the Congress by March 31, as required by GMRA. In contrast, the timely completion of the Overview demonstrated the OCFO's ability to work cooperatively with program offices and take a proactive approach. OCFO staffs advanced planning and coordination assisted in the Overview's completion. Contacts were established early on within program offices, basic instructions and interim time frames were discussed, concerns were resolved and agreements reached. Program offices timely submitted information to the OCFO for inclusion in the Overview. Once consolidated, the program offices were given the opportunity to review the Overview's content prior to submission for audit. The difficulties encountered by the OCFO staff in providing us with complete and reliable financial statements and supporting documentation by the mutually agreed upon dates included: delays in obtaining information from other Agency offices and external sources, and problems implementing new financial accounting standards and OMB guidance. These issues highlight the need for the Agency to strengthen its coordination and quality control processes to ensure 1-1 Audit Report 99B0003 ------- accurate data is available on a timely basis to prepare the financial statements and key financial statement preparation milestones are met. Additional details are provided below. Obtaining Information from Other Agency Offices and External Sources Delays in obtaining information from various entities inside and outside the Agency prevented the timely calculation of the grant accrual, deferred maintenance, and environmental liability amounts. In order for the Agency to determine the amount of the grant accrual liability to be presented on the financial statements, selected grantees must provide EPA with information on the amount of expenses they have incurred but not billed as of September 30. Although grantee responses were due by November 30, 1998, the OCFO did not receive all grantee responses until January 11, 1999. The final grant accrual calculation was not completed until late-February 1999. To improve the timeliness of this calculation, the Agency would like to move from grantee confirmations to reliance on internal analyses to calculate the grant accrual amount. We also found the Agency experienced difficulties in identifying and obtaining deferred maintenance and environmental liability amounts and supporting documentation from the various EPA facilities and laboratories who were required to compile this information. Responses were due by September 28, 1998, but all responses were not obtained until February 11, 1999. OCFO staff provided us information as they received it, so we could audit it. However, the associated footnotes were not completed and the amounts to be recorded on the financial statements were not known until late- February 1999. Implementing New Financial Accounting Standards and OMB Financial Statement Guidance The need to implement, during fiscal 1998, new federal financial accounting standards along with new OMB financial statement presentation requirements also impacted the Agency's ability to timely prepare its financial statements. For example, the Required Supplemental Stewardship Information (RSSI) was delayed in order to resolve an issue dealing with the presentation for the investment in human capital. The RSSI was completed December 6, 1998, but the supporting documentation was not made available for us to audit until January 6, 1999. In addition, we found the Agency was not sufficiently prepared to deal with the new requirements for reporting budgetary accounts in the Statement of Budgetary Resources and Statement of Financing. The Agency concurred that the preparation of these statements posed significant challenges. (Details on the Agency's preparation of these two new statements are included in the material weakness entitled, "Agency Encountered Significant Difficulties in Preparing the Statements of Budgetary Resources and Financing.") Considering all of the new requirements for the presentation of financial statements and the accounting standards which have recently become effective, the Agency agreed its guidance for preparing annual financial statements needed to be updated. Performing Quality Control Reviews of Financial Statement Information Regional finance offices' miscalculation of the allowance for doubtful accounts required a subsequent recalculation. We are concerned that the Agency had not reviewed the allowance Audit Report 99B0003 1-2 ------- calculation results nor recognized the discrepancies. We also found some journal entries for the revenue recognition on State Cost Shares were incorrectly made, and numerous adjustments were needed to the draft financial statements. Given the completeness and accuracy of the information contained in the draft financial statements and related footnotes, the Agency should establish and implement a quality review process including managerial sign-off to assure the preparation of complete and reliable financial statements. RECOMMENDATIONS We recommend the Chief Financial Officer (CFO): 1.1 evaluate the OCFO's process for preparing the financial statements, including the OCFO resources assigned, necessary improvements to IFMS, control processes within the Financial Reports and Analysis Branch, and the Year-End Closing process, 1.2 update the Agency's policies and procedures for preparation of annual financial statements to reflect the new legislative requirement, new accounting standards, and new format and presentation requirements. The procedures should include milestone dates and activities for completion, OCFO and other offices' roles and responsibilities, descriptive processes for preparing the financial statements, and plans for obtaining the needed information and providing reliable supporting documentation, and 1.3 establish a quality review process to ensure that the draft financial statements including the footnotes, supplemental information, and overview are complete and reliable, and the Director, FMD, certifies such documents prior to submittal for audit. AGENCY COMMENTS AND PIG EVALUATION In responding to the draft report, the CFO disagreed that the financial statement preparation process should be categorized as a material weakness. Even though the Agency made a conscious decision to delay the final preparation to address issues to ensure unqualified opinions, the CFO noted that reliable financial statements were prepared. The CFO agreed with our recommendations and (1) has prepared a draft planning document with milestones and responsibilities for the fiscal 1999 audit, (2) plans to update the policies and procedures on preparing financial statements, and (3) is formalizing a financial statement Quality Control Group. The CFO did not agree with our draft report recommendation that the Comptroller should certify the financial statements prior to submittal for audit. Rather the CFO believes that certification by the Director of the Financial Management Division (FMD) is appropriate. We believe that the cited weaknesses in the Agency's financial statement processes are significant enough to be reported as a material weakness, as reliable financial statements could not be 1-3 Audit Report 99B0003 ------- prepared by March 1. The requirement for audited financial statements was enacted to bring about improvements in agencies' financial practices, systems, and controls so that timely, reliable information is available for managing Federal programs. We previously raised this weakness in our management letter that was issued at the conclusion of the fiscal 1997 audit. We concur with the Agency's planned corrective actions, but note the planned target dates should be revised to allow for earlier implementation, so they will be in place for the fiscal 1999 audit. We revised the recommendation to state that the Director, FMD, rather than the Comptroller should certify documents submitted for audit. Audit Report 99B0003 1-4 ------- AGENCY ENCOUNTERED SIGNIFICANT DIFFICULTIES IN PREPARING THE STATEMENTS OF BUDGETARY RESOURCES AND FINANCING EPA encountered significant difficulties in preparing its fiscal 1998 Statements of Budgetary Resources and Financing. First, EPA was not timely identifying and deobligating obligations for some of its inactive grants, contracts and interagency agreements (IAGs), as required by GAO, OMB, Department of Treasury and EPA policies. As a result, after the close of the fiscal year the Agency performed an additional review of its open obligations to help ensure open obligations reported on the Statements of Budgetary Resources and Financing were fairly presented. This review identified $99.6 million of open obligations that needed to be deobligated. This review also identified a problem with incorrect conversion during 1989 of accounting transactions from the predecessor accounting system to IFMS. Consequently, the unliquidated obligation balance of $12.8 million and the authority balance of $43.5 million from 1989 and prior may be misstated. Finally, significant differences existed between the Agency's general ledger, the numerous drafts of its Statement of Budgetary Resources, and the budgetary reports submitted to OMB. These differences existed due to prior period posting errors, reimbursable transactions, posting of activities to improper accounts, and various other unidentified transactions. All of these weaknesses prevented the Agency from preparing timely and accurate Statements of Budgetary Resources and Financing. Weaknesses in EPA's Deobligation Process Weaknesses in EPA's deobligation process have been previously documented by both internal and external reports. Since 1996, EPA has reported in its annual Integrity Act Report, two material weaknesses related to the closeout of grants. In addition, EPA has a substantial backlog of inactive contracts awaiting closeout.7 Significant unliquidated obligation balances remain for these inactive grants and contracts. GAO reported that as of June 30, 1998, inactive nonconstruction grants and contracts accounted for approximately $428.9 million in unliquidated obligations. Inactive construction grants had unliquidated obligations of about $183.2 million as of March 30, 1998.8 Other reports have also documented these problems.9 The Agency is taking steps to correct weaknesses in its close out of grants and contracts. EPA Office of the Comptroller Policy Announcement No. 96-04 and OMB guidance require EPA to review unliquidated obligations at least once a year to ensure that transactions are valid. As a 7 EPA's Progress in Closing Completed Grants and Contracts (GAO/RCED-99-27, November 1998) 8 GAO used the following criteria for identifying inactive grants and contracts: (1) nonconstruction grants - 180 days after all terms and conditions are completed; (2) construction grants - 6 months after the last grant action; and (3) contracts - contractor has delivered all goods or performed all services as required, or EPA has notified the contractor of contract termination. 9 Region 2's Deobligation and Closeout of Construction Grants (EPA-OIG, Report No. E1FWF7-02-0011-8100037, January 1998) and Funds Obligated for Completed Superfund Projects (GAO/RCED-98-232, July 1998) 1-5 Audit Report 99B0003 ------- part of the annual review of obligations, the Financial Systems Branch and both Cincinnati and Research Triangle Park Financial Management Centers send reports to each responsible office. These reports identify items for review. For travel obligations, the reports include items with no activity in the last three months. For all other obligations, the reports include items with no activity in the last six months. EPA's policy requires responsible officials to review these reports for the purpose of identifying unneeded funds and then initiating deobligation of the funds. Once this work is completed, responsible officials are required to certify that a review of unliquidated obligations has been completed. These certifications are then sent to the Financial Reports and Analysis Branch for review. We performed audit work on these reviews in five regional offices and one Headquarters office. Our work discovered problems with obligation reviews in the areas of identifying and deobligating unneeded obligations. Our audit work discovered a total of $7.1 million of unneeded obligations which were either not identified by the Agency's annual review or when identified were not deobligated. In one region, we found a contract with an unliquidated obligation balance of $1.8 million which was identified, but not deobligated. The project officer did not process this deobligation because he was unsure of the procedures. In another region, reviews in fiscal years 1996, 1997 and 1998 identified a contract that needed to be deobligated, but the funds were not deobligated on this contract until July 1998. Agency's Actions to Correct Weaknesses in the Fiscal 1998 Deobligation Process To correct weaknesses we identified in this area, the Financial Management Division (FMD) initiated an additional review, after fiscal year-end, to identify unneeded unliquidated obligations as of September 30, 1998. FMD selected older obligations and requested responsible officials to again review these items. For each item reviewed, officials were required to deobligate the unneeded unliquidated obligation or report the reason for keeping it open. They reviewed unliquidated obligation balances of $150 million for IAGs, $45 million for contracts, $698.5 million for nonconstruction grants and $283.3 million for construction grants. The review identified unneeded obligations of $20.2 million for IAGs, $6.6 million for contracts, $7.4 million for nonconstruction grants and $65.4 million for construction grants. FMD used this information to adjust the Statements of Budgetary Resources and Financing. The current review requires personnel to examine travel and all other obligations with no activity in the last three and six months, respectively. We believe the Agency's year-end obligation review work confirms the need for annual obligation reviews to focus on older open unliquidated obligation balances. Additionally, the OCFO should perform follow up work to verify that all obligations identified as being invalid are deobligated. Until EPA improves its process for reviewing its unliquidated obligations, it will have limited assurance of the validity of its unliquidated obligation balances. Consequently, unliquidated obligations reported on both the Statement of Budgetary Resources and the Statement of Financing may be materially misstated. In addition, the Agency is missing opportunities to deobligate and use funds for other approved projects in support of EPA's environmental goals. Audit Report 99B0003 1-6 ------- Data Conversion Errors Although the Agency's subsequent review of open obligations was successful in identifying unneeded unliquidated obligations, it identified an additional problem. Unsupported obligations were identified for 3 construction grants and 3 nonconstruction grants. These errors were caused by problems with conversion of accounting data when EPA implemented a new accounting system, IFMS, in 1989. The change in accounting systems required EPA to convert accounting data into IFMS compatible format. The conversion included information used to calculate obligation balances. IFMS calculates unliquidated obligation balances by adding up obligation transactions and subtracting out payments and other adjustments. For the unsupported unliquidated obligations, we found that obligation transactions were properly converted, but payments made in 1989 and prior were not. This problem may have occurred in all unliquidated obligation balances appropriated in 1989 and prior. As a result, EPA has no assurance of the validity of obligation balances of $12.8 million appropriated in fiscal year 1989 and prior years. FMD informed us that they had identified this problem shortly after the system change and provided finance officers with instructions to fix this problem. When finance officers found unliquidated obligation balances with missing payment information, they were instructed to record the missing payments against the obligation. This transaction would correct unliquidated obligation balances but would overstate cash disbursements. To correct cash disbursements, finance officers were instructed to decrease the current year's cash disbursements for the corresponding amount. FMD personnel believed that all conversion errors were identified and fixed as a result of these instructions. They stated that unrecorded payments from 1989 and prior have not been identified in the last several years. The unliquidated obligation balance may not be the only account misstated. The problem would have been isolated to obligations, if a finance officer correctly identified a conversion error in an unliquidated obligation balance and processed FMD's correcting accounting entries. However, if a finance officer incorrectly identified a conversion error obligation and decreased the unliquidated obligation balance against an increase to the authority balance, the mistake would have been transferred to the authority balance. FMD believes that this problem has not occurred, but also conceded that IFMS did not contain a control that would have prevented the transfer. Consequently, EPA's authority balance of $43.5 million from fiscal year 1989 and prior may be overstated. Differences Existed Between EPA's General Ledger and Its Budgetary Reports Material differences existed between EPA's general ledger, the numerous draft versions of its Statement of Budgetary Resources, and the Reports on Budget Execution (SF-133s) submitted to OMB. The differences arose due to prior period posting errors, reimbursable transactions, posting of activities to improper accounts, and various other unidentified transactions. In addition, the Agency prepared the SF-133s by manually entering various entries and adjustments into its worksheets that were not posted in the general ledger. The Agency prepared the first draft of the Statement of Budgetary Resources by compiling the SF-133s. However, since the 1-7 Audit Report 99B0003 ------- SF-133s did not agree to the general ledger, the resulting Statement of Budgetary Resources also did not agree to the general ledger. From the initial draft, numerous versions of the Statement of Budgetary Resources, supporting worksheets, and general journal entries were prepared in an effort to reconcile the Statement of Budgetary Resources, SF-133s, and the general ledger. The numerous versions were the result of changes in the Agency's approach to preparing supporting schedules, changes in general ledger account groupings in the statement crosswalks, subsequent analyses of budgetary accounts, worksheet errors, journal entry errors, inclusion and removal of Treasury symbols, inclusion and removal of proprietary accounts, and reconciliations between the general ledger and draft statements. After months of revisions, the Agency was finally able to prepare the Statement of Budgetary Resources by reducing the number of adjustments to the general ledger and by preparing the statement using the general ledger rather than trying to reconcile the statement to the SF-133s. RECOMMENDATIONS We recommend the Chief Financial Officer (CFO): 2.1 review all fiscal year 1989 and prior unliquidated obligation and authority balances and make any necessary adjustments; 2.2 develop reports for the annual review of unliquidated obligations which highlight older open unliquidated obligations; 2.3 require responsible officials to justify unliquidated obligation balances whose period of performance has ended, if the balances are not deobligated; 2.4 follow up on responsible officials' deobligations to verify appropriate actions were taken; 2.5 prepare the SF-133s from the general ledger; 2.6 prepare and retain support for all journal entries and adjustments made to produce the SF-133s; and 2.7 require evidence of supervisory approval to help ensure that procedures have been followed. AGENCY COMMENTS AND PIG EVALUATION The CFO agreed with our recommendation and plans to take corrective action to review all fiscal year 1989 and prior unliquidated obligations and authority balances and make any adjustments. The CFO disagreed with the recommendation to develop reports for the annual review of Audit Report 99B0003 1-8 ------- unliquidated obligations which highlight older open unliquidated obligations. The CFO believes her office already provides responsible officials with reports listing all inactive obligations (no activity for 180 days) as a part of the annual review of unliquidated obligations, and this list includes the older open obligations. The CFO also disagreed with the recommendation to justify unliquidated obligation balances whose period of performance has ended since her office has recently implemented more stringent requirements. Finally, the CFO agreed with the thrust of our recommendation to follow-up on responsible officials deobligations to verify appropriate actions were taken. Our audit work shows the Agency needs to perform more aggressive reviews of its open obligations than it has performed in the past. We believe our recommendation to highlight older unliquidated open obligations would allow the Agency to concentrate its efforts on those open obligations most likely to be invalid. We are not recommending the Agency discontinue its current practices of reviewing all inactive obligations, rather the recommended process improvements are intended to help ensure the validity of obligations. The requirements for documenting unliquidated obligation reviews that are set forth by the March 25, 1999, memorandum "Review of Unliquidated Obligations" are similar to the requirements of Office of the Comptroller Policy Announcement No. 96-04 "Review of Unliquidated Obligations." Although we recognize that the CFO has taken some corrective action, we maintain the recommendation dealing with justifying unliquidated obligations is still needed to correct weaknesses in the Agency's process for reviewing open obligations. We concur with the Agency's planned corrective actions to review all fiscal year 1989 and prior unliquidated obligation and authority balances and to follow up on responsible officials' deobligations. In responding to the draft report, the CFO also agreed with our recommendations to prepare the SF- 133 from the general ledger and retain support for all journal entries and adjustments. However, the CFO disagreed with our recommendation that supervisory approval be required, evidenced by a signature and date, to help ensure that procedures have been followed. The Agency intends to implement an automated process which by its nature does not allow for the supervisor's signature before transmission. Supervisory certification will be incorporated in the new FACTS II transmission and annotated copies maintained. We concur that the Agency's approach for supervisory certification would suffice as evidence of approval. 1-9 Audit Report 99B0003 ------- ATTACHMENT 2 REPORTABLE CONDITIONS TABLE OF CONTENTS Page 3 - AGENCY NEEDS TO ESTABLISH PROCEDURES FOR TRACKING UNILATERAL ADMINISTRATIVE ORDERS 2-1 4 - FURTHER IMPROVEMENTS NEEDED IN MANAGING EPA'S ACCOUNTS RECEIVABLE 2-4 5 - ADDITIONAL CONTROLS NEEDED IN INTERAGENCY AGREEMENT INVOICE APPROVAL PROCESS 2-9 6 - CONTINUED IMPROVEMENTS NEEDED IN ACCOUNTING FOR CAPITALIZED PROPERTY 2-12 7 - REVENUE WAS NOT PROPERLY RECORDED ON SUPERFUND STATE CONTRACTS 2-16 8 - AUTOMATED APPLICATION PROCESSING CONTROLS FOR THE INTEGRATED FINANCIAL MANAGEMENT SYSTEM COULD NOT BE ASSESSED 2-18 Audit Report 99B0003 ------- AGENCY NEEDS TO ESTABLISH PROCEDURES FOR TRACKING UNILATERAL ADMINISTRATIVE ORDERS EPA's regions are not consistently tracking demands for payment made under Comprehensive Environmental Response, Compensation and Liability Act of 1980 (CERCLA) Section 106, Unilateral Administrative Orders (UAOs). UAOs are one of the Agency's primary enforcement tools to compel responsible parties to conduct response actions. The Agency may demand payment for costs it incurs in overseeing the response actions. Some regions tracked the amounts demanded under UAOs in the Integrated Financial Management System (IFMS), but subsequently reversed them out; other regions tracked amounts demanded under UAOs but did not record them in IFMS; and other regions had no system for tracking amounts demanded under UAOs. Consequently, improvements are needed in Agency controls designed to ensure funds are safeguarded against unauthorized use or disposition. Regions were not consistently tracking amounts demanded under UAOs because they did not consistently interpret and apply Agency guidance. Agency policy for recording and establishing Superfund accounts receivable contained in RMDS 2550D, requires clarification to prevent misinterpretation. Agency policy addresses recording, as a receivable, bills incurred under administrative orders. While RMDS 2550D does not distinguish between Administrative Orders on Consent or Unilateral Administrative Orders, Chapter 14, paragraph 1 notes that "EPA generally records accounts receivable and collects payment, when it enters into a consent decree, administrative order, settlement, court order, judgement, agreement, or Superfund State Contract." Chapter 14, paragraph 5 notes that accounts receivable can be established and recorded when "an administrative order or settlement agreement has been issued in final by the Regional Administrator, or his/her designee, and has been filed in Superfund docket" or "a legal claim for SSC or oversight payments exist and a bill for collection has been issued." Some regional Financial Management Offices recorded demands under UAOs as receivables when collected; however, this is not clearly stated in Agency guidance. Further, current Agency guidance does not address how to track and control demands under UAOs prior to their collection. Amounts demanded under UAOs are significant and need to be tracked and controlled. In three regions, we identified $11 million in demands made under UAOs. Other regions either had no record of the amounts demanded under UAOs, or the amounts were not demanded because the UAOs did not include a provision to request reimbursement of oversight costs. When amounts are not tracked in IFMS they cannot be followed up on. Also, the potential exists for multiple demands to be issued for the identical cost to the same or different parties resulting in duplicate collections. Tracking the amounts demanded in IFMS would allow the Agency to maintain better control over the amounts demanded and collected. We also found differences in the language regions used to demand payments under UAOs because of unclear Agency guidance for establishing a legal liability under the different Superfund instruments. Consequently, it was difficult to differentiate between demands for payment and 2-1 Audit Report 99B0003 ------- other bills for payment used in the Superfund enforcement process. The responsibilities for determining the need to demand payment, identifying the demand amount, issuing the demand, controlling and tracking the demand amount, and handling the eventual collection also varied by region. Therefore, the language used in a demand for payment must be clear to ensure UAOs can be easily identified and properly controlled and tracked in IFMS. RECOMMENDATIONS We recommend the Chief Financial Officer (CFO): 3.1 track in IFMS all demands for payment issued under UAOs, 3.2 determine if other demands for payment are issued by the Agency, the respective amounts demanded, and whether a need exists to track the amounts demanded in IFMS, and 3.3 revise RMDS to clearly differentiate between administrative orders (particularly administrative orders on consent and UAOs), describe when the administrative orders need to be established as an accounts receivable in IFMS or separately tracked as a demand for payment in IFMS, and describe all other demands for payment that need to be tracked in IFMS. We recommend the Assistant Administrator for Enforcement and Compliance Assurance: 3.4 develop guidance for ORCs, program offices and finance offices regarding the types of instruments used in the Superfund enforcement process. For each instrument, describe when to establish an accounts receivable or separately track as a demand for payment, and describe the Agency's basis for legal liability under each instrument, and 3.5 clarify the model language to be used by ORCs, program offices and finance offices to clearly differentiate between demands for payment and bills for payment used in the Superfund enforcement process. AGENCY COMMENTS AND PIG EVALUATION In response to the draft report, the CFO partially agreed with our recommendations. The CFO agreed to track only Superfund unilateral administrative orders and disagreed with our recommendation that all other demands for payment should be tracked. The Office of Enforcement and Compliance Assurance did not disagree with our recommendations, but indicated that the model language for billing oversight costs under unilateral administrative orders is not mandatory. Audit Report 99B0003 2-2 ------- We concur with the Agency's planned corrective actions for Superfund unilateral administrative orders. However, we disagree that the Agency's corrective actions should be restricted to only Superfund unilateral administrative orders. Sound financial management practices should cover the identification, tracking and control of all demands issued similar to the Superfund unilateral administrative orders. Since the CFO's corrective actions are only designed to resolve an existing problem for Superfund unilateral administrative orders, there could be problems with the demands for other payments that are not addressed. Therefore, in responding to this report, we request the CFO provide specific corrective actions and target dates for addressing all demands for payment. We also request the Office of Enforcement and Compliance Assurance, in responding to this report, provide specific corrective actions and target dates for recommendations addressed to that office. 2-3 Audit Report 99B0003 ------- FURTHER IMPROVEMENTS NEEDED IN MANAGING EPA'S ACCOUNTS RECEIVABLE During prior financial statement audits, we reported weaknesses in the Agency's management of its accounts receivable. The Agency took action to improve controls in this area by issuing additional guidance and instructing Financial Management Offices (FMOs) to conduct quality assurance reviews covering this area. However, we continued to find accounts receivable, including those for oversight costs, that were not recorded and billed timely; accounts receivable balances in IFMS that did not reconcile to the manual subsidiary records; outstanding receivables that were not timely followed up on and written off; and allowances for doubtful accounts that were not properly computed. Consequently, some accounts receivable may not be correctly valued and timely collected. These problems were primarily due to Offices of Regional Counsel (ORC) and program offices not timely forwarding documentation and other information needed to manage accounts receivable to Agency FMOs, and FMO staff being unsure about the methodology they were to use to compute the allowance for doubtful accounts. Some Accounts Receivable Were Not Timely Recorded and Billed The Statement of Federal Financial Accounting Standards Number 1, "Accounting for Selected Assets and Liabilities;" EPA's Resources Management Directives System (RMDS) 2540, Chapter 9, "Receivables and Billings;"10 and the Financial Management Division's year-end guidance all require accounts receivable to be recorded in the accounting system completely, promptly and at the appropriate value. In Regions 1, 2, 4, and 9, we identified 21 receivables, valued at $23,920,790, that were not recorded in IFMS within the established time frames. These receivables were recorded from 2 days to 2 years beyond the time frames established by the Agency. In some cases, we could not determine if the receivables were recorded timely because the documents establishing the receivable were not date stamped by the ORC when received. The untimely recording of these receivables was attributed to the ORC11 and program offices not promptly forwarding the appropriate documentation to the FMO. During any lapse of time when valid receivables are not recorded, the debtor may not be appropriately billed, interest may not accrue, and EPA may not be paid the debt owed. In addition, we found that responsible parties were not timely billed for Superfund oversight costs.12 For example, it took more than 9 years for Region 2's Emergency Remedial and Response Division (ERRD) to issue a bill for oversight costs valued at $985,558 for one site. For another site in Region 2, it took more than 4 years to issue a bill for $185,610. The delays in billing responsible parties resulted from competing priorities, lack of resources, delays in receiving 10 RMDS 2550D, Chapter 14 contains similar guidance applicable for Superfund Accounts Receivable. 11 In Region 4, the Environmental Accountability Division (EAD) is responsible for forwarding the appropriate documentation to the FMO. 12 We also discussed weaknesses in the billing of oversight costs in the audit of Region 9's Controls Over Superfund Oversight Cost Billings, Audit Report Number E1SFF8-09-0022-8100259, issued on September 30, 1998; and Region 2's Billing of Superfund Oversight Costs, Audit Report Number EISFF8-02-0007-8100206, issued on August 13, 1998. Audit Report 99B0003 2-4 ------- documentation from program offices, and an inadequate tracking system. After this area was identified as a material weakness in our fiscal 1997 financial statement audit report, the OCFO and the Office of Enforcement and Compliance Assurance emphasized the need to issue oversight billings in fiscal 1998 and defined roles and responsibilities of offices involved in the process. As a result the amount of unbilled oversight costs accrued at year end was reduced from $162 million to $62 million. However, this is still a material amount of dollars that the Agency could either currently bill or bill during the next billing cycle. When oversight costs are not billed timely, it jeopardizes the recovery of funds for the Superfund Trust Fund and the availability of resources to clean up other contaminated sites. Accounts Receivable Were Not Properly Reconciled to Subsidiary Records RMDS 2540, Chapter 9, "Cash Management: Receivables and Billings," paragraph 9.f.(2) requires the reconciliation of accounts receivable between the general ledger (IFMS) and the manual subsidiary records. Chapter 14 of RMDS 2550D contains similar requirements for Superfund accounts receivable. Further, the Agency's Fiscal 1998 Year End Finance Closing Instructions state that "FRAB will provide the FMOs with the DOJ Listing of Outstanding Debts for FMO review for the period ending August 31....adjustments resulting from the review must be recorded in IFMS by September 30." Our audit work found that accounts receivable recorded in IFMS did not always reconcile to the manual subsidiary records because: (1) in one region, the FMO did not consistently record accumulated interest on delinquent accounts receivable; and (2) regions did not complete required reconciliations. Reconciliations are designed to identify receivables that have not been recorded or recorded at the correct amount. The untimely or incorrect recording of receivables could result in inaccurate or understated information recorded in both the financial statements and internal EPA reports used for monitoring and managing account receivables. Outstanding Accounts Receivable Were Not Always Properly Managed According to RMDS 2540, Chapter 9, paragraph 9.b.(3), the FMO is responsible for performing a quarterly review of accounts receivable files and disposing of uncollectible receivables. RMDS 2550D, Chapter 14, paragraph 10 states that any changes affecting amounts due, status of debts, and information on cases closed by the Department of Justice (DOJ) or bankruptcy court should be communicated between the FMO and ORC. Once notified by the FMO that a debt is 120 days in arrears, RMDS 2540, Chapter 9 requires the ORC to notify the FMO in writing within 30 days of their decision to: (1) recommend the uncollected debt be referred to DOJ for the initiation of a judicial action, (2) recommend additional FMO collection procedures such as referral to a private collection agency, or (3) recommend write-off of the debt. During our audit, we found that uncollectible accounts receivable were not timely written off due to communication problems between FMOs and ORCs. In some cases, ORCs were aware of certain actions initiated by DOJ but did not provide FMOs with available information about the 2-5 Audit Report 99B0003 ------- status of overdue receivables or collection actions initiated. ORC attorneys indicated that overdue receivables, especially those with small dollars and/or those deemed uncollectible, were not a high priority. Also, some ORC attorneys were not aware of the RMDS requirement. In Region 5, we found five accounts receivable, totaling $5,033,631, that were more than 4 years overdue and still outstanding in IFMS. This occurred because the Region's Comptroller Branch did not regularly analyze accounts receivable and follow up with the ORC to determine the collectability of delinquent accounts receivable. When the Comptroller Branch did follow up, the ORC did not always respond timely to the request for information on the collectability of accounts receivable. Additionally, we found two accounts receivable, totaling $6,091,581 that were not written off when the Comptroller Branch was notified the debts were uncollectible. Additionally, in Region 4 we found five accounts receivable, totaling $6,384,602, that remained in IFMS because the Environmental Accountability Division (EAD) was waiting for an official status/close out decision on the accounts from DOJ before they could be removed by the FMO. This problem was also identified during the fiscal 1997 audit. While DOJ was ultimately responsible for the collection of these receivables, EAD should have provided the FMO a quarterly update on the status of the DOJ debt collection. Timely follow up on accounts receivable is particularly important in Superfund cost recovery cases. Since the Superfund Trust Fund is a revolving fund, collection of money from responsible parties is necessary to replenish the Fund. When debts are not collected timely, continuation of the Fund is jeopardized, and resources are not available to clean up other contaminated sites. Without aggressive follow up action, the chances of collecting all amounts owed decreases. Debtors may not be reachable and/or not in business or assets may be diverted. Allowances For Doubtful Accounts Were Improperly Calculated RMDS 2540, Chapter 9, instructs FMOs to: (1) perform quarterly reviews of the allowance for doubtful accounts and the percentages used to calculate the percentage analysis portion of the allowance, and (2) update percentages as necessary. Our review of the allowance for doubtful accounts calculations in Regions 1, 5 and 9 disclosed that the FMOs did not perform quarterly reviews, update the percentages quarterly based on a historical analysis of the receivables during fiscal 1998, and maintain adequate documentation to support the percentages. This occurred because there was confusion about the methodology to be used to compute the allowance for doubtful accounts. By not calculating an accurate allowance for doubtful accounts, receivables are not properly valued. Once we brought this issue to the attention of the FMOs, the Region 5 and 9 FMOs performed the necessary analysis. The Region 1 FMO agreed to follow the guidance in the future. Audit Report 99B0003 2-6 ------- RECOMMENDATIONS We recommend the Chief Financial Officer (CFO): 4.1 continue to provide training on calculating the allowance for doubtful accounts, particularly in the area of developing the percentage portion of the allowance and maintaining proper supporting documentation, 4.2 review finance offices' management and accounting for accounts receivable during regularly scheduled Quality Assurance Reviews to ensure FMOs understand and are following guidance on accounts receivable, and 4.3 instruct the FMOs to follow-up with ORCs and program offices when responses to requests for receivable collectability information are not received timely; instruct the FMOs to assess how communication with the ORCs and the program offices can be improved; and reemphasize FMOs' responsibilities in ongoing training sessions. We recommend the Assistant Administrator for Enforcement and Compliance Assurance: 4.4 continue to work to improve the Regional process for meeting guidelines in the July 16,1998, memo to Regional Counsels entitled "Effective Debt Management," and 4.5 revise the Department of Justice interagency agreement to require DOJ to directly transmit to the ORCs and Regional finance offices copies of final source documents (i.e. Consent decrees, judgements) required to establish the recording of accounts receivable within 7 days of entry by the courts, and notify both the ORC and finance offices of any changes in the status of the collectability of the debt within 30 days of such determinations. We recommend the CFO and the Assistant Administrator for Enforcement and Compliance Assurance work together to: 4.6 assure the roles and responsibilities of offices involved in the oversight billing process are maintained so that the Agency can sustain its emphasis on timely billing and collection of oversight costs, and 4.7 develop and implement performance measures for the Senior Resource Officials to assess how well the regions are managing their oversight cost billings and other cost recovery activities. Tie the performance measures into EPA Goal 10, Effective Management, which calls for EPA to "establish a management infrastructure that will set and implement the highest quality standards for effective internal management and fiscal responsibility." 2-7 Audit Report 99B0003 ------- AGENCY COMMENTS AND PIG EVALUATION In response to the draft report, the CFO agreed to provide training on calculating the allowance for doubtful accounts, conduct quality assurance reviews to ensure FMOs are properly following accounting guidance for accounts receivable, and continue to emphasize the need for more effective accounts receivable and collections management. The CFO's actions to date have included a Superfund Cost Recovery and Financial Management Training Conference in June 1999, periodic meetings with the Department of Justice to improve accounts receivable recording and to discuss the status of collections, and a July 1999 OCFO/Office of Enforcement and Compliance Assurance (OECA) Superfund Accounts Receivable Collections memorandum to emphasize collection of outstanding accounts receivable. The CFO also noted that the OIG, as part of the Agency's internal controls for the financial statements, demonstrated that the system of controls worked well, as the OIG identified weaknesses in the calculation of the allowance for doubtful accounts. The Assistant Administrator for Enforcement and Compliance Assurance agreed with the recommendation to revise the interagency agreement with the Department of Justice to help ensure source documents are submitted timely to ORCs and finance offices. However, the Assistant Administrator disagreed with the recommendation to conduct regional reviews of ORCs to assure compliance with receivable practices since a coordinated effort is already ongoing to address overdue receivables. The Assistant Administrator also disagreed with the recommendation to provide additional training to assist in assuring accounts receivables are established timely as training was held in June 1999. The Agency agreed with our recommendations to assure that improvements to the oversight cost billing process are sustained and to develop and implement a performance measure to assess how well the regions are managing their oversight cost billings and other cost recovery activities. We recognize the numerous actions that the Agency has taken to further improve management of accounts receivable. We concur with the planned corrective actions designed to improve the recording of accounts receivable and the follow up on outstanding accounts receivable. Accordingly, we modified our recommendation which required OECA to conduct periodic regional reviews since the Agency's ongoing efforts will include monitoring regions' progress in addressing overdue receivables. In addition, we have deleted the recommendation for the Office of Enforcement and Compliance Assurance to discuss the timely establishment of accounts receivable at an upcoming cost recovery conference as the corrective action has been completed. We disagree with the Agency's depiction of the OIG's responsibilities over the allowance for doubtful accounts. We maintain that the Agency is ultimately responsible for determining accurate allowance amounts and maintaining adequate support. The OIG may suggest improvements to Agency practices, but the Agency is responsible for establishing and maintaining a system of internal controls that provides accurate, reliable and timely financial information. Audit Report 99B0003 2-8 ------- ADDITIONAL CONTROLS NEEDED IN INTERAGENCY AGREEMENT INVOICE APPROVAL PROCESS Some EPA project officers were not fulfilling one of their program oversight duties, that of reviewing and approving invoice payment requests for interagency agreements. In our fiscal 1994, 1996 and 1997 financial statement audits, we reported that project officers were not timely approving interagency agreement (IAG) invoices. We also reported that some project officers were not obtaining and reviewing supporting documentation for IAG invoices. The Agency has acknowledged these weaknesses and implemented some corrective actions. However, during our fiscal 1998 financial statement audit, we continued to find that project officers were not properly reviewing and timely approving IAG invoices. Project officers were waiting months for supporting cost documents, or the project officers were absent from the office for extended periods of time with no one assigned to temporarily oversee project administration. Consequently, EPA's Financial Management Center at Cincinnati (CFMC) recorded the transactions in the accounting system, with limited assurance that invoices were valid, appropriate and allowable under the terms of the I AGs. EPA and other non-DOD agencies use Treasury's OP AC (On-line Payment and Collection) system to pay IAG invoices. Through OP AC, CFMC identifies all billings charged to EPA and records the payment in a "suspense" appropriation until the correct appropriation is identified. CFMC then sends a copy of the invoice and the project officer approval form to the project officer for approval. Within 5 working days of receiving the approval form, the project officer must approve the bill or note discrepancies, and return it to CFMC. With a signed approval form, CFMC can confirm that payments are allowable; if the project officer approves only partial payment (or none), CFMC has 90 days from the original OP AC bill date to process a "charge back" through OP AC. The Resources Management Directives System, Section 2550C, Chapter 4, Interagency Agreements, states that it is the project officer's responsibility to: (1) receive and review detailed cost information submitted by other agencies, (2) approve vouchers and OP AC billings received from other agencies after determining that performance is in accordance with the agreement, and (3) forward approved vouchers to CFMC for payment within five days after receipt. EPA's training manual for project officers, Managing Your Financial Assistance Agreement, Module VIII, 3rd edition, October 1996, also contains guidance on project officer responsibilities. During fiscal 1998, we found situations where project officers in Regions 2, 4, 5, 9, RTP, Cincinnati and Headquarters were not: Obtaining and reviewing detailed cost information before approving IAG invoices. Some project officers were still unaware that cost information could or should be requested from the other agency. 2-9 Audit Report 99B0003 ------- Completing the approval forms timely. We found instances where invoices were not certified because the project officers were either on leave, away on travel, reassigned, or handling other priority matters. In some cases, project officers did not believe they were required to approve the invoices. Completing all appropriate sections of the approval form, such as the "account information" or "amount approved" portion. As a result of our prior audit recommendations, the Agency: Updated the project officer training information to instruct project officers to call the Grants Administration Division, if they had problems obtaining cost information from other agencies; • Included this information in a 1998 training manual revision; Requires new IAGs to include a clause/condition requiring the other agency to provide the EPA project officer with information on costs incurred; and Requires EPA project officers to suspend or "charge back" the payment, if the information is not provided. We found, however, that corrective actions implemented have not in all cases resulted in the improvements anticipated. Therefore, we are making the following recommendations. RECOMMENDATIONS We recommend the Director, Grants Administration Division (GAD) to: 5.1 develop a fact sheet for Agency managers explaining the invoice approval requirements to help ensure responses are provided timely. 5.2 consider expanding the IAG portion of the project officer training/refresher course to place more emphasis on the importance of timely and properly completing the approval form. Consider having an official from CFMC present this portion of the course or prepare the materials to be used, and 5.3 work with the Director, Financial Services Division, to have the Chief, CFMC notify the IAG approving officials when project officers are delinquent or not timely in completing and returning the IAG invoice approval forms. We recommend the Director, Financial Services Division to direct the Chief, CFMC: Audit Report 99B0003 2-10 ------- 5.4 to notify IAG approving officials when project officers are delinquent or not timely in completing and returning IAG invoice approval forms, such as by sending the second request to approving officials. 5.5 to compile a list of project officers with outstanding, late or incomplete invoice approval forms and forward to the Senior Resource Officials on a semiannual basis, asking for their assistance in getting project officers to timely and properly complete the forms. AGENCY COMMENTS AND PIG EVALUATION In responding to the draft report, the Agency disagreed with our recommendation to provide project officers a checklist on the process to be followed when an invoice approval form is received, stating that the invoice approval form is self-explanatory. Instead, GAD plans to issue a fact sheet to EPA's managers to explain the invoice approval requirements. Accordingly, we have revised the recommendation. We concur with the planned corrective actions and target dates. The fact sheet can also be a useful tool to alert managers to related concerns about timely return of the approval form, completeness and the need for cost details to support the invoice. The Agency agreed with our recommendation to consider expanding the IAG portion of the project officer training course. The Agency partially agreed with the other recommendations, offering an alternative that the approving official rather than the projects officers' supervisor should be notified when IAG approval forms are not completed and returned timely. Also, the Agency suggested we revise our recommendation to compile a list of project officers with outstanding, late or incomplete invoice approval forms and forward to the Senior Resource Officials on a semiannual rather than quarterly basis. Accordingly, we have revised the recommendations. We concur with the planned corrective actions and target dates. 2-11 Audit Report 99B0003 ------- CONTINUED IMPROVEMENTS NEEDED IN ACCOUNTING FOR CAPITALIZED PROPERTY For a number of years, we have reported that EPA needs to make improvements in its accounting for property. The Agency has taken aggressive actions to permanently resolve these issues. We commend the Agency for its continuing efforts to correct weaknesses in the property area. In late fiscal 1997, the Agency implemented the Fixed Assets Subsystem (FAS), which is integrated with IFMS, the Agency's accounting system. During fiscal 1998, the Agency provided additional training to property and finance personnel on their roles and responsibilities for accounting for property in FAS. The results of this year's audit show the Agency needs to continue its efforts to improve its accounting for property. We found property that was not recorded or not recorded timely or accurately in FAS, and property that was capitalized when it should have been expensed. This occurred because property was delivered directly to its destination, and Property Management Officers (PMO) were not notified of its receipt; and inaccurate or incomplete property and accounting information was included on procurement requests. In addition, we found weaknesses in the Agency's process for reconciling property information contained in IFMS with that contained in FAS. When property is not accurately accounted for, it impacts the quality of data available to manage EPA's resources and increases the risk of theft, loss, or misuse of the property. Property Was Not Always Recorded Timely or Accurately in FAS OMB Circular A-123, "Management Accountability and Control," requires that transactions be promptly recorded, properly classified and accounted for in order to prepare timely accounts and reliable financial and other reports. The Statement of Federal Financial Accounting Standards (SFFAS) Number 6, Accounting for Property. Plant, and Equipment (PP&E) and the Agency's policy require that PP&E be recognized when title passes to the acquiring entity or when the PP&E is delivered to the entity or to an agent of the entity. At Research Triangle Park (RTP), we identified 36 Working Capital Fund (WCF) property items including components, totaling $5,961,980 and meeting the capitalization criteria, that were either not recorded in FAS or were not recorded timely or accurately in FAS. In addition, at RTP we found a total of 10 items of accountable property,13 $11,395 of Superfund property and $109,270 of WCF property, which were not recorded timely in FAS. In Region 9, we identified both accountable and capital property acquired for the Region 9 laboratory, which were recorded in FAS 9 months after it was received and placed in service. When property acquisitions are not recorded timely or accurately in FAS, the property data available is not reliable. Items were not recorded timely in FAS because the property was delivered directly to a location where there was no designated receiving personnel, and property personnel were not informed the property had been received. In addition, property was not recorded accurately in FAS because procurement 13 Accountable property is non-expendable property with an original acquisition cost of $5,000 or more. Audit Report 99B0003 2-12 ------- requests did not contain accurate and complete accounting information, and procurement requests for component pieces of equipment did not include information on the parent property items. To correct the weaknesses with regards to procurement requests, the Agency issued guidance during October 1998 on how to prepare procurement requests for property, which was effective immediately. We commend the Agency for establishing detailed instructions and examples on preparing procurement requests to remedy this problem. Property Was Not Properly Classified SFFAS Number 6 defines PP&E as tangible assets, including land, which meet the following criteria: (1) have an estimated useful life of 2 years or more; (2) are not intended for sale in the ordinary course of operations; and (3) have been acquired or constructed with the intention of being used or available for use by the entity. PP&E should be recorded at cost. In addition, any costs which either extend the useful life of existing PP&E, or enlarge or improve its capacity should be capitalized and depreciated over the remaining useful life of the asset. The Agency's policy requires personal property owned by EPA to be capitalized if it costs $25,000 or more. The cost of property not meeting the capitalization criteria is to be expensed in the period acquired. At RTP, we identified WCF property items totaling $188,360, which were improperly capitalized when they should have been expensed. As a result, the value of EPA's WCF property and equipment was overstated and its expenses were understated. These items were not properly expensed because incorrect or incomplete accounting information was included on the procurement requests. As mentioned above, the Agency issued guidance in October 1998 to correct this problem. Problems Were Experienced During the Year-End Reconciliation Process Property balances reported in the fiscal 1997 financial statements were derived from the IFMS general journal balances. To ensure the general journal properly reflected the amount of Agency- held capital equipment, the Financial Management Division (FMD) provided guidance and year- end instructions to the Financial Management Officers (FMOs) requiring them to reconcile capital equipment transactions recorded in the IFMS general journal with the entries recorded in the fixed assets journal (a part of the FAS). Any differences between the journals were to be corrected by adjusting entries. For fiscal 1998, the FMD's year-end instructions (dated September 9, 1998) changed the process for performing year-end reconciliations. The FMOs were only required to ensure that the capital equipment balances in FAS were as accurate and comprehensive as possible by performing limited reconciliation work. Headquarters' FMD staff were to reconcile the general journal to the fixed assets journal, making the necessary adjusting entries. Although FMD reconciled the general journal to the fixed assets journal, we found discrepancies between the two balances. Year-end balances in the fixed assets journal and the general journal 2-13 Audit Report 99B0003 ------- did not reconcile at RTP and Cincinnati even though adjustments were made. We found approximately $1.2 million14 in WCF capital property at RTP that was not recorded in FAS. In Cincinnati, we found that the capital equipment balance in the general journal was understated by $252,124. Differences were noted between the general journal and the fixed assets journal, totaling $985,754, due primarily to partial payments on capital property items not placed in service or operational as of year-end and capital property that was not recorded in FAS. We also found problems with the year-end property reconciliations at Region 5 and RTP. Region 5 did not perform the required year-end property reconciliation activities because they did not receive the year-end instructions. At RTP, finance personnel created their own reports to reconcile the general journal and fixed assets journal because the reports provided by FMD did not contain a common data element that allowed them to match transactions. FMD staff adjusted the general journal, removing approximately $14.4 million of property at year- end so that it would reconcile with balances in the fixed assets journal. As a result, property balances were understated. For example, the payments for capital property not recorded in FAS at RTP, totaling $1.2 million, were removed from the general journal property balances during the year-end reconciliation process. In Cincinnati, payments for capital property, totaling $317,000, were removed from the general journal property balances during the year-end reconciliation process when they should not have been. FMD personnel adjusted the general journal to match FAS because they felt the FAS tables were the best source of data about the Agency's property. Even though these transactions have no material effect on the Agency-wide financial statements, failure to accurately record these items in the Agency's property accountability system in a timely manner increases the risk of theft, loss, or misuse of the property. RECOMMENDATIONS We recommend the Chief Financial Officer, in conjunction with the Assistant Administrator for Administration and Resources Management: 6.1 continue to work to strengthen controls designed to ensure that property is timely and accurately recorded in the Agency's property accountability system, FAS. Specifically, reemphasize to the appropriate Agency personnel their responsibilities to: provide descriptive information about an existing parent property item in the procurement request for capital improvements; and 14 The $1.2 million in WCF capital property was also included in the $5.9 million of WCF property reported as either not recorded in FAS, or as not recorded timely or accurately in FAS. 2-14 Audit Report 99B0003 ------- report receipt of accountable and capital property to the appropriate PMO in a timely manner when property acquisitions are directly delivered to the ordering official, and forward copies of appropriate documentation to the PMO. AGENCY COMMENTS AND PIG EVALUATION The Agency agreed with our recommendations, and emphasized that all property users, such as custodial officers, project officers, funds certifying officers, managers, and other ordering officials, must be made aware of Agency property management requirements. Therefore, the Office of Administration and Resources Management (OARM) will coordinate with specific organizations when property records indicate non-compliance with Agency property management requirements. In addition, OARM's Facilities Management and Services Division (FMSD), in conjunction with FMD, plans a more proactive approach to disseminate property information and guidance concerning accurate documentation and timely processing of required receiving documents. FMSD will issue a memorandum to remind Agency Senior Resources Officials: (1) to follow Agency property management policy, and (2) to distribute Transmittal Notice No. 99-03, "Guidelines on Preparing Requisitions for Property and Related Goods and Services," to their respective project officers, ordering, and funds certifying officers. Also, the Enterprise Technology Services Division (ETSD) is scheduling a joint review session with RTP-FMSD, RTP-OAM, and FMD to address Working Capital Fund property accounting problems. ETSD expects to have a plan of action for correcting problems before the end of this fiscal year. We concur with the Agency's planned corrective actions in the property area. 2-15 Audit Report 99B0003 ------- REVENUE WAS NOT PROPERLY RECORDED ON SUPERFUND STATE CONTRACTS During fiscal 1998 and prior years, EPA did not properly recognize revenue on Superfund State Contracts (SSC). We audited the state cost share analysis and year-end adjusting entries at 6 of EPA's 10 regional finance offices. Although significant progress was made toward resolving problems that have existed in this area, we found a few issues remained that caused SSC accounts to be misstated by $16 million, primarily at 3 regions. Material adjustments were needed to fairly present the financial statements. If thorough analytical reviews of regional account balances had been performed, these errors could have been identified and corrected more timely. When EPA assumes the lead for a Superfund remedial action, a state's role in the action is set forth in an SSC. The SSC is a contract that ensures state involvement and obtains state assurances as mandated under the Comprehensive Environmental Response, Compensation, and Liability Act of 1980 (CERCLA). CERCLA, as amended by the Superfund Amendments and Reauthorization Act of 1986, requires the state to provide a 10 percent cost share for remedial actions at privately owned sites and at least a 50 percent cost share for all response activities at publicly operated sites. In accordance with Agency policy, EPA must bill the state for its cost share as provided by the SSC. At the time of the billing, EPA records an advance (unearned revenue). As EPA expends efforts to clean up the SSC sites, the unearned revenue should be reduced and revenue should be recognized. Comptroller Policy 95-06, EPA Accounting Policies and Procedures for Superfund State Contracts, and the Financial Management Division's fiscal 1998 Year-end Closing Instructions, prescribe recognizing revenue on the state cost share as a percentage of expended dollars to estimated total costs as indicated in the SSC. Officials in each finance office should calculate a completion ratio (site expenditures as a percentage of the SSC) for each SSC and apply the ratio to each state cost share to determine the amount of each share that has been earned. The finance personnel should record year-end adjusting entries to recognize revenue for the appropriate amount of each state cost share that has been earned. The offset to the revenue recognition should be a decrease in the advance (unearned revenue) account, to the extent available, or unbilled accounts receivable if the earnings have not been billed or collected. Significant progress has been made in addressing the issues that have complicated accounting for SSCs in the past. During the past few years, FMD updated policies and procedures that guide regional personnel through this revenue recognition process. They also developed a standard report to summarize SSC disbursement data needed to more accurately determine completion percentages on each SSC site. During 1998, FMD also conducted a training workshop for regional personnel to address past difficulties and discuss proposals for future procedures. Additionally, FMD refined a spreadsheet program that was originally designed to be an analytical tool, so it could be used to compute adjusting entries the regions should record. Audit Report 99B0003 2-16 ------- Despite the Agency's progress in the SSC area, a few issues caused material errors in the general ledger. An error in FMD's SSC program, related to the accounting for Superfund state credits, caused an overstatement of unbilled accounts receivable and an understatement of advances. Additionally, the reversing effect of prior years' entries, in addition to unrecorded corrections of prior years' entries, adversely impacted the current year's balances. Material adjustments were made to fairly present the financial statements; however, 2 of the 6 regions we audited continue to have several million dollars of unreconciled differences in their SSC accounts. RECOMMENDATIONS We recommend the Chief Financial Officer (CFO): 7.1 assist the regions in identifying and correcting problems causing errors in their advances and unbilled accounts receivable, and 7.2 continue to emphasize the need for regional personnel to perform analytical reviews of their account balances. AGENCY COMMENTS AND PIG EVALUATION The CFO agreed with our recommendations. The CFO's staff has already identified and corrected errors in the SSC spreadsheet program utilized by the regions to calculate SSC revenue. Further, FMD conducted a workshop during June 1999 for the regions. One of the workshop sessions specifically dealt with the general ledger and the need for continued account analysis. We concur with the corrective actions the Agency implemented. 2-17 Audit Report 99B0003 ------- AUTOMATED APPLICATION PROCESSING CONTROLS FOR THE INTEGRATED FINANCIAL MANAGEMENT SYSTEM COULD NOT BE ASSESSED We continue to be unable to assess the adequacy of the automated internal control structure as it relates to automated input, processing, and output controls for the Integrated Financial Management System (IFMS). IFMS applications have a direct and material impact on the Agency's financial statements. Therefore, an assessment of each application's automated input, processing and output controls, as well as compensating manual controls, was necessary to determine the reliance we could place on the financial statements. During past financial statement audits, we attempted to evaluate controls without documentation, but these alternatives proved to be inefficient and impractical considering available resources. Program level flowcharts or similarly descriptive narrative system documentation were not available. The IFMS Users' and other EPA contractor baseline Federal Financial Systems (FFS) manuals did not contain the level of detail necessary to construct tests of automated internal controls which would satisfy our field work standards. Agency officials disagreed with the conclusions and recommendations made in the OIG report, "Fiscal 1995 Financial Statement Audit of the EPA's Trust Funds, Revolving Funds and Commercial Activity," dated May 3, 1996, and maintained that sufficient documentation existed in the Change Management System (CMS). Furthermore, management stated that the OIG's opinion was restricted by its definition of acceptable documentation. As a result of the fiscal 1995 report, the OIG provided samples of documentation and flowcharts for two other EPA systems to Financial Management Division (FMD) and Enterprise Systems Division (ESD) representatives. The Agency, in turn, requested the programming contractor to review the "model" documentation and determine whether such documentation could also be developed for IFMS. The Agency also requested the contractor survey the IFMS data and evaluate the scope of data elements to include in a data dictionary. The Agency subsequently agreed to complete several corrective action items by September 30, 1997, in response to the OIG audit report, "Audit of EPA's Fiscal 1996 Financial Statements," issued March 24, 1997. The action items were: completing a system documentation analysis, developing draft Accounts Receivable documentation, obtaining OIG approval of the draft documentation, and providing documentation for OIG selected transactions in other modules. The Agency also agreed to take actions to conduct an analysis and estimate costs associated with implementing a comprehensive data dictionary. During fiscal 1997, the contractor completed the analysis for a comprehensive IFMS data dictionary and developed documentation for the IFMS Accounts Receivable module. We evaluated the IFMS Accounts Receivable documentation, as part of our fiscal 1998 financial statement audit, to determine its adequacy as a model for developing systems documentation for Audit Report 99B0003 2-18 ------- the remainder of IFMS. We concluded that the Accounts Receivable documentation was not adequate to establish the reliability of IFMS transaction processing controls. The Joint Financial Management Improvement Program's (JFMIP) Framework for Federal Financial Management Systems (FFMSR-0), dated January 1995, requires systems documentation include information necessary for a systems analyst or a programmer not familiar with the system to learn and maintain the system in a timely and efficient manner. FFMSR-0 is intended to be used by senior systems analysts, systems accountants, and their immediate supervisors as a reference to understand concepts and requirements in other FFMSRs, which the Federal government is required to implement for an integrated financial management system. The Accounts Receivable documentation did provide a high level overview, but a systems analyst unfamiliar with the system could not have assessed the logic or embedded system controls related to accounts receivable transactions. In addition, no information was included to define the data elements and the related edits in the data dictionary; thereby, preventing us from identifying key fields used for the transactions. AGENCY COMMENTS AND PIG EVALUATION In her response to the draft report, the Chief Financial Officer stated that her office continues to believe that IFMS documentation is sufficiently detailed in the context of their legacy system. Whereas management acknowledges that the IFMS dictionary could be improved, they maintain that the data dictionary enhancements and ongoing maintenance would not be cost effective considering the system's maturity and life-cycle stage. In response to years of internal discussion between EPA's Financial Management Division and the Office of Inspector General on this issue, the Agency requested the Department of Treasury Financial Management Service Center for Applied Financial Management (Center) to perform an independent review of IFMS system documentation, including its data dictionary. The Center's operations staff performed the review and concluded that IFMS documentation complies with OMB, JFMIP and GAO requirements. Despite their conclusions, the Center's report also recommended that a more comprehensive data dictionary be developed, suggesting that such action be deferred until EPA migrates from IFMS to a new replacement financial system. Furthermore, the Center's report emphasized that a real-time, distributed database replacement system would necessitate developing data standards. Therefore, the Center's recommendation appears to endorse the benefits of both products while, at the same time, echoing Agency concerns that it would not be economical to make major IFMS cost investments, if management intends to replace the financial systems within the next several years. We appreciate management's desire to minimize expenditures for its legacy systems, but remain concerned because IFMS could easily remain operational for five or more years before a replacement system is funded, developed and put into operation. Almost one and a half years ago, management first reported its intent to replace all or part of the Core financial systems; however, they have taken little action to make that goal a reality. The Agency only recently began the formal process to replace its payroll system, and that project is still in the initial stages 2-19 Audit Report 99B0003 ------- of the system development life cycle. To the best of our knowledge, Agency management has not initiated a tangible action plan to replace IFMS. If the Agency is serious regarding their decision, then we would expect the CFO's office to formally set up a system replacement project by: (1) assigning staff and establishing a schedule, (2) preparing an information technology capital investment budget request, and (3) approving a formal decision paper. We are confident that a cost benefit analysis of the core financial systems would support the need for a more efficient and economical system, but without such analysis we cannot agree that it would not be economical to make further major investments in the existing system. At this time, we cannot rely on the Center's conclusions regarding the adequacy of IFMS system documentation. Auditing standards require that we satisfy ourselves as to the work of others before placing reliance on it for audit purposes. While we reviewed the Center's report, we found that it only presented the issue at a high level, and was ambiguous because the recommendations seemed to contradict the report's conclusions. Moreover, the Center's report did not provide details which would allow us to understand: (1) which specific portions of the IFMS "user" manuals adequately described automated system control processes, and (2) the thought process used to arrive at the report's conclusion. In addition, the Center's report presented data that contradicted facts which we previously obtained from the same source, e.g., percentage of IFMS customization. We requested clarification and access to the review team's working papers on July 13, 1999, but have not received any supporting materials to date. Until such time as we are allowed to evaluate the team's detailed findings and assess analytical support associated with their conclusions, we will continue to consider system documentation a reportable condition. In conclusion, we maintain our position that IFMS systems data dictionary and other technical systems documentation do not meet Federal systems documentation requirements for an integrated financial management system, and continue to believe that IFMS systems documentation is a reportable condition. Audit Report 99B0003 2-20 ------- ATTACHMENT 3 COMPLIANCE WITH LAWS AND REGULATIONS TABLE OF CONTENTS Page 9 - EPA IS NOT IN SUBSTANTIAL COMPLIANCE WITH FEDERAL FINANCIAL MANAGEMENT SYSTEM REQUIREMENTS 3-1 Audit Report 99B0003 ------- EPA IS NOT IN SUBSTANTIAL COMPLIANCE WITH FEDERAL FINANCIAL MANAGEMENT SYSTEM REQUIREMENTS In last year's audit report, EPA's Fiscal 1997 and 1996 Financial Statements (Audit Report No. E1AML7-20-7008-8100058, dated March 2, 1998), we reported that, as of September 30, 1997, EPA's financial management systems did not substantially comply with certain federal financial management system requirements. One major problem was the lack of completed security plans for each of the core financial systems. In the Agency's remediation plan, dated March 31, 1999, EPA's Comptroller advised OMB that all corrective actions were completed concerning the financial management systems. Agency management contend that their financial application system security plans substantially comply with requirements. Management primarily bases its position on several reviews which were performed subsequent to the end of the reporting period, September 30, 1998. We acknowledge that the Agency has been working aggressively to improve security planning for their financial systems, and we realize that the Agency's sources may have considered improvements made since September 30, 1998. However, such improvements would have no bearing on the state of compliance during fiscal 1998. Our fiscal 1998 audit work identified numerous weaknesses in the Agency's security planning for its financial systems. We concluded that financial systems were substantially noncompliant with federal financial management systems requirements because our audit work found that: (1) numerous systems had one or more critical security components which were "substantially" noncompliant with requirements, (2) a considerable number of critical security components were noncompliant15 in most systems, and (3) security plans did not exist for some financial systems. In our opinion, the cumulative effect of the noncompliant and substantial noncompliant areas warranted classifying EPA's financial systems as substantially noncompliant. Our fiscal 1998 audit work included a follow up of actions taken concerning the five core financial systems,16 as well as a review of the additional ten financial and mixed-financial management systems. For the security plans that were completed for the core systems, we found them lacking in several respects. Additionally, we found security plans for the ten additional systems either did not exist, or the plans were inadequate or incomplete. Therefore, we concluded that EPA's financial systems were substantially noncompliant because the number and type of noncompliance and substantial noncompliance issues reflected a cumulative state of risk with regards to security. 15 Noncompliant means that parts of a critical security control may have been compliant, although other aspects were missing or needed improvement. 16 The Core Financial System consists of the Integrated Financial Management System (IFMS), the Combined Payroll Redistribution and Reporting System (CPARS), and the Management Accounting and Reporting System (MARS). The other principal financial systems in the financial system inventory are the EPA Payroll and Personnel System (EPAYS) and the Contract Payment System (CPS). Audit Report 99B0003 3-1 ------- In responding to our fiscal 1998 FFMIA findings, senior management disagreed with our conclusion that EPA is again in substantial noncompliance with financial management systems requirements. While management agreed that additional corrective actions are needed, they do not agree that the actions warrant classification as "substantial" and are not planning to prepare another remediation plan, as is required under FFMIA. FFMIA requires the preparation of a remediation plan when an audit determines there is substantial noncompliance with FFMIA. We believe that security concerns are of a paramount nature, and EPA needs to take reasonable corrective actions to mitigate the threat of financial data being intentionally or accidently compromised by either external or internal sources. We met numerous times with senior Financial Management Division, Financial Services Division and Grants Administration Division officials (the owners of the financial management systems we reviewed) and provided them additional information which explained how we assessed the degree of FFMIA non-compliance and clarified our overall audit position. We are presenting our findings below along with proposed recommendations. Following our recommendations, which include the preparation of another remediation plan, we provide detailed management comments and our evaluation of those comments. Fiscal 1998 Audit Results EPA is not in substantial compliance with Federal financial management systems requirements under the Federal Financial Management Improvement Act (FFMIA). Our review of Agency financial management systems under development or operational, as of September 30, 1998, found that: Approved security plans for eight financial or mixed-financial systems did not comply with the requirements of OMB Circular A-130, Management of Federal Information Resources, Appendix III (February 1996), and Management had not approved security plans for the remaining seven financial or mixed- financial systems, as required by OMB Circular A-130. In the fall of 1998, the Chief Information Officer (CIO) declared Information Systems Security Plans a carryover material weakness under the Integrity Act. The CIO recognized the need to (1) finalize guidance, (2) strengthen and revise the National Security Center's Security Plans, (3) strengthen and revise the EPA Network Security Plan, and (4) provide assistance to managers to update their security plans. The CIO declared this a continuing material weakness under the Integrity Act, only after it became apparent that many Agency systems did not have updated plans or the existing plans were deficient. In order to be in substantial compliance with the Federal financial management system requirements, Agencies were to comply with: Office of Management and Budget (OMB) Circular A-127 requirements; 3-2 Audit Report 99B0003 ------- • Joint Financial Management Improvement Program's (JFMIP) Federal Financial Management System Requirements series; OMB Circular A-130, Appendix III; and OMB Bulletin 98-08 17. Our review of compliance with OMB Circular A-130 was limited to evaluating the approved system security plans and supporting documentation for financial or mixed-financial management systems under development or operational as of September 30, 1998 (Table 1). We compiled the list of systems from the Agency financial and mixed-financial systems inventory reported to OMB in October 1997 and October 1998. We included the: (1) Superfund Cost Recovery Collection Tracking System because it is a major regional financial system, and (2) Partnership 2000 because it is a major Agency development project to replace the Grants Information and Control System. We reviewed but have not reported findings associated with the Electronic Time and Attendance Data Collection System (ETAMS), because the Agency is in the process of replacing its payroll system and decided not to expend any additional resources on developing this particular system. In addition, the Agency recently reclassified the Asbestos Receivable Tracking System (ARTS) from a major to a non-major application. Nevertheless, we included ARTS in our evaluation because it was categorized as a major application during the period under review. However, due to its reclassification, we excluded ARTS from recommended corrective actions in this report. TABLE 1 EPA's FISCAL 1998 FINANCIAL AND MIXED-FINANCIAL SYSTEMS INVENTORY Status (9/30/98) 1. Asbestos Receivable Tracking System (ARTS) Operational 2. Combined Payroll Redistribution Reporting System (CPARS) Operational 3. Contracts Payment System (CPS) Operational 4. EPA Payroll & Personnel System (EPAYS) Operational 5. Integrated Financial Management System (IFMS) Operational 6. Management Accounting and Reporting Systems (MARS) Operational 7. Travel Manager Plus (TM+) Phased Development 8. Budget Automation System (BAS) Phased Development 9. Grants Information and Control System (GICS) Operational 10. Partnership 2000 (P2000) Development 17 Internal controls, as they relate to the principal statements and required supplemental stewardship information, are designed to provide reasonable assurance that financial reporting is reliable; the Agency is in compliance with applicable laws and regulations; and performance reporting is reliable. Audit Report 99B0003 3-3 ------- TABLE 1 EPA's FISCAL 1998 FINANCIAL AND MIXED-FINANCIAL SYSTEMS INVENTORY Status (9/30/98) 11. Integrated Contracts Management System (ICMS) Operational 12. Small Purchase Electronic Data Interchange (SPEDI) Operational 13. Contract Information System (CIS) Operational 14. Contract Delivery Order Tracking System (CDOTS) Operational 15. Superfund Cost Recovery Collection Tracking System (CTS) Operational With regards to complying with FFMIA requirements, we did not verify that the security controls identified in the system security plans were operational. Operational security controls are being examined under several, separate ADP general control audits. We defined this audit approach in a multi-year audit plan which was endorsed by General Accounting Office representatives. We will conduct one or more audits of operational security controls during fiscal 2000. We reported the weaknesses found during our evaluation of the individual security plans to the applicable Senior Information Resource Management Officer (SIRMO) and the responsible system manager. Existing Systems Security Plans Not In Compliance As of September 30, 1998, none of the existing eight, approved security plans for Agency financial or mixed-financial systems adequately addressed compliance with OMB Circular A-130, Appendix III (see Table 2). Seven of the eight financial or mixed-financial systems which had an approved security plan were operational systems: IFMS, CPARS, MARS, EPAYS, ARTS, CPS and GICS. The other system with a final security plan, P2000, was under development. We continue to report on ARTS because, as of September 30, 1998, it still was classified as a major application system. However, ARTS will not be included in our fiscal 1999 assessment regarding FFMIA compliance, because the system owner subsequently reclassified ARTS to a non-major application. Due to its reclassification, we excluded ARTS from recommended corrective actions in this final report. The OIG considers the following five security controls to be critical for creating and approving comprehensive system security plans that comply with OMB's major control requirements. A notation of 'SUB' indicates that we consider the particular noncompliance to be of substantial nature. The designation 'NC' indicates that a system was noncompliant in some respects with requirements for the critical control, but we did not consider the critical control substantially 3-4 Audit Report 99B0003 ------- noncompliant. Therefore, an 'NC' denotes that parts of a critical security control may have been compliant, although other aspects were missing or needed improvement. A 'YES' indicates that a system was compliant with all aspects of the required, critical security control. 'N/A' indicates that the particular control was not applicable, because the system was under development. TABLE 2 Ma] or Finarn 1 :ial and J \s of Sep tfixed Sys tember 3( tems Se< ), 1998 :urity I 'lans CRITICAL SECURITY CONTROLS IFMS CPARS MARS EPAYS ARTS CPS P2000 GICS Number of Substantially Non-Compliant Svstems 1. Independent review of current security operations completed. YES YES YES YES NC YES N/A SUB 1 2. Security Plan level of detail was sufficient to adequately address required subjects. 18 SUB SUB SUB SUB SUB NC SUB SUB 7 3. Contingency/disaster recovery plan existed and adequately addressed required subjects. NC NC N/A NC SUB NC N/A SUB 2 4. Security training was adequate. SUB SUB SUB SUB NC SUB N/A SUB 6 5. Management approval to operate was properly authorized by the owner. YES YES YES YES YES YES SUB 19 SUB 20 2 Critical Security Control #1 - Independent Reviews: We considered a system to be in compliance with OMB Circular A-130, if an independent review or audit of security operations had been completed during the three years prior to September 30, 1998. For example, the OIG conducted an independent review of CPS controls, including security, in 1996. On the other hand, we could not recognize contractor-performed risk assessments of MARS and CPARS (dated June 3, 1996, 18 Using OMB Circulars, NIST guidance and Agency guidance, we evaluated the system security plans' detailed information. We provided copies of our detailed comments to the appropriate managers. 19 The security plan was approved by an Office of Information Resources Management (OIRM) manager, but the development project should be approved by the system owner(s). Grants Administration Division program manager is the primary owner. 20 The security plan was approved by OIRM, rather than the system owner(s). Audit Report 99B0003 3-5 ------- and July 1, 1996, respectively), because these assessments did not include a review or audit of operational security controls.21 These formal assessments were based on interview and survey data and did not include actual system testing. Neither could we view SIRMO-performed desk reviews of security plans as an independent assessment of an application's operational security controls. In 1994 and 1995, management hired a contractor (i.e, Booz-Allen & Hamilton, Inc.) to review operational systems and security controls for IFMS, EPAYS, MARS and CPARS. The contractor issued a report to the Agency in December 1995. Management made significant revisions to the contractor's 1995 report and re-issued the report during 1996. We have allowed the contractor's report to serve as the independent assessment of operational controls for these systems, although we remain concerned that Agency management negated some of the report's "independence" by downgrading/excluding several of the reported nonconformances from their internal report and subsequent corrective action plan. We downgraded ARTS to a noncompliance standing with respect to Critical Control #1. We took this action on the basis that the OIG's independent review of this application: (1) addressed some of the security functions addressed in OMB Circular A-130, and (2) was issued within three years prior to the period under review. However, we reiterate that the OIG's review did not cover many areas which would be expected of an independent audit or review under current OMB Circular A- 130 requirements. Also, the system owner reclassified ARTS to a non-major application on July 29, 1999. Due to its reclassification, we concur that ARTS no longer requires an independent assessment of security controls. Still, we expect management to assess the ARTS operational security controls on a regular basis and to revise the ARTS security plan based on such assessments. We did not include ARTS in our recommendations to management, and it will not be included in our fiscal 1999 audit regarding FFMIA compliance. Critical Security Control #2 - Security Plan Level of Detail: A security plan's detail was not considered acceptable unless it addressed functional and other requirements found in the current OMB Circular A-130, Appendix III. Section A.3.b. of the Circular specifically requires that major application security plans be consistent with NIST's guidance. Therefore, we also used NIST security guidance, Agency Directives on security and Agency interim guidance on security plans to judge the adequacy and acceptability of approved security plans. Regarding NIST guidance, we used two publications regarded as generally accepted security principles and practices for the Federal government: (1) Publication 800-12, An Introduction to Computer Security. The NIST Handbook, and (2) Special Publication 800-14, Generally Accepted Principles and Practices for Securing IT Systems. Lastly, we considered a security plan to be noncompliant if it was 21 The risk assessments cited the following limitations: • The ability to gather data from all users regarding the efficiency and effectiveness of controls is limited. In particular, due to budget constraints, regional users of MARS and CPARS were not included in the survey group. • Data regarding the exact implementation status for each control was not available so an assumption was made that all partially implemented controls were at least 50 percent implemented. • This risk assessment was based on interview and survey data and did not include actual system testing. 3-6 Audit Report 99B0003 ------- formulated solely on outdated requirements (e.g.,versions of Circular issued prior to February 8, 1996). Our review found that none of the plans referenced operational security problems identified by independent reviews or audits of security controls. The security plan should recognize security problems reported in the last independent review, identify planned corrective actions, and acknowledge any compensating operational controls. Unless known security problems are addressed in the security plan, management cannot properly utilize the security plan as a basis to assess risks and authorize the system for operation. Furthermore, the security plan formally establishes management's accountability to manage risks associated with system operations. We provided detailed comments to management for security control deficiencies, noting each category required to be documented by OMB Circular A-130. These detailed comments identified specific OMB, NIST or Agency requirements, and were provided separately because they were voluminous. For example, we determined that the security plans for IFMS, CPS and EPAYS did not describe, or summarize and reference in an addendum, a minimum set of specific controls for: (1) requesting, establishing, issuing, and closing user accounts; (2) tracking users and their respective access authorizations; and (3) managing these functions. In addition, these same security plans did not describe or summarize and reference, in an attached addendum, specific controls used to ensure the timely and proper handling of friendly terminations, unfriendly terminations, and changes in job responsibilities. Furthermore, the security plans for IFMS, CPS and EPAYS, for example, did not reference or describe specifically how their respective application rules/controls were implemented for changing data, searching databases, or divulging information. These requirements are identified in NIST Publications 800-12 and 800-14, as a standard minimum set of generally accepted practices to be employed in an effective computer security program. The absence of details in the security plans gains significance because, in most instances, OCFO does not have formal policies or procedures which define security control processes for the financial systems. Formalizing control processes, whether in policies or in the form of security plans, ensures that everyone understands and can consistently apply the required controls. To further clarify how existing security plans lack sufficient details, we offer the following examples for two control topics required under OMB Circular A-130, Personnel Security and Access Security: Personnel Security Controls: The IFMS security plan prefaces its "Personnel Security" section by stating that the application system processes confidential or sensitive information and contains information requiring high availability and integrity controls. While the plan lists three implemented areas of personnel security (i.e., Separation of Duties, Least Privilege, and User Accountability), each area is described in minimalist terms. For example, the Least Privilege subsection makes a blanket statement that Financial Systems Branch personnel performing maintenance may also need to process documents. This subsection does not Audit Report 99B0003 3-7 ------- specify what types of processing might be performed by maintenance personnel or identify compensating controls which might be applicable under the circumstances. Similarly, the User Accountability subsection briefly refers to established audit trails, but does not specify what reports are generated to the security officer. Nor does this subsection identify if specific files are retained or for how long. Furthermore, the IFMS security plan does not recognize or define personnel screening requirements for Agency employees. The plan recognizes that personnel screening policies and procedures should be developed (sometime in the future) to govern contractor access to IFMS, and that these procedures should include non-disclosure agreements and be completed prior to granting system access. As a minimum, the security plan should address specific requirements in EPA Directives 2195 and 2100. For example, the plan should describe minimum screening requirements and procedures for both employees and contractor personnel performing comparable work. Intentional misuse and destruction of data can be committed by either type of user if given sufficient access. The EPAYS security plan addresses "personnel security" in a similar manner, but is more liberal because it does not address the need for non-disclosure agreements for contractor personnel. EPAYS, like IFMS, contains sensitive information which could be compromised by improper disclosure. Agency management needs to establish a policy and outline procedures which require both employees and contractor personnel to complete a screening prior to being granted access to these sensitive systems. Access Security Controls: The IFMS security plan only briefly addresses "Access Security" controls, focusing primarily on how local area network userids and passwords form the first line of defense for the application system. Although the IFMS plan assigns security responsibilities to the IFMS Coordinator and system users, it does not identify or reference minimum policies and procedures that could ensure access is properly and consistently controlled. Furthermore, this section of the plan does not address control processes associated with employees who change jobs or leave the Agency. Rather, under the section entitled "Password Rules," the plan states that "IFMS users are responsible for informing the designated IFMS coordinator of any changes in duties or termination." Making users responsible for initiating changes to their personal access authorities may seriously undermine access controls, because users could intentionally refrain from notifying the IFMS Coordinator, thereby retaining special access privileges long after they no longer require those access rights. Under the described circumstances, users intent on misusing or destroying system data at a later date would have the upper hand. Furthermore, even if 100 percent of users notify the IFMS Coordinator regarding impending changes, no formal process exists to ensure that appropriate actions will be taken in a consistent and timely manner. 3-8 Audit Report 99B0003 ------- Similarly, the CPS security plan addresses access controls at a very high and general level. It states that access is maintained by: (1) IBM mainframe userids and passwords, (2) AD ABAS Natural security, and (3) an individual user profile which allows specific functions in CPS. Whereas the security plan mentions mainframe security, it does not specify how the security software (i.e., RACF) is implemented. Also, the plan does not elaborate on Natural security procedures other than to state that a person's userid must be added to a main CPS "group." The plan does not expand on the number and types of "groups" available. The plan states that supervisors should decide which function(s) a user should be given access to, but the plan does not identify how the supervisor is to make that determination or what functions are available. Both IFMS and CPS contain sensitive and confidential information requiring access restrictions. Therefore, the security plans for these systems should identify a minimum set of policies and procedures for granting user access. For example, the plans should distinguish specific access rights/privileges which apply to predefined user groups or functional job titles. Furthermore, incompatible duties should be segregated into separate access groups. The security plans should define access rights/privileges for each group, and individuals should be granted access to one group based on their job - no more and no less. This approach is discussed in NIST Publication 800-12. Critical Security Control #3 - Contingency Plan: Contingency planning was not considered acceptable unless the security plan addressed related requirements found in OMB Circular A-130 Appendix III, OMB Memorandum M-98-12, NIST guidance and Agency requirements. Furthermore, OMB Memorandum M-98-12 required that agencies use the GAO document entitled Year 2000 Computing Crisis: Business Continuity and Contingency Planning as a guide to ensure the continuity of core business functions. This GAO document required contingency plans for mission-critical systems to address contingencies for Year 2000 failures. As a result, we considered a security plan to be inadequate whenever the application's contingency plan: was inconsistent with its corresponding security plan, did not include a prioritized list of program-critical functions and the effect that the inability to perform each program-critical function would have on the organization, did not address contingencies and related disaster scenarios, did not address resource requirements and related time frames for continuity of operations related to the application, did not contain the application schedule and procedures for backup, did not assign or document specific procedures (e.g., initial response, Back Up Operations and Recovery) to be followed in response to each contingency and related disaster scenario, or had not been tested. Furthermore, if the contingency plan did not mention Year 2000 contingencies as a risk or the security plan did not address the issue under continuity of operations, then we did not consider the plan specific enough to address OMB's requirement. Audit Report 99B0003 3-9 ------- Some financial management systems only addressed contingency plans as part of the general support system's continuity of support plan. In such cases, we considered the general support system's continuity of support plan to be adequate only if it specifically and reasonably addressed the application system. Our review disclosed that CPS, IFMS, CPARS, and EPAYS were the only financial management systems included in Enterprise Technology Services Division (ETSD) NCC Critical Applications Disaster Recovery Plan. Management provided applicable portions of the ETSD NCC Critical Applications Disaster Recovery Plan in lieu of contingency plans specific to these four applications. While other financial management applications also reside on the mainframe, they were not included in NCC's DRP focused on critical applications. These other applications also lacked adequate contingency plans. However, the Agency adequately justified that the MARS application is not essential for producing standard reports and that management could also use other tools to create ad-hoc reports. These alternative reporting methods equated to a lower risk and, therefore, MARS did not need to meet this requirement. However, if MARS is not an essential system, we question why the Agency continues to classify it as a "core" financial system. Furthermore, the referenced alternative reporting methods should be referenced and tested as part of the other core financial systems' contingency plans. Critical Security Control #4 - Security Training: In evaluating security training, we used various criteria from the Computer Security Act of 1987; OMB Circular A-130, Appendix III; EPA Directive 2100, IRMPolicy Manual, and EPA Directive 2195, Information Security Manual. In each security plan, we expected to find a description of an operational security training program which addressed general and application-specific security. If the security training program was scheduled for development and not operational during fiscal 1998, then we looked for more rigorous system controls to compensate for the lack of security training. The security plan was considered acceptable when it documented an operational training program that addressed application-specific security policies, procedures and system requirements. For example, MARS identified a schedule to establish user and training manuals by January 2000, but compensating controls did not exist to mitigate the risk incurred during the interim period. An acceptable compensating control would have been to provide interim training to users before they were granted access to the application. Furthermore, as part of an effective security training program, we would have expected management to address a schedule for future user training, as well as document system-specific security training provided during the past three years. Agency management acknowledged they need a formal security training program, and stated that they have taken steps towards that goal since the end of the period under review. We commend management for making continued improvements to their security training program, but reiterate that this particular report must judge the state of compliance as of September 30, 1998. We will evaluate recent improvements during the fiscal 1999 audit of FFMIA compliance. Critical Security Control #5 - Approval Authorization: We considered approval authorization to be in compliance with Federal regulations and Agency policy if: (1) the security plan was approved by the program management official responsible for the system and related program data, and (2) responsible management authorized the application for operation on or before September 30, 1998. We reviewed the documentation for approving financial systems security plans and 3-10 Audit Report 99B0003 ------- program management's authorization to operate financial and mixed-financial systems using the security controls identified in the security plan. In our analysis, we used requirements outlined in the Computer Security Act of 1987, OMB Circular A-130, NIST Pub 800-14, and Agency policies. For example, the program manager responsible for the GICS and P2000 systems had not signed the security plan or authorized the systems operation. Instead, the service center manager approved the security plan and authorized its operation. We did not consider this to be a proper approval, because a major application must be authorized by the management official responsible for the function supported by the application. Systems Security Plans Not Approved As of September 30, 1998, seven EPA financial or mixed-financial systems lacked an approved system security plan, as required by OMB Circular A-130. Five of the seven financial or mixed- financial systems without an approved security plan were operational: CDOTS, ICMS, SPEDI, CIS and CTS. The other two systems without a final security plan (BAS22 and TM+) were under development. Management Is Not Treating Security Plans as Priority Tasks In our opinion, the primary reason contributing to deficient and missing security plans was that responsible financial and mixed-financial systems managers did not take timely actions to treat the completion of a review of operational security controls and development of security plans as a priority. The February 1996 revision of OMB Circular A-130 significantly expanded Agency security requirements for application systems and general computer environments. Previously, only a periodic risk assessment of security controls was required. To adequately address and implement the new OMB requirements, management needed to commit additional resources to: incorporate the results of independent reviews/audits of security controls into the approved security plans; and authorize, in writing, the use of the application by confirming that the implemented security plan would adequately secure the application. In fiscal 1997, the CIO recognized the significance of these policy changes when he declared security plans an Agency material weakness. The CIO established short deadlines to revise existing security plans, and expected system managers to provide the resources necessary to implement the new security requirements. However, it takes significant time and resources to perform an independent security review and subsequently develop a comprehensive security plan. As of September 30, 1997, neither EPA's core financial systems nor EPAYS had application security plans. To quickly meet the CIO's deadline, in fiscal 1998, system managers either: (1) revised older security plans without addressing the new requirement for an independent review of operational security controls, (2) delayed revising the security plans until resources became 22 BAS, a system under development, had an approved security plan which expired on June 30, 1998. The BAS security plan was not reauthorized; therefore, we did not perform a detailed review of the plan. Audit Report 99B0003 3-11 ------- available, or (3) composed a bare bones document which modeled the format and content of the generic example attached to the Agency guidance. Each of these tactics appeared to meet the CIO's mandate, while allowing scarce resources to be used for completing other priorities, such as implementing systems upgrades to achieve Year 2000 compliance. In their response to the draft report, management asserted that considerable staff time was devoted to identifying security requirements and documenting security controls in their security plans. Furthermore, OCFO management stated that they added staff in the OCFO immediate office to assist the SIRMO with security plan development, review and coordination. We commend management for taking more aggressive action to improve and approve security plans, but suggest that many measures were taken too late to affect the state of compliance as of September 30, 1998. Management's investments towards improving compliance with FFMIA requirements will be evaluated during the fiscal 1999 financial statement audit. Responsible Management Did Not Take Accountability for Risk of System Operations There was also general confusion regarding which managing official should "approve" security plans and authorize systems to operate. For example, OIRM management approved the GICS security plan and authorized the system for operation, even though they did not own the system or its data. Grants Administration Division (GAD) management maintained that this happened because there was confusion about who owned GICS. GAD was recognized as the system's primary owner, but other program offices also owned GICS data. For example, the Office of Water used GICS for the Construction Grant Program. In our opinion, GAD management needs to reach an agreement with the other program offices regarding who should be responsible for approving the GICS security plan and authorizing the system for operation. GAD management has already reached such an agreement for the P2000 system, which is being developed and will be piloted as a replacement system for GICS. GAD will be the official owner of the P2000 system and other secondary owners agreed that GAD should be responsible for approving the system's security plan. Financial Systems' Security Does Not Provide Reasonable Assurance of Data Integrity We found that specific system controls were not adequately described in the security plans to provide management with a reasonable basis for adequately considering the risks to financial data integrity. In addition, management's decision to forego completion of independent reviews or audits of current security controls did not provide management with reasonable assurance that operational and compensatory security controls existed or would prevent: unauthorized disclosure or manipulation of data; inconsistent application of security controls and procedures; the loss of data integrity in the event of a disaster, accidental damage, or intentional damage; and loss of audit trails concerning changes to the data. 3-12 Audit Report 99B0003 ------- Therefore, we believe management does not have an adequate basis to evaluate current risk to financial data and accounting operations. EPA's financial systems are a complex combination of off-the-shelf applications, in-house developed legacy systems, and in-house client-server systems which do not use standard data definitions. EPA also uses complex multi-platform, multi-protocol, and multi-vendor open systems. The financial systems and their platforms are integrated, and management needs to understand the operational controls and risks as part of the entire financial process. Therefore, management must ensure that the controls which secure this financial data from loss or alteration are thoroughly identified, assessed, strengthened when necessary, and documented to make certain that staff understand the relevance of such controls and are able to provide for their continuance. Comprehensive security plans provide a structured approach for documenting specific controls that provide management reasonable assurance that Agency data will be secure from unexpected or intentional threats in EPA's complex, decentralized architecture. For this reason, management needs to make it a priority to develop financial and mixed-financial systems security plans which fully address the requirements outlined by the Computer Security Act of 1987, OMB, NIST and Agency policies. RECOMMENDATIONS Because the organizational responsibility for the financial and mixed-financial systems varies, we are directing our recommendations to multiple action officials. The following recommendations intentionally address corrective actions at a high level, because it would be too prescriptive and voluminous to elaborate on corrective actions for each system within the confines of this final report. Furthermore, we believe managers should be responsible for determining minimum security controls, based on the risk associated with system operations. For more specific information, managers should refer to the detailed evaluations which we previously forwarded to system owners. We recommend the Chief Financial Officer: 9.1 develop an overall remediation plan which specifies resources, remedies and intermediate target dates associated with bringing CPARS, CPS, EPAYS, IFMS, MARS, TM+ and BAS systems into substantial compliance with OMB, NIST and Agency requirements, and addresses the critical security controls shown in Table 2. We recommend the Director for Acquisition Management: 9-2 develop security plans for CDOTS, ICMS, SPEDI, and CIS which address the critical security controls depicted in Table 2 above, and bring these systems into compliance with OMB Circular A-130, NIST and Agency requirements. Audit Report 99B0003 3-13 ------- We recommend the Director for Grants Administration: 9-3 address the critical security controls, as indicated in Table 2, needed to bring the P2000 security plan into compliance with OMB Circular A-130, NIST and Agency requirements, and 9-4 coordinate with GICS data owners and address the critical security controls, shown in Table 2, necessary to bring the GICS security plan into compliance with OMB Circular A- 130, NIST and Agency requirements. We recommend the Region 5 Assistant Regional Administrator for Resources Management: 9-5 develop a security plan for the CTS financial system which addresses the critical security controls shown in Table 2 and makes the system compliant with OMB Circular A-130, NIST, and Agency requirements. AGENCY COMMENTS AND PIG EVALUATION The Chief Financial Officer provided a coordinated response for the four action officials identified in the draft report. For the most part, the Office of Chief Financial Officer, the Office of Acquisition Management and the Grants Administration Division disagreed with the overall audit findings, stating that they believe EPA financial systems substantially comply with FFMIA requirements for financial management systems. Management stated that the Agency completed the security plans called for in the remediation plan which addressed fiscal 1997 FFMIA noncompliance issues. In addition, management disregarded some of the Federal and Agency criteria cited in this audit report, and maintained that the contents of completed security plans substantially complied with "applicable" requirements. Region 5 management agreed with our recommendation and subsequently submitted a security plan for review and approval. Throughout their response, Agency management referred to a recent independent assessment performed by the Department of Treasury's Financial Management Service Center for Applied Financial Management (Center). According to the Agency, the Center's review team issued three reports which concluded that: (1) the technical system documentation for EPA's financial systems met FFMIA requirements, (2) nine of EPA's financial systems met OMB A-127 requirements "in all material respects," and (3) nine of EPA's financial systems met OMB A-130 requirements" in all material respects." EPA management also cited an ongoing review by the National Security Agency as a basis for concluding that EPA substantially complied with FFMIA requirements. Agency management further supported their position by stating: NIST Publication 800-18 should not be used to evaluate the security plans because it postdated the period covered in the 1998 Financial Statement Audit; 3-14 Audit Report 99B0003 ------- NIST Publications 800-12 and 800-14, and GAO Year 2000 guidance were not appropriate criteria for evaluating security plans; audit staff inappropriately used OMB requirements for general support systems to evaluate major application system security plans; security plans were not required to contain the level of detail called for in the draft report; Agency officials intentionally excluded details from financial security plans because they thought offering too much detail was a security risk; and sufficient security controls actually existed for EPA's financial systems, although these controls were not always formally documented in system security plans, policies or procedures. In those instances where Agency officials acknowledged that: (1) systems were technically noncompliant with requirements, or (2) control weaknesses existed, management contended that the operational risk was minimal and such weaknesses did not warrant a substantial noncompliance opinion. Furthermore, in their response, Agency management raised many issues which they believed had not been duly considered by audit staff in reaching a conclusion regarding the degree of FFMIA noncompliance. In particular, management asserted that: the "yes/no" indicator used in Table 2 of the draft report did not accurately reflect the degree of noncompliance in each critical security control area; some systems, such as ARTS, CTS, and TM+ did not require security plans; Booz-Allen and Hamilton (BAH) issued an assessment report on EPA's financial systems within the three year period preceding the period being audited; the credibility of BAH's report was not diminished by the fact that EPA subsequently "reclassified" some of the review findings and issued a revised version of the report in 1996; and audit conclusions regarding security controls were too strong given that auditors only evaluated controls documented in security plans, policies or other documentation, and did not observe or test operational security controls. Management also asserted that audit staff did not adhere to auditing standards because we did not review operational controls as part of our review of security documentation. Agency management also suggested that: (1) the auditor's standard for contingency planning was substantially more stringent in the draft report than it had been in prior formal position papers, (2) in the draft report, audit staff expanded the criteria for contingency planning compliance in two instances and also added three new requirements, (3) the audit criteria was not consistently applied from system to system, and (4) our criteria for evaluating contingency plans contained requirements associated with the preparation of Continuity of Operations Plans (COOP). The Agency's response repeatedly emphasized that security is a high priority item to them and that, in the months since the end of the reporting period, they have continued to improve the content of security plans, as well as other noted control weaknesses. With regard to security plans, management stated that they devoted considerable staff time to identifying security requirements and documenting security controls. For example, OCFO added additional staff to Audit Report 99B0003 3-15 ------- its immediate office to assist the SIRMO with security plan development, review and coordination. In concluding, OCFO management disagreed with report recommendation 9.1, but suggested that the OIG report include more specific recommendations by addressing specific deficiencies which needed correction. OAM, GAD and Region 5 management also provided comments regarding their respective report recommendation(s). Specifically: OAM management disagreed with report recommendation 9.2, citing that the Agency's procurement systems were substantially compliant with OMB, NIST and Agency requirements. In addition, they stated that: The Contracts Information System has been in operation for a number of years and has had an approved security plan in the past. However, they noted that security information for this system is being incorporated into the ICMS Security Plan. The SIRMO directed OAM to revise the ICMS Security Plan23 to address issues which OIRM's IRM Policy and Evaluation Division raised in connection with their recent extensive critique of the plan. OAM's Office Director was briefed on the status of the ICMS Security Plan and granted authority to operate these systems, with direction that OAM's Technical Information Officer comply with the SIRMO's instructions and guidance. GAD management disagreed with report recommendations 9.3 and 9.4, stating that the GAD Systems Security Plan, as of September 30, 1998, was sufficiently detailed to meet EPA guidelines. However, GAD management also added that: they are currently revising the plan which should be completed by June 2000. The revised plan will include requirements for the operation of the Partnership 2000/Integrated Grants Management System, which is under development (9.3). they will coordinate with the Office of Water, the co-owner of GICS data, and jointly address the additional critical security controls necessary to keep the GICS Security Plan in compliance with OMB, NIST and Agency requirements (9.4). Furthermore, management is arranging for an independent audit of the system. Region 5 management agreed with report recommendation 9.5. They developed and submitted a CTS Security Plan to the SIRMO for review and approval by March 31, 2000. 23 The ICMS family of applications includes ICMS, SPEDI and CDOTS. 3-16 Audit Report 99B0003 ------- In the following paragraphs, we have attempted to address all of the Agency's aforementioned concerns: The Agency based its position mainly on two sources, which were issued after the end of the reporting period, September 30, 1998. Auditors have not had the opportunity to review products issued from these sources. For example, the National Security Agency's (NSA) review is ongoing and, to date, NSA has not taken a stance on any issue by releasing a draft or final written product. Similarly, whereas the Center issued three draft reports, audit staff were given access only to one draft report. As of August 16, 1998, (i.e., date of the Agency's formal response to the draft audit report), two Center reports were still in draft format. At that time, Center staff had finalized their report addressing system documentation; however, management still has not provided auditors access to the report's supporting analytical work papers. We acknowledge that the Agency has been working aggressively to improve security planning for its financial systems, and we realize that these two sources may have considered improvements made since the end of the reporting period. Nevertheless, such improvements would have no bearing on the state of compliance during fiscal 1998. Furthermore, auditing standards require that we satisfy ourselves as to the work of others before placing reliance on it for audit purposes. Therefore, until we can review the referenced reports, evaluate related analytical work papers and weigh other review procedures, we must continue to place reliance on our own audit analysis in determining FFMIA compliance. Although we cannot use these products as a basis for our 1998 audit opinion, we will consider them as part of our fiscal 1999 audit work. Based on the Agency's response to the draft report, we made several major revisions to the audit findings in the final report. Most notably, we removed the "yes/no" indicators from Table 2 of the report and replaced them with indicators which denote either full compliance, noncompliance or substantial noncompliance. In addition, we allowed the Booz-Allen and Hamilton final report to serve as the independent assessment of operational controls, although we remain concerned that Agency management negated some of the report's "independence" by excluding several of the reported nonconformances from the Agency's corresponding internal report and subsequent corrective action plan. As a result, we revised findings associated with this particular security control for the following systems: IFMS, MARS, CPARS and EPAYS. Also, we removed ETAMS from the list of financial systems, based on the Agency's response that "because the Agency's payroll system is to be replaced, management decided to not expend any additional resources on this system." We modified the final report to reflect the exclusion of ETAMS. With one exception, we maintain that the Federal and Agency criteria used in our evaluation are appropriate for identifying required security controls and evaluating the content of major application security plans. The one exception is NIST Publication 800-18. Prior to the issuance of the draft report, we agreed with Agency managers that NIST 800-18 should not be applied for compliance purposes because it became effective after the period under review. We emphasized to Agency management that this particular criteria only affected one element within one of the five, identified critical security controls (depicted in Table 2), specifically Control Item # 2. Upon re-evaluation, we concluded that the degree of noncompliance for that critical control did Audit Report 99B0003 3-17 ------- not materially change when we excluded the questioned guidance. The findings depicted in both draft and final reports did not include the requirements of NIST 800-18. Based on the current security risk to EPA systems, we did not agree with the Agency's logic for excluding the other referenced criteria. We attempted to hold a meeting with the various financial system managers and staff, and EPA's National Program Manager for Security, to discuss both Federal and Agency requirements for security plans. We thought such a meeting was necessary, because OCFO representatives stated that criteria such as NIST 800-12, NIST 800-14, EPA Directives 2100 (IRM Policy Manual) and 2195 (Information Security Manual) were not applicable to the evaluation of their application system security plans. OCFO management subsequently postponed the scheduled joint meeting, stating thatNSA staff should also attend the meeting but would not be available until sometime after August 25, 1999. To date, Agency security personnel have not been able to meet with NSA representatives to discuss minimum security controls for sensitive financial systems. Furthermore, to our knowledge, OCFO management has not received a waiver or special dispensation from responsible Agency officials which would have excluded financial systems from the requirements stated in EPA Directives 2100 and 2195. Despite management's comments, they were not able to provide support which specifically identified parts of our analysis where criteria was inappropriately applied. In its response, the Agency referenced Section B of OMB Circular A-130, Appendix III, to support its position. However, Section B only contains explanatory, descriptive language which is included merely to assist users in understanding the requirements outlined in Section A of the Circular. Rather, Section A.3.b, Controls for Major Applications, is the section which identifies applicable requirements and states that security plans should be consistent with guidance issued by NIST. Agency management stated that security control details were intentionally excluded from security plans to protect sensitive information from unauthorized individuals. However, we noted that, except for CPS, management could not provide audit staff with the other documents which supplemented or supported their security plans (e.g., incident handling plans, accreditation statements, training programs, contingency plans, etc.). After repeated attempts to obtain any documents fitting this description, we concluded that no such documentation existed, at least during the period under review. Consequently, management maintained that: (1) security plans were not required to contain the level of detail called for in the draft report; (2) management was able to rely on other information it received on financial system security; and (3) security controls actually existed, although they may not have been formally documented. In response, we maintain that the security plan is the recognized vehicle under which management is obligated to weigh, in the aggregate, reported system strengths and risks, and approve or disapprove system operations. When management formally approves (i.e., signs) a system security plan, they provide tangible assurance that they: (1) are aware of particular control deficiencies, (2) knowingly accept the risk of operations during the interim, and (3) have adequate compensating controls to mitigate the risk or action plans to address the reported weaknesses in a timely manner. Other documents, although related, are not recognized as 3-18 Audit Report 99B0003 ------- providing the same level of accountability and "tangible assurance" as the security plan. For this reason, a security plan needs to include or reference any report findings which play a part in management's decision to authorize operations. Whereas the Agency may have addressed findings through other documents, they did not reference or include important review findings in the security plan; therefore, the plan could not provide tangible assurance that management fully understood and evaluated the risks of operation before granting that authorization. Despite Agency comments to the contrary, we continue to believe that security plans should have been in place for ARTS, CTS and TM+, during the period under review. We based our conclusions on the following facts: ARTS was classified as a major application system during the period under review, as well as the preceding years. Although it is only a microcomputer database application, ARTS electronically transmits information to IFMS. We support the concept of a risk assessment which ensures that the cost of controls do not exceed the expected benefits, and concur that ARTS no longer requires an independent assessment of security controls. Still, we expect management to assess the ARTS operational security controls on a regular basis, revise the ARTS security plan based on such assessments, and maintain appropriate cost-effective security controls. Although we continue to report ARTS-related findings associated with the period under review, we will exclude ARTS from our report recommendations. CTS may be a regional program, but it is a major Agency system. CTS also played a major role in accounting for Region 5 Superfund receivables. In fact, CTS was used for over $100 million or about 11 percent of Agency Superfund receivables. Although Region 5 is the only region using CTS, and no direct interface exists to IFMS, we believe CTS is a major subsystem to IFMS with regard to the accounting process. The Agency has been reporting TM+as a pilot to OMB. TM+was under "phased development" as part of that pilot, as the Agency indicated. However, the application was being piloted in several organizations such as Region 5, Region 7, RTP and Financial Management Centers. Although TM+ has yet to be adopted Agency-wide, travel documents are being processed and approved by this system. For years, systems under development have been required to address security under the Computer Security Act of 1987 and OMB Bulletin 90-08. Therefore, we believe TM+ should be listed as a system under development in the financial inventory, unless a formal decision is made, using EPA's Directive 2100 system development process, to stop system development. We disagreed with management's contentions that our audit work was inconsistent with applicable audit standards, because we limited our audit to evaluating controls documented in security plans, policies and other documentation. As previously discussed, operational security controls are being examined under several, separate ADP general control audits. We defined our audit approach in a multi-year audit plan which was endorsed by the General Accounting Office. We will conduct one or more audits of operational security controls during fiscal 2000. Audit Report 99B0003 3-19 ------- Furthermore, our audit intentionally focused on the contents of security plans, among other critical security controls, because such plans are intended to document existing operational controls, recognize control weaknesses, and identify compensating controls which could be used to temporarily mitigate those risks until additional controls could be put in place. In most instances, we found that specific controls were either absent or insufficiently described in the plans. Moreover, our analysis demonstrated that many critical security controls were either moderately noncompliant or severely lacking to the point that they were substantially noncompliant with the stated requirements. As such, we maintain that the audit findings are appropriately reported. With respect to our standard for evaluating contingency planning (i.e., Critical Security Control #3), audit staff neither expanded the criteria for compliance in the draft report nor added three new requirements for evaluation purposes. The draft report language was more explicit than that included in prior position papers, because audit staff believed OCFO management needed additional examples to show the extent of the noncompliance in that area. At no time during the review, did audit staff expand or adjust the evaluation criteria in order to make compliance more difficult. The Agency believed that we inconsistently applied criteria to our examinations of disaster recovery plans. Our evaluation comments for CPS and IFMS differed because the IFMS contingency plan was better in two major respects than the corresponding CPS disaster recovery plan. Therefore, we wanted to inform RTP management that off-site storage and information on testing should be incorporated into the CPS Disaster Recovery Plan. With regards to our examination of contingency plans, we did not use the requirements for a COOP plan as part of the review criteria. As the Agency pointed out, this was not an official requirement until after September 30, 1998. We expected the Agency to address multiple contingencies as part of security plan requirements to address continuity of operations. EPA Directive 2195 requires a disaster recovery plan to identify the kinds of events as limited (temporary disruption), major (serious disruption) or catastrophic. Therefore, situations such as electrical power outages (limited), destruction of computer facilities due to fire (major) and software failure due to year 2000 problems (catastrophic) would require different types of response actions. Emergency procedures should then address disruption of business operations. Currently, contingency plans only address catastrophic events. In their response, management emphasized that they continue to devote resources to improving the content of system security and contingency plans and the state of their security programs. We commend OCFO management for making continued improvements to their security programs and system plans, but this particular report must judge the state of compliance as of September 30, 1998. The referenced Center reports may reflect improvements made subsequent to the end of fiscal 1998, but these reports were not provided to audit staff for evaluation. Therefore, recent application system improvements will be evaluated during the fiscal 1999 audit of FFMIA compliance. 3-20 Audit Report 99B0003 ------- As shown in Table 2 of the report, the state of FFMIA critical security controls ranged from compliance to substantial noncompliance, depending on the system and the particular critical security component. Moreover, we considered each system which did not have an approved security and contingency plan in place, at the end of the review period, to be substantially noncompliant in all respects with the five, listed critical security controls. For purposes of the audit report, we needed to deliver one, overall opinion regarding the state of compliance with FFMIA financial system requirements as of September 30, 1998. We maintain that the number and type of noncompliance and substantial noncompliance issues have a cumulative effect which reflect the state of security, as a whole, with regards to EPA's financial systems. Therefore, in the aggregate, EPA's financial and mixed-financial systems were substantially noncompliant with FFMIA requirements for financial management systems. In both the draft and final reports, we intentionally address corrective actions at a high level because we believe it would be too prescriptive and voluminous to elaborate on specific corrective actions for each system in this report. Furthermore, we believe management should be responsible for determining minimum security controls, based on the risk associated with system operations. For more specific information, managers should refer to the detailed evaluations which we previously forwarded to system owners. As needed, audit staff will meet with system owners, responsible managers, and security personnel to further explain: (1) the kind of information expected in a major application system security plan, and (2) the level of detail which would satisfy OMB, NIST and Agency requirements. OAM, GAD and Region 5 management provided the following responses to their respective report recommendation(s): OAM management formally disagreed with report recommendation 9.2, citing that the Agency's procurement systems were substantially compliant with Federal and Agency requirements. Although management maintained that the Contract Information System had an approved security plan in the past (1992), they could not locate a copy of the referenced plan for our review. As a result, we saw no evidence that an approved security plan existed for CIS. Therefore, we endorse OAM's commitment to revise the ICMS Security Plan to include security controls for CIS. Likewise, we commend management's decision to revise the ICMS Security Plan by addressing issues which OIRM staff raised during a recent critique of the plan. Whereas OAM management delegated the task to their Technical Information Officer, their response did not indicate an expected completion date for complying with the SIRMO's instructions and guidance. GAD management formally disagreed with report recommendations 9.3 and 9.4, stating that the GAD Systems Security Plan, as of September 30, 1998, was sufficiently detailed to meet EPA guidelines. Despite their formal position, GAD management added that they will: revise the plan to include requirements for the operation of the Partnership 2000/Integrated Grants Management System. Management expects to complete Audit Report 99B0003 3-21 ------- the task by June 2000. This corrective action satisfies the intent of report recommendation 9.3. coordinate with the Office of Water, the co-owner of GICS data, and jointly address the additional critical security controls necessary to keep the GICS Security Plan in compliance with OMB, NIST and Agency requirements. Management expects to complete the task by March 31, 2000. Furthermore, management is arranging for an independent audit of the system. We anticipate that this action will satisfy the intent of report recommendation 9.4. Region 5 management agreed with report recommendation 9.5. They developed and submitted a CTS Security Plan to the SIRMO for review and approval by March 31, 2000. In prior communications with Region 5, management indicated their intent to simultaneously develop a security plan for the Chicago Accounts Receivable Management System (CHARMS), which will eventually replace CTS. 3-22 Audit Report 99B0003 ------- ATTACHMENT 4 STATUS OF PRIOR AUDIT REPORT FINDINGS TABLE OF CONTENTS Page AUDIT OF EPA'S FISCAL 1997 FINANCIAL STATEMENTS 4-1 AUDIT OF EPA'S FISCAL 1996 FINANCIAL STATEMENTS 4-7 FISCAL 1995 FINANCIAL STATEMENT AUDIT OF EPA'S TRUST FUNDS, REVOLVING FUNDS AND COMMERCIAL ACTIVITY 4-8 FISCAL 1994 FINANCIAL STATEMENT AUDIT OF EPA'S TRUST FUNDS, REVOLVING FUNDS AND COMMERCIAL ACTIVITY 4-10 FISCAL 1993 FINANCIAL AUDIT; PESTICIDES REVOLVING FUNDS AND THE OIL SPILL TRUST FUND 4-12 FISCAL 1992 FINANCIAL AUDIT; SUPERFUND, LUST AND ASBESTOS LOAN PROGRAM 4-12 FISCAL 1992 FINANCIAL AUDIT; PESTICIDES REVOLVING FUNDS 4-12 FISCAL 1991 FINANCIAL AUDIT; HAZARDOUS SUBSTANCE SUPERFUND 4-13 Audit Report 99B0003 ------- STATUS OF PRIOR AUDIT REPORT FINDINGS Report Findings and Recommendations Management Comments and Corrective Action Plans Target Date Status AUDIT OF EPA'S FISCAL 1997 FINANCIAL STATEMENTS (Audit Report E1AML7-20-7008-8100058, Issued 03/2/98) EVALUATION OF INTERNAL CONTROLS - MATERIAL WEAKNESSES: 1.0 IMPROVEMENTS NEEDED IN AGENCY'S ACCOUNTING FOR UNBILLED SUPERFUND OVERSIGHT COSTS ! The Acting Chief Financial Officer (CFO) develop a plan with goals and milestones that will ensure all oversight billings are current by the end of fiscal year 1998. OCFO and OECA establish a plan with goals and milestones for oversight billings. 04/30/98 Completed 06/09/98 OIG Note: This issue, which was also reported in our FY 96 financial statement audit report, is also discussed as a FY 98 Reportable Condition on accounts receivable. Please refer to Attachment 2 for additional comments. OIG Note EVALUATION OF INTERNAL CONTROLS - REPORTABLE CONDITIONS: 2.0 FURTHER IMPROVEMENTS NEEDED IN MANAGING EPA'S ACCOUNTS RECEIVABLE We recommend that the Acting CFO: 2.1. provide detailed training to regional finance personnel on how to calculate an allowance for doubtful accounts, Conduct training at a technical workshop. 06/12/98 Completed 2.2. conduct site visits to regional finance offices and perform quality assurance reviews to ensure FMOs are properly following accounting guidance, In a 9/30/98 memo, the CFO informed us that they performed quality assurance reviews in prior years, and in FY 1998, conducted such reviews in Regions I, IV, and V. The CFO further informed us that, on an as needed basis in future years, the CFO would: 1) determine which regions require quality assurance reviews; 2) conduct FMO training; and 3) conduct quality assurance reviews to ensure FMOs are properly following accounting guidance. 09/30/98 Completed 2.3. develop procedures that require FMOs to follow-up with ORCs and program offices when responses to their requests for receivable collectibility information are not received timely, and In a 9/30/98 memo, the CFO informed us that, based on discussions (with Regional Program Offices and Offices of Regional Counsel), there was a need to clarify the management of oversight bills. Guidance was provided by the Financial Management Division in April 1998. The CFO also recognized a need to continue providing periodic training and workshops on the management of accounts receivable and collections to further improve performance in this area. Accordingly, the OCFO will annually provide training and workshops on the management of accounts receivable and collections and will meet monthly with the Department of Justice (which began in April 1998). 06/12/98 Completed 09/30/98 Audit Report 99B0003 4- 1 ------- STATUS OF PRIOR AUDIT REPORT FINDINGS Report Findings and Recommendations Management Comments and Corrective Action Plans Target Date Status 2.4. work with the Assistant Administrator for Enforcement and Compliance Assurance to implement guidance that will ensure Offices of Regional Counsel and program offices timely provide financial management offices with the supporting documents they need to record and write off accounts receivable. 2.5 We recommend the Assistant Administrator for Enforcement and Compliance Assurance emphasize to ORCs: 2.5.1. the need to forward to FMOs within 3 workdays, copies of all source documents that are required to establish accounts receivable, and 2.5.2. the need to respond back to FMOs within 30 days concerning receivable collectibility determinations. OIG Note: We are again noting a Reportable Condition for accounts receivable in our FY 98 audit. Please refer to Attachment 2 for additional comments and current status on this issue. For many years, management has been working to improve its management of accounts receivable. Starting with FY 83, our audit reports (of the Hazardous Substance Superfund obligations and disbursements) consistently identified improvements needed in the three phases of a receivable: recording the amount due, monitoring the status of the receivable and recording the funds collected. While we acknowledge many actions and initiatives have been taken to resolve these problems, management should continue its emphasis in this area. Issue Cross Servicing Policy Announcement on delinquent debts. Issue Revised RMDS 2540, Chapter 9 In a 9/30/98 memo, the CFO informed us that, on July 26, 1998, the Assistant Administrator for Enforcement and Compliance Assurance issued a memorandum entitled "Effective Debt Management" to the Regional Counsels. The purpose of that memo was to reiterate and reinforce the Agency's policy regarding the Regional Counsels' responsibility in the identification and collection of accounts receivable. 03/30/98 06/30/98 07/30/98 (rev) 12/15/98 (rev) 04/30/99 (rev) 08/30/99 (rev) 03/31/98 06/30/98 (rev) Completed 06/09/98 Open Completed 07/26/98 OIG Note Audit Report 99B0003 4-2 ------- STATUS OF PRIOR AUDIT REPORT FINDINGS Report Findings and Recommendations Management Comments and Corrective Action Plans Target Date Status 3.0 CONTINUING EFFORTS NEEDED TO IMPROVE THE ACCOUNTING FOR CAPITALIZED PROPERTY 3.1 We recommend that the Acting CFO, in conjunction with the Acting Assistant Administrator for Administration and Resources Management, continue to jointly work to strengthen controls designed to ensure that property is timely and accurately recorded in the Agency's accounting system. Specifically, additional training should be provided to property and finance personnel addressing the roles, responsibilities, and requirements for processing and recording capital asset transactions in IFMS FAS. Conduct property training session Conduct joint property/finance training 03/09/98 06/30/98 08/30/98 (rev) Completed 06/09/98 Completed 08/19/98 3.2 We recommend that the Acting Assistant Administrator for Administration and Resources Management encourage PMOs to establish property records in a timely manner once supporting documentation is received from the FMO during the reconciliation process. Above actions are also applicable to recommendation 3.2. OIG Note: We have reported property issues since our first financial statement audit of the Superfund in FY 92 and other financial related audits of the Superfund since FY 82. Since that time, we have reported continuing problems with accounting for and controlling property. We are pleased to report that much progress has been made in this area. Please refer to Attachment 2, Reportable Conditions, for additional details on the current status of this issue. OIG Note 4.0 ADDITIONAL ACCOUNT ANALYSIS COULD IMPROVE THE ACCURACY OF THE AGENCY'S FINANCIAL INFORMATION 4.1 We recommend that the Acting CFO continue to emphasize to regional financial personnel the importance of analytical reviews, and provide them timely general ledger account information and detailed training that is specific to each general ledger account. OIG Note: We first reported this issue in our FY 94 financial statement audit of EPA's Trust Funds, Revolving Funds and Commercial Activity. In a 9/30/98 memorandum, the CFO informed us "As previously reported, we have undertaken several actions to improve the Agency's account analysis capabilities. We have: 1) issued a matrix that provides a description of all of EPA's general ledger accounts and that cross-walks these accounts to the government-wide Standard General Ledger, 2) provided training to finance office staff on how to perform general ledger account analysis, 3) provided general ledger reports by finance office to the finance offices, and 4) provided training at our Financial Management Conference in June of this year. Additionally, as previously reported, we have employed the personal computer-based file interrogation program IDEA (Interactive Data Extraction and Analysis) to allow us to perform various analyses of information contained in IFMS and other automated systems, including general ledger account analyses." OIG Note Audit Report 99B0003 4-3 ------- STATUS OF PRIOR AUDIT REPORT FINDINGS Report Findings and Recommendations Management Comments and Corrective Action Plans Target Date Status 5.0 GRANT ACCRUAL PROCEDURES NEEDED 5.1 We recommend that the Acting Chief Financial Officer develop guidance for determining the grant accrual amounts for future financial statements. The procedures should consider the impact of implementing OMB Bulletin 97-01 and should be supported by a verifiable rational analysis. In a 9/30/98 memorandum, the CFO informed us that they had been working with the OIG to develop draft procedures and reached an agreement on the procedures. We selected 3 samples of grants and forwarded the sample selection to the OIG for their concurrence. We received the OIG's concurrence on September 2, 1998, and e-mailed the grants in our samples to our finance offices. Pending Completed OIG Note: This issue was also reported in our FY 96 financial statement audit report. OIG Note 6.0 CONTROLS FOR APPROVING INTERAGENCY AGREEMENT INVOICES NEED TO BE IMPROVED No new recommendations. OIG Note: This issue was first reported by us in our FY 94 financial statement audit of EPA's Trust Funds, Revolving Funds and Commercial Activity. Please refer to Attachment 2, Reportable Conditions, for additional comments and current status on this issue. OIG Note: Although corrective actions had been implemented, our audit work continued to find that project officers were not receiving required information and payment requests were not timely approved. OIG Notes 7.0 PROCEDURES NEED TO BE ESTABLISHED FOR IDENTIFYING, TRACKING AND REPORTING EPA'S ENVIRONMENTAL LIABILITY 7.1 We recommend that the Acting CFO work with the Assistant Administrator for Enforcement and Compliance Assurance, Acting Assistant Administrator for Administration and Resources Management, and the Office of General Counsel to jointly develop policies and procedures for tracking and annually reporting the Agency's environmental liability. 8.0 REVENUE WAS NOT PROPERLY RECORDED ON SUPERFUND STATE CONTRACTS Jointly draft policies and procedures for tracking and annually reporting EPA's environmental liability. Jointly finalize policies and procedures for tracking and annually reporting EPA's environmental liability. 04/30/98 07/15/98 (rev) 07/31/98 08/31/98 (rev) 10/30/98 (rev) 03/31/99 (rev) 05/31/99 (rev) 08/31/99 (rev) Completed 07/31/98 Open 8.1 We recommend the Acting CFO continue working with regional finance officials to further their understanding of the adjustments and how to utilize the spreadsheet analysis as a tool for determining necessary adjustments. Conduct a SSC training session 07/31/98 Completed 07/23/98 OIG Note: We first reported this issue in our FY 92 financial statement audit of the Superfund Trust Fund, LUST Trust Fund and Asbestos Loan Program. Please refer to Attachment 2, Reportable Conditions, for additional comments and current status on this issue. OIG Note Audit Report 99B0003 4-4 ------- STATUS OF PRIOR AUDIT REPORT FINDINGS Report Findings and Recommendations Management Comments and Corrective Action Plans Target Date Status 9.0 AUTOMATED APPLICATION PROCESSING CONTROLS FOR THE INTEGRATED FINANCIAL MANAGEMENT SYSTEM COULD NOT BE ASSESSED No new recommendations. OIG Note: This issue has been reported since our FY 94 financial statement audit of EPA's Trust Funds, Revolving Funds and Commercial Activity. Please refer to Attachment 2, Reportable Conditions, for our comments on this issue. In the OCFO's February 20, 1998 response to the draft report, the OCFO responded that existing documentation is sufficient to support ongoing operation and maintenance of IFMS. From a functional and operational perspective, the benefits of this additional documentation do not justify the costs to develop and maintain it. IFMS is a mature system and OCFO will be initiating a system replacement project, so it would not be economical to make major IFMS cost investments that could not be recovered within the next several years. OIG Note Audit Report 99B0003 4-5 ------- STATUS OF PRIOR AUDIT REPORT FINDINGS Report Findings Target and Recommendations Management Comments and Corrective Action Plans Date Status COMPLIANCE WITH LAWS AND REGULATIONS: 10.0 EPA IS NOT IN SUBSTANTIAL COMPLIANCE WITH 10.1 - EPA submitted a remediation plan to OMB on 3/31/99. In this plan, the Comptroller advised OMB that all 10/31/98 Completed FEDERAL FINANCIAL MANAGEMENT SYSTEM corrective actions were completed concerning the five core financial management systems 02/28/99 (rev) 03/31/99 REQUIREMENTS OIG Note: Our FY 98 audit again identified weaknesses in the Agency's security planning for its financial systems OIG Note We recommend that the Acting CFO direct the Director, Financial and we are again reporting a substantial noncompliance with FFMIA. Please refer to Attachment 3 - Compliance Management Division (FMD) to: with Laws and Regulations for additional comments on this matter. 10.1 develop a remediation plan which includes resources, 10.2 - OCFO and OIRM Approval of IFMS and EPAYS Decision Paper; - Complete EPAYS Year 2000 Decision 03/31/98 Completed remedies and intermediate target dates to bring the Agency Paper into substantial compliance with Agency, OMB and FFMIA requirements; 10.2 - Implement EPAYS/TAPP Year 2000 modifications 01/30/99 Completed 10.2 follow existing EPA policy for System Life Cycle Management; OIG Note: Although FMD has addressed implementing Agency Systems Development Life Cycle (SDLC) policies OIG Note for the core financial systems, we believe the OCFO needs to address implementing standard SDLC policies or 10.3 with the assistance of the Office of Information Resources procedures for all Agency financial systems. Management, ensure that application security plans are developed, approved and implemented for all of the OCFO's 10.3 - Prepare IFMS, MARS, CPARS, EPAYS & Employee Express application security plans 02/20/98 Completed financial management systems; 01/15/98 10.3 - Develop & Finalize Travel Manager + Security Plan 12/31/98 Completed 10.4 implement policies and procedures where necessary to ensure 03/31/99 (rev) 09/13/99 appropriate FMD oversight of system planning, and upgrade 09/30/99 (rev) and maintenance operations for financial systems; 10.4 - Review and update SMG & EMG Charters / Establish SMG/EMG or alternative groups 03/31/98 Completed 09/30/98 (rev) 02/02/99 10.5 ensure that the financial systems annual inventory data OIG Note: The Comptroller decided to eliminate the SMG and EMG rather than update their charters. OIG Note required by OMB is consistent, comparable and accurate; and 10.4 - Issue internal operating procedures for IFMS oversight 12/31/98 Completed 10.6 ensure that the annual update of the CFO Financial 02/02/99 Management Report and Five Year Plan submitted to OMB OIG Note: The new FMD policies and procedures are limited in scope and only apply to three of the eight OCFO OIG Note includes all significant system changes in the financial systems financial systems. We believe that there is a need to establish improved controls through formal oversight policies inventory. and procedures applicable to all financial systems under the OCFO. OIG Note: We again note a Noncompliance with Laws and Regulations 10.5 - Improve guidance for OMB Inventory update 09/30/98 Completed for federal financial management system requirements in our FY 98 10/15/98 audit. Please refer to Attachment 3 for additional comments on this issue. 10.6 - Include system inventory in CFO Five-Year Plan. In a 9/30/98 memorandum, the CFO advised us that "We 10/30/98 Open are providing more guidance to the system managers to improve the accuracy of the inventory data, which will be 02/26/99 (rev) completed by October 15, 1998. The guidance will emphasize the need to accurately report systems inventory data and have supporting documentation for the responses on the inventory. FMD plans to use the new process in the FY 1998 annual update. Additionally, we will reflect all changes to the system inventory in the 1998 CFO Five-Year Plan by October 30, 1998." OIG Note: As of the date of this report, the OCFO had not issued the 1998 CFO Five-Year Plan. OIG Note Audit Report 99B0003 4-6 ------- STATUS OF PRIOR AUDIT REPORT FINDINGS Report Findings and Recommendations Management Comments and Corrective Action Plans Target Date Status 11.0 EPA IS NOT COMPLYING WITH APPROPRIATIONS LAW WHEN DISBURSING GRANTS FUNDED WITH MULTIPLE APPROPRIATIONS 11.1 We recommend that the Acting CFO and Acting Assistant Administrator for Administration and Resources Management finalize and implement guidance for awarding and disbursing multiple-funded grants that complies with Title 31 U.S.C. 1301. OIG Note: This issue was first reported by us in our FY 94 financial statement audit of EPA's Trust Funds, Revolving Funds and Commercial Activity. AUDIT OF EPA'S FISCAL 1996 FINANCIAL STATEMENTS (Audit Report E1AML6-20-7001-7100120, Issued 03/24/97) EVALUATION OF INTERNAL CONTROLS - MATERIAL WEAKNESSES: 2.0 COMPONENTS OF SUPERFUND NET POSITION COULD NOT BE AUDITED EVALUATION OF INTERNAL CONTROLS - REPORTABLE CONDITIONS: 9.0 AUTOMATED APPLICATION PROCESSING CONTROLS FOR THE IFMS COULD NOT BE ASSESSED OIG Note: Repeat finding from our FY 95 financial statement audit (finding 8.0, page 4-9). Because corrective actions on this issue were underway, we did not make additional recommendations. Please refer to our FY 98 audit report, Attachment 2, Reportable Conditions, for additional comments on this issue. In a 9/30/98 memorandum, the CFO provided the following status "The determination of whether our accounting practices violate Appropriations Law remains under OGC review. We will continue to encourage them to issue an OGC decision as soon as possible, so we can resolve this issue." OGC opinion requested from OGC. Obtain OGC opinion. Implement accounting changes dependent on OGC opinion. Target date will be established after OGC opinion is received. 03/06/96 To be determined To be determined OIG Note Completed Open Open OIG Note: Repeat finding from our FY 95 financial statement audit. Corrective action plans already established based on prior OIG recommendations . See pages 4-8 and 4-9 below for current status. OIG Note: Please refer to our FY 97 audit finding 9.0, above, for additional comments on this issue and to our FY 95 audit finding 8.0, below, for planned corrective actions that have not been completed. OIG Note Open OIG Notes Audit Report 99B0003 4-7 ------- STATUS OF PRIOR AUDIT REPORT FINDINGS Report Findings and Recommendations Management Comments and Corrective Action Plans Target Date FISCAL 1995 FINANCIAL STATEMENT AUDIT OF EPA's TRUST FUNDS, REVOLVING FUNDS AND COMMERCIAL ACTIVITY (Audit Report E1SFL5-20-8001-6100200, Issued 5/3/96) 3.0 3.1 EXPENSES FOR MULTI-FUNDED GRANTS NEED TO BE ADJUSTED TO REFLECT WHICH APPROPRIATION BENEFITTED FROM THE WORK PERFORMED Recommend that the Chief Financial Officer obtain a legal opinion from the Office of General Counsel regarding whether: (a) it is proper to use the FIFO grant disbursement method, and (b) if it is, whether adjustments are needed at year-end. 3.2 Use the Office of General Counsel opinion to develop and implement policies and procedures for accounting for disbursements for multi-funded grants. OIG Note: Please refer to our FY 97 audit finding 11.0, page 4-7 (EPA Is Not Complying With Appropriations Law When Disbursing Grants Funded With Multiple Appropriations) for an additional recommendation and corrective actions on this issue. 5.0 COMPONENTS OF NET POSITION ARE NOT RECONCILABLE 5.1 The CFO should make the completion of any Superfund analysis and the resulting reallocation of funds a priority for fiscal 1996. In addition, reconcile any remaining material differences for the fiscal 1996 financial statements. AGENCY COMMENTS: In a 07/02/96 response, the Agency stated: We agree with this recommendation. On March 6, 1996 we requested a legal opinion from our Office of General Counsel (OGC) on the propriety of the FIFO method. In a 12/30/96 update, the Agency stated: We have now decided, on a prospective basis, to phase out the FIFO grant disbursement method for charging payments on multi-funded grants. In lieu of this FIFO method, a workgroup, organized by GAD and including OIG representation, agreed to take the actions described in our response to recommendation 3.2 presented below. Also, for the existing multi-funded grants, we will ensure that each appropriation is appropriately charged with the respective benefits from the work performed by developing an allocation method for adjusting total payments to each appropriation at year-end. This adjustment will reflect the original funding allocation justifying the obligation to each appropriation benefitting from the work performed and will reflect the proper costs to each appropriation in our fiscal year-end financial statements. The OIG has concurred with our proposed methodology. In a 12/30/96 update, the Agency stated: We worked with OGC and have now decided on an appropriate course of action. The GAD will develop and issue a policy that clearly defines the appropriate use of multi-funded grants and will also provide the grantee with instructions for requesting payment to ensure proper accounting by each appropriation. The OIG representatives have concurred with this action. Develop draft policies and procedures Circulate draft policy to the appropriate offices and receive comments Revise draft and issue policy. FMD issued Transmittal 97-08 "Expense Allocation Methodology for Multi-Funded Assistance Agreements" on 01/03/97. Issue guidance on Superfund State Contract and Cash Out billings and collections recorded in Superfund. Develop report and issue guidance for interest recorded incorrectly in FY 1994 and prior Correct interest activity Move SSC and Cash Out billings and collections to SSC and Cash Out funds Analyze pre-1996 Cash Outs recorded in the reimbursable funds and adjust revenue and advances as required. N/A N/A 01/30/97 03/15/97 N/A N/A 01/31/97 04/30/97 (rev) 02/28/97 04/30/97 (rev) 04/30/97 Audit Report 99B0003 ------- STATUS OF PRIOR AUDIT REPORT FINDINGS Report Findings and Recommendations Management Comments and Corrective Action Plans Target Date Status Analyze SSC and Cash Out funds, Superfund and the Superfund equity and prepare adjustments. 06/30/97 08/30/97 (rev) 11/23/97 (rev) Open 8.0 AUTOMATED APPLICATION PROCESSING CONTROLS FOR THE INTEGRATED FINANCIAL MANAGEMENT SYSTEM COULD NOT BE ASSESSED 8.1 Require minimum IFMS technical documentation which would include a system design, development plan, test plan, test results and other appropriate documents for future enhancements and upgrades. OIG Note: Please refer to our FY 98 audit report, Attachment 2, Reportable Conditions, for additional comments on this issue. We also disclosed a reportable condition in our FY 96 (finding 9.0) and FY 97 (finding 9.0) audit reports, because the automated processing controls were not sufficiently documented for us to audit them. AGENCY COMMENTS: In a 07/02/96 response, the Agency stated: We believe that we have sufficient documentation to meet the intent of the OIG recommendation. However, we will continue to work with the OIG staff to resolve our differences on this issue. We have accepted the OIG's request to participate in the testing of our next IFMS subrelease scheduled for July 1996. We have also requested that our programming contractor review the "model" documentation provided by the OIG to determine whether such documentation could also be developed for IFMS. In a 12/30/96 update, the Agency stated: We are pleased that your staff has agreed to work with us on a project to develop additional system documentation for your staff to use in evaluating the automated application controls in the IFMS. While we believe we have demonstrated that we have sufficient documentation to operate IFMS effectively to meet the Agency's needs, we also acknowledge the OIG's needs to fully understand and develop a working knowledge of IFMS. Due to delays in the EPA FY96 budget and in issuing the FY96 operating plan, funding for the system documentation analysis had been delayed; however, funding has now been made available by the CFO, and we have established milestones for completing this activity. OIG Note Complete system documentation analysis Draft Accounts Receivable documentation completed by AMS Final Accounts Receivable documentation approved by OIG and FMD OIG Note: Please refer to Attachment 2, Reportable Conditions, for additional comments on this issue Documentation for OIG selected transactions in other modules completed by contractor OIG Note: FMD closed this recommendation in its audit tracking system because Agency management did not believe it was cost effective to develop additional documentation. 12/31/96 01/30/97 09/30/97 (rev) 03/15/97 11/15/97 (rev) 09/30/97 TBD Completed 03/07/97 Completed 09/30/97 OIG Note Closed 04/10/98 OIG Note 8.2 Establish a plan and schedule to implement a comprehensive data dictionary. OIG Note: Please refer to our FY 98 audit report, Attachment 2, Reportable Conditions, for additional comments on this issue. FMD closed this recommendation in its data base indicating the responsible action office was OIRM. AGENCY COMMENTS: In a 12/30/96 update, the Agency stated: The Enterprise Information Management Division has established, at the agency level, a Data Register for program system metadata that would be accessible via the World Wide Web on the Internet. It is our intention to place the IFMS metadata into the EPA Data Register. We believe that this is a viable alternative solution for our data dictionary needs, for both the short and long term. It also broadens our view and interpretation on what a data dictionary is, and moves us closer to what the agency is doing, in the area of integrated agency level metadata sharing on the EPA Register. This activity will put us at the forefront as the agency evolves in this new direction. OIG Note Completion of scope and responsible party definition 12/30/96 Open Completion of associated cost estimates 02/15/97 Open Entry of IFMS metadata into EPA Data Register 09/30/97 Open Audit Report 99B0003 4-9 ------- STATUS OF PRIOR AUDIT REPORT FINDINGS Report Findings and Recommendations Management Comments and Corrective Action Plans Target Date Status FISCAL 1994 FINANCIAL STATEMENT AUDIT OF EPA's TRUST FUNDS, REVOLVING FUNDS AND COMMERCIAL ACTIVITY (Audit Report E1SFL4-20-8001-510192, Issued 2/28/95) 1.0 ADDITIONAL INFORMATION AND REPORTS WOULD ALLOW AGENCY OFFICIALS TO MORE EFFECTIVELY MANAGE FINANCIAL ACTIVITIES We recommended that the Chief Financial Officer: 1.1 Provide financial management offices with general ledger reports by accounting point and hold them accountable for the accuracy of their account balances. FMO's scheduled receipt of general ledger reports by accounting point. 08/31/95 Completed 06/26/95 1.2 Determine why individual obligations in MARS do not match the IFMS amount and take appropriate corrective action. 4.0 GRANTEE PAYMENT REQUESTS DO NOT PROVIDE NECESSARY ACCOUNTING INFORMATION Determine corrective action Develop IFMS reports for outstanding obligations. Modify MARS to incorporate the contract order number on contract obligation data OIG Note: FMD closed this recommendation in its data base as this recommendation will be superseded by an updated recommendation concerning obligations in the FY 98 financial statement audit. 08/31/95 03/31/96 10/01/96 07/30/97 (rev) 07/30/98 (rev) Completed 10/31/95 Completed 03/31/96 Closed 04/14/99 OIG Note 4.1 Chief Financial Officer require a clause in all assistance agreements funded from multiple appropriations that specifies how the payments should be charged to the various appropriations. If, for example, all work can be paid for from any appropriation, the clause should state that the finance office may charge any appropriation. However, if certain work should be paid for from a specific appropriation, the clause should require the recipient to include accounting information with each payment request. Prepare a draft policy on split funded projects Circulate to Grants Customer Relations Counsel for comment Enter the policy into the Green Border process Finalize and issue the policy 08/15/95 08/31/95 09/30/95 01/97 (rev) 11/30/95 Completed 12/96 Completed 12/96 Open Open Audit Report 99B0003 4- 10 ------- STATUS OF PRIOR AUDIT REPORT FINDINGS Report Findings and Recommendations Management Comments and Corrective Action Plans Target Date Status 10.0 A COMPREHENSIVE AGENCY-WIDE POLICY ON INDIRECT COSTS SHOULD BE IMPLEMENTED 10.1 Chief Financial Officer develop and implement an Agency- wide policy for identifying and allocating indirect costs. Identify the major tasks and requirements associated with implementing Agency-wide cost accounting based on FASAB managerial cost accounting standard, the provisions of GPRA and other applicable considerations. Commence development of detailed cost accounting policy including financial system requirements analysis. OIG Note: FMD indicated that the two milestones above were completed on 3/15/97 and 8/28/97 respectively and closed this recommendation in its audit tracking system on 9/4/97. FMD closed this recommendation upon the issuance of a 8/28/97 memorandum to the Office of Site Remediation Enforcement which discussed a preliminary methodology for developing Superfund "full cost" indirect cost rates. FMD also indicated that their goal is to develop and implement the new Superfund indirect methodology by fiscal year 1999. Upon closing this recommendation in its audit tracking data base, FMD officials provided a number of reasons why they believed it is premature at this time to commit to a corrective action plan with specific milestones. These reasons included EPA's appropriation structure; principles of appropriation law, as well as specific provisions in EPA's appropriations, may effectively prescribe accounting methods which do not necessarily reflect generally accepted cost accounting principles; and specific ceilings in EPA's appropriation (i.e. Superfund administrative expenses) also govern how EPA must account for its expenditures. FMD officials also mentioned the Working Capital Fund (implemented in FY 96), would address some of the cost accounting issues for certain administrative functions. In conclusion, FMD officials indicated that. . the development and implementation of an EPA-wide comprehensive cost accounting system will require a long term plan that coordinates system development, policy considerations, and user needs. The integration of these requirements are complex, and a simple corrective action plan at this time is insufficient. Therefore, we will address this issue when we update our Five-Year Plan." During FY 98, EPA developed detailed cost accounting procedures for implementation in FY 99. 06/30/96 03/01/97 (rev) 10/31/96 03/01/97 (rev) 09/30/97 Open OIG Note Open OIG Note Audit Report 99B0003 4- 11 ------- STATUS OF PRIOR AUDIT REPORT FINDINGS Report Findings and Recommendations Management Comments and Corrective Action Plans Target Date Status FISCAL YEAR 1993 - FINANCIAL AUDIT - PESTICIDES REVOLVING FUNDS AND THE OIL SPILL TRUST FUND (Audit Report E1AML3-20-7001-4100230, Issued 3/31/94) 7.0 HIGHER PRIORITY NEEDS TO BE PLACED ON COMPLETING REQUIRED REVIEWS OF USER FEES 7.1 CFO include timely review of user fees as one of the financial management performance measures used to evaluate program offices in the future. Implement financial management performance measures in the program offices. OIG Note: On 11/5/97, the Acting CFO provided the Administrator with a biennial fee review report. The report shows five current fees, four proposed fees, and eight exceptions. The Agency still needs to follow through and either institute, revise, or update all user fees or obtain exceptions from OMB as OMB Circular A-25 requires. The next biennial review of user fees is scheduled to be completed by September 1999. 12/01/94 04/01/95 (rev) 07/31/97 (rev) 9/30/99 Open OIG Note FISCAL YEAR 1992 - FINANCIAL AUDIT - SUPERFUND, LUST AND ASBESTOS LOAN PROGRAM (Audit Report P1SFL2-20-8001-3100264, Issued 6/30/93) 4.0 ACCOUNTING FOR GRANT DRAWDOWNS DOES NOT PROVIDE REQUIRED ACCOUNT INFORMATION Establish QAT to review the procedures, establish milestones, report to process owners, and implement changes. OIG Note: Our FY 94 audit report also discussed this issue. For a current status on corrective actions, please refer to our FY 94 audit finding 4.0 on page 4-10. N/A Open OIG Note 4.1 CFO review the results of the Quality Action Team's analysis of this issue and determine if additional procedures need to be developed to account for grant drawdowns. FISCAL YEAR 1992 - FINANCIAL AUDIT - PESTICIDES REVOLVING FUNDS (Audit Report E1EPL2-20-7001-3100065, Issued 6/30/93) 6.0 TOLERANCE FEES COLLECTED DID NOT COVER EPA'S COSTS Develop methodology for conducting review of tolerance program costs OIG Note: A workgroup was formed by OPPTS to determine the total cost of assessing pesticide tolerances and to change the current fee structure through rule making to recover the aggregate cost. The proposed rule for recovering the aggregate cost of the tolerance program through fees was published in the Federal Register on June 9, 1999 (Vol. 64, Number 110, pages 31039-31050). Comments on the proposed rule were due by September 7, 1999. Complete review and submit to CFO with recommendations OIG Note: In its FY 97 Integrity Act report, EPA reported a corrected Agency-level weakness for user fees. Our FY 93 audit report also discussed this issue. Please refer to our FY 93 audit finding 7.0 above for additional comments and the current status for this issue. 10/31/93 Completed 12/15/93 OIG Note 6.1 CFO, in coordination with the Director, OPP, conduct a comprehensive review of tolerance program costs to determine how much tolerance fees should be raised, and take the necessary steps to make appropriate changes in the fees charged. 6.2 CFO conduct the required biennial review of other Agency user fees, and institute the necessary policies and procedures to ensure that these reviews will be conducted in a timely manner in the future. 01/31/94 Completed 11/5/97 OIG Note Audit Report 99B0003 4- 12 ------- STATUS OF PRIOR AUDIT REPORT FINDINGS Report Findings and Recommendations Management Comments and Corrective Action Plans Target Date Status FISCAL YEAR 1991 - FINANCIAL AUDIT - HAZARDOUS SUBSTANCE SUPERFUND (Audit Report P1SFF1-11-0026-2100660, Issued 9/30/92) 3.0 CERTAIN ALLOCABLE COSTS WERE NOT ALLOCATED TO SUPERFUND 3.1 Obtain a written opinion from the OGC on the legal basis for charging Superfund administrative expenses to the Salaries and Expenses Appropriation. If the OGC determines that the Agency's current practice of charging the S&E appropriation for Superfund administrative expenses after the Superfund administrative ceiling is reached is improper, then the OGC should provide guidance on appropriate corrective action. Request a legal opinion from OGC to reaffirm the legality of charging Superfund expenses to the S&E appropriation. OIG Note: OGC issued a memo to the Comptroller on 7/11/96 reaffirming prior OGC opinions concerning the charging of Superfund administrative expenses to other appropriation accounts. Specifically, a 1984 Associate General Counsel opinion on the subject stated that under applicable GAO precedent, once the Agency elects the type of costs to charge to Superfund and the types of costs to charge to S&E, it is bound by its election. Based on this OGC decision, on 8/9/96, we asked the Comptroller to provide a work sheet or schedule that clearly identifies each fiscal years' understatement (from FY91-95). On 9/17/96, the Comptroller sent us a memo advising us that they are not planning to move S&E charges to the Superfund account for FY91 or subsequent years. The OC and OGC are examining the application of the statute for allocating costs between appropriations. The OC believes that the history behind the administrative expense ceiling in Superfund may permit EPA to appropriately discontinue allocating costs once the ceiling limitation has been reached. As of the date of this report, the Comptroller and the OGC have not reached resolution on this issue. OIG comments: We encourage the Comptroller to make every attempt to resolve this long standing issue. If the Comptroller is aware of reasons that would prevent taking action suggested by OGC, we suggest that a decision memorandum be prepared to resolve this issue by the CFO and the Acting OGC. 02/15/93 06/30/95 (rev) Open OIG Note Audit Report 99B0003 Audit Report 99B0003 4-13 ------- APPENDIX I EPA'S FISCAL 1998 FINANCIAL STATEMENTS Audit Report 99B0003 ------- ------- September 1999 FY 1998 AUDITED FINANCIAL STATEMENTS Produced by the U.S. Environmental Protection Agency Office of the Chief Financial Officer Financial Management Division ------- ------- TABLE OF CONTENTS Overview of EPA 1 EPA Programs - Descriptions and Highlights/Accomplishments and Future Trends -Air 13 -Radiation 21 -Drinking Water 23 -Water Quality 28 -Toxic Substances 35 -Hazardous Waste 41 -Superfund 49 -Oil Spills 62 -Leaking Underground Storage Tank 66 -Pesticides 68 -Water Infrastructure Financing 73 Principal Financial Statements 77 Acronyms 115 EPA's FY 1998 Annual Financial Statements Page i ------- ------- OVERVIEW OF EPA Background The U.S. Environmental Protection Agency (EPA) was established in 1970 to lead the Nation's efforts to protect and preserve human health, and to safeguard the natural environment. EPA is working to achieve this mission by reducing risks to human health and the environment, preventing pollution, and simultaneously promoting economic development in an environmentally sound and cost-effective manner. EPA has made significant strides during the past 25 years towards achieving these goals, but the Nation still faces critical environmental challenges. Americans continue to live in areas where the soil is contaminated and is unsuitable to live or play on, the water is unsafe to drink, and the air is dangerous to breathe. Despite these challenges, EPA is committed to ensuring that the Nation's environment is made safe and clean for our next generation. Congress provided EPA with $7.6 billion and 17,975 workyears for FY 1998. During FY 1998, the Agency began advancing the environmental commitments made by the President and began implementing new environmental and public health standards. For example, EPA issued guidance and worked with states on implementing the improved air quality standards for ozone and particulate matter (July 1997 standards). EPA also accelerated Superfund cleanups of hazardous waste sites, and expanded Brownfields redevelopment efforts under the Brownfields Redevelopment Initiative. The Agency improved access to information about pollution in local communities consistent with its commitment to the public's right-to- know about toxic and hazardous chemicals in their neighborhoods. EPA increased assessments of health risks to children who may be vulnerable to the effects of toxic substances. The Agency assisted in the revitalization of urban areas, applied new research tools to the state of the environment, and ensured the safety of the Nation's water and food supplies. Also, EPA continued to promote environmental justice and urban environmental quality; improve Federal environmental management; empower states, tribes, communities, and the university research community; and develop a more dynamic enforcement program to enhance compliance, regulatory, and voluntary activities. GPRA Implementation In September 1997, EPA issued its first Strategic Plan required by the Government Performance and Results Act (GPRA). This plan describes EPA's mission, long-term goals, and identifies specific objectives the Agency would meet in achieving these goals. The Plan also serves as the framework by which the Agency is transitioning to performance-based planning and budgeting. EPA's FY 1999 Annual Performance Plan and Budget integrates resource requests with annual performance goals and measures. The performance results for these annual goals and measures will then be used to assess the contributions of the FY 1999 accomplishments towards achieving EPA's longer-term goals and objectives. During FY 1998, EPA continued to develop other key mechanisms to strengthen the Agency's planning, budgeting, analysis, and accountability framework in cooperation with its partners and stakeholders. First, EPA initiated a new multi- year planning process in January 1998 to examine the links between the Annual Performance Goals (APGs) identified in EPA's FY 1999 Annual Performance Plan and Budget and the longer-term goals and objectives outlined in the Strategic Plan. Goal Teams, having a Regional Administrator and a National Program Manager as co-leaders, discussed plans with EPA's Deputy Administrator to improve the availability and quality of environmental information, and their plans for achieving environmental and programmatic results. For the first time, EPA's planning focus was based on the Agency's strategic goals and objectives rather than on the activities of individual program offices. Second, EPA reviewed its FY 1999 APGs and Performance Measures and began work to improve its APGs and Performance Measures for the FY 2000 Annual Performance Plan and Budget. The Office of the Chief Financial Officer (OCFO) developed the criteria for establishing APGs and Performance Measures, and evaluated the Agency's ability to measure progress against its strategic objectives and sub-objectives. EPA's FY 1998 Annual Financial Statements Page 1 ------- Third, EPA developed the FY 1999 performance accountability process with advice from a broad range of partners and stakeholders including representatives of states and tribes. Approved by EPA's Deputy Administrator in June 1998, the FY 1999 process is centered on the creation of a basic framework to support the development of EPA's first Annual Performance Report under GPRA — due to Congress in March 2000. The initial accountability process is part of a two-track strategy that recognizes FY 1999 as a learning year that will ultimately contribute to the development of a long-term accountability process for FY 2000 and beyond. Accomplishments to date include the development of an initial outline on the form and content of the Annual Performance Report, and the design and testing of a central accountability database to record performance information on APGs and Performance Measures. Finally,EPA developed a major outreach effort to communicate the Agency's need and capacity to implement the GPRA. Accordingly, the OCFO conducted regional workshops to provide regional employees and managers with information concerning the Agency's planning, budgeting, analysis, and accountability processes. The OCFO also presented briefings to a number of EPA headquarters offices and to several external stakeholders. Protecting Communities from Toxic Pollution The President made a national commitment to protect our Nation's communities from the dangers of toxic pollution. Accordingly, EPA began carrying out this promise by addressing four key areas: ~ Began efforts to accelerate toxic waste cleanups at 900 of the Nation's worst toxic waste sites. ~ Expanded the Brownfields Redevelopment Initiative to increase the number of grants provided by EPA to communities for site assessments, cleanups, and redevelopment planning of contaminated and abandoned urban properties. ~ Enhanced the availability of right-to-know information to our Nation's citizens and communities by working with federal, state, and local agencies to develop a nationwide network that monitors key environmental health indicators relating to air, land, and water. Americans will have the ability to access timely health-related data needed to make informed choices affecting their health and information concerning the possible links between toxics and environmental health risks (e.g., cancer and reproductive risks). ~ Continued to get tough on criminal polluters by helping prosecutors, police, and investigators develop better tools to protect our communities from the threat of toxic pollution. EPA also provided state and local law enforcement officers with training to enhance their abilities to investigate and detect environmental crimes. Implementing New Environmental Laws EPA continued to implement new requirements under the Safe Drinking Water Act (SDWA) Amendments of 1996 to ensure that our Nation's public water system provides safe drinking water. To achieve this goal, EPA has improved the way drinking water safety standards are established and regulations are developed, emphasized prevention programs such as protecting source waters, set regulatory priorities based on risk, and expanded consumer information about contaminants found in drinking water. EPA also provided technical and financial assistance to state and local governments to assist them in the operation of small drinking water systems, and EPA capitalization grants were issued to states for loans to local municipalities to improve their drinking water systems. EPA's drinking water research efforts strengthened the scientific basis for drinking water standards through the use of improved methods and new data to better evaluate the risks associated with exposure to chemical and microbial contaminants in drinking water. EPA implemented the requirements of the Food Quality Protection Act (FQPA) of 1996 created to improve the safety of our Nation's food supply. To ensure that pesticides are safer, EPA reassessed existing pesticide tolerances, streamlined reviews of safer Page 2 EPA's FY 1998 Annual Financial Statements ------- pesticides, reviewed pesticide registration for new health concerns such as endocrine disruptors, and accelerated the review of existing pesticides. EPA also developed and distributed more useful information to the public to inform them of the risks posed from exposures to adverse pesticides. To help finance these new requirements, EPA increased the pesticide reregistration and tolerance fees. Finally, EPA initiated a major research effort to address critical science needs, such as cumulative exposure, identified under Titles III and IV of the Act. Protecting Children from Environmental Threats Assessing the health risks of our children from environmental pollutants is a primary concern of the President. In support of this policy, EPA initiated a research program to improve understanding of the unique health risks children face when exposed to pesticides and other environmental pollutants. Accordingly, EPA's Administrator established policy ensuring that all environmental health risks to children are explicitly and consistently evaluated as part of the Agency's risk assessments, risk characterizations, and environmental and public health standards pursuant to EPA's national agenda on children's environmental health issued in 1996. EPA continues to increase families' awareness of possible health threats to their children by way of public information and education under the Right-to-Know program. Also, EPA's enforcement efforts have focused on children through coordinated initiatives, case development, and litigation to protect them from the dangers of lead-based paint. To fulfill the President's commitment, EPA reassessed existing information and approaches used to determine health risks to children, and began revising national standards to provide our children with greater protection. Revitalizing Cities EPA is committed to making America's cities more livable through effective environmental protection. EPA continued to build new partnerships with urban communities by increasing urban revitalization efforts through an expanded Brownfields Redevelopment Initiative which promotes cleanup and redevelopment of abandoned and contaminated industrial and commercial properties (i.e., brownfields) across the Nation. In addition to redeveloping contaminated properties, the Brownfields Initiative provides communities with an increased tax base, creates additional jobs, and improves the overall quality of urban environments. EPA produced guidelines for preventing polluted runoff that could threaten urban drinking water sources and for improving air quality in urban communities. EPA also provided support to cities for pilot projects in waste minimization outreach and through coordinated pollution prevention goals that reduce waste generation, energy usage, and water usage. Applying Advanced Technology to Environmental Management Recent technological developments in remote sensing, information systems, and computer technologies have created new and more effective ways for EPA to monitor and manage the environment. The Advanced Measurement Initiative (AMI) has enabled the identification, research, and application of advanced monitoring tools and technologies that provide more timely, accurate, comprehensive, and cost-effective monitoring information for assessing the status of the environment, human health, and ecosystems. Fundamental to AMI is the demand for effective partnerships with intra-agency and inter- agency (e.g., NASA and the Departments of Defense, Energy, Interior, and Commerce) organizations, including partnerships with communities, academia, and private industry. EPA will continue to leverage these vital partnerships while matching specific environmental monitoring needs with the appropriate technological solutions. Regulatory Reinvention EPA continued to support high-priority reinvention activities such as Project XL (i.e., excellence and leadership), the Common Sense Initiative (CSI), and the Sustainable Development Challenge Grant Program, while seeking alternatives to the current regulatory system. Under Project XL, companies, states, and localities may redesign current EPA rules if they can formulate alternative systems that are both cheaper and cleaner for the environment. Through Project XL, EPA has successfully forged new and EPA's FY 1998 Annual Financial Statements Page 3 ------- challenging partnerships with businesses and communities interested in contributing new and innovative strategies for efficient and effective environmental management. The CSI is central to EPA's ongoing efforts to improve the way it undertakes environmental missions. The CSI has enabled EPA to find cleaner, cheaper, and smarter solutions to help overcome the Nation's environmental problems. The CSI concept is based on the understanding that EPA should be uncompromising in achieving its health and environmental objectives, but flexible enough to provide regulated entities with cost-effective ways to meet their environmental regulatory objectives. The Sustainable Development Challenge Grant Program awards funds to projects that leverage public and private community investment for the purpose of developing comprehensive environmental management plans. The program is designed to improve environmental quality and economic prosperity. Through open community involvement and investment, this program has challenged communities to meet their present environmental and economic needs without compromising the needs of future generations. Finally, EPA's Environmental Leadership Program continued to work with Federal and state partners to initiate projects that will provide new and innovative approaches to compliance. EPA has provided funding to assist small businesses, including Small Business Compliance Assistance Centers that help small businesses in specific industries, comply with their environmental requirements. EPA's compliance with the Small Business Regulatory Enforcement Fairness Act has steadily increased the amount of consideration and accommodation afforded small business concerns in regulatory matters. Strengthening State and Tribal Partnerships EPA continued its efforts to build and support state, local, and tribal environmental protection programs. Since effective Federal/state/local/tribal partnerships are essential to fully realize our Nation's environmental laws, EPA continues to enhance its partnership efforts to implement, operate, and enforce these laws. EPA continued to provide state and tribal governments with technical and financial assistance. Additional resources were provided to states for their air, water, and multimedia enforcement programs to assist them in addressing growing program requirements created by the FQPA, new clean air standards, and the need to review the quality of surface waters for Total Maximum Daily Loads. Increased resource levels also were provided to tribes to help them continue developing their own environmental protection programs. For example, resources were provided to tribes through Indian General Assistance Program grants. These resources enabled tribes to identify the scope of their environmental management needs, establish their program development priorities, and to continue building their individual environmental programs. These grants have provided EPA with its most effective means for building the tribal capacity necessary for making and implementing environmental management decisions. Under the National Environmental Performance Partnership System, EPA has recognized the states' increasing capacity to operate their own environmental programs. Accordingly, EPA continued to explore new approaches that would provide its state and tribal partners with more flexibility in managing their environmental programs. For example, the Agency is attempting to formalize Tribal/EPA Environmental Agreements with every Federally recognized Indian tribe. Through these agreements, EPA can support its Indian partners in a manner that is consistent with both tribal priorities and various statutory requirements. Performance Partnership Grants and Agreements In 1996, Congress enacted the President's proposal to establish permanent authority for EPA to enter into Performance Partnership Grants with states and tribes. During 1998, EPA continued to work with states and tribes to combine individual categorical grants (e.g., air, water, hazardous waste, etc.) into one or more consolidated grants. Consolidating several individual grants into one has helped to streamline administrative burdens and has enabled states and tribes to direct valuable resources to their most pressing environmental problems. As states and tribes begin to realize the major benefits of these combined grants, a further increase in state and tribal participation is anticipated. Also, Performance Partnership Grants, Page 4 EPA's FY 1998 Annual Financial Statements ------- which are closely tied to the National Environmental Performance Partnership System (NEPPS), have allowed states to sign agreements with EPA which reduce oversight in exchange for strong state performance. En forcement and Compliance Assurance EPA's enforcement program continued to emphasize a balanced approach between traditional activities of compliance monitoring, civil and criminal enforcement actions, and more recent approaches such as compliance assistance and compliance incentives. In 1998, the Agency carefully invested and redirected resources to support its dual role which requires the use of enforcement and compliance tools to ensure adherence to environmental regulations, particularly in high risk areas. Resources were subsequently redirected from relatively low risk areas, such as Hazardous Waste Enforcement, to programs that protect children's health from lead-based paint and pesticide misuse. The enforcement program also provided additional resources to protect public water systems and to address unique water pollution problems associated with concentrated animal feedlot operations. Although the amount of Federal compliance assistance resources has been reduced as states assume greater responsibility, the enforcement program provided additional resources for compliance incentives to the regulated community. During 1998, the enforcement program emphasized and provided increased resources to establish the new self-audit policy as a way of achieving greater compliance levels at a lower cost to the public and private sectors, including industry and Federal agency partnerships. EPA continues to direct resources to multimedia compliance. The enforcement program is enhancing compliance by providing compliance assistance to the regulated community, including Federal facilities, and by developing and implementing ways to encourage voluntary compliance with environmental regulations. One example of developing assistance tools for the regulated community is the Small Business Compliance Assistance Centers. These Centers provide one-stop shopping for all regulations for a given industry sector such as printing or metal finishing. The Centers provide plain-English guides to compliance requirements and technical assistance resources, assistance and training on treatment technologies, and methodologies for self-audits and compliance surveys. The enforcement program completed the pilot phase of the Sector Facility Indexing Project (SFIP). The pilot SFIP makes it easier for the public to access a wide range of environmental information about regulated facilities. In the past, these records, although public, were very difficult for government and public users to access because they were spread across many different databases. Under SFIP, the Agency has integrated this information so that it can be viewed in one place, and can be used to better understand overall facility environmental records. SFIP, in its current pilot stage, will allow EPA to gauge the level of public interest in examining records regarding government oversight of regulated facilities, facility compliance with environmental laws, and the overall pollutant releases that are reported. SFIP currently contains records for five industry sectors that consist of a total of 653 facilities. The Agency publicly released the SFIP data on May 1, 1998, via the Internet. In September 1998, EPA made available a hard copy report of SFIP for those who do not have ready access to the Internet. In FY 1999, the Agency will evaluate the SFIP to determine future directions of the project. The primary goal of EPA's Federal Facility Compliance Program is to ensure that all agencies reach a level of compliance with environmental requirements that equals or surpasses the rest of the regulated community. EPA uses a three- pronged approach: training and compliance assistance; compliance oversight and enforcement; and review of federal agency environmental plans and programs. This comprehensive approach is designed to help federal agencies develop appropriate compliance strategies and to request adequate funding to carry out those strategies. Environmental Reviews and multimedia inspections continue to be used for compliance assistance at federal facilities. EPA's FY 1998 Annual Financial Statements Page 5 ------- In FY 1998, the Environmental Justice Program (EJP) continued to emphasize public outreach efforts and focused on disadvantaged communities with a disproportionate number of polluting sources. A total of $2.5 million in small grants up to $20,000 each were awarded to 123 community organizations seeking solutions to local environmental problems. Also, a total of $500,000 was awarded to states and tribes to provided financial assistance to state and environmental departments to address environmental justice issues. Finally, the National Environmental Justice Advisory Council held 18 meetings in FY 1998. The EJP will continue to develop tools for identifying impacted communities and to target enforcement actions in areas with the greatest risk from environmental hazards. The enforcement and compliance assurance program continued to emphasize the review of environmental impacts of proposed major federal actions as required by the National Environmental Policy Act (NEPA); Section 309 of the Clean Air Act; Executive Order on Environmental Justice; Antarctic Science, Tourism, and Conservation Act. The program also focused on EPA's compliance with NEPA, the Endangered Species Act, the National Historic Preservation Act, and other relevant executive orders. EPA continued to fulfill the Nation's commitments under the legislation implementing the North American Free Trade Agreement, other international trade and environmental agreements and treaties, such as the General Agreement on Tariffs and Trade, and other international commitments. The enforcement and compliance assurance programs continue to support the expansion of the American public's right- to-know by providing the public with access to information through a variety of avenues: 1) the enforcement DOCKET, a physical and electronic site where the public can access policies, guidance documents, and legal interpretations; 2) Integrated Data for Enforcement Analysis (IDEA) which integrates compliance data from individual databases available nationally in an interactive, on-line mode; and 3) the Sector Facility Indexing Project (SFIP), implemented in FY 1998, which provides the public with profiles of major regulated industries and information on industry demographic processes, pollution emissions, compliance history, pollution prevention, and regulatory requirements. The enforcement and compliance assurance program deters noncompliance by maintaining levels of field presence and enforcement actions, particularly in high risk areas and/or where populations are disproportionately exposed. The program used the following performance measures for assessing success in FY 1998: Kev Performance Measures 1998 Goal 1998 Actual Hits to Several Web Sites 67,400 Documents 80,000 Documents Lab Integrity Inspections 86 Inspections 96 Inspections Lab Integrity Audits 230 Audits 277 Audits Import/Export Notifications 2,300 Notices 1,700 Notices Multimedia Inspections - Headquarter 15 Inspections 23 Inspections Federal Facility Inspections 28 Inspections 82 Inspections Other EPCRA Inspections 700 Inspections 700 Inspections Administrative Orders Issued 90 Administrative Orders 84 Administrative Orders Number of Small Entities Receiving Relief under Small Business Policy 10 Entities 5 Entities Compliance Assistance Centers, in Operation 8 Centers 8 Centers Compliance Tools Development 7 Sector Notebooks 3 Sector Notebooks NEPA Compliance Actions 100% Documented 100% Documented Page 6 EPA's FY 1998 Annual Financial Statements ------- Kev Performance Measures 1998 Goal 1998 Actual Major Proposed Federal Actions, Draft Environmental Impact Statement (DEIS) Filed 325 DEIS 273 DEIS DEIS Requiring EPA Follow-up 650 Impacts 655 Impacts Impacts Requiring EPA Follow-up Successfully Mitigated 70% of Impacts 62% of Impacts Federal Facilities Management Reviews 15 Reviews 26 Reviews Environmental Justice Grants 100 Grants 114 Grants CERCLA Environmental Justice Grants 27 Grants 20 Grants Multimedia Inspections - Regions 120 Inspections 41 Inspections Documents included in Enviro$en$e 4,200 Documents 4,126 Documents Specialized Assistance and Training 100 Courses 72 Courses Administrative Cases Concluded 80 Administrative Cases 97 Administrative Cases Civil Judicial Cases Concluded 2 Civil Cases 2 Civil Cases Criminal Cases Referred 310 Cases 266 Cases Compliance Tools Development 4 Sector Guides 4 Sector Guides Facilities that Self Disclosed Potential Violations as a Result of Targeted Agency Action 75 Facilities 710 Facilities Facilities that Self Disclosed Potential Violations 330 Facilities 954 Facilities Single Media Inspections - Field 14 Inspections 23 Inspections Multimedia Inspections - Field 15 Inspections 10 Inspections The criminal provisions of the nation's environmental statutes are enforced by EPA's criminal investigators. These special agents, located nationwide, conduct criminal investigations, support Department of Justice (DOJ) prosecutors, and coordinate with other law enforcement agencies to present a highly visible and effective component in the Agency's enforcement strategy. The goal of the criminal enforcement program is to bring to bear the most serious sanctions for the most significant environmental violations. By demonstrating to the regulated community that serious, knowing statutory violations will be met with harsh sanctions in terms of both fines and jail sentences, the program acts to forcefully deter violations of environmental laws and regulations in a way that civil judicial and administrative enforcement rarely can. Cases are referred to the U.S. Attorneys' Offices or DOJ for prosecution, with special agents serving as key witnesses in the judicial proceedings. Performance Measures: Criminal cases, in all media, referred for prosecution. This measure provides the number of criminal cases referred by EPA to the United States Attorneys and/or DOJ for prosecution. EPA is responsible for criminal investigations, while any decisions of a prosecutorial nature are made by DOJ in cases referred by EPA. EPA's FY 1998 Annual Financial Statements Page 7 ------- Results: In FY 1998, 266 cases were referred to DOJ. This number is lower than the estimated number of 310 referrals. This is due to two factors, an increase in the number of complex cases, consistent with program guidance, and the development of new agents hired at the end of FY 1997. The program had anticipated hiring all 200 agents, as mandated by the Pollution Prosecution Act. However, delays in hiring during FY 1997 meant that a portion of FY 1998 was spent training new staff. Now that the program is fully staffed and trained, it is anticipated that the Agency will be able to make the projected number in the future. Reducing Uncertainties Through Research During 1998, EPA continued its support of a vigorous research and development program focused on strengthening the Agency's understanding in areas having major environmental and human health uncertainties. Research priorities were developed by the Agency in accordance with the Office and Research Development's strategic plan which uses a risk-based priority process. One particular area identified as having great risk and major uncertainty is Particulate Matter (PM). PM is probably the largest single contributor to the adverse health effects caused by air pollution and cause, within an estimated range, thousands to tens of thousands of premature deaths each year. PM research has focused on mortality risks, exposure, and the mechanisms by which the particles affect human health. EPA conducted research, in response to growing scientific concerns, on the unknown effects of environmental exposure to substances that interact with the endocrine system. Research in this area has characterized the effects of environmental exposure to various chemicals in two target populations, humans and wildlife. EPA also conducted research to gain a better understanding of the potential health risks associated with human exposure to drinking water disinfection by-products and microbial pathogens. EPA research developed a rapid response measure for recreational water quality. Typically, it takes 48 hours to estimate whether recreational water is contaminated with gastrointestinal bacteria. If contamination is present, this time period carries a high risk for illness, especially for children. EPA developed a method that only takes 24 hours, thereby cutting the time at risk in half. Additional research focused on EPA's Mid Atlantic Integrated Assessment (MAIA), a cooperative geographic study conducted under the Environmental Monitoring and Assessment Program. The MAIA program has generated a number deliverables, including An Inventory of Existing Programs, An Ecological Assessment of the United States Mid Atlantic Region: A Landscape Atlas, and the State of Estuaries Report for Mid Atlantic Estuaries. EPA's research program also includes the Superfund Innovative Technology and Evaluation (SITE) program. Recognizing the movement towards remediation and away from the removal of soil and groundwater (ex-situ), the SITE program has emphasized the development of technologies that treat contamination in place (in-situ). In FY 1998, in-situ groundwater, vadose zone-in-situ remediation, and containment technologies were developed. Work continued in phytoremediation evaluation processes along with system cost documentation. Climate Change Action Plan EPA continued to support the implementation of the Climate Change Action Plan (CCAP). The actions taken under the CCAP are the means by which the U.S. is striving to meet its commitment to reduce annual greenhouse gas emissions to 1990 levels by the year 2000. The heart of the CCAP relies heavily on voluntary partnerships between EPA and organizations, or individuals, that join to save energy and/or increase productivity while reducing greenhouse gases. EPA continued to develop new partnerships and to strengthen its on-going partnerships with entities such as states, cities, farmers, and large and small businesses. Year 2000 (Y2K) Activities FY 1998 was a critical year in positioning the Agency's information technology assets to successfully transition to the next millennium. The Agency strategy was to address mission critical assets first and systematically devolve through the remaining assets. EPA is on schedule to meet the government-wide compliance deadline of March 31,1999 for mission critical systems - already completed the Assessment, Renovation, and Validation phases. The agency has also implemented Page 8 EPA's FY 1998 Annual Financial Statements ------- an independent certification program: six systems have successfully completed third party review/testing, another eight are being reviewed/tested and therest are being scheduled. The Agency also has made major progress in addressing potential Y2K vulnerabilities of servers, personal computers, networks, scientific equipment, and our base computing environments (i.e., mainframe, client/server, supercomputer), and our other than mission critical application systems. We are confident that all EPA-leased and owned buildings will be compliant by February 1999 and will request written confirmation of Y2K compliance from GSA for each building leased through them by no later than March 1, 1999. The Agency has greatly expanded outreach efforts to ensure continuity of environmental services to the public. EPA is responsible for coordination and outreach for three sectors identified by the President's Council on Year 2000 Conversion: Water, Waste, and Chemicals. As the "sector coordinator," EPA coordinates federal agency efforts to address the Y2K issue with federal, state, local, and private sector organizations whose activities affect the protection of public health and the environment. EPA also has established internal environmental sectors for Air, Water, Waste, Chemicals, Pulp and Paper, Manufacturing/Metals, and Regulatory Compliance and Enforcement. EPA also developed detailed outreach plans that clearly identify constituent organizations/key stakeholders, define specific awareness raising events and opportunities, and developed plans to promote awareness and encourage assessment. EPA has issued a Y2K enforcement policy designed to encourage prompt testing of computer related equipment to ensure that environmental compliance is not impaired by the Y2K issue. EPA's primary vehicle to ensure continuity of its core business functions is the Continuity of Operations Planning (COOP) process. EPA has an internal Agency Order which requires Regional and Headquarters offices' plans to address essential functions, safety and security, vital records, primary and alternate COOP planners, and responsibility for exercising and implementing the plans. Following completion of individual office plans, EPA will develop an overarching Agency plan in accordance with Presidential Decision Directive (PDD) #67 which addresses the need for Continuity of Operations Planning, and requires department and agencies to have an Agency COOP plan completed by October 1999. As part of this process we will be performing Business Continuity and Contingency Planning (BCCP) for our Y2K program. The Agency's Year 2000 Senior Council has directed that an interdisciplinary team be formed to develop the Y2K BCCP that will be an addendum to our overarching COOP Agency plans. Additionally, the Agency is coordinating milestones and activities of PPD #67 and Y2K to enhance the Critical Infrastructure Protection Plan (CIPP) required by PDD #63 - Critical Infrastructure Protection. Coordinating these concurrent efforts will eliminate redundancy and ensure that the Agency can meet its obligations to protect people and the environment. The agency's schedule for BCCP development was: Date Activities 1/26/99 Establish BCCP Project Group Determine High-Level Core Business Functions Set Master Schedule and Milestones 3/15/99 Complete Initial Prioritzation of Areas Assess Criticality of Potential Disruptions 4/22/99 Critical Infrastructure Protection Plan (PDD #63) 4/30/99 Perform Business Impact Analysis Assess Infrastructure Risks Define Minimum Acceptable Levels of Performance 5/31/99 Develop contingency Plans and Implementing Triggers Prepare Contingency Test Plans Establish Business Resumption Teams 9/30/99 Prepare and Execute Tests Update Disaster Recovery Plans and Procedures Individual system specific plans will be developed as neccessary consistent wth the outcome of the above analysis. EPA's FY 1998 Annual Financial Statements Page 9 ------- The worst case scenario for Y2K is that all or many systems will not work and we will have have to implement the procedures currently being developed in EPA's contingency plans (COOP, BCCP). The use of COOP plans to continue the Agency's essential functions in response to a Y2K failure is recognized by the Agency and we will continue to examine the use of this vehicle for Y2K contingencies. In the area of buildings and facilities, we are preparing contingency plans for each facility. We also are exploring the need for a contingency plan to support EPA programs if state data exchange partners are unable to provide data electronically and must resort to paper reporting of regulated environmental information. The agency estimates total expenditures of $37.2M from FY 1996 through FY 2000 to support the Y2K program. Summary EPA is committed to protecting our Nation from environmental threats. EPA's increased focus on toxic pollution in 1998 has effectively paved the way for future generations of Americans to grow up in a cleaner and safer environment. By targeting those geographical areas hardest hit by pollution, EPA will ensure that the families living in environmentally disadvantaged communities have hope for a better future. Through these initiatives and programs, EPA continues to demonstrate that its investments are in tune with America's most demanding environmental priorities — including a government that works for its people. Page 10 EPA's FY 1998 Annual Financial Statements ------- EPA PROGRAMS EPA's FY 1998 Annual Financial Statements Page 11 ------- U.S. ENVIRONMENTAL PROTECTION AGENCY (EPA) ¦]iri';.\nvii\isTRAT()R \i aiixis i k.\ i k )\ AXI) UHSOl .R("i:S yia\\vikyii-;xt (OARM) IXTKRXATIOXAI, ACTIVITIHS R;H(j|()\ I (Moslon, NIA'i AIR A\l) k \Jil \TIO\ (C )AR) i-:\]-'C)R(ii\n-:\T ANDCOMPl.lAXC'r- ASSI RAVI-; - ijri-:\"i-;\tk)\. - phsticidhs, and TOXIC SI BSTAXCKS (Xew York. XY'i (Philadelphia. PA) pixaxhai, offichr iSSNSBi RICSIiARC '1.1 AM") ni-;vi-;i.opMi-;\T solid wasthaxd liVlfiKtlliXC-V (Atlanta. <>A'j IXSPl-X 'TOR cihxhral WATI-R (I )allas. TX) RliGlOX \'lI. RKGlOX Ylll RKulOX IX RHGIOXX (Kansas-City. KS) (Denver. CO) (Sun Francisco. C'A) (Seattle, \VA) Page 12 EPA's FY 1998 Annual Financial Statements ------- AIR Under the Clean Air goal, the Agency protects public health and the environment through programs to attain federal clean air standards, reduce air toxics emissions, and control acid rain. Under the Reducing Global Environmental Risks goal, the Agency develops and implements programs to help reduce greenhouse gas emissions and to return the stratospheric ozone layer to levels found prior to the development of the Antarctic ozone hole. Lastly, under the Preventing Pollution and Reducing Risk goal, the Agency works to ensure healthier indoor environments. Air Program Description EPA is required to set National Ambient Air Quality Standards (NAAQS) for air pollutants that endanger public health and welfare. EPA has set NAAQS for six air pollutants (particulate matter, sulfur dioxide, ozone, carbon monoxide, lead, and nitrogen dioxide). EPA strives to reduce these air pollutants in all areas of the country as well as to maintain clean air in areas that comply with the NAAQS. The NAAQS are attained and maintained primarily through state and local air pollution control programs aimed at controlling stationary and mobile source emissions. EPA directly provides emission controls for many of these sources, primarily through federal standards for motor vehicles, fuels, and new stationary sources. EPA also is required to review the NAAQS every five years and revise them as necessary. The review process includes risk, health, and benefits analyses. In July 1997, EPA promulgated a new standard for fine particulate matter (PM2 5) and revised the standards for ozone and coarse particulate matter (PM10) after an extensive review of the science. FY 1998 was the first full year in which the new standards were in effect. After a NAAQS is set, states are responsible for monitoring ambient air quality and developing state implementation plans (SIPs) to reduce pollution and bring areas into NAAQS attainment. EPA provides policy, guidance, and technical assistance for modeling and monitoring air quality and devising strategies available to states to include in their SIPs. EPA also plays a major role in helping states achieve the NAAQS through standard setting for vehicles, non-road engines, fuels, and stationary sources. To determine whether areas are attaining the new PM25 standards, EPA is funding a 1,500 site PM25 monitoring network. By the end of FY 1998, grants were approved for 940 sites to be established by the end of calendar year 1998 . By the end of calendar 1999, all sites will be established and fully instrumented. Three years of data will be available from the earliest monitors in the spring of 2001 and three years of data will be available from all monitors in 2004. Following this monitoring schedule and allowing time for data analysis, governors and EPA will be able to make the first determinations as to which areas should be designated non-attainment with the new PM2 5 standards in 2002. The data from the monitoring network also will provide the basis for EPA and states to further and better characterize the PM2 s problem which in turn will help states develop attainment strategies. To reduce emissions of hazardous air pollutants, EPA develops technology-based standards known as Maximum Achievable Control Technology (MACT) standards for 188 hazardous air pollutants from 174 industry categories. The standards are being developed on a phased schedule through the year 2000. After standards are implemented, EPA will determine whether the residual public health risk warrants additional regulation. EPA is developing other air toxic rules for combustion sources and developing and implementing strategies to reduce public health risk in urban areas, as well as reducing atmospheric deposition of toxic compounds to the Nation's water bodies, including the Great Lakes. Title V of the CAA establishes an operating permit program in which a single permit contains all the applicable requirements for a major source of air pollution. Major industrial sources must file periodic reports identifying how they have complied with the requirements. These sources pay fees to the states and the fee revenues are to cover the cost of the state air pollution control program. EPA provides guidance and assistance to those states and tribes developing and EPA's FY 1998 Annual Financial Statements Page 13 ------- implementing permit programs. In FY 1998, EPA issued periodic monitoring guidance to aid state and local permitting authorities in evaluating whether each facility's air operating permit contained sufficient monitoring to assure compliance with regulations developed to meet CAA requirements; a Fugitive Emissions policy; and guidance on tracking Regional Office Federal Operating Permit Program Costs. A cross-agency workgroup completed work on the Indian Country Part 71 final rule. The Agency pursues protection of human health and the environment in Indian country equal to that provided in state and local territories. The actions undertaken, in 1998, include working with tribes to assess air quality conditions in Indian country, and providing technical and financial support for the development of tribal capacity to address potential problems. A significant component of this capacity building is a training program, developed through a cooperative agreement with Northern Arizona University, that prepares tribal environmental professionals to take on the responsibility of air quality management in Indian country. In addition, EPA is drafting guidance documents to encourage tribes to develop their own tribal air programs. To support federal implementation of the CAA in Indian country in the interim, EPA began developing a number of regulatory tools, including a federal permitting rule to regulate construction and modifications of minor sources of air pollution in Indian country. The Acid Rain Program, in Title IV, is a market-based incentive program for reducing annual sulfur dioxide (S02) emissions by ten million tons from 1980 levels (a 40% reduction). Title IV, along with efforts under Titles I and II, also will reduce nitrogen oxide (NOx) emissions by over two million tons below 1980 levels. The Agency already has achieved significant S02 emission reductions of nearly five million tons of SO 2 annually from 1980 levels. These reductions were achieved by the 263 units affected by Phase I of the innovative market-based program that provides affected sources with flexibility in meeting required emission reductions at least cost (both to industry and government). The program features tradeable S02 allowances composed of one ton units. It ensures accurate and verifiable measurement of emissions, and a cap on total S02 emissions. The Acid Rain Program is a model for market-based efforts to control pollutants here and abroad. For example, the states in the Ozone Transport Region (OTR) have asked EPA to help develop and administer a NOx emissions trading program for large combustion sources in the OTR. EPA offers a similar program to assist states in meeting their summertime NOx emission budgets developed in the recent NOx SIP call. To restore the stratospheric ozone layer, EPA focuses on four areas: domestic and international phase-out of ozone- depleting chemicals (chlorofluorocarbons [CFCs], halons, and methyl chloroform), implementation of limitations on other ozone depleters (hydrofluorocarbons [HCFCs] and methyl bromide), more intensive recycling programs in the U.S. and abroad, and earlier voluntary phase-out of CFCs and HCFCs in developing countries. To stabilize greenhouse gases, EPA promotes voluntary, partnership programs to prevent and reduce emissions of air pollution. By demonstrating the pollution prevention benefits of energy efficiency, the program educates manufacturers, designers, and consumers on the purchase, installation and use of energy efficient products in a manner that benefits the environment without imposing net costs on participating organizations. The Climate Change Action Plan also expands cooperative, non-regulatory programs to profitably capture and use methane and emissions of other potent greenhouse gases. Furthermore, EPA is working with the U.S. automobile industry to develop a "clean car," an affordable vehicle that would have three times the fuel efficiency of today's cars (representing a 67% reduction in carbon dioxide emissions) while preserving utility and comfort features and emitting very low levels of other air pollutants. The Agency's primary strategy to reduce exposure to indoor air pollutants is to use voluntary partnerships to educate audiences from consumers to building managers about indoor air problems and solutions. The Agency develops guidance about ways to reduce the risk of indoor contaminants (such as radon, moisture and mold, environmental tobacco smoke, and emissions from building and consumer products) and works through partner organizations to create awareness and to influence consumer and institutional behavior. Three program laboratories supported the Air Program. The labs carried out a broad range of policy, regulatory, and compliance functions needed to implement the CAA and fuel economy statutes. In addition, they provided technical understanding related to Agency responsibilities under the Indoor Radon Abatement and the CAA. Page 14 EPA's FY 1998 Annual Financial Statements ------- Research and Development Program Description The Air Research and Development Program supports the development of air criteria and standards, as well as public policy decisions required for EPA to implement the CAA. The components of this program in FY 1998 included Air Toxics Research, Criteria Air Pollutants Research, and Global Change Research. Air Toxics Research was conducted to address risks associated with major sources of hazardous air pollutants and their presence in the urban environment, address air toxics deposition to Great Waters, address the environmental risk to human health associated with indoor air pollution, and support motor vehicle emission characterization for exposure assessments. The Criteria Air Pollutants Research Program supported EPA in its mandatory review of the NAAQS for ambient exposures to certain widespread air pollutants. The research pertained to the effects, exposure, risk assessment and risk management aspects of two major criteria air pollutants: particulate matter (PM) and tropospheric ozone. The Global Change Research Program supported the Agency by providing research into the magnitude, timing, and regional patterns of climate change. As part of the effort to further understand global climate change, research was aimed at reducing uncertainties associated with ecosystem vulnerabilities to climate change and related impacts, such as the possible spread of waterborne diseases from changing climate patterns. Enforcement and Compliance Assurance Program Description The Stationary Source Enforcement and Compliance Assurance Program supports a national air enforcement and compliance assurance program. In FY 1998, Air Enforcement and Compliance Assurance Program priorities included implementation of the Title V operating permit program, carrying out the Title III hazardous air pollutant programs, enforcing the CFC program, evaluation of synthetic minor permits, and enforcement of the New Source Review/Prevention of Significant Deterioration (NSR/PSD) program. There also is a national enforcement and compliance program for mobile sources. In FY 1998, the program continued to focus on all the Title II statutory provisions under its responsibility for fuels, vehicles and engine compliance with applicable federal requirements. While maintaining a federal presence in all statutory areas remained a priority for the program, there was one major compliance/enforcement action that dominated for much of the year which involved nearly industry-wide noncompliance by the manufacturers of heavy duty diesel engines. The emissions consequence of this noncompliance was enormous. Initial resolution of that action will occur in early FY 1999 although oversight will continue for several years. Future En forcement Trends In FY 1999 and FY 2000, EPA will continue its commitment to maintaining a strong compliance and enforcement presence. In addition, EPA will continue to support compliance assistance activities to educate state and local permitting authorities on new requirements, educate and provide technical assistance to aid industries in achieving compliance, and target enforcement actions to deter noncompliance. EPA regions also will continue to implement strategies for addressing multi-state and multi-program violators and for corporate-wide patterns of noncompliance. Specific Agency enforcement and compliance priorities for FY 1999 and FY 2000 include Title V permits, synthetic minors, air toxics, CFC program enforcement, and NSR/PSD enforcement. In addition, air compliance and enforcement activities will concentrate on industries in the following sectors: coal-fired utilities, petroleum refineries, wood product facilities, and pulp and paper facilities. In FY 1999 and FY 2000, the mobile source program will continue its range of compliance and enforcement activities under Title II of the Act. In addition to the early implementation and oversight of the agreements in the actions discussed above, there will continue to be a focus on the actual compliance of vehicles and engines with applicable emissions EPA's FY 1998 Annual Financial Statements Page 15 ------- standards. In addition to the existing vehicles and engines currently regulated, a new range of engines not previously regulated will be subject to emissions requirements and will be monitored closely over the next few years. These include lawn and garden machinery, marine and construction engines and locomotives. More stringent standards also will apply for existing motor vehicles and motor vehicle engines. With regard to motor vehicle fuels, the program will be monitoring industry closely for compliance with the new complex model requirements under the federal reformulated gasoline program utilizing sources of industry compliance data not previously scrutinized. The program also will review foreign refiner baseline petitions received pursuant to the World Trade Organization ruling and EPA's subsequently revised regulations, work with other agency offices in the development of an enforceable gasoline sulfur program to meet the new Tier 2 vehicle emissions requirements, and continue to enforce the gasoline and diesel fuel requirements through its nationwide program of downstream fuels inspections and refinery audits. Highlights and Accomplishments The Air Program regularly tracks real world accomplishments. FY 1998 highlights include: Environmental Results/Reduced Health Risks ~ Through the combined efforts of EPA and the states, 62 (22 in FY 1998) of the original 100 ozone (smog) classified areas have been redesignated to attainment or revoked (met original standard) ensuring an additional 7.9 million people in FY 1998 now breathe clean air. Additionally, nine of the 43 carbon monoxide non- attainment areas have been redesignated, providing healthier air in FY 1998 for nine million people. ~ Under the Acid Rain Program, S02 emissions from the 263 Phase I units have been reduced dramatically to 4.8 million tons, or 32% below the 1996 allowable emission limit of 7.1 million tons. The S02 reduction by these sources from their 1980 baseline level (9.4 million tons) is about 4.6 million tons (48%). In addition, NOxmass emissions, from sources affected by Title IV, decreased by about 180,000 tons from 1995 to 1996, despite the increase in fuel utilization. ~ The over 2,700 participants in EPA's Energy Star Buildings and Green Lights Partnership have prevented the emission of 1.8 million metric tons of carbon equivalent (mmtce) during the past year, which is equivalent to taking over 1.4 million cars off the road. In FY 1998, these program partners also saved over $580 million on their energy bills. ~ As part of EPA's contribution to the Partnership for a New Generation of Vehicles, EPA has demonstrated preliminary results of fuel economy better than 60 miles per gallon (MPG). ~ As a result of the Radon Program, 70% of the public is aware of the health risks from radon and ten million homes have been tested. About 1.5 million homes have reduced radon levels either through mitigation efforts or use of radon- resistant construction techniques. ~ We have reached millions of people with the message of preventing involuntary exposure to Environmental Tobacco Smoke (ETS) and 83% of Americans know that ETS is harmful. New Approaches ~ In October 1997, EPA provided eastern states with proposed targets for reducing the emissions that create smog problems throughout the eastern United States. The new strategy was developed cooperatively with the members of the Ozone Transport Assessment Group (OTAG), 37 states and the District of Columbia. The final NOx SIP call was AIR Program Obligations - FY 98 Total Obligations - $910 Million Air Pollution Control 15.7% State/Local Assistance 15.7% 12.9% Air Quality Stds. 18.6%R & D n tor cement t. 6.7% • o Air Quality Mgt. L4.7% Atmospheric Programs Trends Monitoring Page 16 EPA's FY 1998 Annual Financial Statements ------- signed by the Administrator on September 24, 1998. It sets individual reduction targets for NOx reductions for 22 eastern states ranging from a few percent to about half compared with projected emission levels in the year 2007. ~ EPA stakeholders such as the Environmental Council of the States (ECOS), the National Governors Association (NGA), the State and Territorial Air Pollution Program Administrators ( STAPPA), and the Association of Local Air Pollution Control Officials (ALAPCO) continue to be integral partners as we develop innovative ways to address environmental problems. In addition, the Federal Advisory Committee Act (FACA) process was used extensively in FY 1998 to gain stakeholder input and acceptance of rulemakings and implementation processes. ~ EPA began approaching its air toxics program with a different strategy by gradually changing its emphasis from specific source category emission reductions to a health risk orientation. This new risk-based strategy will center on identifying the human health risks associated with individual toxic substances and establishing priorities for reducing those risks. ~ EPA continues to work with industry, state, and local representatives to collect information on emissions and controls used by sources to determine what MACT would be if it were based on this information. EPA, state and local representatives, industry and environmentalists then determine if the information at hand is sufficient or if there is additional information needed. If the information is sufficient a Presumptive MACT is determined. On a limited basis, state and local partners can take the lead to complete a MACT standard which EPA subsequently approves or through a cooperative process EPA provides leaders in the development of a standard with one or more partners providing assistance. ~ EPA also undertook another effort to simplify and streamline the MACT standard development process by developing procedures for generic MACT rules. The generic rule specifies MACT floor control levels for a broad range of pollutant scenarios thus establishing generic MACT groups into which individual source categories would be placed. Using these innovative approaches, EPA has initiated over 20 partnerships in FY 1998 to collaborate in MACT standard development. ~ EPA solicited comments on two aspects of the New Source Review (NSR) Reform rulemaking: an alternative for determining the applicability of NSR to modifications under NSR and Prevention of Significant Deterioration (PSD); and review of plant-wide applicability limits (PALs). In addition, EPA issued the NSR Transitional Strategy Concept paper, guidance on interim implementation for PM2 5, a potential to emit guidance (for major sources with the potential to emit large amounts of pollutants), and guidance on crediting MACT reductions for NSR netting and offsets were all issued. ~ The Plain English regulation writing program continued. Three MACT rules and a guide to Title V Operating Permits were put into "Plain English" format. Teams working on rules took the Plain English course so that they could immediately apply the techniques. Rulemakings/Standard Setting ~ This year, EPA proposed 14 MACT standards and promulgated five MACTs. The MACT standards, once they are all implemented, are expected to reduce air toxic emissions by 13 % from 1993 levels. ~ The Tribal Authority Rule implements the requirements of Section 301(d) of the CAA that authorize the Administrator of EPA to treat tribes in a manner similar to states. The rule identifies those provisions of the CAA for which it is appropriate to treat tribes as states, establishes eligibility requirements for tribes to be treated as states, and lays out procedures for approving tribal air programs. The rule was promulgated on February 12, 1998 and became effective on March 16, 1998. ~ The Office of Mobile Sources finalized 13 rules during FY 1998 and proposed an additional nine new rules dealing with areas such as emissions standards, fuel and fuel additives, and on-board diagnostic devices. Some notable examples are listed below: EPA's FY 1998 Annual Financial Statements Page 17 ------- • Final Rulemaking (FRM) (April 16, 1998) - Emission Standards for Locomotives and Locomotive Engines. Lhis rule marks the first time in the history of the CAA that regulations are established to control emissions from locomotive engines. • Advanced Notice of Proposed Rulemaking (ANPRM) (May 22,1998) - Control of Emissions of Air Pollution from New Compression Ignition (CI) Marine Engines at or Above 37 Kilowatts. • FRM ( May 4, 1998) - Inspection and Maintenance (IM) Program Requirement—On-Board Diagnostic Checks: Amendment to the Final Rule. • FRM (December 31, 1997) - Regulation of Fuels and Fuel Additives: Modifications to Standards and Requirements for Reformulated and Conventional Gasoline. Clean Air Program Implementation ~ Work on enhancement of the air toxics infrastructure continued, including the completion of the national inventory for 40 urban Hazardous Air Pollutants (HAPs) to support the Urban Area Source Project. In addition, air toxics monitoring and emission inventory guidance for FY 1999 for regions and states was developed and communicated. A baseline inventory for MACT Emission Reduction Lracking was compiled. ~ EPA continued transition to the new and revised Ozone & Particulate Matter Standards. Lhe Office of Air Quality Planning and Standards (OAQPS) finalized the ozone revocation notice and proposed a second notice. Interim Implementation Guidance was issued for the states to implement the one-hour ozone standard and the pre-existing PM10 NAAQS in order to make the transition to the new eight-hour ozone standard and the new PM2 5 standard. Of the 52 NAAQS implementation actions in the matrix of implementation actions (not all scheduled for FY 1998 completion), 25 have been issued and 6 have been proposed, working cooperatively with EPA regional offices, the state and local air agencies, and the stakeholder community. Examples of guidance developed include: guidance on attainment demonstrations for particulate matter and ozone, judging compliance with the new ozone standard, and data handling guidance for both the new ozone and particulate matter standards. Education/Outreach/Information Sharing ~ EPA's Radon Public Service Announcement campaign reached several million people this year. In addition, hotlines for radon and Indoor Air Quality (IAQ) fielded 125,000 calls and distributed over one million informational brochures this year. ~ EPA's Office of Air and Radiation (OAR) has extensive information on its activities on the World Wide Web. Lhe homepages for OAR and its program offices deal with issues that affect the quality of air including indoor and outdoor air quality, stationary and mobile sources of air pollution, radon, acid rain, stratospheric ozone depletion, global warming and pollution prevention. Lhese web pages (see table below) and associated links contain a wealth of information of value for those affected directly by EPA regulations and EPA's partners as well as the general public. ©modest UjL Cities ' D<.*5lTip f 0&<\C Page 18 EPA's FY 1998 Annual Financial Statements ------- Office Webpage Address OAR Main Homepage http://www.epa.gov/oar/oarhome.html Office of Air Quality Planning and Standards http://www.epa.gov/oar/oaqps Office of Atmospheric Programs: Acid Rain http: //www. epa. gov/acidrain/ ardhome.html Ozone Depletion http: //www. epa. gov/ozone Global Warming http: //www. ep a. gov/ glob al warming Office of Radiation and Indoor Air: Indoor Air http ://www. epa. gov/iaq Radiation http://www.epa.gov/radiation Office of Mobile Sources http://www.epa.gov/OMSWWW/omshome.htm Strengthening Air Research and Regulatory Programs ~ EPA's National Vehicle and Fuels Emissions Laboratory (NWEL) continued to upgrade its equipment and other testing capabilities as part of a multi-year update program. This program is aimed at assuring that the NWEL keeps up to date with the rapidly changing testing technology associated with changed emissions, emissions control technology, and its mission focus aimed at assuring in-use compliance with emission standards and advancing the state of the art for emissions reduction. ~ EPA's analysis of Southern Oxidant Study (SOS) data from 1995 programs in the Nashville, Tennessee Region resulted in methods to measure and model ozone and its precursors. This research resulted in the publication of 31 journal articles, and provided observation-based methods to be used in planning FY 2000-2001 State Implementation Plans (SIPs). SIPs are required to carry out the new NAAQS for ozone. ~ EPA released Models-3, the next generation of atmospheric chemistry models, with meteorological and emissions modules, to the public in June 1998. It is the first air quality modeling system to simulate the dynamics of different pollutants simultaneously. In addition, it will provide environmental managers greater speed and flexibility in finding solutions to environmental problems. ~ The Agency identified and will continue to study in detail a hypothesis related to the role of transition metals in producing reactive oxygen species that produce oxidative stress and an inflammatory response, leading in turn to cardiopulmonary stress and, potentially, sudden death. The identification of biologically plausible hypotheses will improve confidence in the 2002 review of the NAAQS for particulate matter, leading to an improved basis for risk assessment and management of particulate matter. ~ EPA completed risk assessments for beryllium, chromium, bentazon, and acetonitrile. ~ In December 1997, EPA released an eight-volume report to Congress that evaluates the impacts of air emissions of mercury on human health and the environment. ~ The Agency published The Carcinogenic Effects of Benzene: An Update (EPA/600/P-97/001F) in April 1998. ~ EPA delivered the draft Health Risk Assessment Document for Diesel Engine Emissions to the Science Advisory Board and held a public review meeting on the document in May 1998. ~ As part of the U.S. Global Change Research Program's National Assessment of "The Potential Consequences of Climate Change and Climate Variability on the United States," the Agency held regional workshops as a first step in conducting a regional assessment. The EPA held a Gulf Coast Workshop in Baton Rouge, LA in February 1998, a EPA's FY 1998 Annual Financial Statements Page 19 ------- Great Lakes Workshop in Ann Arbor, MI in May 1998, and a "problem formulation" workshop at Penn State University in June 1998 to begin the Mid-Atlantic Regional Assessment. En forcement and Compliance Assurance Program Performance Measures The enforcement and compliance assurance program deters noncompliance by maintaining levels of field presence and enforcement actions, particularly in high risk areas and/or where populations are disproportionately exposed. The program used the following performance measures for assessing their success in FY 1998: Kev Performance Measures 1998 Goal 1998 Actual Mobile Sources Inspections 2,250 Inspections 2,665 Inspections Stationary Source Inspections 2,100 Inspections 2,722 Inspections Stationary Source Civil Referrals 70 Case Referrals 113 Case Referrals Stationary Sources APO Complaints 90 APO Complaints 156 APO Complaints Stationary Sources Compliance Orders 155 Compliance Orders 273 Compliance Orders (Note: APO is Administrative Penalty Order.) Diesel Engine Industry En forcement EPA and the Department of Justice settled with seven heavy duty engine diesel manufacturers in what is the largest Clean Air Act enforcement action in history. The manufacturers were charged with violating the Clean Air Act by installing devices that defeat emission controls in an estimated 1.3 million engines. In addition, the manufacturers, which comprise 95 percent of the U.S. heavy duty diesel engine market — will spend more than one billion dollars and will pay an $83.4 million civil penalty to settle charges that they illegally poured millions of tons of pollution into the air. Page 20 EPA's FY 1998 Annual Financial Statements ------- RADIATION The EPA program to protect public health and the environment from adverse effects of radiation exposure is grounded in the following statutes: the Indoor Radon Abatement Act; the Clean Air Act (CAA) Amendments of 1990; the Waste Isolation Pilot Plant Land Withdrawal Act of 1992; Robert T. Stafford Disaster Relief and Emergency Assistance Act of 1998; Title XIV of the National Defense Authorization Act of 1996 (Nunn-Lugar II); the Energy Policy Act of 1992; the Atomic Energy Act; the Public Health Service Act; the Uranium Mill Tailings Radiation Control Act; the Marine Protection, Research, and Sanctuaries Act; and the Superfund Amendments and Reauthorization Act. These laws authorize a wide range of regulatory, assessment, assistance, and research activities. Radiation Program Description The Radiation Program helps carry out the major environmental goal of Better Waste Management and Restoration of Abandoned Waste Sites. EPA's Radiation Program has two main objectives: ~ Reducing adverse health effects and environmental impacts from radiation exposure through a program of standards and guidelines. ~ Responding to radiation issues of serious public concern while maintaining the capability to respond to radiological emergencies, including collaborating on the development and testing of federal, state, and local plans for emergency response. To accomplish these objectives, EPA assesses and regulates sources of airborne radionuclides, evaluates and regulates radioactive waste disposal, provides site assessments and radiochemical analyses of environmental samples, operates the Environmental Radiation Ambient Monitoring System, develops radiation cleanup and waste management standards, and responds to radiological emergencies. Two program laboratories supported the Radiation Program by providing technical understanding related to Agency responsibilities under the Indoor Radon Abatement Act, the Waste Isolation Pilot Plant Land Withdrawal Act, the Energy Policy Act, and the Atomic Energy Act. Highlights and Accomplishments Highlights and accomplishments of this program in FY 1998 include the following: ~ EPA certified that the Department of Energy's (DOE) Waste Isolation Pilot Plant (WIPP) in Carlsbad, NM, is a safe disposal site for defense-related nuclear waste and meets health-based environmental protection standards that will protect public health and the environment. ~ EPA conducted three inspections of DOE waste generator sites to comply with the conditions of the WIPP certification in preparation for shipment to WIPP. ~ The Agency currently is developing environmental radiation protection standards for the disposal of radioactive wastes at Yucca Mountain, NV, a potential site for a geologic repository for spent nuclear fuel and high-level radioactive waste. RADIATION Program Obligations - FY 98 Total Obligations - $47.9 Million Radiation Criteria, Standards 40.9% & Guidelines Program Implementation 3.8% Waste 20.3% Isolation Pilot Plant ^ T . * 34"9% Implementation . _ 1T Radiation Environmental Impact Assessment EPA's FY 1998 Annual Financial Statements Page 21 ------- ~ As part of its ongoing radiological and emergency response program, EPA maintained its unique capability to respond to radiological events through participation in national and international exercises. EPA also provided radiation emergency response and counter-terrorism training courses for states and EPA regional offices. EPA conducted a Post- Emergency Response Recovery Conference which attracted over 300 participants from the U.S. and other nations. ~ EPA in partnership with other federal agencies published a site assessment manual, Multi-Agency Radiation Survey and Site Investigation Manual (MARSSIM), and conducted training for federal and state employees involved in the cleanup of radioactively contaminated sites. ~ EPA published Draft Federal Guidance Technical Report No. 13 (Part 1) which provides consistency in assessments by federal agencies and others of the risks to health from radiation. This helps ensure that such assessments are based on sound scientific information. ~ In conjunction with the Conference of Radiation Control Program Directors, managers of the state radiation protection programs, EPA developed a program for the safe disposal of lost or abandoned industrial sources of radioactive materials to mitigate the potential detrimental health effects. ~ EPA participated in the successful launch of the plutonium-bearing Saturn Probe. EPA staff supported DOE's Advance Launch Support Group to prepare for the possibility of an accident and an EPA staff member served as a Senior Official at the Launch Support Center assisting the operation from the EPA perspective. ~ Office of Radiation and Indoor Air's (ORIA's) National Air and Radiation Environmental Laboratory (NAREL) provided analytical support to 16 Superfund sites via over 4,000 site clean-up and radiological analyses. Approximately 70% were independent analyses and 30% were for quality assurance. Approximately 80% were radiological and 20% dealt with mixed waste. This work was done for EPA's Regions 2, 4, 5, 8, 9, and 10. NAREL: Field Work Page 22 EPA's FY 1998 Annual Financial Statements ------- DRINKING WATER The Drinking Water Program was established to ensure that public water supplies are free of contaminants that may pose unacceptable human health risks and to protect our ground water resources. Safe drinking water is essential to human health. Contaminated drinking water can cause illness and even death as was the case in Milwaukee in 1993 as well as more recent occurrences in Las Vegas, NV; Austin, TX ; and Alpine, WY. Furthermore, contaminated drinking water poses a special risk to such populations as children and people with compromised immune systems. In 1994, 23 million people were provided water that violated drinking water health standards at least once during the year. An additional 23 million people were placed at increased risk because they were served by systems that had inadequate or no filtration treatment. The Drinking Water Program was reauthorized on August 6, 1996 with the passage of the Safe Drinking Water Amendments of 1996, which further amended Title XIV of the Public Health Service Act (commonly known as the "Safe Drinking Water Act"). Drinking Water Program Description The responsibility for ensuring that 240 million Americans have safe drinking water rests with EPA and the states as mandated by the Safe Drinking Water Act (SDWA) and its 1996 Amendments. To carry out its portion of the responsibility, EPA must work with the states and tribes to provide protection for drinking water during each phase of the drinking water cycle — the raw source water, the water treatment plant, and the pipes that deliver the finished water from the treatment plant to the tap. The 1996 SDWA Amendments improve the ability of states, water suppliers, and EPA to prepare for future drinking water safety challenges and assure sustained availability of safe drinking water. The Amendments center around four major areas of change: 1) improving the way that EPA sets drinking water safety standards and develops regulations that are based on good science and data, prioritization of effort, sound risk assessment, and effective risk management; 2) establishing new prevention approaches, including provisions for operator certification, capacity development, and source water protection; 3) providing better information to consumers, including consumer confidence/"right-to-know" reports; and 4) expanding funding for states and communities through the Drinking Water State Revolving Fund (DWSRF). In addition, the 1996 Amendments increase the states' flexibility to focus on public health-based priorities and make better use of resources, recognize the problems facing small systems and establish appropriate cost-effective approaches for such systems, and emphasize the role of stakeholders and partnerships as a key aspect of an effective national drinking water program. Research Program Description The occurrences of waterborne disease outbreaks demonstrate that drinking water supplies are still vulnerable to contamination. Drinking water research evaluates the effects of the pathogenic bacteria, parasites, and viruses that can cause serious illness and death. The SDWA Amendments of 1996 mandate that the EPA identify and regulate contaminants which may threaten human health. Among these contaminants are by-products formed during disinfection (disinfection by-products [DBPs]) by chlorination or alternative practices. Drinking water research also focuses on determining what levels of exposure to arsenic in drinking water are dangerous to human health. EPA's FY 1998 Annual Financial Statements Page 23 ------- Several detailed health effects studies have been initiated to determine the overall human risk from exposure to waterborne pathogens, DBPs, and arsenic, as well as the ability to reduce any determined danger through effective risk management. These studies are critical in order to promulgate regulations that provide citizens with clean and safe drinking water. Enforcement and Compliance Assurance Program Description EPA is committed to a strong compliance and enforcement presence to ensure that drinking water supplies meet SDWA requirements and that underground injection practices are conducted in accord with applicable regulations to ensure the safety of underground sources of drinking water. In FY 1998, in the Public Water System Supervision (PWSS) Program, EPA continued to enforce the SDWA requirements and national primary drinking water regulations, with priority given to the Surface Water Treatment Rule (SWTR), total coliform, and lead and copper regulations. In the Underground Injection Control (UIC) Program, EPA enforced against all classes of wells, giving priority to those situations where there was endangerment or potential endangerment of groundwater. In addition, EPA worked to implement the 1996 SDWA amendments, including developing and promulgating the variance and exemption regulation by the statutory deadline of August 1998, and developing with the states and other stakeholders the first National Public Water System (PWS) Compliance Report. Highlights and Accomplishments In FY 1998, EPA continued its many implementation activities related to the 1996 SDWA Amendments. The partnership process, which the Agency instituted in 1997, with its drinking water program stakeholders is considered a model within the Agency and the federal government and has been strengthened and expanded. EPA held over 60 formal stakeholder meetings on regulatory development issues for specific contaminants, including unregulated contaminants, as well as on the science and data needed to support the regulation of these contaminants. For Stage 1 Disinfection By- products (DBPs) and the Interim Enhanced Surface Water Treatment (IESWT) rules that will be promulgated by November 1998, the Agency held both informational and public comment meetings on the final drafts. Moreover, a safewater web site has been created and provides to drinking water stakeholders the single best source of information about drinking water rules. In addition, two new stakeholder workgroups have been created under the auspices of the National Drinking Water Advisory Council. One has been established to focus on Class V underground injection wells/source water protection and one that will help us implement the right-to-know provisions of SDWA. In the second year of its implementation, the Agency has strengthened the scientific underpinnings for its statutorily-required rulemaking by conducting studies focusing on health risks to sensitive subpopulations, such as children. EPA also developed risk assessment methodologies applicable to infants, children, pregnant and lactating women, and individuals with chronic disease as consumers of drinking water. In addition, EPA has continued to be successful in meeting all of its statutory deadlines. The Agency completed the following activities: 1) published the Contaminant Candidate List (CCL), the basis for which regulatory determinations on at least five contaminants will be made by August 6, 2001, as mandated by the 1996 SDWA amendments; 2) collaborated with the Centers for Disease Control and Prevention and issued studies on waterborne disease occurrence; DRINKING WATER. Obligations - FY 98 Total Obligations - $335.7 Million Water Criteria, Standards & Guidelines R&D 34.5% 1.6% 11.9% State Program 27.9% Groundwater Resource Assistance Protection Page 24 EPA's FY 1998 Annual Financial Statements ------- 3) promulgated the consumer confidence report regulations that require public water systems to issue an annual right- to-know report to all their customers (these reports must contain information on the source of public water systems' supply, the level of detected contaminants, data on the health effects of contaminants found above the drinking water standard, as well as information on unregulated contaminants in the water supply); 4) issued the variances and exemptions rule; 5) published operator certification requirements; 6) provided Public Water System (PWS) definitions guidance; 7) disseminated information to assist states in developing affordability criteria; 8) reviewed existing monitoring requirements; 9) circulated guidance on capacity development; 10) published the annual national compliance report; and 11) issued a small system technologies list. Furthermore, the Agency completed the supporting risk analyses for promulgation of the Stage 1 DBP and the IE SWT rules, published Notices of Data Availability in the Federal Register, and promulgated these rules in November 1998, as stipulated by the 1996 SDWA amendments. The Agency completed supporting risk and risk-reduction benefit analyses for radon levels in drinking water. All FY 1997 DWSRFs, which totaled over $1.2 billion, were awarded to the 50 states and Puerto Rico before the September 30, 1998 deadline for these funds to be committed/obligated. In addition, 30 awards were made in FY 1998 using FY 1998 funds. The first state source water assessment program (SWAP) was approved in September 1998 (six months before the deadline for state submittal) after EPA successfully negotiated revisions with State of Kentucky officials. SWAPs are the centerpiece of the 1996 SDWA Amendment's preventive focus. They give states and communities the tools they need to prevent contamination in the source of the drinking water supply, and thus comprise one of the multiple barriers to drinking water contamination, along with treatment. Source water assessments identify the source(s) of a community's drinking water and the potential threats to which a source is susceptible. The preamble and regulatory language for the proposed Class V underground injection control (UIC) rule was published in July 1998, meeting its court-imposed deadline. Also, final drinking water primacy regulations were promulgated in April 1998. Safe and Unsafe Disposal of Industrial Waste DRY LEANERS AUTO SERVICE Manufacturing Sub Soil Unsafe disposal of waste Gravel Bed Rock Confining Layer /|\ /|\ EPA's FY 1998 Annual Financial Statements Page 25 ------- Drinking Water Research EPA's research and development program increased the Agency's understanding of environmental processes and our capability to assess environmental risks - not only to human health, but also to ecosystems. This research supported EPA efforts to identify the most important sources of risk to human health and the environment, and thereby guides priorities, policies, development of environmental regulations, and deployment of resources. In addition, Agency research endeavored to provide the understanding and technologies needed to detect, abate, and avoid environmental problems. In the future, environmental problems will be dealt with using those features of the current system that have proven effective and by designing and testing fundamentally new tools and approaches that utilize the latest advances in scientific knowledge and technology. ~ EPA developed methods for two disinfection by-products classes, aldehydes and bromates, culturable viruses and Cryptosporidium, and investigated the occurrence of Mycobacterium in drinking water to assess the risk due to exposure. ~ EPA issued a report on the evaluation of membrane technology to control oocysts. The data indicate that this type of technology has the potential to control Cryptosporidium oocysts. ~ EPA issued a report on Meta-Analysis of Epidemiologic Studies on Cancer and Chlorinated Drinking Water which will be used in support of the development of the Regulatory Impact Analysis (RIA) for addressing the costs and benefits of Stage I of the DBP Rule. This report provides information on the appropriateness of using these published studies as the basis for a risk assessment when analyzed via a meta-analysis method. Drinking Water En forcement Performance Measures The enforcement and compliance assurance program deters and reduces noncompliance and achieves environmental and human health improvements by maintaining a strong, timely and active enforcement presence. EPA directs enforcement actions to maximize compliance and address human health problems. Specific measures include noncompliance rates, measurement of average length of time for violators to return to compliance or enter enforceable agreements, and the number of administrative, civil, and criminal judicial actions. The data for some of these measures is reported in the Water Quality Enforcement Performance Measures section. (See page33.) These measures count the number of enforcement actions in the drinking water program and also measure how successful compliance and enforcement programs have been by looking at the length of time for significant noncompliers to return to compliance or have an enforcement action taken against them. Addressing significant noncompliers constitutes a major portion of the base program. Moreover, dealing with priority regulations (SWTR, total coliform, and lead and copper) will result in improvements to human health as these contaminants have the greatest potential for direct health effects. Future Trends With its partners, EPA will continue to implement the 1996 SDWA Amendments. Requirements that will be met in FY 1999, in accordance with statutory deadlines are: ~ Promulgate Stage I Disinfectants and Disinfection By-Products and Interim Enhanced Surface Water Treatment rules. ~ Publish health risk reduction benefits and cost analysis for potential radon standards. ~ Propose radon standard. ~ Publish Final Class V UIC rule. Page 26 EPA's FY 1998 Annual Financial Statements ------- ~ Publish unregulated contaminant monitoring rule. ~ Establish National Occurrence Database. Solicit recommendations for inclusion of additional contaminants. ~ Publish guidelines specifying minimum standards for certification and recertification of operators . ~ Complete UIC study on remaining Class V wells. ~ Determine if states have legal authorities or other means in place to ensure new system capacity. ~ Complete sulfate study with the Centers for Disease Control (CDC) to establish a reliable dose-response relationship. .~ Evaluate state ground water protection programs. In addition, the Agency will continue to focus on Right-to-Know activities. This includes working with water systems to develop consumer confidence reports, developing tools to increase consumer knowledge of drinking water issues, and proposal of revisions to the Public Notification Rule. Also, the Agency will implement various components of the data reliability action plan to address data quality issues in the Safe Drinking Water Information System (SDWIS) and ensure that SDWIS provides the best source of national compliance information on the supply of drinking water to all Americans. EPA will continue its commitment to maintaining a strong compliance and enforcement presence. Agency priorities for FY 1999 and FY 2000 include compliance assistance/enforcement for the microbial and lead/copper regulations, follow- up on the recommendations in the Compliance Report, SDWIS support and implementation (critical for compliance analysis and for measuring progress in meeting environmental and public health goals), implementation of SDWA Amendments of 1996, and compliance monitoring/enforcement against owners and operators of Class V wells. In addition, the compliance and enforcement program will develop compliance and enforcement strategies and implement appropriate compliance/enforcement activities for the regulations promulgated in FY 1998, the Consumer Confidence Rule, and the FY 1999 Interim Enhanced SWTR and Disinfection By-Products rules. EPA's FY 1998 Annual Financial Statements Page 27 ------- WATER QUALITY Since the passage of the Clean Water Act (CWA) in 1972, the United States has had tremendous success in reducing pollution entering our surface waters from factories and municipal sewage plants. However, in spite of the great strides that have been made, more than six billion pounds of toxic industrial pollution are still being discharged annually into our rivers, lakes and streams. The National Water Quality Inventory 1996 Report to Congress indicates that 16% of assessed rivers and streams and 35% of assessed lake acres are not safe for fish consumption; 20% of assessed rivers and streams and 25% of lake acres are not safe for recreational activities (e.g, swimming); and 16% of assessed rivers and streams and 8% of lake acres are not meeting drinking water uses. While this is a dramatic improvement over conditions thirty years ago, much work remains before we meet our long-term goal of clean and safe water for all Americans. The Water Quality Program is mandated by the CWA, as amended. Major amendments to the CWA were enacted in the Water Quality Act of 1987. This Act enhanced water quality management and improved the Agency's partnerships with the states. This Act also authorized the development of new standards and guidelines to prevent and control water quality pollution and authorized new approaches to deal with nonpoint sources of pollution. Other statutory mandates for this program are in the Great Lakes Critical Programs Act (GLCPA); Water Resources Development Act (WRDA); the Marine Protection, Research and Sanctuaries Act (MPRSA); the Shore Protection Act (SPA); the Marine Plastics Pollution Research and Control Act (MPPRCA); and the Coastal Zone Act Reauthorization Amendments (CZARA). Water Quality Program Description The Water Quality Program has broadened its emphasis over the years to consider all sources of water quality pollution by looking at entire watersheds, including oceans, which are the ultimate receiving waters for all watersheds. This broader "place-based" approach considers critical ecosystems affected, stakeholders involved, strong science and data available, and pollution prevention strategies in developing effective solutions. In this way, both point source and nonpoint source problems — such as wet weather runoff from farms, streets, lawns, construction sites, and atmospheric deposition of pollutants — will be addressed. This is critical since nonpoint source pollution has become the Nation's most significant remaining water quality problem. EPA's Water Quality Program faces three main challenges: improving the quality of our surface water, protecting groundwater resources, and reducing wetlands loss. First, the Agency seeks to prevent surface water pollution, control pollution sources, and restore degraded areas. Second, the Agency must protect groundwater from pollution and help the public better understand the ways to prevent the groundwater from becoming polluted. Finally, EPA is seeking to continue the trend toward reduced wetlands loss, with the long-term goal of ultimately realizing a net gain in wetland acreage through efforts to create new wetlands and protect, improve, and better understand wetlands conditions. Research Program Description The Water Quality Research Program develops and analyzes scientific data and technologies to protect and enhance the designated uses of our Nation's waters and related ecosystems by providing technical assistance to EPA regulatory programs, states, and municipalities. The goal of the program is to minimize environmental risks from pollutant discharges, environmental stressors and disturbances. Scientific understanding and techniques are being developed for integrated ecological risk assessment and ecosystem protection for fresh, estuarine and marine waters, wetlands, contaminated sediments, aquatic ecocriteria, nonpoint sources, habitat/biodiversity, wastewater, and sludge. This requires improving analytical methods for quantifying pollutants. EPA's Ecosystem Protection Research Program also contributes to these efforts by focusing on areas such as measuring and reporting on surface water quality, including research on the further development of ecological and biological criteria; improved designs for monitoring surface water quality; new indicators to assist in diagnosing degraded streams, rivers and estuaries; and better measures of condition to report on success. Page 28 EPA's FY 1998 Annual Financial Statements ------- Enforcement and Compliance Assurance Program Description In FY 1998, EPA promoted a comprehensive watershed approach to water quality compliance and enforcement. The Water Quality Enforcement and compliance assurance program ensures compliance with permits issued under National Pollutant Discharge Elimination System (NPDES) as well as taking actions for discharges into U. S. waters without a permit. In FY 1998, EPA targeted its resources on wet weather discharges (e.g., sanitary sewer overflows, combined sewer overflows, and stormwater). In addition, EPA focused attention on the development and implementation of the Concentrated Animal Feeding Operations (CAFO) Compliance Assurance Implementation Plan and participated in the development of the draft Unified Strategy for Animal Feeding Operations (AFO). These areas pose substantial risks to human health and the environment. Moreover, the program emphasizes the importance of identifying significant noncompliers and taking an appropriate enforcement action or returning them to compliance in a timely manner. Highlights and Accomplishments The Agency continued to place a heavy emphasis in FY 1998 on expanding efforts to promote understanding of the condition of aquatic resources in geographic terms — on a watershed basis. The President's Clean Water Action Plan, announced in February 1998, calls for more than 100 specific key actions by EPA and by many other federal agencies with either water quality responsibilities or activities that have an impact on water quality. These key actions cover most aspects of the water program at EPA. The Action Plan mobilizes federal, state, and local agencies to achieve the Nation's clean water goals through the watershed approach; brings a sharp focus to the critical actions that are required; and establishes deadlines for meeting these commitments over the next several years. The Action Plan calls upon states and tribes to work in cooperation with federal, interstate, and local agencies, watershed-based organizations, and the public to identify watersheds most in need of restoration and to develop watershed restoration action strategies. In June, EPA, U.S. Department of Agriculture (USDA), and other federal agencies developed a framework to assist states and tribes in preparing their watershed assessments. States were encouraged to draw from existing water quality data in assessing overall watershed conditions. Forty-six states and territories and 44 tribes submitted draft Unified Watershed Assessments (UWAs) on August 1. After receiving feedback from an interagency workgroup and the public, 54 states/territories and the District of Columbia as well as 13 tribes submitted final UWAs as of October 9. A key next step will be to map the results of these UWAs. In support of these efforts, the Agency strengthened the Watershed Academy to provide training for watershed managers and others implementing the watershed approach. The Academy includes training courses, state facilitations in which the Academy assists states and tribes in reorienting their programs to implement watershed approaches, an information transfer series, and a web site. In FY 1998, the Watershed Academy also developed numerous Internet distance learning training modules to serve those who cannot attend the live courses. EPA completed a number of efforts to provide to states and tribes improved tools with which to carry out their water quality standards programs. The Agency published guidance documents on a methodology for deriving ambient water quality criteria for the protection of human health and completed water quality criteria documents for four chemicals of concern — Ammonia-revision, 1,3-Bichloropropne (1,3-BCP), Hexachlorobutadiene (HCBD), and Acrylonitrile. EPA published a National Strategy for the Development of Regional Nutrient Criteria and began to assist states and tribes in adopting numeric nutrient criteria in their water quality standards. The Agency also published a national Contaminated Sediment Management Strategy and submitted the National Sediment Inventory to the Congress. The Agency reviewed and approved state and tribal standards submissions and provided guidance, technical assistance, and training to states and tribes. In FY 1998, EPA promulgated federal water quality standards for two states, Alabama and WATER QUALITY Obligations - FY 98 Total Obligations - $789.4 Million Grants Assistance Prog. Engineering & Analysis 8 9J5.4% Grants Prog. ^ JB-7% Mgt. i 6.8% 1 •—••• -K R&D 40'6% / g 7% Strategies ™ Enforcement Implementation 22.9% Water Quality Monitoring & Analysis EPA's FY 1998 Annual Financial Statements Page 29 ------- California. Due to state action, EPA was able to withdraw the federal human health criteria for arsenic in the State of Alaska. EPA enhanced its user-friendly geographic information system, BASINS, with additional geo-referenced data and released a sediment quality modeling package to enable states, tribes, and local agencies to conduct watershed-based environmental assessments. Training and on-line user support services, including a BASINS web site, further increased access to and use of the model. The Agency also began design of a nationwide survey to identify the presence and extent of persistent bioaccumulative toxics in fish tissue. EPA continued its efforts to look at the future direction of the water quality criteria and standards program by publishing an Advance Notice of Proposed Rulemaking (ANPRM) to consider revisions to the existing water quality standards regulations. The ANPRM seeks feedback on changes that would allow states and tribes to tailor their own regulations to local conditions and to address biological health as well as human health in developing solutions to water quality problems. EPA conducted two of three large public meetings to encourage public dialogue and nationwide consistency in water quality standards programs. EPA launched a new program to support states, tribes, and local communities in assessing water quality at bathing beaches. The Beaches Environmental Assessment, Closure, and Health (BEACH) Program, designed ultimately to reduce exposure to microbial contamination at bathing beaches, will assist states and local governments to better monitor and inform the public of risks associated with exposure to contaminated waters at beaches. EPA made information on specific beaches available on the BEACH Watch web site that includes beach monitoring and closure information for the public to use in assessing risks that selected beaches may pose. The Total Maximum Daily Load (TMDL) Program is authorized by Section 303(d) of the CWA. Section 303(d) requires states to identify and list waters for which existing pollution controls are not stringent enough to achieve state water quality standards, and to establish TMDLs for these waterbodies. A TMDL specifies the amount of a particular pollutant that may be present in a waterbody such that water quality standards still are attained or maintained, and allocates allowable pollutant loads among sources, thus providing the basis for taking actions needed to restore impaired waterbodies. During FY 1998, the TMDL Federal Advisory Committee Act (FACA) committee completed its deliberations and submitted a final report to the EPA Administrator containing over 100 recommendations for improving the effectiveness and efficiency of the TMDL program. Also during FY 1998, EPA initiated efforts to propose revisions to the current TMDL program regulations and guidance. EPA will consider the TMDL FACA committee recommendations as it develops these proposed revisions. The proposed regulatory revisions are scheduled for publication in the Federal Register in the Spring of 1999. Consistent with the current TMDL program regulations, states were required to submit lists of impaired and threatened waters to EPA in April 1998. As of the end of the fiscal year, most states had submitted final lists to EPA for review and approval/disapproval action; other states were in the process of developing final lists for submission to EPA. The EPA Regions, in consultation with Headquarters, are carefully reviewing the final state lists and making appropriate approval/disapproval decisions. The Agency made significant advances toward the goal of providing to our state, local, and private partners accurate information on the quality of our Nation's waters. EPA's efforts to develop appropriate indicators of environmental health, to support monitoring programs, and to store and provide data are critical to maintaining the ability to identify and understand remaining high-risk problems, develop appropriate solutions, and evaluate if and when environmental results are being achieved. The Agency continued to improve and update the Index of Watershed Indicators (IWI), a major project intended to facilitate decision-making within the watershed protection framework. IWI configures existing information from multiple sources to display the condition and vulnerability of the Nation's 2,111 watersheds. Many of the original 15 indicators have been updated with more recent data. Additionally, new candidate indicators dealing with living resources (e.g., biological integrity and terrestrial condition), ground water, and air deposition have been added to the redesigned web site. IWI is available on Surf Your Watershed, an Internet community-based information system for organizing, locating, and sharing water quality information critical for understanding problems and developing solutions. Page 30 EPA's FY 1998 Annual Financial Statements ------- The team tasked with development of a new generation STORET, the Nation's primary water quality data storage and retrieval system, rolled out Version 1.0 of the production system on September 3, 1998. Since the release, approximately 300 copies of the system have been distributed. The system is available for either the desktop or a Local Area Network (LAN) application. EPA initiated a training program for using the new system. EPA is placing increased emphasis on protecting ocean and coastal waters. The Agency was a key participant in the National Oceans Conference, held in June 1998 in recognition of the International Year of the Ocean. At the conference the President made numerous commitments that will involve EPA action, including efforts to protect coral reefs, improve beach and coastal water quality, ready our ports for expanded use in the 21st century, and develop recommendations for a federal ocean policy. The Agency also worked on several fronts to build partnerships to more effectively protect and restore coastal ecosystems. The Partners for Smart Growth Conference succeeded in bringing developers, local government officials, and financiers together to discuss how growth and development can complement environmental protection efforts and can create more liveable communities. EPA and the National Oceanic and Atmospheric Administration (NOAA) held a meeting with state coastal program managers and National Estuary Program directors to discuss common issues such as habitat loss and nutrient over-enrichment. EPA has been working with NOAA and other federal agencies to provide technical assistance to states responding to and mitigating the impacts of toxic Pfiesteria outbreaks and other harmful algal blooms. A national contingency plan has been prepared to provide emergency federal response to Pfiesteria outbreaks and other harmful algal blooms in cases where state response capabilities are exceeded. Our National Estuary Program is one of the Water Quality Program's foremost community-based, stakeholder-oriented efforts, with 17 programs successfully implementing their Comprehensive Conservation and Management Plans. The Water Program continued to examine the effects of air deposition of chemicals, heavy metals, nutrients, and other pollutants in the Nation's surface waters. EPA's goal is to characterize and manage air deposition effects on downwind waters by building upon ongoing programs, primarily under the Clean Air Act (CAA) and the C WA. Studies have confirmed the need for more stringent air controls by demonstrating residual benefits to water quality. The Office of Water (OW) Air Deposition Initiative partnered with the Office of Air and Radiation (OAR) to ensure the effective use of CAA tools to protect water quality by incorporating water quality benefits and issues into air regulations and policy. In 1998, this included analysis of the benefits to certain water bodies as a result of the NOx State Implementation Plan (SIP) Call rule issued by OAR. The partnership also has expanded, with more joint meetings held and being planned for the future. In addition, the Initiative has launched an effort to pilot the development of a TMDL under the CWA that considers the air loadings of mercury to the impaired water body. The Agency continued its approach to protecting the environment from urban wet weather pollution sources. Following the Phase I Storm Water rule covering industries and large municipalities, EPA published a proposed rule to regulate smaller municipalities and construction storm water sources. This rule was based on detailed discussion with the Urban Wet Weather Flows Federal Advisory Committee, other outside stakeholders, and internal EPA stakeholders. In addition, EPA continued to work with stakeholders on ways to incorporate controls on combined sewer overflows, sanitary sewer overflows, and storm water into a watershed approach, in order to better control those sources. This approach recognizes the need for flexibility in implementing any controls that go beyond a minimum set of technology-based controls, identifies the relative roles of government in implementing a watershed approach, and recognizes that monitoring on a watershed basis is an important focus of the effort. As part of the effort to reduce nutrient loadings, the Agency began to more actively address issues related to animal agriculture. EPA published a draft "Strategy for Addressing Environmental and Public Health Impacts from Animal Feeding Operations." This draft strategy delineates EPA's short-term and long-term efforts to comprehensively address the environmental and public health problems associated with animal feeding operations. Later in the year, EPA and the USDA published a draft "Unified National Strategy for Animal Feeding Operations." The draft strategy is one of more than 100 actions President Clinton directed as part of the Clean Water Action Plan, and proposes a variety of voluntary and regulatory approaches for minimizing environmental threats posed by animal agriculture. EPA also participated in dialogues with representatives of the poultry and hog production industry, state agricultural and environmental agencies, local communities and USDA to find ways to improve environmental controls applicable to poultry and hog production. EPA's FY 1998 Annual Financial Statements Page 31 ------- The Agency also conducted training in its permitting programs. EPA continued its partnership with the Water Environment Federation to present wastewater pretreatment training in five cities. EPA also continued providing the basic NPDES permit writers course, which was offered more frequently and to a much wider audience due to agreements with the Department of the Navy and Department of Energy. EPA also funded eight whole effluent toxicity training courses through a cooperative agreement with the Society for Environmental Toxicology and Chemistry. The Agency continued its reinvention of the NPDES permitting program. EPA published a rule to streamline the State Sewage Sludge Management regulations. EPA also published a notice requesting proposals for pretreatment pilot programs based on environmental results, and received eight applications. Within the Metal Finishing sector of the Common Sense Initiative (CSI), EPA developed training videos that focus on program implementation, inspections, and sampling; developed innovative measures to increase environmental compliance; and addressed innovative ways to decrease reporting burden. In FY 1998, the Water Program completed "modernization" of the Clean Water Needs Survey which is the government's primary gauge of national wastewater infrastructure needs. The survey will now facilitate the collection of information on a watershed and estuary basis including needs for Publicly Owned Treatment Works to control traditional "point" source pollution, and needs for control of storm water and "nonpoint" source pollution such as agricultural runoff. The survey will now link to other agency databases such as "STORET," and will enable states to more holistically assess their water quality pollution control needs and prioritize them. The Water Program also issued guidelines for water conservation plans for water conservation systems. States may require water systems to submit a water conservation plan consistent with these guidelines as a condition of receiving a loan from the Drinking Water State Revolving Fund (DWSRF). The Water Program developed an agreement with the states on a major new direction in the national Nonpoint Source (NPS) program. The states agreed to review and upgrade their NPS programs to assure that they address critical elements, while EPA committed to streamlining and refocusing the grants issuance and reporting process to maximize efficiency. EPA continued to carry out the Administration's commitment to protect and manage the Nation's wetland resources during FY 1998. As part of the President's Plan to make the federal wetlands program more flexible, fair, and effective, EPA worked with the U.S. Army Corps of Engineers and other agencies to develop appropriate revisions to the Section 404 Nationwide Permit program. EPA also continued to spearhead the interagency development of a new Agricultural Wetlands Memorandum of Agreement, to provide farmers with clear and reliable wetland determinations for CWA and Food Security Act purposes. The Inland Testing Manual was issued, which is used to evaluate proposed discharges of dredged material. The Agency is working to implement the wetlands and water provisions of the Transportation Equity Act for the 21st Century (TEA-21). A study of locally sponsored wetlands mitigation banks was undertaken in order to provide technical assistance to local governments. The Agency continued to promote development of the hydrogeomorphic approach for assessing wetland functions. As part of our wetlands restoration commitments under the Clean Water Action Plan, the Agency initiated the Five Star Restoration Program to provide challenge grants, facilitate technology/information transfer and partner collaboration, and support peer- to-peer communication programs in an effort to promote community-based wetland and restoration projects. Water Quality Research The Water Quality Research Program increased understanding of landscape characteristics and ecosystem structure and function, and supported EPA efforts to reduce uncertainty surrounding the effects of chemical, biological, and physical stressors on aquatic ecosystems. In addition, this research endeavored to develop diagnostic tools to evaluate the exposures to toxic constituents of wet weather flows, and develop and validate effective watershed management strategies for controlling these flows. Water quality research also sought to develop and provide effective beach evaluation tools necessary to make timely and informed decisions on beach advisories and closures. One goal of EPA's water quality research is to develop and release the Multimedia Integrated Modeling System (MIMS), a common software framework for computation Page 32 EPA's FY 1998 Annual Financial Statements ------- of nutrient, toxics, pesticides, sediments, and pathogen loadings into surface waters for determination of TMDLs including alternative management solutions. ~ EPA developed a rapid response measure for recreational water quality. Typically, it takes 48 hours to estimate whether recreational water is contaminated with gastrointestinal bacteria. If contamination is present, this time period carries a high risk for illness, especially for children. The Agency developed a method that only takes 24 hours, thereby cutting the time at risk in half. ~ EPA published the Landscape Atlas of the mid-Atlantic region. The Atlas ranks 125 watersheds based on patterns of land cover and land use. ~ EPA published reports on Big Darby Watershed (located in central Ohio) - Phase 1 Analysis and Problem Formulation. Specific case studies developed for Big Darby will have application for other watersheds and regional assessments of ecological impacts. This information will provide data and methods for conducting regional ecological risk assessments and setting risk management options. Water Quality En forcement Performance Measures The enforcement and compliance assurance program deters and reduces noncompliance and achieves environmental and human health improvements by maintaining a strong, timely and active enforcement presence. EPA directs enforcement actions to maximize compliance and address human health problems. Specific measures include noncompliance rates, measurement of average length of time for violators to return to compliance or enter enforceable agreements, number of administrative, civil, and criminal judicial actions. These measures count the number of enforcement actions and the number of inspections in the Water Quality Enforcement and Compliance Assurance Program and also measure how successful compliance and enforcement programs are by looking at the length of time for significant noncompliers to return to compliance or have an enforcement action taken. Addressing significant noncompliers is a major portion of the base program. Moreover, dealing with priority areas (wet weather, CAFOs) will result in improvements to human health and the environment as these sources are some of the most significant uncontrolled water quality areas. The program used the following performance measures for assessing their success in FY 1998: Kev Performance Measures 1998 Goal 1998 Actual NPDES Inspections 2,400 Inspections 2,135 Inspections UIC/PWSS Inspections 5,700 Inspections 7,760 Inspections CWA Section 313 Inspections 600 Inspections 500 Inspections NPDES Civil Referrals 50 Case Referrals 53 Case Referrals UIC/PWSS Civil Referrals 20 Case Referrals 14 Case Referrals NPDES APO Complaints 150 APO Complaints 227 APO Complaints UIC/PWSS APO Complaints 60 APO Complaints 65 APO Complaints NPDES Compliance Orders 505 Compliance Orders 770 Compliance Orders UIC/PWSS Compliance Orders 300 Compliance Orders 287 Compliance Orders Wetlands Compliance Orders 40 Compliance Orders 74 Compliance Orders (Note: APO is Administrative Penalty Order.) EPA's FY 1998 Annual Financial Statements Page 33 ------- Future Trends The Water Quality Program will continue to build on the approaches described in the Clean Water Action Plan. New resources provided in 1999 for Plan support will be available to implement watershed restoration action strategies targeted to watersheds not meeting clean water and other natural resource goals. Watershed strategies will be developed for priority watersheds to invest new spending in appropriate and cost-effective projects. A key source of funding for action strategy implementation will be the CWA Section 319 nonpoint source state grant program. EPA will work with states to upgrade their nonpoint source pollution control programs to ensure effective use of the funds. EPA and many other federal agencies are conducting critical research which will help us understand the human health and environmental effects of Pfiesteria outbreaks and the environmental factors (nitrogen, phosphorous, and other factors) which contribute to Pfiesteria outbreaks. Further reducing the levels of nitrogen and phosphorous in our Nation's waters is imperative in order to prevent risks to human health, as well as the associated environmental degradation and economic impacts, caused by Pfiesteria outbreaks and other harmful algal blooms (HABs). EPA will continue to work with states and tribes to collect data and develop site-specific control strategies for nutrients, which will result in control of these E1AB outbreaks. The Agency will continue its longstanding trend toward common sense, place-based approaches that build on the solid foundation for the basic water programs. In keeping with the commitments in the Clean Water Action Plan, EPA will work with stakeholders to assure that water quality standards and fish consumption advisory programs are implemented consistently across the country. In particular, we will revise existing water quality criteria and encourage states and tribes to adopt and implement biocriteria that enhance acquatic life. EPA will continue to assist stakeholders in incorporating a risk-based approach, investigate newly-identified environmental problems, and provide increased support for tribal water quality programs. The Agency will also issue guidance and informational materials to provide the public and responsible officials with accurate up-to-date information about the risks, especially to children, from consuming contaminated fish and exposure to contaminated recreational waters. The Administration and both houses of Congress support the development of a National Ocean Policy — a coherent, comprehensive, and long-range national policy regarding the exploration, protection, and use of ocean and coastal resources. Implementation of activities stemming from the National Oceans Conference will continue. In addition, the Agency is developing a Coastal Watershed Protection Strategy to more effectively protect and restore coastal ecosystems by transferring the lessons learned and experiences from the National Estuary Program to other coastal watersheds. We intend to work with regions and states to encourage the use of Comprehensive Conservation and Management Plans as Clean Water Action Plan Watershed Restoration Action Strategies, and to target our resources and activities to the needs identified by coastal states. Interagency coastal monitoring and coastal research strategies will also be developed, consistent with the Clean Water Action Plan. Finally, through state and tribal program assistance, EPA will continue to pursue its strategy of building state and local capacity to implement and enforce the Nation's environmental laws. One approach will be to encourage states and tribes, under the new authority of Performance Partnership Grants (PPGs), to group categorical grant funds into PPGs so they can address their own unique environmental priorities. EPA's role will be to help those who need our assistance and strive to make sure that federal financial assistance brings the Nation the best possible return on its investment in a cleaner, safer environment. EPA will continue its commitment to maintaining a strong compliance and enforcement presence. Priority areas for FY 1999 and FY 2000 include implementation of the enforcement commitments in the Clean Water Action Plan. Specifically, EPA will focus additional resources on wet weather discharges (CSOs, SSOs, and stormwater) as well as on implementing the CAFO Compliance Assurance Implementation Plan and the draft national Unified AFO Strategy. EPA will continue to emphasize a strong base enforcement program focusing on conducting inspections and taking timely and appropriate action against significant noncompliers. Page 34 EPA's FY 1998 Annual Financial Statements ------- TOXIC SUBSTANCES The Toxic Substances Program, administered by the Office of Pollution Prevention and Toxics (OPPT), is responsible for environmental programs carried out under six major statutes. The Toxic Substances Control Act (TSCA) is designed to protect human health and the environment from risks associated with the manufacture, processing, distribution, use, or disposal of toxic chemical substances. Title X of the Residential Lead-based Paint Hazard Reduction Act of 1992, now codified as Section IV of TSCA, requires EPA to provide a comprehensive national approach to dealing with lead-based paint in the Nation's housing stock. The Pollution Prevention Act of 1990 (PPA) encourages cooperative efforts between EPA and the private and public sectors to prevent toxic chemical pollution. Section 313 of Title III of the Emergency Planning and Community Right-to-Know Act of 1986 (EPCRA) requires facilities that emit certain toxic materials to report those emissions to EPA and requires EPA to collect and provide the data to the public. The Asbestos Hazard Emergency Response Act (AHERA) requires inspection for and abatement of asbestos in all public and private schools, and directs EPA to examine asbestos exposure issues in public and commercial buildings. Finally, the Asbestos School Hazard Abatement Act (ASHAA) authorizes EPA to provide loans or grants to local education agencies to conduct asbestos abatement projects in public and private school buildings. A key feature of the Toxic Substances Program is the concept of pollution prevention. Preventing pollutants from entering the environment, as compared to costly risk management and remediation efforts that deal with pollutants already in the environment, has provided society with an effective, cost-conscious approach to protecting public and environmental health. The pollution prevention program concentrates on eliminating or reducing the use of toxic substances in chemical manufacturing processes and reducing other downstream uses of such chemicals. In cooperation with various stakeholders, OPPT proposes or develops strategies incorporating market incentives, technological innovation, and other assistance to help the adoption of pollution prevention practices. However, to be most effective, the pollution prevention ethic must be applied voluntarily by industry, business, and consumers. Toxic Substances Program objectives involve identifying chemicals that may be harmful to human health or the environment, preventing these chemicals from reaching the marketplace, and the mitigating harmful effects of toxic chemicals already present in commerce. The Toxic Substances Program strives to accomplish this without impeding or creating unnecessary barriers to technological innovation. The traditional regulatory approaches of the core TSCA programs (i.e., the New and Existing Chemicals programs) to managing chemical risks are increasingly being complemented by voluntary compliance and market based programs emphasizing pollution prevention as the strategy of first choice. Chemical testing and scientific analysis, used to gain knowledge about the environmental and health effects of toxic chemicals, promote sound chemical assessment and management. Within the context of the Government Performance and Results Act (GPRA), the Toxic Substances Program is organized around three of the Agency's primary environmental goals: Preventing Pollution and Reducing Risk in Communities, Homes, Workplaces and Ecosystems; Reduction of Global and Cross-Border Environmental Risks; and Expansion of Americans' Right to Know About Their Environment. The principal programs found under these three goals are described below. Toxic Substances Program Description Preventing Pollution and Reducing Risk in Communities. Homes. Workplaces and Ecosystems Key areas under this goal are the New and Existing Chemicals Programs, the Lead Program, National Chemicals Program (e.g., asbestos, polychlorinated biphenyls [PCBs], and dioxin), and the Pollution Prevention Program. The New Chemicals Program, which includes biotechnology-based applications, identifies and manages the risk of new chemicals entering the market place. Manufacturers must submit a premanufacture notice (PMN) to EPA for evaluation before new chemical substances and biotechnology products can be manufactured commercially. EPA may prohibit or EPA's FY 1998 Annual Financial Statements Page 35 ------- restrict the commercial manufacture and use of the chemical or request additional information from the manufacturer if it determines the chemical or product may present unreasonable risks to human health or the environment. There are several exemptions to the PMN process, including those for low volume production quantities and polymers. EPA collects fees up to $2,500 ($100 for small businesses) for each PMN submission, generating annual revenues of about $2 million which are deposited into the General Fund of the U.S. Treasury. The Existing Chemicals Program identifies risks associated with the approximately 70,000 chemicals currently in commerce, assesses alternative chemicals, and identifies pollution prevention opportunities through the screening of chemicals, groups of similar chemicals (clusters), processes and use patterns. The program emphasizes both voluntary agreements with industry and, if necessary, regulatory approaches to mitigate risk. Serious health effects can result from exposure to lead contamination in paint, dust, soil and drinking water. The Lead Program seeks to reduce lead exposure, especially for children, and to identify the most serious exposure sources. The Lead Program addresses past, current and new uses of lead and educates the public about the dangers of lead exposure. The Agency is responsible for administering over 30 mandates contained in the Lead-Based Paint Hazard Reduction Act of 1992 ("Title X"). The National Chemicals Program concentrates on risk management activities for asbestos, PCBs, dioxin, and other toxic chemicals of national concern and impact. Asbestos and other hazardous fibers are commonly found as indoor air contaminants. The National Chemicals program supports the development and implementation of asbestos control and management programs by the federal, state, and local governments and the private sectors. PCB efforts work to reduce the risks from PCB contaminants in residential, school, and workplace settings. The program regulates PCB use in electrical equipment and other products; directs appropriate clean-up of spills, leaks and other releases of PCBs to the environment; and approves permits for facilities for the storage and disposal of PCB wastes. The program ensures PCBs are managed in an environmentally sound manner while they are in use and requires the safe disposal of PCBs. OPPT continues to address the health and environmental hazards of and exposures to dioxin, a toxic chemical that accumulates in the environment. Reduction of Global and Cross-Border Environmental Risks Pollution has no respect for political boundaries and many risks to human health and the environment in the U.S. originate outside our borders. Chemicals that are persistent, toxic, and bioaccumulative and that pose threats to human health and the environment are of particular concern to OPPT when these chemicals cross international borders. OPPT is actively involved in an international cooperative effort to harmonize test guidelines, i.e., coordinating and standardizing methods for testing chemicals and chemical substances to assess hazard or toxicity. Test guideline harmonization reduces the burden on domestic chemical companies of repetitive or duplicative testing requirements and expands the universe of toxic chemicals for which testing information is available. Harmonization also encourages international information exchange and mutual international acceptance of test data. OPPT also contributes to international efforts to establish emissions inventories, generically termed pollutant release and transfer registries (PRTRs), similar to EPA's Toxic Release Inventory (TRI). Expansion of Americans' Right to Know About Their Environment An essential component of a comprehensive national approach to environmental protection is the full participation by the American public in environmental priority-setting, risk reduction and remediation, and short- and long-term environmental planning. Informed citizens are better equipped to consider the relative severity of environmental risks, the opportunities for prevention or remediation, and the trade-offs and uncertainties that accompany many environmental decisions. Page 36 EPA's FY 1998 Annual Financial Statements ------- The TRI administered by OPPT, provides the public with valuable information about chemical releases in their communities. Mandated by Section 313 of EPCRA, the TRI program collects and provides the public with information annually about releases of certain toxic chemicals at manufacturing and federal facilities. Section 6607 of PPA expanded the type of pollution prevention information included in TRI reports. OPPT makes TRI information available to the public in various formats, including via the Internet. Research Program Description Toxic substances research provides an understanding of basic mechanisms and processes that are useful to regulatory program analysts in the interpretation of data submitted by industry in response to TSCA regarding risks arising from the manufacture, processing, distribution, and use or disposal of new or existing chemical substances. In addition, research efforts as part of the Children's Agenda focused on assessing children's health risks from exposure to toxic chemicals and other toxic substances. The products of these research efforts are intended to support human and environmental risk assessments, which are the basis for implementation of these laws. Toxic substances research was carried out in such areas as ecosystems protection, human exposure, health effects, and health risk assessment methods. The information developed from application of these methods will significantly improve our understanding of the extent of human exposure to specific toxic substances. The Agency will incorporate these methods into its battery of testing guidelines under which industry will be required to submit data to the Agency on toxic substances as regulated under TSCA. Enforcement and Compliance Assurance Program Description The Toxic Substances Enforcement and Compliance Assurance Program conducts compliance monitoring inspections, with emphasis on asbestos worker protection and high-risk PCB's. EPCRA has emphasized data quality. EPA also is promoting compliance and enforcement of Section 1018 of TSCA, the lead-based paint notification and disclosure requirements. EPA's grant support to states' toxic substances program emphasizes meeting asbestos worker protection safety standards and PCB standards, and managing state lead risk reduction and abatement programs. In FY 1998, states continued to conduct compliance monitoring inspections on toxic substances requirements. During 1998, EPA emphasized continuing partnerships with the states to foster comprehensive toxic substances enforcement authorities at the state level. EPA will continue its commitment to maintaining a strong compliance and enforcement presence in the core TSCA program and other programs under TSCA. Agency priorities for FY 1999 and FY 2000 include compliance assistance/enforcement for lead based paint (including the Real Estate Notification and Disclosure Rule and the lead abatement, certification, and training requirements in TSCA Sections 402/404/406) and commencement of the national PCB phase-out initiative. This PCB initiative targets facilities voluntarily removing PCB containing transformers and capacitors. The TSCA Enforcement and Compliance Assurance Program will continue to use EPA incentive policies to increase the number of facilities that self-police and self-correct environmental problems. The EPCRA Program targets inspections and enforcement actions at companies with data quality and data reporting violations. The program also conducts compliance inspections to detect companies and federal facilities that have failed to report toxic chemical emissions. Executive Order 12856 authorizes EPA to conduct reviews and inspections to monitor compliance with EPCRA Sections 301 and 313 at federal facilities. Agency priorities for FY 1999 and FY 2000 will include targeting sector or "priority pollutants", inspecting and enforcing for violations of TRI data quality, and leading a national enforcement initiative for high risk chemicals of concern or priority sectors for the Community Right to Know, EPCRA Sections 311 and 312. The EPCRA Enforcement and Compliance Assurance Program will continue to use EPA incentive policies to increase the number of facilities that self-police and self-correct environmental problems. EPA's FY 1998 Annual Financial Statements Page 37 ------- Highlights and Accomplishments Preventing Pollution and Reducing Risk in Communities. Homes. Workplaces and Ecosystems During FY 1998, OPPT received 1,553 TSCA Section 5 notices, including PMNs, low-volume exemptions and test marketing exemptions. The number of notices received is about 10% greater than in recent years. OPPT's scientific staff continued to develop assessment tools, collect data, and issue guidance for the New Chemicals and Biotechnology Program. The Existing Chemicals Program continued initial chemical screening to determine the potential human health and environmental effects posed by chemicals currently in commerce. Additionally, the program examined control options, conducted detailed risk management reviews, and implemented risk control measures where appropriate. OPPT continued its chemical testing activities as part of the overall Existing Chemicals Program, concentrating both on chemicals designated by the Interagency Testing Committee (ITC) and also on multi-chemical rules identified through non-ITC sources. The continued use of multi- chemical test rulemaking resulted in an acceleration of the number of chemicals handled in the rulemaking process. Additional testing candidates were identified for inclusion on the Agency's Master Testing List. The chemical testing program continues to play a major international role in the accumulation of test data for high production volume chemicals. An important new and developing component of this program is the Community Right to Know concept. In this area, EPA seeks to find ways to share its broad knowledge of chemical toxicity and exposure with citizens and communities, fostering better public understanding of environmental risk and facilitating well-informed local decisions on environmental quality and protection. The Lead Program made important progress in the development of lead regulations during FY 1998. OPPT published the final TSCA Section 406(b) rule, involving lead abatement activities in housing renovation; promulgated the renovation information rule; and developed a rule establishing the fee charged by EPA to accredit training providers and to certify lead- based paint professionals. OPPT also proposed a rule under TSCA Section 403 establishing regulatory standards for identifying lead-based paint hazards, lead-contaminated dust, and lead-contaminated soil; and forwarded to the Office of Management and Budget for review a proposed rule under TSCA Section 402 establishing management and disposal standards for lead-based paint debris. The Lead Program also published an important new resource document for parents concerned about lead and their children entitled Lead In Your Home: A Parent's Reference Guide. In FY 1998, OPPT published a final rule on PCB disposal. OPPT continued to assist the states in improving their asbestos accreditation programs, as required under the AHERA, and completed evaluations of awarded ASHAA loan and grant projects. OPPT continued its dioxin assessment activities in FY 1998. Assessment findings support scientific evidence that dioxin is a major environmental pollutant although OPPT still has insufficient knowledge of dioxin sources, transport, and exposure to support sound policy and program development. OPPT continued its cross-media efforts to characterize human exposure to, and sources of, dioxin through a variety of surveys, studies, and tests to determine the level of dioxin exposure in the United States. OPPT completed and published the results of surveys for dioxin in milk and food, and implemented the first phase of a national monitoring network to detect dioxin in ambient air. Reduction of Global and Cross-Border Environmental Risks In FY 1998, OPPT continued its involvement in negotiations to complete a legally binding protocol for the elimination and/or control of specified persistent organic pollutants. These negotiations are being conducted under the auspices of the United Nations Economic Commission for Europe (UNECE) Convention on Long-Range Transboundary Air Pollution. TOXIC SUBSTANCES Obligations - FY 98 Total Obligations - $175.7 Million Toxic Substances Strategies Enforcement 27.5% Emergency Planning & Community Right to Know Page 38 EPA's FY 1998 Annual Financial Statements ------- OPPT similarly participated in the process of completing a legally binding convention, known as Prior Informed Consent, that will delineate requirements for the export and import of selected banned or restricted chemicals. Serving as a major source of scientific expertise and review in updating guidelines, OPPT continued its close cooperation with other federal agencies and the Organization for Economic Cooperation and Development (OECD) in test guideline harmonization activities. OPPT also provided financial and technical assistance to support the development of PRTRs. Expansion of Americans' Right to Know About Their Environment The original TRI reporting requirements were limited to the manufacturing sector, and included approximately 320 chemicals and chemical categories. The list of chemicals subject to TRI reporting has more than doubled since 1986 to 600-plus chemicals, with over 31,000 facilities now submitting annual TRI reports. This total includes federal facilities that became subject to TRI reporting under Executive Order 12856. Reporting facilities submitted a total of 101,145 TRI reports in FY 1998. An important accomplishment for the TRI program in FY 1998 was the development of a rule to add certain persistent bioaccumulative toxics (PBTs) to the TRI reporting list. In addition, the TRI program lowered reporting thresholds for new PBTs, as well as for PBTs already on the reporting list. Work is underway to expand TRI reporting requirements to additional industries, specifically the oil and gas industries, and airports. Other key activities in FY 1998 included conducting public outreach meetings on the use of TRI reporting forms and developing new industry sector technical guidance manuals to assist the regulated community. OPPT continues to review comments received during 1997 as a result of an Advance Notice of Proposed Rulemaking on the possible expansion of the types of data collected under TRI to determine whether to collect materials accounting data, worker exposure information and data on toxic chemicals in products. Also in FY 1998, OPPT produced the annual national TRI data release, which included expanded data analyses. OPPT information management activities concentrated on data quality, public data access, and expansion of the use of TRI data by state and local governments, other EPA offices, private industry, and the general public. OPPT continues to develop tools to facilitate public access to, and the use of, chemical information and strives to put in place improved technology which will ease the reporting burden on industry for submitting TRI reports. Within the overall framework of the Right to Know goal, OPPT actively promotes the concept of community-based environmental programs (CBEP). CBEP is a community-based approach to environmental protection and economic development in which environmental issues are addressed from the perspective of the local neighborhood. CBEP fosters consideration of a detailed level of information often missed when policy is made at national or state levels, incorporating the community's knowledge and thereby making it possible to address effects on the local environment from multiple sources. CBEP empowers local communities to take the lead in addressing environmental issues while utilizing government as a source of information and technical assistance. Building consensus at the local level unites the community around voluntary pollution prevention efforts that may go beyond statutory requirements. Reducing Exposure through Human Health Protection Research EPA's research and development program increased the Agency's understanding of environmental processes and our capability to assess environmental risks - not only to human health, but also to ecosystems. This research supported EPA efforts to identify the most important sources of risk to human health and the environment, and thereby guide priorities, policies, development of environmental regulations, and deployment of resources. In addition, Agency research sought to provide the understanding and technologies needed to detect, abate, and avoid environmental problems. In the future, environmental problems will be dealt with using those features of the current system that have proven effective and by designing and testing fundamentally new tools and approaches that utilize the latest advances in scientific knowledge and technology. ~ EPA continued to develop and evaluate biologically based dose response (BBDR) models to describe the underlying mechanisms of toxicity and to facilitate extrapolation from animal studies. These models will foster improved estimation of human risks from exposure to compounds such as methanol, dibromochloromethane, arsenic, acrylamide, and dioxin. EPA's FY 1998 Annual Financial Statements Page 39 ------- ~ EPA published the Exposure Factors Handbook (paper copy). The Internet version was available in April 1998. The Exposure Factors Handbook is the primary reference in the Agency for information on factors used in exposure assessment relating to human characteristics and behaviors. ~ EPA performed research that will lead to the development of improved testing guidelines for predicting the human health effects of prenatal and perinatal exposures to toxic substances. Improved testing guidelines and health effects methods and models will enhance the Agency's ability to characterize toxic effects in children. ~ EPA continued research that provides data needed to develop and further define models that predict the human health outcome of exposures to toxicants, including pesticides and industrial chemicals. These models are used by the Agency to screen and prioritize new and existing chemicals and toxic substances for further regulatory action. En forcing Toxic Substances andEPCRA Laws ~ In FY 1998, EPA Headquarters issued 15 administrative complaints to companies for TSCA violations. Two of the complaints were for penalties of over $1 million. Also, approximately 700 compliance inspections were conducted under the EPCRA Enforcement and Compliance Assurance Program and compliance assistance outreach was provided to chemical facilities that use, manufacture or process potentially harmful chemicals. ~ The enforcement and compliance assurance program deters noncompliance by maintaining levels of field presence and enforcement actions, particularly in high risk areas and/or where populations are disproportionately exposed. The program used the following performance measures for assessing their success in FY 1998: Kev Performance Measures 1998 Goal 1998 Actual Toxic APO Complaints 185 APO Complaints 214 APO Complaints TSCA Inspections 1,100 Inspections 1,542 Inspections State Toxics Inspections 1,000 Inspections 1,136 Inspections Toxics Civil Referrals 2 Case Referrals 0 Case Referrals EPCRA Civil Referrals 10 Case Referrals 11 Case Referrals EPCRA APO Complaints 200 APO Complaints 233 APO Complaints EPCRA Compliance Orders 3 Compliance Orders 4 Compliance Orders (Note: APO is Administrative Penalty Order.) Page 40 EPA's FY 1998 Annual Financial Statements ------- HAZARDOUS WASTE The Hazardous Waste Program was established to address the prevention, management and disposal of hazardous and municipal solid wastes generated nationwide. Hazardous wastes are produced by large businesses and industries, such as chemical and manufacturing plants, and small businesses. The Resource Conservation and Recovery Act (RCRA) of 1976, as revised by the Hazardous and Solid Waste Amendments (HSWA) of 1984, provides the legislative mandate for a nationwide program to protect human health and the environment from the risks of improper management of hazardous and solid wastes. The goals of the Act are to minimize the generation of waste, ensure adequate and safe management practices from generation to disposal of wastes, and prevent and detect leakage from underground storage tanks. CEPPO Program Description Title III of the Superfund Amendments and Reauthorization Act (SARA) of 1986, also known as the Emergency Planning and Community Right-to-Know Act (EPCRA), helps State and local officials address risk posed by hazardous chemicals present in their communities. This program gives state and local governments tools they need to develop response plans to protect and inform the public in the event of a chemical release emergency. The Clean Air Act (CAA) of 1990 accidental release provisions require facility owner/operators to prepare risk management plans to prevent, detect, and respond to chemical accidents. These CAA provisions also mandate the investigation of major chemical accidents to assess root causes. Public awareness of the potential danger of accidental releases of hazardous substances has increased over the years as serious chemical accidents have occurred around the world. In response to public concern about chemical accidents, in 1986, EPA integrated its Chemical Accident Prevention and Chemical Emergency Preparedness programs into the Chemical Emergency Preparedness and Prevention Office (CEPPO). CEPPO is responsible for implementing Title III of SARA, as well as Section 112(r) of the CAA. Title III requires states to establish State Emergency Response Commissions (SERCs) and Local Emergency Planning Committees 11.1 {PC's i to develop emergency response plans for each community. Title III also requires chemical facilities to provide information on hazardous chemicals to the public. Section 112(r) of the CAA requires facilities that produce, process, handle or store certain hazardous substances to prepare and submit risk management plans (RMPs) to EPA by June 1999. The RMPs will contain very specific information on the risks of chemicals in communities. CEPPO has established a strategy to provide facilities with the information needed to meet the Section 112(r) requirements and ensure public access to useful information about chemical risks. UST Program Description The goal of the Underground Storage Tank (UST) Program is to prevent, detect, and address leaks from underground storage tanks containing petroleum and hazardous substances. The UST program objectives are to stimulate development and implementation of comprehensive state, local and tribal regulatory programs with prevention requirements (i.e., installation, upgrade, leak detection, and technical operating standards); improve implementation and enforcement performance; develop effective state corrective action programs; and provide ongoing technical information, assistance, and training. These objectives directly support the Agency's guiding principle of partnerships through building strong state, local, and tribal UST programs. CEPPO works to prevent accidents like this EPA's FY 1998 Annual Financial Statements Page 41 ------- RCRA Program Description The Agency continues to refine program strategies to direct both private and public resources towards the greatest environmental risk in all areas of the program, including corrective action stabilization and permit work. Additionally, the RCRA program will continue ongoing efforts to develop risk-management standards for hazardous waste. Large and small businesses and manufacturers annually generate approximately 270 million tons of hazardous waste, including wastewater, and more than 7.6 billion tons of industrial non-hazardous waste. The U.S. generates about 210 million tons of municipal solid waste peryear, or 4.3 pounds per person per day. Without proper management and disposal, hazardous, non-hazardous industrial, and municipal solid wastes pose short- and long-term environmental and human health hazards. EPA's Office of Solid Waste (OSW) continues to direct its resources to address the greatest environmental and human health risks. In this regard, the RCRA Program seeks to correlate the stringency of waste management and disposal standards with the degree of risk posed by individual wastes. Regulatory improvements include more tailored and flexible standards and reduced reporting burden on industry while still targeting priority sites. For example, the proposed combustion rule will reduce amounts of priority contaminants, such as heavy metals and dioxins, that enter the air when hazardous wastes are burned. Permitting and corrective action increasingly are risk-based. The permit program is developing streamlined procedures for regulating lower risk facilities, and the corrective action program continues its strong commitment to addressing highest risk releases first. OSW also is working with states to develop comprehensive guidance on the proper management of non-hazardous industrial solid wastes. Research Program Description The Agency's research objective seeks to reduce uncertainties in the risk analyses used in environmental management decisions. In the RCRA Program, research was targeted at reducing uncertainties in exposure estimates and providing technical assistance to regional and headquarters scientists. The primary functions of Waste Risk characterization research are predicting the fate and transport of hazardous waste constituents and estimating exposure. Special emphasis will be placed on providing technical support. Enforcement and Compliance Assurance Program Description In support to EPA's goals of reducing noncompliance in priority areas of the program, EPA continues its commitment to maintaining a strong compliance monitoring and enforcement program with a particular emphasis on demonstrated patterns of national noncompliance by particular companies or industrial sectors. EPA uses its audit and small business policies to provide incentives to businesses to bring their facilities into compliance as well as supporting compliance assistance activities to educate small businesses on achieving compliance. In support of the Agency's goal to prevent waste and harmful chemical releases, EPA continues to use all available tools to ensure that facilities managing hazardous waste and other hazardous chemicals (including hazardous waste combustion and recycling facilities) are operated safely and in compliance with all applicable requirements. The enforcement and compliance assurance program continues to use enforcement and compliance tools to ensure that federal, state, and locally owned facilities that store, treat, and/or dispose of hazardous wastes are in compliance with federal environmental laws. The enforcement and compliance assurance program continues to work with states to enhance their inspection and enforcement activities and to develop voluntary compliance programs. In addition, we will provide resources to tribal governments to assist in building their capability to enforce solid waste regulations. Page 42 EPA's FY 1998 Annual Financial Statements ------- Highlights and Accomplishments CEPPO Worked to Ensure Access to Chemical Risk In formation CEPPO has continued developing computer systems to facilitate collection and provision of RMP information to the public. "RMP*Info" is a central database of RMP information. "RMP*Submit" is a user-friendly system designed for industry to submit its RMPs. In FY 1998, the beta version of the RMP* systems was available for review and comment. Also, definitions and design documents for RMP*Info and RMP*Submit were completed. At the 1998 Hazardous Materials Spills Conference, the prototype of the RMP*Info and RMP*Submit were demonstrated along with RMP*Comp. RMP*Comp is an electronic tool used to perform the off-site consequence analysis required under the Risk Management Program rule. Facilitated Implementation of RMPs by Industry The RMP Implementation Workgroup continued its role of reviewing and commenting on tools currently available to assist industry in developing RMPs and developing recommendations for additional tools needed to implement the RMP program. In FY 1998, CEPPO, working with appropriate stakeholders, published and distributed RMP Implementation Guidance to assist states implement the RMP program. CEPPO also completed over 100 outreach and technical assistance workshops to states, LEPCs, and industry to assist them in understanding and implementing the RMP program. As a result of this and other CEPPO efforts with the states, a total of 15 states agreed to implement the RMP program. CEPPO also worked with states and industry associations to developed industry guidance and five model RMPs to assist industry in meeting Section 112(r) requirements. CEPPO also published and distributed a factsheet on Funding Sources for RMP implementation. Provided In formation Resources to the Public In FY 1998, CEPPO approved grants to 34 states to implement RMP programs and integrate preparedness and prevention activities at the state and local level. CEPPO also is revising their web page to ensure that SERCs, LEPCs, and other stakeholders have easy and continuous access to EPA's emergency planning and accident-risk information. CEPPO also developed and posted on the web site, an RMP matrix to explain existing and planned tools. Additionally, CEPPO provided hardcopies of emergency planning and accident risk information directly to those SERCs and LEPCs that do not have access to the Internet. EPA distributed Computer Aided Management of Emergency Operations (CAMEO) to SERCs and LEPCs, through a cooperative agreement with the George Washington University. CAMEO assists SERCs and LEPCs to organize the information collected under community right-to-know regulations and coordinate activities. A survey of CAMEO users found that 70% of the SERCs and LEPCs are using the system and find it very beneficial and efficient in meeting their needs. The survey also determined that many of the non-users intend to implement CAMEO when they have the proper hardware and training. Established and Conducted EPA/OSHA Accident Investigation Activities In FY 1998, CEPPO completed and issued four final chemical accident investigation reports: Napp; Pennzoil; Powell- Duffryn; and Shell Surpass Chemical. In addition, CEPPO published and distributed chemical alerts for ammonium nitrate and ammonia refrigeration based on information discovered from EPA/OSHA accident investigations. HAZARDOUS WASTE Obligations - FY 98 Total Obligations - $413.7 Million Waste Mgt. Regulations, Guidelines & Policies Financial Assistance 14.6% 26.3% Mgt. Strategies Implementation 30.0% 6.9% R&D Enforcement 16.7% 5.6% Emergency Planning/Community Right to Know EPA's FY 1998 Annual Financial Statements Page 43 ------- Also, in FY 1998, the Chemical Accident Investigation Board was established. Since that time, CEPPO has been working closely with the Board to establish appropriate roles and responsibilities and exchange expertise and lessons learned. Prepared State and Local Governments for Counter-Terrorism Recent legislation (Nunn-Lugar II) authorized the federal government to assist state and local governments to address potential terrorist incidents that may involve weapons of mass destruction (i.e. nuclear, biological, and chemical). EPA, through the leadership of CEPPO, has been recognized as one of the six federal agencies to design and implement this newly created Counter-Terrorism program in the United States. Additionally, CEPPO and the Defense Department visited 21 cities to determine their training needs to respond to such incidents and established a program to provide that training. These federal agencies also provided training to 31 cities as well as completed chemical weapons table-top exercises in 30 cities, chemical weapons functional exercises in five cities, and biological weapons table-top exercises in ten cities. CEPPO also chairs and manages an Anti-Terrorism Strategy Workgroup, utilizing the Agency's National Incident Coordination Team, which developed an Agency Anti-Terrorism Strategy and leveraged resources across Office of Solid Waste and Emergency Response (OSWER) and the Agency to ensure the overall success of the program using existing agency emergency planning and response structures (National Response System) for implementation. UST Assisting State USTPrograms The Office of Underground Storage Tanks (OUST) is working with states to ensure that all owners and operators of USTs comply with EPA requirements as quickly as possible. EPA's goal is to prevent and detect releases of petroleum products and certain hazardous substances from USTs to the environment. In order to achieve this goal, one of EPA's objectives has been and will continue to be to ensure that UST owners/operators comply with the requirements to close, upgrade, or replace older tanks as of December 1998. As of the end of FY 1998, approximately 55% of UST systems were equipped to meet EPA/State 1998 requirements for spill containment, overfill prevention, and corrosion protection. States have the primary responsibility for ensuring that UST facilities (except those in Indian country) are brought into compliance. EPA provides several kinds of technical and financial support to state UST programs. In FY 1998, OUST: ~ Provided more than 270,000 documents in both printed and electronic form to help educate UST owners and operators (the OUST web site generated an average of 2,000 hits per month); ~ Conducted UST inspection and enforcement initiatives jointly with states, and provided technical materials and training programs to help state inspectors assess compliance with requirements for leak detection and corrosion protection; ~ Developed an EPA enforcement strategy and worked with states to develop state-specific enforcement plans; ~ Worked with states to assess the validity of third-party evaluations of leak detection methods; ~ Supported information exchange among states; ~ Helped states explore and use alternatives to traditional inspection programs; and ~ Provided financial support to states through UST state grants and supported improvements to state programs including inspection and enforcement, data collection and management, and staff development and training. TT ' Well Maintained Facility Page 44 EPA's FY 1998 Annual Financial Statements ------- EPA has been working with states over the past several years to reduce cleanups yet to be completed. The Agency helped states streamline their corrective action processes; educated state staff about appropriate uses of innovative cleanup technologies; and provided technical manuals, computer software, and other tools and training. In FY 1998, the Agency continued its efforts to help states design and implement risk-based corrective action (RBCA) programs. As of October 1998, 14 states were implementing RBCA programs and 27 were designing such programs. For the 14 states that are implementing RBCA programs, EPA's focus is to assist in the refinement and documentation of the corrective action process, as well as to assist the states in streamlining their corrective action programs. EPA also is assisting the 27 states in the design phase of their corrective action programs. A public-private partnership involving EPA, states, the American Society for Testing and Materials, and six petroleum industry sponsors provides most of the training and implementation assistance to states. The six companies have contributed significant financial and technical resources to the undertaking. EPA is working with five states to establish RBCA performance measures. Pilot projects began in 1998. EPA and these five states have established pre-RBCA baselines and RBCA performance measures. EPA will analyze each program after one or two years to measure the extent to which RBCA improves their performance. Helping UST Owners and Operators Comply with the 1998 Deadline As of December 22,1998, USTs installed before December 22, 1998 that do not comply with EPA technical standards aimed at preventing releases must be upgraded, replaced, or closed. In 1998, the EPA Administrator confirmed that the Agency would not extend this deadline. Throughout FY 1998, OUST continued its efforts to educate UST owners and operators about the December 1998 deadline. OUST provided compliance assistance materials in response to requests, and conducted mass mailings to trade associations that serve UST owners and operators. OUST also prepared letters from the OUST Director to state governors as well as owners and operators to remind them of the 1998 deadline and to emphasize that it will not be extended. In May 1998, EPA regions and states conducted inspections to confirm compliance with existing release detection requirements, and to remind owners and operators about the 1998 requirements. In August 1998, EPA, after consultation with the states, publicly issued its enforcement strategy for the 1998 deadline. Indian Country EPA has the primary responsibility for implementation of the UST program in Indian country. In FY 1998, EPA regional offices continued to educate owners and operators about the UST requirements, conduct inspection and enforcement activities, and maintain a database of information on USTs located in Indian country. OUST continued to use demonstration grants under RCRA Section 8001 to help tribes develop the capability to administer UST programs. RCRA OSW works to achieve two of the Agency goals as outlined in the new Strategic Plan: better waste management and pollution prevention. Measuring environmental progress achieved in the RCRA Program has been the primary focus of OSW's strategic planning effort. OSW's FY 1998 accomplishments substantially advanced EPA's efforts to achieve these two goals. Targeting Risk The corrective action program supports the waste management goal by cleaning up releases of waste from active hazardous waste facilities, reducing current exposure risks to people and to the environment. In FY 1998, the program continued to stabilize (prevent from further contamination) releases at high-priority sites. By the end of FY 1998, stabilizations were implemented at 704 sites or units; human exposures were controlled at 290 sites or units; and groundwater releases were controlled at 234 sites or units. Further, the corrective action program sponsored a substantial number of RCRA's community-based environmental projects. Regulatory and policy efforts in FY 1998 centered on a final EPA's FY 1998 Annual Financial Statements Page 45 ------- Hazardous Waste Identification Rule for Media, a final Post Closure rule; and examination by EPA and stakeholders of ways to streamline corrective action procedures. OSW targets the control of contamination from hazardous and non-hazardous industrial waste management facilities by defining the pollutants and the appropriate management and disposal standards. Furthering the goal of better waste management means establishing standards based on multipathway risk assessment. Multipathway risk assessment considers not only pollutants and their environmental and health impacts, but also the amount of the pollutants, risk of exposure, and specific industry practices. OSW has been working with the Office of Research and Development (ORD) to develop a multi- media/multiple pathway model to characterize human and ecological health risks of exposure to hazardous constituents. In FY 1998, OSW and ORD completed the analytical strategy for the Hazardous Waste Identification Rule (HWIR) rulemaking effort and initiated the multi-faceted peer review steps for the model and its application. The model is an integral part of the HWIR, a major reinvention effort intended to exempt low-risk wastes from RCRA regulation. The Air Characteristics Study is a new area of risk analysis for the RCRA Program, addressing the questions of whether some industrial wastes should be classified as hazardous because of risks posed by their air emissions. Other efforts to improve the Agency's understanding of risk include RCRA's portion of the initiative to improve the Integrated Risk Information System (IRIS) database and an exploration of mercury treatment standards and alternatives to the Land Disposal Restrictions (LDR) program. Significant FY 1998 Rulemakings In FY 1998, the RCRA Program promulgated several key environmentally protective rulemakings, including the final rule on the management of used oil and the completion of Phase IV of the LDR which addressed treatment standards for newly identified toxicity characteristic metal wastes and formerly exempt mineral processing wastes. The Post Closure rule will provide flexibility to EPA and authorized states by eliminating the requirement to obtain a permit for the post-closure period and allowing the use of other available authorities to address post-closure needs. Under the Hazardous Minimization and Combustion Strategy, EPA is working on two rulemakings that will address hazardous waste combustion in incinerators, boilers, and industrial furnaces and also will address the risks posed by indirect exposure to dioxins, furans, and toxic metals. To reduce burden on the regulated industry, both of these rules will be promulgated under both the Clean Air Act and RCRA. In 1998, significant progress was made on the Phase I combustion rule; this rule will be finalized in 1999. The proposed rule provides for public involvement and allows for extensions of the compliance period to promote the use of cost-effective pollution prevention technologies. The proposal also exempted waste-derived fuels from RCRA, an example of regulatory reinvention OSW provided several Notices of Data Availability (NOD As) that provide public access to information and analysis being used in ongoing development of regulatory alternatives. OSW also issued rules in 1998 addressing regulatory alternatives under the definition of Solid Waste for the petroleum listings and for the primary metal processing industry. The RCRA Program participated in a number of important Common Sense Initiatives in support of EPA efforts to make complying with environmental requirements a more holistic process for a particular industry or business. Examples of these efforts include the successful completion of an agreement on Cathode Ray Tube recycling and the issuance of a proposed rule on extended generator storage limits for metal-finishers who employ pollution prevention techniques. Increased Safety. Flexibility. Efficiency The RCRA Program is working to have approved controls in place at 95% of the hazardous waste facilities by 2005. A total of 992 operating hazardous waste permits were issued by the end of September 1998 out of a universe of 1,480 operating facilities. OSW, EPA regions, and states are continuing to work together to enter additional activities and ensure accuracy in these numbers. The pace of ongoing permitting efforts will be enhanced by improvements to the permit process. In FY 1998, the focus was on the development of Standardized Permits, as recommended by the Permits Improvement Tearn, as well as participation in Project XL proposals. Page 46 EPA's FY 1998 Annual Financial Statements ------- For facilities that produce industrial non-hazardous waste, pollution controls will be based on voluntary guidance rather than permits. OSW is writing the voluntary guidance in partnership with states, based on input from stakeholders including industry, environmental groups, and tribes. In FY 1998, OSW also focused on individual chapters and development of a CD-ROM that will be used as one of the electronic means of distribution, along with the Internet. Electronic distribution will allow industry easy access to the tools and reference materials associated with the guidance that will streamline implementation. These voluntary guidelines are expected to be issued in FY 1999 and will address a range of issues, including groundwater contamination, air emissions, and alternatives to waste disposal. The Municipal Waste Landfill Permit Program is administered by the states, with a target of 100% of facilities having approved controls in place by 2005. OSW also promulgated the Flexibility Rule for Small Municipal Solid Waste Landfills, which will assist the states in implementing landfill controls. The majority of the Agency's efforts in the Municipal Solid Waste Program, as well as some work under the Hazardous Waste Program, contribute to the pollution prevention goal and center on source reduction and recycling. The RCRA Program continued its support for the Jobs Through Recycling program, issuing $1.4 million in grants to regional and local organizations to build markets for reusables and recyclables. The WasteWise program continued its effort to build innovative voluntary partnerships to assist and encourage businesses in taking cost-effective action to reduce solid waste. WasteWise successfully expanded in FY 1997 to include states and local governments. Currently, WasteWise has over 800 partners plus an additional 60 endorser organizations which promote the program to their members. In the program's fourth year, WasteWise partners prevented 816,000 tons of waste and recycled nearly 6.9 million tons, in addition to saving many millions of dollars through their solid waste reduction efforts. The Hazardous Waste Minimization Program saw a significant accomplishment in FY 1997 when the Waste Minimization Prioritization Tool (WMPT) was made available for public and industry use. This software tool assists interested businesses in ranking chemicals to establish priorities for waste minimization programs according to persistence, bioaccumulation and toxicity. During FY 1998, OSW worked with EPA regions and states to provide technical assistance in working with the WMPT. Encouraging and assisting voluntary waste minimization programs, as well as those established as part of permitting, is the main vehicle for achieving the program's target of a 50% reduction in the most persistent, bioaccumulative, and toxic chemicals in hazardous waste streams by 2005. A draft list of the RCRA Waste Minimization Persistent, Bioaccumulative and Toxic (PBT) Chemical List will be issued in early FY 1999. The Waste Information Needs initiative is another major reinvention effort that seeks to streamline and screen the data collected by the states and EPA for purposes of hazardous waste program management. In FY 1998, significant progress was made on migrating two major databases (Resource Conservation and Recovery Information System [RCRIS] and Biennial Reporting Systems [BRS]) from Focus to Oracle. The majority of this work was done in-house. Additionally, the first program area under Waste Information Needs (WDNO/INFORMED completed its data gathering and analysis. EPA will issue the final report in the first quarter of FY 1999. This report will identify data elements needed for planning and evaluation and will include recommendations for business process improvements. Other information management accomplishments include redesigning the permitting program accomplishments report to make the report easier to read and more useful, deciding to privatize the BRS implementer software, and developing a prototype of WEB software. Research Reducing Uncertainties Through Waste Risk Characterization Research ~ EPA produced research results, models, and reports on innovative surface-based geophysical characterization technologies for predicting location and migration of contaminants. These new technologies permit more rapid, accurate, cost-effective characterizations and subsequent cleanups of waste sites. ~ The Agency provides technical support to regional permit writers and risk assessors through the Combustion Technical Assistance Center (CTAC). ~ EPA's Hazardous Waste Identification Rule (HWIR) research teams have developed a number of draft products, including a research plan, assessment strategy, technology design document, modeling components (for an open architectural, object-oriented, multimedia modeling system framework — FRAMES), and several volumes of the EPA's FY 1998 Annual Financial Statements Page 47 ------- 15-volume set describing the HWIR-FRAMES Technology Software System. These products are intended to develop a systems approach to modeling and data management in order to facilitate the consistent and scientifically credible assessment of multimedia-based human and ecological exposure to chemical stressors. Enforcement En forcement Performance Measures The enforcement and compliance assurance program deters noncompliance by maintaining levels of field presence and enforcement actions, particularly in high risk areas and/or where populations are disproportionately exposed. The program used the following performance measures for assessing their success in FY 1998: Kev Performance Measures 1998 Goal 1998 Actual RCRA Inspections 1,100 Inspections 2,659 Inspections RCRA Civil Referrals 12 Case Referrals 49 Case Referrals RCRA APO Complaints 64 APO Complaints 155 APO Complaints RCRA Compliance Orders 20 Compliance Orders 49 Compliance Orders (Note: APO is Administrative Penalty Order.) EPA will continue its commitment to maintaining a strong compliance and enforcement presence. In FY 1999, we will conduct over 1,100 inspections, bring over 64 administrative penalty actions, and refer at least 12 actions to the Department of Justice for filing in federal district court. We also expect to issue at least 20 administrative orders designed to abate conditions that may present an imminent and substantial endangerment to human health and the environment. In addition, the Hazardous Waste Enforcement and Compliance Assurance Program will make significant contributions to the Agency's goal of obtaining 75 self-disclosed violations from targeted programs and 330 overall voluntary disclosures. Agency priorities for FY 1999 compliance assistance, monitoring and enforcement activities include facilities generating hazardous waste in priority sectors and community-based areas, combustion/fuel blenders, volatile organic air emissions from RCRA regulated facilities, and RCRA Subtitle I facilities (Underground Storage Tanks). Page 48 EPA's FY 1998 Annual Financial Statements ------- SUPERFUND EPA administers the Superfund Program under the Comprehensive Environmental Response, Compensation and Liability Act of 1980 (CERCLA) as amended by the Superfund Amendments and Reauthorization Act, 1986 (SARA) and the Omnibus Budget Reconciliation Act of 1990. The Office of Solid Waste and Emergency Response (OSWER) and the Office of Enforcement and Compliance Assurance (OECA) provide primary management of the program. In this section, Headquarters Superfund references will include OSWER and OECA unless otherwise noted. Superfund Program Description The Superfund Program was enacted on December 11,1980 to address public health and environmental threats from spills of hazardous materials and from abandoned hazardous waste sites. It established a comprehensive program to identify and clean up these spills and sites. The law also created the "Hazardous Substance Response Trust Fund" known now as the Hazardous Substance Superfund or Superfund. CERCLA is predicated on a "polluter pays" principle. As such, EPA works first to compel potentially responsible parties (PRPs) to respond and conduct site cleanups. When this is not possible because an agreement cannot be reached or because of an emergency, EPA may use the Trust Fund dollars to address and clean up hazardous waste sites. Cleaning up a Superfund site is often a multi-stage and multi-year process. In fact, it takes seven to ten years after site discovery to start cleanup at the average site. Superfund site cleanup includes site assessment, removal, remedial, and enforcement activities. Prior to placing a site on the National Priorities List (NPL), EPA conducts a preliminary assessment of the site. This is the beginning of the site assessment phase of site cleanup. Where warranted, this is followed by a site investigation. The conclusion of this phase of site cleanup could be a removal action to stabilize the site and/or listing the site on the NPL. Removal actions are a critical phase of addressing and cleaning up sites. They are conducted at NPL and at non-NPL sites. Since 1980, EPA has started more than 3,600 short-term removal actions at 3,167 non-NPL sites (238 actions at 191 non-NPL Sites in FY 1998 alone, excluding federal facilities). These short-term responses address an immediate threat posed by the uncontrolled release of a hazardous substance, such as from a newly discovered dump, transportation accident, or fire. Early actions also are a part of the overall removal action phase of site cleanup. Early actions are similar to removals but are usually non-time critical and can be performed under removal or remedial program authority. An example of an early action is implementing interim controls to contain/stabilize a plume of contamination in groundwater. Sites that require a long-term, permanent cleanup remedy become part of the remedial action pipeline and enter the remedial phase of cleanup. These sites represent circumstances where the risk to human health and the environment also warrants placing the site on the NPL. Once a site is listed on the NPL, EPA works with responsible parties, the community, and other stakeholders around the site to plan the long-term cleanup with a detailed study of the site and an evaluation of cleanup options. The planning process can take up to four years with an average cost of $ 1.4 million per site. The actual cleanup (construction) work itself averages between $12 and $13 million per site. Because of the high cost of construction and limited Superfund resources, EPA's Superfund Enforcement and compliance assurance program emphasizes compelling PRPs to conduct a majority of the cleanup actions and to reimburse the federal government for cleanup actions financed by the Trust Fund. PRPs currently fund approximately 72% of new remedial actions at NPL sites. EPA's FY 1998 Annual Financial Statements Page 49 ------- While Superfund responsibilities cannot be delegated, at some sites the state or local government or Indian tribe takes the lead in managing the site cleanup. At other sites, the state or local agency cooperates with EPA on handling a site cleanup. Superfund Federal Facilities Program Description Across the country, thousands of federal facilities are contaminated with hazardous waste, unexploded ordnance, radioactive waste, fuels and a variety of other toxic contaminants. These facilities include many different types of sites, such as abandoned mines, nuclear weapons production plants, fuel distribution areas, and landfills. The Superfund Federal Facilities Response Program is responsible for providing oversight of Superfund environmental restoration work at federal facilities on the NPL. At the end of FY 1998, there were 162 proposed and final federal facility NPL sites. Brown fields Program Description Through its Brownfields Program, EPA's Outreach and Special Projects Staff (OSPS) promotes cleanup and redevelopment of abandoned and contaminated industrial and commercial properties (Brownfields). Across the country Brownfields sites plague virtually every community in the Nation. The Administration believes strongly that environmental protection and economic progress are inextricably linked, and has designed a comprehensive program based on community empowerment and strong partnerships among all stakeholders. The initial Brownfields Action Agenda outlined four key areas for returning Brownfields to productive reuse: 1) awarding Brownfields Assessment Demonstration Pilots, 2) building partnerships and expanding outreach, 3) clarifying liability and cleanup issues, and 4) fostering local workforce development and job training initiatives. In addition to these four key areas, EPA's new Action Agenda for FY 1998 and FY 1999 continues to focus on partnerships between EPA and fifteen other federal agencies. These partnerships are designed to leverage resources from nonprofit and private organizations, and eliminate duplicative efforts at the local level. EPA has established partnerships with nonprofit groups, such as the Trust for Public Land and the U.S. Conference of Mayors, and with private organizations, such as the Heinz Endowments and the James T. Irvine Foundation. These partnerships will further identify, strengthen, and improve the commitments EPA and its colleagues can make to Brownfields communities across the country. Sixteen Showcase Communities were selected to serve as models of Brownfields success as a result of these partnerships in FY 1998. In addition, 11 job training pilots were selected to enhance workforce development in Brownfields communities. Research Program Description Improved assessments of the potential threats to human health posed by each waste site is a goal prescribed by Superfund. Superfund research attempts to improve our understanding of the underlying science of exposure, risk assessment, and remediation. Risk management techniques are utilized to focus on the remediation of both surface and subsurface contaminated soils, sludge, sediments, and groundwater. The focus of Waste Management and Site Remediation research is groundwater treatment, bioremediation, and the Superfund Innovative Technology Evaluation (SITE) Program. These efforts involve fundamental research to understand the processes that influence soil and groundwater contaminants, the initiation of development and testing of new remediation methods, and process evaluation research to evaluate the cost-effectiveness of full-scale remediation technologies. Page 50 EPA's FY 1998 Annual Financial Statements ------- Enforcement and Compliance Assurance Program Description The Superfund Enforcement and Compliance Assurance Program seeks to maximize PRP participation in conducting and/or funding response actions while working to assure fair treatment for all PRPs. PRPs are financing approximately 72% of new remedial actions at NPL sites, thereby conserving the Superfund Trust Fund for sites at which there are no liable, viable responsible parties. Nationally, the Superfund Enforcement and Compliance Assurance Program is implementing a series of reforms to improve Superfund by increasing enforcement fairness and reducing transaction costs. These reforms include compensating settlors for a portion of the orphan share at a site; reducing PRP oversight, where appropriate; settling with small volume contributors of waste; and using special accounts which ensure that settlement funds will be dedicated to specific sites. Highlights and Accomplishments Financial Perspective At the end of FY 1998, the Trust Fund reflected an unappropriated balance of $2.1 billion. In FY 1998, Congress appropriated $1.5 billion for the Superfund Program. Superfund Response Program disbursements through FY 1998 total $16 billion. Parties responsible for contaminating Superfund NPL sites are conducting and paying for more of the cleanup work at their sites, reserving the Trust Fund resources for those sites where parties are unable to contribute. Approximately 72% of new remedial actions are now financed by PRPs. The Agency's goal is to maintain or increase that level of participation. Superfund Obligations by Location - FY 1998 74.5% Regions HQ-OSWER 17.0% HQ-All Others SUPERFUND Obligations - FY 98 Total Direct Obligations - $1.5 Billion Hazardous Substance Response 73.0% -3 DO/. R&D 8.9% Management 5.6% Hazardous Substance Response - Interagency 8.7% & Support Enforcement Much of the operational responsibility for direct Superfund activities resides in the EPA Regions. The chart depicts FY 1998 obligations broken out by Regions, Headquarters (HQ)-OSWER, and HQ-All Others. The line chart depicts Superfund financial trends from FY 1993 through FY 1998. The appropriation line reflects new obligational authority only and does not include prior year carryover of appropriations. Appropriations for Superfund, as specified in the appropriating language, are No- Year Appropriations which are available for obligation without fiscal year limitation. They remain available until expended, rescinded, or otherwise withdrawn. In FY 1998, EPA processed almost $1.5 billion in direct obligations (against appropriated funds) and $72 million in reimbursable obligations. Superfund Superfund Financial Trends Millions of$ 1,650 1,600 1,550 1,500 1,450 1,400 1,350 1,300 1,250 FY94 FY96 FY98 FY95 FY97 As part of measuring the impact of site cleanup efforts, EPA established Environmental Indicators for the Superfund Program to document its progress in protecting people and the environment. These indicators serve to describe the condition of the environment before, during and after cleanup. There are three indicators: A, B, and C. Indicator A, Populations Protected, measures the program's efforts to protect people and the environment from immediate threats. The indicator measures the number of sites EPA's FY 1998 Annual Financial Statements Page 51 ------- and people served by the following actions at NPL and non-NPL sites: site security, populations relocated, alternate water supplied, and immediate actions (removals). Indicator B, Progress Toward Cleanup, measures the program's incremental progress to clean up sites and to address persistent threats. The indicator measures sites where cleanup goals as listed in the ROD have been fully, or partially achieved; sites with direct contact threats addressed; and possible site candidates for partial deletions. Indicator C, Cleanup Technologies Applied, measures the program's efforts to apply appropriate or innovative treatment and containment technologies to clean up sites. The indicator measures the following at NPL and non- NPL sites technology counts, organized by treatment and containment, and volumes of wastes handled as a result of using these technologies. By combining the level of goal attainment with the volume of waste handled, the public can achieve a better sense on the extent of work that needs to be done to make them safe from pollution at the site. These Environmental Indicators show that in FY 1998 EPA continued making progress in hazardous waste cleanup. Data gathered through June 1998 shows that Superfund continues to fulfill its environmental mission and is gradually reducing the risks to human and ecological health posed by dangerous chemicals in the air, soil, and water. Through 1991, cleanup systems had been constructed and completed at a total of 61 Superfund NPL sites. By the end of FY 1998, more than nine times that number, 568 non-federal facility sites, have been completed. There were 84 non-federal facility construction completions in FY 1998. In addition, assessment and cleanup is now underway at 663 sites on the NPL. The Superfund Program addresses both immediate threats to populations living near hazardous waste sites as well as long-term cleanup actions at these sites. To address immediate threats, short-term (removal) actions often are taken to control critical situations and ensure the safety of communities until long-term (remedial) actions can remove or permanently clean up hazardous contamination. The critical actions that Superfund takes to protect public health are: ~ Emergency removals of contaminated materials or media; ~ Permanent and temporary alternative drinking water supplies; ~ Permanent and temporary population relocation; ~ Institutional controls (deed restrictions, restrictions on fishing); and ~ Site security (including fences and guards) to restrict access to the site. The Superfund Program has conducted response actions (remedial or removal) at 3,019 non-NPL sites to ensure the safety of the surrounding community from critical emergencies caused by hazardous waste. Since inception of the Superfund Program in 1980, EPA has achieved all cleanup goals for all media (groundwater, soil, surface water, etc) at 179 sites. In addition, the Agency has achieved all cleanup goals for at least one medium at 165 sites. Sites where all cleanup goals for all media have been achieved are candidates for deletion from the NPL. At some sites, remediation of specific media is fully completed before cleanup for the entire site is finished. When a medium at a site requires no further cleanup activity, the site is a candidate for partial deletion. Through June 1998, the Superfund Program has supplied over 350,000 people at NPL and non-NPL sites with alternative water supplies in order to protect them from contaminated groundwater and surface water. Over 14,300 people at NPL and non-NPL sites have been relocated in instances where contamination posed the most severe immediate threats. To prohibit certain types of land uses at sites, institutional controls such as deed and fishing restrictions, have been implemented at over 800 NPL sites. Site security measures, such as fencing and guards, to restrict access have been implemented at over 560 NPL sites. Through June 1998, the Superfund program has cleaned over 132 million cubic yards of hazardous soil, solid waste, and sediment and over 341 billion gallons of hazardous waste liquid-based waste, groundwater, and surface water. Each year the program has increased the total number of Superfund sites that had their cleanup goals met through remediation activities. In the last seven years, the total number of NPL sites achieving all cleanup goals for at least one area of contamination has more than tripled. A great deal has been learned about the nature and extent of contamination, the risk to human health and the environment, and the technologies necessary to reduce the risks. With further development of Page 52 EPA's FY 1998 Annual Financial Statements ------- initiatives such as innovative technologies and presumptive remedies, the Superfund Program can make even greater strides in meeting the challenges of the future. The direct beneficiaries of Superfund cleanups are those people living in the vicinity of the cleanup sites. Indirect beneficiaries include those living further from the sites who might suffer degradation of their groundwater, drinking water, or air if these programs did not alleviate the risk of contamination before it became more widespread. Early action to contain impacted areas also lessens the potential liability of parties responsible for the contamination. During FY 1998, the Superfund Program spent approximately $6.5 million to respond to ongoing efforts to address methyl parathion misuse. This supplements past expenditures of $65 million spent in FY 1997 in Mississippi and Louisiana, and $19.1 million spent for the Lorain County, OH, and Detroit, MI, responses during FY 1994/95. EPA does not anticipate spending any resources on remediation in FY 1999. EPA is planning outreach and communication programs with pesticide applicators, the agricultural community, and residential and small business communities. For 1999, EPA is requesting $1 million for EPA regions to implement a multimedia initiative focusing on these issues. The regions will enlist the cooperation of manufacturers, distributors, producers, and state certification officials. The Superfund Program is working to ensure the most efficient, most protective response within limited resources. EPA continued its effort to protect human health and the environment through both the second and third rounds of Administrative Reforms. There were many noteworthy Administrative Reform achievements in FY 1998 which include: 1) archiving over 30,900 CERCLIS sites; 2) issuing notices of intent to delete clean parcels at one site and deleting clean parcels at 11 sites; 3) establishing Community Advisory Groups (CAGs) at 43 sites; 4) publishing CAG Guidance/Reference sheet in English and Spanish; 5) issuing final guidance on implementing the risk sharing initiative; 6) signing Memorandum of Agreement (MOA) for State/EPA cooperation with 11 states under the Voluntary Cleanup Program; 7) signing agreements with 12 states under the Integrated Federal/State/Tribal Site Management Program; 8) issuing annual progress report for the National Remedy Review Board; 9) issuing Technical Approach to Risk Assessment for planning, reporting, and reviewing risk assessments; 10) issuing final guidance on lead regulator for federal facilities; 11) conducting ongoing public outreach and mediation training; and 12) issuing final report documenting obstacles in awarding and utilizing Superfund resources for the State/Tribal Superfund Block Funding. Class regulatory deviations have been requested to fully implement this reform. Twelve pilots are underway. The successes realized throughout Superfund during FY 1998 place the Agency in a uniquely positive position to achieve and expand Superfund accomplishments in FY 1999. To meet the requirements of the Government Performance and Results Act (GPRA) of 1993, the Superfund Program established 11 goals to assess performance in its major program areas: response, enforcement, federal facilities, and Brownfields redevelopment. The goals will enable the program to align planning, budgeting, and accountability functions for better management for environmental outcomes. Performance Measures Under the Superfund Response Program's sub-objective Respond to Superfund Hazardous Waste Sites, by 2005, EPA and its state, tribal, and federal partners will reduce the risks that Superfund sites pose to public health and the environment by: completing construction at a total of 1,200 NPL sites; conducting 2,400 additional removal actions; determining if Superfund cleanup is needed at 85% of the sites entered into the Superfund site data base (CERCLIS); maximizing PRP participation in conducting/funding response actions; and meeting statutory deadlines for federal facility activities. EPA will collaborate with states and Indian tribes to enhance the federal, state, and tribal Superfund program, reduce overlap among the programs, and leverage public and private resources to promote cost-effective, efficient cleanups of Superfund sites. EPA's FY 1998 Annual Financial Statements Page 53 ------- Under this sub-objective, three key performance measures were developed which are measurable and quantifiable. The performance measures are: ~ Site Assessment: The number of final Superfund site assessment decisions to: place a site on the NPL; defer a site to another federal program, state, or tribe for action under their legal authority; take no further remedial action at a site based on current information; or aggregate a site into an existing NPL site. In FY 1998, the Superfund Response program made 471 site assessment decisions. ~ Removal: The number of removal response action starts per year. In FY 1998, the Superfund Response program conducted 286 removal response actions. ~ Construction Completions: The number of construction completions per year (this represents all program accomplishments, including federal facilities). In FY 1998, the Superfund Response Program achieved 87 construction completions for a total of 585. The purpose of this section of the financial statements is to relate program performance to Trust Fund expenditures. Since the funds used to clean up federal facility sites do not come from the Trust Fund, accomplishments attributable to EPA's Federal Facilities Program have been excluded from this section. OSWER has used the following five performance measures for assessing the success of the Superfund Program during FY 1998. Cleanup: For site cleanup we measure not only the completion stage but also the critical steps in the cleanup process. Because the cleanup process can take a number of years, it is important to look at the "pipeline" of activities to get an accurate sense of progress. Note that in Cleanup/Response Measures 1-5, the cumulative totals reflect current information and methodology refinements and may not reconcile with previous annual reports. Part of this difference in comparing cumulative totals is attributable to the conversion of a site from Fund-lead to state-lead and the point in time when that conversion is captured in the state and Agency systems. Cleanup/Response Measure 1: Number of non-federal sites on the NPL where EPA has started the first cleanup or investigation compared to the total number of non-federal sites on the NPL. Activities captured under this measure are short-term removal actions and the remedial investigation/feasibility study which assesses the nature and extent of contamination at the site and analyzes cleanup alternatives so that a remedy can be selected. Results: In FY 1998, EPA started the first cleanup or investigation at nine sites. Cumulative performance to date is 1,181 cleanups or investigations begun compared to 1,265 non-federal NPL sites. The number of cleanups started to decline in FY 1991, relative to earlier years, as the Superfund Program's emphasis shifted to the later stages of the cleanup effort needed to complete work at a site. Also, cleanup has begun at nearly all sites on the NPL. The remaining sites have been evaluated for immediate threat, even though cleanup action has not yet begun. Cleanup/Response Measure 2: The number of non-NPL sites with hazardous releases where EPA has begun a cleanup action. Sites with confirmed hazardous releases, which do not score high enough to be included on the NPL or where an emergency exists, are eligible for a short-term Superfund removal action if they meet certain regulatory criteria. This measure counts the number of sites where EPA has started a removal action. Results: In FY 1998, EPA began cleanup actions at 191 non-NPL sites, bringing the total number of sites addressed through such actions since program inception to 3,167 non-NPL sites. Page 54 EPA's FY 1998 Annual Financial Statements ------- Cleanup/Response Measure 3: The number of non-federal sites on the NPL where EPA made a decision about how to proceed with the cleanup of at least a significant portion of the site compared to the total number of non- federal sites on the NPL. Activities counted under this measure include the documentation of how to proceed with the remedial action — the signing of a Record of Decision (ROD) — or the documentation of the selection and authorization of a removal — an Action Memorandum. The ROD identifies the remedy that has been chosen for remediating the site (or a portion of the site) and summarizes the site problems, the alternative remedies considered, and the public's involvement in the decision. The Action Memorandum substantiates the need for removal action, identifies the proposed action, and explains the rationale for the particular type of removal action selected. Results: EPA made cleanup decisions for 26 sites in FY 1998, resulting in a total to date of1,049 sites of the 1,265 non-federal sites on the NPL. Cleanup/Response Measure 4: Number of non-federal sites on the NPL where EPA completed remedial action for at least a significant portion of the site compared to the total number of non-federal sites on the NPL. This measure counts those NPL sites (or portions thereof) which have progressed through the remedial action phase. At this stage, the construction work to implement the remedy is complete, and EPA has conducted a final inspection to determine that the remedy is functioning properly and performing as designed. As indicated above, a site may have more than one remedial action. Results: In FY 1998, 32 sites (or significant portions thereof progressed through the Remedial Action cleanup phase. This brings the total number of such sites to 502 of the 1,265 non-federal sites on the NPL. Cleanup/Response Measure 5: The number of non-federal sites on the NPL where cleanup construction is completed compared to the total number of non-federal sites on the NPL. This measure counts the sites for which EPA has declared cleanup construction complete. Sites qualify for construction completion when: ~ any necessary physical construction is complete whether or not final cleanup levels or other requirements have been achieved, ~ EPA determines that the response action does not involve construction, or ~ the site qualifies for deletion from the NPL. Additional clarification on the definition of site cleanup is described in the Federal Register, March 2, 1993. Results: During FY 1998, EPA completed cleanup at 84 non-federal facility sites. The continuing cumulative increases in completions reflect management's increasing focus on completions, the maturing of sites already in the pipeline, and the streamlining of documentation requirements. Cumulative results for the program to date are 568 sites with cleanup construction completed of the 1,265 non-federal sites on the NPL. OECA has used the following five enforcement/cost recovery performance measures for assessing the success of the Superfund Enforcement and compliance assurance program during FY 1998. Enforcement: In FY 1998,EPA's enforcement and compliance assurance program continued seeking settlement with those parties potentially responsible for contaminating Superfund sites and pursuing recovery of monies EPA expended from the Trust Fund. EPA's FY 1998 Annual Financial Statements Page 55 ------- Under the Enforcement Program's sub-objective, EPA will continue to maximize the participation of potentially responsible parties in conducting/funding response actions at Superfund sites while promoting fairness during the enforcement process. Based on the urgency of the situation and/or the capabilities of the PRPs, EPA will optimize PRP removals. More than 70% of the long-term cleanup actions are now financed by PRPs, and EPA's goal is to maintain or increase that level of participation. EPA will do this through orphan share compensation, de minimis settlements, cash-out, mixed funding, mixed work, alternative dispute resolution, ability-to-pay settlements, PRP oversight, and interest bearing special accounts where applicable. At sites where EPA decides to issue unilateral administrative orders (UAOs), EPA will issue, or document non-issuance of UAOs, to 100 percent of non-settling parties (except UAOs for time critical or emergency removal actions). In addition, EPA will address cost recovery at 100 percent of all NPL and non-NPL sites with total past costs equal to or greater than $200,000 which need to be addressed prior to the expiration of the Statute of Limitations (SOL). Under this subobjective the following performance measures were developed which are measurable and quantifiable: ~ Maintain 70% PRP participation in the long-term cleanup actions: In FY1998, approximately 72% of new remedial action starts at NPL sites were initiated by potentially responsible parties. ~ Orphan Share Offers: In FY 1998, EPA made offers at all eligible RD/RA and removal sites. ~ De Minimis Settlements: In FY 1998, EPA negotiated 34 de minimis settlements to resolve the potential liability of over 2,200 small parties. ~ Cost Recovery: Address cost recovery at all SOL sites with total past costs > $200K. In FY 1998, EPA addressed all of the FY 1998 SOL cases (where past costs exceeded $200,000) prior to the expiration of the SOL. ~ Prospective Purchaser Agreement Requests Assessed: EPA signed 24 Prospective Purchaser Agreements in FY 1998. The Superfund Enforcement Program used the following five enforcement/cost recovery performance measures for assessing the success of the program during FY 1998. Cleanup/Enforcement Measure 1: The number of enforcement actions taken at NPL sites to have PRPs conduct or participate in response activities compared to the total number of sites on the NPL. The percentage and estimated value of PRP commitments to response activities at non-federal facility sites on the NPL. This measure counts the number of legal actions taken to involve PRPs in site study and cleanup at NPL sites (including proposed sites). This measure includes all administrative and judicial settlements, judicial actions, and administrative orders for removals, site studies, and remedial design and remedial actions (RD/RA). It includes those instances where parties have voluntarily entered into a settlement, as well as those instances where unilateral enforcement order authority was used to compel PRPs to conduct work and the PRPs have agreed to comply with the order. Results: During FY 1998, 110 enforcement actions for site study and cleanup were taken at 88 sites on the NPL. 63 of these actions were settlements for RD/RA (37 consent decrees referred to the Department of Justice (DOJ) and 26 unilateral administrative orders in compliance). Since the inception of the Superfund Program, PRPs have committed to conduct site response at 856 sites (68%) of the 1,265 non-federal facility sites on the NPL, with an estimated cumulative value of over $11.6 billion. In FY 1998, PRPs committed to conduct response work at 88 (7%) of the 1,265NPL sites, with an estimated value of approximately $694 million. Cleanup/Enforcement Measure 2: The total value of cost recovery settlements and judicial actions achieved. This measure provides the amount of cost recovery that has been achieved to date. A number of factors limit EPA's ability to recover its past costs. The first limitation is that EPA only can recover money that has been spent. A significant Page 56 EPA's FY 1998 Annual Financial Statements ------- portion of EPA's budget is obligations for future years. These funds will be eligible for cost recovery after they are actually expended. EPA's ability to recover money that has been spent is also limited. A number of factors, including bankruptcy of PRPs, other litigation concerns, the inability to identify financially viable PRPs, and the exclusion of certain indirect costs make 100% cost recovery not realistic. Results: Through FY 1998, EPA has achieved settlement for approximately $2.4 billion with $230 million of this amount achieved in FY 1998 and is seeking an additional $1.8 billion in ongoing cost recovery actions. EPA has been very effective in addressing past costs for Statute of Limitation (SOL) cases at sites where the past costs exceeded $200,000. The SOL requires EPA to address cases by certain dates. EPA addresses these cases by negotiating a settlement, referring the case to DOJfor trial, or writing the case off when no financially viable PRP can be found. In FY 1998, the number of cost recovery cases addressed was 194 with a total value of $378 million. EPA addressed all of the FY 1998 SOL cases (where past costs exceeded $200,000) prior to the expiration of the SOL. Cleanup/Enforcement Measure 3: The amount of money EPA has collected from PRPs compared to the total amount achieved in cost recovery settlements and judicial actions. This compares the total value of cost recoveries, penalties, and damages collected to-date to the total amount of cost recoveries achieved through settlements and judicial actions. There is frequently a delay between the date the settlement is reached (the day cost recovery is considered to be achieved) and the date the funds are collected. Delays are not uncommon because of the time required to file the necessary documents with the courts, and because in some cases settlement payments are received in installments. As a result, settlements may be reached in one fiscal year, and the settlement payment collected in a later fiscal year. Results: In FY 1998, the Agency collected approximately $320 million in cost recovery and reached settlements for the recovery of $230 million. Since the inception of the program, the Agency has collected approximately $2.1 billion in cost recoveries. This represents approximately 87% of the total value of cost recovery settlements (approximately $2.4 billion) reached by the program to-date. Cleanup/Enforcement Measure 4: The estimated amount of money PRPs have committed legally to site cleanup compared to the total amount of funds obligated by the Superfund Enforcement and Compliance Assurance Program. This measure compares the estimated dollar value of cleanups PRPs have agreed to perform at NPL and non-NPL sites to the enforcement obligations EPA has incurred achieving settlements. The estimate of the value of PRP work to be performed is derived from sources such as the Record of Decision, the Remedial Design, enforcement settlement document (i.e., Administrative Order on Consent [AOC], Unilateral Administrative Order [UAO]), or other relevant source (i.e., Action Memorandum, Engineering and Evaluation Cost Analysis). The estimate of PRP work to be performed is then compared to the amount of funds obligated from the Trust Fund for enforcement activities. This provides an order-of- magnitude contrast between EPA and DOJ enforcement obligations versus the estimated value of private party settlements for site response (recognizing that the actual outlay of funds by PRPs may take place over several years). The resulting ratio is a measure of enforcement effectiveness. Results: In FY 1998, the Agency reached settlements with PRPs valued at over$l billion ($806 million in response settlements and $230 million in cost recovery settlements) for NPL and non-NPL sites. EPA's FY 1998 enforcement obligations (including DOJ obligations) were $173.5 million. The resulting ratio of approximately 6 to 1 indicates that PRPs have committed approximately $6 for every dollar obligated for Superfund enforcement. This ratio varies from year to year for a variety of reasons, such as the number and/or value of the settlements completed in a given year. Over the life of the Superfund Program, the Agency reached settlements with an estimated value of $15.5 billion ($13.1 billion in response settlements and $2.4 billion in cost recovery settlements) for NPL and non-NPL sites. EPA's EPA's FY 1998 Annual Financial Statements Page 57 ------- enforcement obligations over this period were approximately $2.3 billion. The resulting ratio of approximately 7 to 1 indicates that PRPs have committed $ 7 for every dollar obligatedfor Superfund enforcement. Cleanup/Enforcement Measure 5: The number of de minimis settlements, potential value of these settlements, and the estimated number of settlors. EPA continues to seek enforcement fairness by entering into de_ minimis settlements with PRPs who have contributed only a very small amount of waste to a site. EPA may consider parties who have contributed only a small amount of waste to a site to be de_ minimis parties if their contribution of waste is minimal compared to the other waste at the site. In recognition of their relatively small contribution of waste, and to help ensure that these de_ minimis parties do not get drawn into lengthy and expensive private party lawsuits, EPA may offer a special type of settlement to these parties known as a de minimis settlement. Although the amount a de_ minimis settlor may pay varies from site to site, in general, the amount paid in the settlement is a combination of a basic payment (based on cleanup costs and waste contribution by the de_ minimis party) and a premium payment. This measure counts the total number of administrative and judicial settlements reached with PRPs that qualify as de minimis settlors under Section 122(g) of SARA. This measure also counts the potential value of these settlements and the estimated number of settlors. Results: In FY 1998, the Agency achieved 34 de_ minimis settlements valued at approximately $60 million with over 2,200 de minimis settlors at 26 sites. Through FY 1998, the Agency achieved over 400 de_ minimis settlements with over 18,000 settlors. Superfund Federal Facilities In FY 1998, there were 162 NPL federal facilities. The program started 31 Remedial Investigation and Feasibility Studies, signed 81 Records of Decision, started 60 Remedial Actions, completed 68 Remedial Actions, started 47 Removals, and completed 46 Removals. By the end of FY 1998, 17 federal facilities achieved site construction completions. Brownfields Brownfields Pilots are Encouraging Redevelopment Through Site Assessment The Brownfields Assessment Demonstration Pilots form a major component of the Brownfields Action Agenda. EPA increased the number of site assessment pilots to a total of 227 at the end of FY 1998. Grantees may use up to $200,000 for site characterization, site assessment, and site inventory work. These activities help communities determine if a property is contaminated and the extent of the contamination. Brown fields Revolving Loan Fund Pilots Boost Cleanup The Brownfields Revolving Loan Fund (BRLF) Pilots enable eligible states, cities, towns, counties, territories, and Indian tribes to capitalize revolving loan funds to safely cleanup and sustainably reuse Brownfields. In FY 1997, EPA awarded 23 demonstration pilots to Brownfields site assessment demonstration pilot "graduates." In FY 1998, EPA was restricted from signing cooperative agreements to capitalize BRLFs. This restriction has been lifted for FY 1999. Brown fields National Partnership Leverages Resources ~ The Brownfields National Partnership represents a $300 million investment in Brownfields communities including more than 100 commitments from more than 15 federal agencies. This Partnership will help communities cleanup and redevelop up to 5,000 properties by leveraging $5 billion in public funds to attract $28 billion in private investment. Page 58 EPA's FY 1998 Annual Financial Statements ------- ~ The Centerpiece of the Brownfields National Partnership was the selection of 16 Brownfields Showcase Communities in FY 1998. Showcase Communities serve as national models to demonstrate successful public-private partnerships in support of the Brownfields Program. ~ Federal resources include additional Brownfields pilots from EPA; redevelopment funds from Housing and Urban Development (HUD) and Economic Development Administration (EDA); job training efforts by Labor, Health and Human Services (HHS), Education, and Veterans Affairs. Supported Department of Treasury's Efforts on Brown fields Tax Incentive This three-year tax incentive plan will reduce the cost of cleaning up thousands of contaminated, abandoned sites in economically distressed areas. It is anticipated that this $1.5 billion tax incentive will leverage more than $6 billion in privately funded cleanups at an estimated 14,000 Brownfields sites. Local Job Training Efforts Support Brown fields Pilot Communities Through its cooperative agreement with EPA, the Hazardous Materials Training Institute conducted workshops on how to implement environmental training programs in over 20 community colleges located near Brownfields pilot sites as of the end of FY 1997. These workshops enable local communities to participate in the cleanup process. In FY 1998, EPA selected 11 job training pilots which are designed to enhance workforce development in Brownfields communities. Released Draft Voluntary Cleanup Guidance To encourage partnerships with states and tribes, EPA issues draft guidance to promote state voluntary cleanup programs. The draft guidance sets out baseline criteria that EPA will use to evaluate state voluntary cleanup programs. In FY 1998, EPA funded cooperative agreements with approximately 45 states to support new and existing state voluntary cleanup programs. Sponsored Sixth Annual EPA Teachers Institute at Morgan State University Experts taught over 40 teachers from across the U.S. how to be effective community advocates. These teachers live or teach near contaminated property in minority or disadvantaged neighborhoods, representing over 20 Superfund and Brownfields sites. Building Tribal Capacity In FY 1998, EPA funded a cooperative agreement with the Tribal Association on Solid Waste and Emergency Response. The Association uses the funds to build tribal capacity and assist tribes in establishing and managing their environmental programs. Furthermore, EPA continued to provide technical and financial assistance to the four tribal integrated waste pilots, and selected six tribal applications for Brownfields assessments. Brown fields Success Stories In Emeryville, CA, $644 million in private investment has been leveraged so far, while 10,600 jobs are expected to be created over the next five years. Local tax coffers have increased by $6.4 million as a result of their Brownfields Pilot and other public and private activities. Dallas, TX, enjoys new prosperity, thanks in part to its Brownfields efforts. Private investment has increased $43.5 million through $8.4 million leveraged by the public sector. Tax base improvements reflect a $32 million increase, with 163 jobs created so far and 700 jobs total anticipated. Sports figure Larry Johnson donated $1 million to create a youth activity center on a Brownfields site in his old neighborhood. EPA's FY 1998 Annual Financial Statements Page 59 ------- Bridgeport, CT, a community devastated by high unemployment and a lack of economic vitality, is turning itself around with the help of its EPA Brownfields demonstration pilot and other state and federal agencies. At this very early stage in its cleanup and redevelopment process, Bridgeport has already attracted $ 15 million in private investment and $ 13 3 million in public investment. This investment has created 400 jobs and led to a $250 thousand increase in the tax base. Research Improving Science Through Waste Management and Site Remediation Research ~ EPA completed the SITE Annual Report and submitted it to Congress in September 1998. This report is required in the SARA legislation, which authorizes the SITE Program. ~ The Agency and its external research partners completed a draft project report that covers performance aspects of RCRA-compliant waste containment facilities, focusing on hydraulic containment, physical stability, and long-term performance, and will be published under EPA title in 1999. Reducing Uncertainties Through Waste/Site/Risk Characterization Research ~ The Agency developed research results and reports on how to evaluate the toxicological properties of complex mixtures of contaminants, along with an upgrade of the Exposure Factors Handbook. These references will provide up-to-date scientific data on key characteristics of potentially exposed populations. ~ EPA produced research results on innovative geophysical characterization technologies for determining subsurface structure and location of contaminants, especially non-aqueous phase liquids (NAPLs). These new technologies permit more rapid and cost-effective characterizations and subsequent cleanups of Superfund and other hazardous waste sites. Enforcement Parties responsible for contaminating Superfund sites continue to conduct and pay the cost of cleanup, preserving the Trust Fund monies for those sites where parties are unable to contribute. While implementing previous Administrative Reforms, EPA continues to improve the Superfund Enforcement and Compliance Assurance Program. Policy for Municipality and Municipal Solid Waste CERCLA Settlements at NPL Co-Disposal Sites (February 5, 1998) This document states EPA's continued policy of not generally identifying generators and transporters of municipal solid waste (MSW) as potentially responsible parties at NPL sites. In recognition of the strong public interest in reducing contribution litigation, however, the policy identifies a settlement methodology for MSW generators and transporters who seek to resolve with the U.S. their CERCLA liability, thereby protecting themselves from third party litigation. In addition, the MSW policy identifies a presumptive settlement range for municipal owners and operators of co-disposal sites on the NPL who desire to settle their Superfund liability. This policy is intended to reduce transaction costs, including those associated with third party litigation, and to encourage global settlements at sites. Memorandum of Understanding among the Environmental Protection Agency. United States Coast Guard. Department of Commerce. Department of the Interior. Department of Agriculture. Department of Defense. Department of Energy, and Department of Justice Concerning the Exercise of Authority under Section 106 of the Comprehensive Environmental Response. Compensation, and liability Act (February 10. 1998) In addition to EPA and the Coast Guard, other federal agencies have significant responsibilities and substantial programs for responding, or requiring others to respond, to releases and threatened releases of hazardous substances. Such agencies include the Departments of Agriculture, Commerce, Defense, Energy, and Interior ("Federal Resource Managers"). The Page 60 EPA's FY 1998 Annual Financial Statements ------- Federal Resource Managers have been delegated the authority under Section 106 of CERCLA to issue administrative orders or seek judicial relief with respect to a release or threatened release of a hazardous substance affecting either natural resources under a Federal Resource Manager's trusteeship, or a vessel or facility subject to the Federal Resource Manager's jurisdiction, custody, or control. Federal Resource Managers are required to obtain EPA or the Coast Guard's concurrence before each use of Section 106 authority. Federal Resource Managers also are prohibited from using this authority at any vessel or facility where EPA or the Coast Guard is the lead federal agency for the conduct or oversight of a response action. This Memorandum of Understanding is intended to ensure that the signatories exercise their authority in a cooperative and integrated fashion, and in a manner to ensure interagency coordination that enhances efficiency and effectiveness. Fact Sheet: Using Supplemental Environmental Projects to Facilitate Brownfields Redevelopment (Issued September 1998) In April 1998, EPA issued the final "Supplemental Environmental Projects (SEPs) Policy." In that policy, EPA encourages the use of SEPs in the settlement of environmental enforcement actions. In September EPA issued a fact sheet, entitled "Using Supplemental Environmental Projects to Facilitate Brownfields Redevelopment," to address specifically the use of SEPs at Brownfields. The fact sheet explains how the legal requirements identified in the SEP Policy relate to SEPs performed at Brownfields, and describes the two categories of SEPs that are appropriate for use at Brownfields: environmental quality assessments and environmental restoration. The fact sheet includes an analysis of two hypothetical projects submitted for Brownfield sites. Guidance on Administrative Response Cost Settlements under Section 122 (h) of CERCLA and Administrative Cashout Settlements with Peripheral Parties under Section 122 (h) of CERCLA and Attorney General Authority (March 24, 1998) EPA and the Department of Justice (DOJ) jointly issued the CERCLA § 122(h) guidance and five model settlement documents. The guidance announces a new type of expedited "cashout" settlement for "peripheral parties." Peripheral parties are those parties who, although not technically de minimis or de micromis, are not the focus of CERCLA enforcement activities. They include ability to pay parties, parties for whom unresolved CERCLA liability is an "extreme burden," and other parties as defined on a case-by-case basis. For qualifying "peripheral parties," a "cashout" settlement that resolves the settlor's liability at the site is possible under the terms outlined in the guidance. The guidance and model agreements offer the possibility of increasing the efficacy and consistency of CERCLA administrative settlements nationally. Guidance for Implementing Superfund Reform Lnitiative 9a: Risk Sharing (March 24, 1998) Estimates of the eventual cost of cleaning up the Nation's hazardous waste sites highlight the need to support the development of more cost-effective cleanup technologies. PRPs are sometimes reluctant to implement new technologies due to concerns about having to "pay twice" if the innovative approach fails to achieve the required levels of cleanup. As part of the Superfund Reform Initiatives, EPA's guidance identifies a program designed to share the risk of using selected innovative technologies. The purposes of this initiative are: 1) to encourage the demonstration and use of innovative technologies with the potential to lower costs and/or improve performance at a particular site and at other Superfund sites, and to document these early applications to assist future selection of response actions; 2) to support developers of promising technologies, especially small businesses, by enhancing contracting opportunities with PRPs; and 3) to encourage PRPs to assume a more active role in the development of new technologies for site remediation. Superfund Oversight Billing Under Superfund, the Agency is required to monitor the cleanup of hazardous waste sites by responsible parties. Any oversight costs incurred by the Agency are recoverable from the responsible parties. In FY 1998, the Agency made billing of oversight a priority. EPA implemented actions to improve the management and timeliness of oversight billings and to become current in oversight billings by the end of the fiscal year. The Office of Site Remediation Enforcement (OSRE) and the Office of the Comptroller (OC) developed a methodology to resolve this issue and to improve oversight billing efficiency. EPA's FY 1998 Annual Financial Statements Page 61 ------- OIL SPILLS EPA's Oil Program is administered by the Office of Solid Waste and Emergency Response (OSWER) and uses the Oil Spill Liability Trust Fund (OSLTF) to finance the cost of cleaning up spills and damages in cases where the responsible party cannot or will not pay for the cleanup. OSWER's Office of Emergency and Remedial Response (OERR) provides assistance to Regional On-Scene Coordinators during oil spill incidents and for implementation of the Oil Program. Support for enforcement activities is provided by EPA's Office of Enforcement and Compliance Assurance (OECA). Oil Program Description The goal of the Oil Program, which is authorized by the Clean Water Act (CWA) and has been in effect for over twenty years, is to protect public health and the environment from hazards associated with a discharge or substantial threat of a discharge of oil or hazardous substances into navigable waters, adjoining shorelines, and exclusive economic zones of the United States. The program was strengthened by the Oil Pollution Act of 1990 (OPA) which was passed in response to increasing frequency and severity of accidental oil discharges into the environment, such as the Ashland Tank Collapse and the Exxon-Valdez spill. Under the CWA and OPA, EPA protects inland waterways through oil spill prevention, preparedness, response, and enforcement activities associated with about 450,000 non-transportation-related oil storage facilities. These facilities, which range from hospitals and apartment complexes storing heating oil to large tank farms, include any oil storage facility with a single aboveground storage tank larger than 660 gallons, total aboveground storage capacity greater than 1,320 gallons, or underground storage greater than 42,000 gallons. The Oil Program establishes requirements to prevent and prepare for spills at oil storage facilities subject to its regulations, and respond to all spills to inland waterways. EPA has established the regulatory framework under which it will proceed with its OPA-mandated responsibilities. This framework includes the Oil and Hazardous Substances National Contingency Plan (40 CFR Part 300); the Oil Pollution Prevention regulation or Spill Prevention, Control and Countermeasures (SPCC) regulation (40 CFR Part 112); and the Facility Response Plan (FRP) regulation. All regulated oil storage facilities must prepare SPCC plans. In addition, certain high-risk oil storage facilities must prepare Facility Response Plans (FRPs) to identify and ensure the availability of resources to respond to a worst case discharge, establish communications, identify an individual with authority to implement removal actions, and describe training and testing drills at the facility. In the event of a spill, the National Contingency Plan (NCP) is the Nation's blueprint for the federal response to releases of oil and hazardous substances. Both the revised NCP and FRP regulations were published in the Federal Register in mid-summer 1994. The OPA also requires area committees (comprised of state, local and federal officials) to develop Area Contingency Plans (ACPs). These plans detail the responsibilities of those parties involved in planning the response process, describe unique geographical features of the area covered, and identify available response equipment and its location. Current Oil Program prevention efforts focus on continued implementation of SPCC regulations. Preparedness efforts focus on periodic review of FRPs and on development of ACPs. Response efforts include monitoring or responding to all spills within the inland waterways. Headquarters efforts include strengthening the response infrastructure and policy and program guidance development for preventing harmful releases of oil and other petroleum products; improving nationwide capability to respond to threats of discharge of oil or other petroleum products; improving nationwide capability for containment and removal of releases Wisconsin Fire — Oil Spill Page 62 EPA's FY 1998 Annual Financial Statements ------- that occur in navigable waters; coordinating with other federal agencies on Facility Response Plan (FRP) requirements, review, and approval; minimizing the resulting environmental damage from releases; and fully utilizing enforcement authority to compel responsible parties to clean up spills, provide a strong economic incentive to invest in preventive measures, and comply with regulations. In addition, Headquarters supports field operations through operational guidance, technical bulletins, and demonstrations of new technologies. Headquarters also supports the OPA-mandated FRP process, chiefly through the development of approval criteria for the responsible parties. A major component of the regions' work is monitoring, directing, or performing oil spill cleanups. In addition to responding to oil spills, the EPA regions conduct oil storage facility inspections to ensure compliance with the SPCC regulations. EPA inspects hundreds of these facilities each year, including site visits and/or plan reviews. EPA regions also conduct periodic equipment inspections and unannounced area drills. The regions take administrative actions against facility operators for failure to comply with SPCC and FRP requirements, and refer a limited number of actions for judicial action. Administrative and judicial actions also are brought as a result of oil and hazardous substance spills. EPA regions also assist the Federal Emergency Management Agency (FEMA) at major disasters and participate in response training of state and local staff. The beneficiaries of the Oil Pollution Prevention Program are those people living in the vicinity of confirmed spills when cleanup actions are taken either by EPA, state or local responders, or the responsible party (RP). People living near regulated facilities benefit from the increased safety measures incorporated into the FRPs which quicken response time for spills and lessen the resulting environmental damage done by a spill. Research Program Description For the Agency's Oil Spill Prevention and Response Program, the Office of Research and Development conducts research on new approaches to cleaning up oil spills. As a member of the International Coordinating Committee on Oil Spill Research, as mandated by OPA, the Agency has primary responsibility for research on the use of bioremediation to remediate spilled oil, the use of dispersants and other chemical agents, mechanical cleanup on fast flowing streams, and debris disposal. Bioremediation is the primary focus. The goal of this research program is to provide the federal on-scene coordinators with the technical information they require to allow them to make decisions on the best cleanup procedure to be used on any given spill. Additionally, the information produced is required by EPA to periodically revise the NCP and its annexes. Enforcement and Compliance Assurance Program Description The Oil Spills Enforcement and Compliance Assurance Program's primary focus is petroleum storage facilities that fail to comply with oil pollution SPCC regulations and facility response plan requirements as well as those facilities which had a spill of oil or hazardous materials. The Agency's enforcement and compliance assurance program provides national guidance and direction in implementing enforcement, regulations, and strategies for civil, administrative, and criminal enforcement responses, including cost recovery and inspection issues; spill prevention penalty policies, and enforcement and compliance agreements with the U. S. Coast Guard. The program brings civil judicial enforcement case referrals and administrative actions against facilities for failure to comply with oil pollution SPCC regulations and with FRP regulations. The program also provides assistance to help facilities comply with these regulations. The enforcement and compliance assurance program will continue to maintain a strong presence. Since this is a federally run program, EPA will emphasize enforcement of the SPCC regulations and will work with the regions to streamline processes, where possible, for taking enforcement actions. In addition, EPA will develop an enforcement management system for CWA Section 311 violations. This system will set out the appropriate enforcement actions and timeframes. This infrastructure improvement will make this program more consistent with the other programs under the CWA. EPA's FY 1998 Annual Financial Statements Page 63 ------- Highlights and Accomplishments Financial Perspective Since the beginning of the Oil Spill Trust Fund's existence through FY 1998, Congress has appropriated a total of $125.2 million to the Agency. In FY 1998, EPA received a budget authority of $15 million to implement the Oil Pollution Prevention Program. In FY 1998, the Agency processed $16.4 million in direct obligations (against appropriated funds) and $25.4 million in reimbursable obligations for oil spill response activities and $16 million in net disbursements. Performance Measures Since last year, EPA has introduced a new Oil Program measure, "Facilities Brought Into Compliance", to reflect more accurately program accomplishments as required by the Government Performance and Results Act (GPRA). Measure 1: FRP Reviews, SPCC Inspections, and Facilities Brought into Compliance To ensure continued compliance with the OP A and consistency with the FRP regulation, EPA will continue to review FRPs on a periodic basis. This typically includes review of written plans, evaluation of response resources, communication with facilities, and site visits, leading to an overall evaluation of plan adequacy and facility preparedness. To ensure compliance with the prevention portions of the SPCC regulation, EPA conducts inspections of SPCC-regulated facilities each year. This typically includes review of written SPCC plans, interviews of facility personnel, and inspection of facilities and equipment on site. Facilitites brought into Compliance is a new measure, this is a transition year, but it will include verification of SPCC compliance by the facility as a result of the EPA interaction either through enforcement action or compliance assistance and outreach. Results: About 150 facilities received FRP approval in FY 1998, and a few additional facilities were identified or received approval since then. In FY 1998, EPA conducted about 750 reviews of Facility Response Plans. EPA regulates about 450,000facilities under the SPCC regulation. In FY 1998, EPA inspected about 1,060 SPCC-regulatedfacilities. Over 300facilities were brought into compliance in FY 1998. Measure 2: Oil Spill Cleanups and On-Scene Monitoring of Potentially Responsible Party (PRP) Lead Cleanups. This measure counts the number of oil spills cleaned up by EPA using OPA funds and the number of times EPA monitors cleanup actions done by state or local responders, or the RP. EPA monitors a cleanup when another party such as a state or local government, or the RP responds to the spill to ensure adequate cleanup takes place. Results: 127 oil spills cleanups were started in FY 1998 using OPA funds. EPA monitored 165 responsible-party oil spill cleanups in FY 1998. Since program inception through FY 1998, 418 oil spills have been cleaned up using OPA funds. For that same period, EPA monitored 1,487 responsible-party cleanups. Measure 3: Administrative Actions and Judicial Penalty Enforcement Actions for spill violations and prevention regulation violations. OIL SPILLS RESPONSE Obligations - FY 98 Total Direct Obligations - S16.4 Million Environmental Emergency Resp. & Prevention R&D V-5% J Support j) 3.8% Services 9.7% Enforcement Page 64 EPA's FY 1998 Annual Financial Statements ------- This measure counts the number of administrative and judicial enforcement actions resulting from prohibited spills and violations of the regulations of the CWA as amended by OPA. These two actions account for a significant portion of the resources used in the Oil Program and indicate significant achievements in compliance. An administrative complaint is counted on the date it is issued to the respondent. A judicial case is counted on the date of the referral letter/cover memo to the Department of Justice (DOJ). Results: 84 administrative cases were filed and 16judicial enforcement actions were referred to the DOJ in FY 1998. Improving Science Through Waste Management and Site Remediation Research The Agency continued efforts on the evaluation of screening tests for oil spill chemical countermeasures, including dispersant agents. This was used towards improving the protocols, thereby assuring better oil spill response decisions. EPA's FY 1998 Annual Financial Statements Page 65 ------- LEAKING UNDERGROUND STORAGE TANK Subtitle I of the Resource Conservation and Recovery Act of 1984 (RCRA) established a State-EPA program to prevent, detect, and clean up leaks from underground storage tanks (USTs). EPA estimates that there are about 900,000 regulated USTs buried at about 300,000 sites nationwide. Regulated USTs contain petroleum products (except heating oil for on-premise consumption) or potentially hazardous substances. Leaking underground storage tanks (LUSTs) can cause contamination of soil and groundwater, endangering human health and the environment. LUSTs may also ignite or explode. In 1986, to support LUST cleanup programs, Congress established the LUST Trust Fund, financed by a 0.1 cent tax on each gallon of motor fuel sold in the U.S. Taxing authority for the Trust Fund expired December 31, 1995, but Congress reinstated it on October 1,1997, with a new expiration date of March 31, 2005. As of the end of FY 1998, the Trust Fund had accumulated about $1.8 billion in taxes and interest (on unappropriated funds). Congress establishes the amount of the Fund that EPA may use by issuing annual and supplemental appropriations. Through FY 1998, the Congress appropriated $730.8 million to EPA, 87% of which was provided to the states. At the end of FY 1998, the Trust Fund reflected a balance of $1.2 billion, a portion of which is available for future Congressional appropriation. LUST Program Description EPA supports state programs through cooperative agreements funded by the LUST Trust Fund. States use LUST Trust Fund dollars largely to administer their corrective action programs, oversee cleanups by responsible parties, and undertake necessary enforcement actions. States also may use the Trust Fund money to pay for cleanups in cases where a responsible party cannot be found or is unwilling or unable to pay for a cleanup. Such cases have accounted for less than 1 % of all LUST releases. Research Program Description Research to support the LUST Program is authorized under Subtitle I of the Hazardous and Solid Waste Amendments of 1984, as amended by the Superfund Amendments and Reauthorization Act of 1996. The Office of Research and Development conducts research on new approaches for leak detection and remediation at LUST sites. This includes identifying information needed on the subsurface environment, released petroleum products therein, and how the information can be used to select appropriate corrective action technologies. Technical support is provided to the Office of Underground Storage Tanks, EPA regions, state and local agencies, and practicing professionals implementing the LUST Program. This effort includes providing scientific expertise on low-cost approaches for the assessment of site contamination and evaluation of remedial technologies. Enforcement and Compliance Assurance Program Description The LUST Enforcement and Compliance Assurance Program continues to target responsible parties to finance or conduct corrective actions. Agency staff provides assistance to state personnel to enhance voluntary compliance with corrective actions and financial responsibility requirements. Page 66 EPA's FY 1998 Annual Financial Statements ------- Highlights and Accomplishments Financial Perspective In FY 1998, EPA obligated approximately $65 million to implement the LUST Program. The Office of Solid Waste and Emergency Response (OSWER) supported the LUST Program by obligating $62.1 million, while approximately $2.9 million was obligated by non-OSWER offices in Headquarters and the Regions. Responsible parties conducted nearly all of the cleanups with state oversight. Guidelines & Implementation 95.4% LUST Obligations - FY 98 Total Obligations - $65 Million 1.0% 0 7% Enforce- L 2.9% ment R&D Protecting Human Health and the Environment Through Cleanups Management & Support Under the supervision of state or local agencies (or EPA in Indian country), UST owners and operators undertake nearly all corrective action. EPA's performance goal for the LUST cleanup program is to ensure that UST releases are detected and cleaned up promptly and cost effectively to protect human health and the environment. Progress in the LUST Program is measured by comparing the number of cleanups initiated and cleanups completed to the number of confirmed releases. Cumulatively, through FY 1998, there were 371,387 confirmed releases; 314,965 cleanups initiated; and 203,247 cleanups completed. For FY 1998, EPA's performance goals were to initiate 24,000 cleanups and complete 20,000 cleanups. During FY 1998, 29,614 LUST releases were confirmed; 22,519 cleanups were initiated; and 24,950 cleanups were completed. Indian Country Through FY 1998, the cumulative total of LUST activity on Indian lands came to 1,024 confirmed releases, 767 cleanups initiated, and 427 cleanups completed. EPA anticipates that it will take several more years to clean up all known and undiscovered releases in Indian country. In collaboration with tribes, EPA is developing a risk-based corrective action (RBCA) process for LUST sites in Indian country. Improving Science Through Waste Management and Site Remediation Research EPA provided recommendations on improvements to the risk-based corrective action (RBCA) approach to remediation option selection. These recommendations helped to insure optimal application of available LUST corrective action remediation alternatives. EPA's FY 1998 Annual Financial Statements Page 67 ------- PESTICIDES The Agency's Pesticides Program was established pursuant to the Federal Insecticide, Fungicide and Rodenticide Act (FIFRA) to protect public health and the environment. The law requires the Agency to balance public health and environmental concerns with the expected economic benefits derived from pesticides. The guiding principles of the Pesticides Program are to reduce risks from pesticides in food, the workplace, and other exposure pathways and to prevent pollution by encouraging the use of new and safer pesticides. In accordance with FIFRA and the Federal Food, Drug and Cosmetic Act (FFDCA), the Pesticides Program administers the Revolving Fund for Certification and Other Services (Tolerance Fund) and the Pesticides Reregistration and Expedited Processing Fund (FIFRA Fund). Tolerance Program Description As part of its authority to regulate pesticides, EPA is responsible for setting "tolerances." If the pesticide is being considered for use on a food or feed crop or as a food or feed additive, the applicant must petition EPA for establishment of a tolerance (or exemption from a tolerance) under authority of the FFDCA. A tolerance is the maximum legal limit of a pesticide residue on food commodities and animal feed. Tolerances are set at levels that ensure that the public is protected from health risks posed by eating foods that have been treated with pesticides in accordance with label directions. In 1954, Congress authorized the collection of fees for the establishment of tolerances for raw agricultural commodities (Section 408 of FFDCA). Congress, however, did not authorize the collection of fees for food additive tolerances (Section 409 of FFDCA). EPA, therefore, does not collect fees for food additive tolerances. The Agency also does not collect fees for Agency-initiated actions such as the revocation of tolerances for previously canceled pesticides. Fees collected for tolerances for raw agricultural commodities were deposited to the U.S. Treasury General Fund until 1963 when Congress established the Tolerance Fund. Specific fees are contained in 40 CFR 180.33 and range from $3,725 to $65,600 depending on the type of tolerance action requested. Waivers and/or refunds are granted for minor use pesticides submitted under the Inter-Regional Research Project Number 4 (IR-4 Program), public interest, such as reduced-risk pesticides, and economic hardship. The fee schedule is changed annually by the same percentage as the percent change in the federal General Schedule (GS) pay scale. Fees were increased 2.45% in 1998. In 1996, the Agency supported pesticide reform legislation which included provisions for additional fees to support reregistration activities. Passage of the Food Quality Protection Act (FQPA) of 1996 requires tolerances to be reassessed as part of the reregistration program. Effective January 1997, all fees related to tolerance activities are deposited in the FIFRA Fund. Pesticide Reregistration Program Description As part of its authority to regulate pesticides, EPA is responsible for re-registering existing pesticides. The FIFRA legislation, requiring the registration of pesticide products, was originally passed in 1947. Since then, health and environmental standards have become more stringent and scientific analysis techniques are much more precise and sophisticated. In the 1988 amendments to FIFRA (FIFRA '88), Congress mandated the accelerated reregistration of all products registered prior to November 1, 1984. The amendments established a statutory goal of completing reregistration eligibility decisions by 1997. The legislation allows for various time extensions which can extend the deadline by three years or more. The current goal for the completion of reregistration is 2002. Congress authorized the collection of two kinds of fees to supplement appropriated funds for the program: an annual maintenance fee and a one-time reregistration fee. Maintenance fees are assessed on registrants of pesticide products and are structured to collect approximately $14 million per year. Reregistration fees are assessed on the manufacturers of the active ingredients in pesticide products and are based on the manufacturer's share of the market for the active ingredient. In fiscal years 1992 through 1998, approximately 14% of maintenance fees collected, up to $2 million each year, were used Page 68 EPA's FY 1998 Annual Financial Statements ------- for the expedited processing of old chemical and amended registration applications. Fees are deposited to the FIFRA Revolving Fund. By statute, excess monies in the FIFRA Fund may be invested. Waivers and/or refunds are granted for minor use pesticides, antimicrobial pesticides, and small businesses. In 1996, the Agency supported pesticide reform legislation which included provisions for additional fees to support reregistration activities. Passage of the FQPA of 1996 implements the following changes in the Pesticide Reregistration Program: reauthorizes collection of fees through 2001 to complete the review of older pesticides to ensure they meet current standards (increases annual fees from $14 million to $16 million per year for 1998, 1999, and 2000 only); requires tolerances to be reassessed as part of the reregistration program. Tolerance fees received will be deposited and reported in the FIFRA Fund. The reregistration process is being conducted through reviews of groupings of similar active ingredients called cases. There are five major phases of reregistration: ~ Phase 1 - Listing of Active Ingredients. EPA publishes lists of active ingredients and asks registrants whether they intend to seek reregistration. Completed in FY 1989. ~ Phase 2 - Declaration of Intent and Identification of Studies. Registrants notify EPA if they intend to reregister and identify missing studies. Completed in FY 1990. ~ Phase 3 - Summarization of Studies. Registrants submit required existing studies. Completed in FY 1991. ~ Phase 4 - EPA Review and Data Call-Ins (DCIs). EPA reviews the studies, identifies and "calls-in" missing studies by issuing a DCI. A "DCI" is a request to a pesticide registrant for scientific data to assist the Agency in determining the pesticide's eligibility for reregistration. Completed in FY 1994. ~ Phase 5 - Reregistration Decisions. EPA reviews all studies and issues a Reregistration Eligibility Decision (RED) for the active ingredient(s). A "RED" is a decision by the Agency defining whether uses of a pesticide active ingredient are eligible or ineligible for reregistration. The registrant complies with the RED by submitting product specific data and new labels. EPA reregisters or cancels the product. Pesticide products are re-registered, based on a RED, when it meets all label requirements. This normally takes 14 to 20 months after issuance of the RED. Research Program Description Pesticides research focused on providing scientifically valid, cost effective methods for evaluating risks associated with pesticide use, manufacture, and release into the environment. These research efforts included studying the effects of environmental stressors on human health and ecosystems, measuring the exposure of children to pesticides, elucidating the mechanisms of neurotoxicity, and assessing the immunotoxicity and reproductive toxicity risks presented by pesticides. The information developed from application of these methods will significantly improve our understanding of the extent of human exposure to specific pesticides. The Agency will incorporate these methods into its battery of testing guidelines under which industry will be required to submit data to the Agency on pesticides as regulated under FIFRA. In addition, efforts included research on agricultural and residential exposure and effects, with particular emphasis on research in support of the Children's Agenda, which included efforts to assess children's risk from exposure to pesticides and other toxins, and research on the special susceptibilities of infants and children from exposure to pesticides. The products of these research efforts are intended to support human and environmental risk assessments. Enforcement and Compliance Assurance Program Description The Pesticides Enforcement and Compliance Assurance Program focuses on problems relating to urban pesticide misuse, ineffective antimicrobial products, food safety, adverse effects, and pesticide worker safety protection. The enforcement and compliance assurance program provides compliance assistance to the regulated community through EPA's FY 1998 Annual Financial Statements Page 69 ------- seminars, guidance documents, brochures, and other forms of communication to ensure knowledge of and compliance with environmental laws. EPA's grant support to states' pesticides programs emphasizes pesticide worker protection standards, high risk pesticide activities including antimicrobials, pesticide misuse in urban areas, and the misapplication of structural pesticides. In FY 1998, states continued to conduct compliance monitoring inspections on core pesticides requirements. EPA will continue its commitment to maintaining a strong compliance and enforcement presence. Agency priorities for FY 1999 and FY 2000 include enforcement for products making illegal public health claims, including unregistered and ineffective products, such as ineffective hospital disinfectants; enforcement of worker protection standards, including inspecting and enforcing against misuse violations and labeling requirements violations; and continued focus on urban pesticides control and enforcement. Highlights and Accomplishments Tolerance Performance Measures Tolerance fees collected in FY 1998 were approximately $1.6 million and obligations were $2.5 million. Measure: Tolerance re-evaluations. Results: In FY 1998, EPA set 258 tolerances and exemptions from tolerance. Of these, 240 were for conventional pesticides, 16 were for biopesticides, and 2 were for antimicrobial pesticides. In FY 1998, 1,646 tolerances were re-evaluated, of which 821 were revoked, 486 reassessed as part of re registration, and 339 reassessed for registration actions.1 FOP A requires that EPA reassess within ten years over 9, 700 tolerances to ensure that the tolerances meet the federal safety standard of a reasonable certainty of no harm. In developing the reassessment schedule, EPA is placing a priority on pesticides that appear to pose the greatest potential risk to the public (these include organophosphate, carbamates, probable and possible human carcinogens, organochlorine pesticides, and high-hazard inert ingredients). Reregistration (FIFRA) Financial Perspective During FY 1998, the Agency's obligations charged against the FIFRA Fund for the cost of the reregistration and expedited processing programs were almost $18.2 million and 202 workyears. Of these amounts, the Office of Pesticide Programs obligated $16.8 million of this cost and funded the 202 workyears. Appropriated funds are used in addition to FIFRA revolving funds. In FY 1998, approximately $19.1 million in appropriated funds were obligated for reregistration and expedited processing program activities. The unobligated balance in the Fund at the end of FY 1998 was $15.5 million. This is a decrease of $500,000 compared to the FY 1997 year-end balance of $16 million. The Fund has two types of receipts: fee collections and interest earned on investments. Of the $ 17.2 million in FY 1998 receipts, approximately 96% were fee collections. The fee collections are slightly more in FY 1998 compared to FY 1997. PESTICIDES Obligations - FY 98 Total Obligations - $262.1 Million Generic Chemical Review 47.0%^^ ^ R&D ^\15.2% 3 .1% pL^io.1% 24.6% Registration, Special Program Implementation Registration, & Tolerances 1 A tolerance is considered scientifically reassessed and counted the day a RED or other decision document is signed, and in most cases when there is a revocation, the day the final rule is signed. A final FR notice to implement 698 of the 821 tolerance revocations was published in FY 1999 (October 26, 1998). Page 70 EPA's FY 1998 Annual Financial Statements ------- Reregistration Program (FIFRA) Performance Measures The following measures support the program's strategic goals of Food Safety and Safer Pesticides as contained in the FY 1998 President's budget. Measure 1: Number of Reregistration Eligibility Documents (REDs) completed. Results: The number of Reregistration Eligibility Decisions (REDs) completed was 13, a decrease of 10 from FY 1997 when 23 were completed. This decrease is the result of adapting the reregistration and tolerance reassessment process to the more stringent requirements realized with the passing of the FQPA. There are approximately 382 chemical cases (representing 3,822 chemicals), of which 184 REDs have been completed. Measure 2: Number of products reregistered, canceled, or amended. Approximately 19,000 products are subject to reregistration. Many products, however, contain more than one active ingredient. Since products are reassessed separately for each active ingredient, EPA will conduct approximately 38,000 product reviews. Results: FY 1998, 221 products were reregistered2, 53 were amended and 337 were cancelled. The combined 611 decisions were achieved versus a target of 750. In addition, 135 products were forwarded to the EPA Office of Compliance Monitoring for suspension. The cumulative totals at the end of FY 1998 were 2,020 products cancelled3, 109 products amended, and 1,152 products reregistered. Reducing Exposure through Human Health Protection Research ~ EPA completed analysis of data from the National Human Activity Patterns Survey (NHAPS). NHAPS addresses a vital human exposure research need by providing comprehensive activity and location information on a national level. In addition to providing robust data, NHAPS will be especially valuable to exposure modelers who previously had to rely on assumed exposure scenarios rather than on distributions of reported data. ~ EPA completed the National Human Exposure Assessment Survey (NHEXAS) pilot scale multipathway studies. These studies measured human exposures to multiple chemicals, and human exposures from multiple pathways and media, for representative population samples. These studies provide unique information on the ranges of actual exposures in the general population for use as benchmarks for site-specific investigations and for health risk assessments. ~ The Agency completed a peer-reviewed protocol for the Agricultural Health Study. A series of statistical design analyses were performed and a draft revised protocol was developed for internal review. From this study, farmer-applicators will be selected for exposure measurements and to determine the most significant exposure factors resulting from pesticides handling and application practices. Spouse and child biomarker measurements will be performed to measure the extent to which these practices result in exposure to applicator family members. 2 Product reregistrations include federally registered products and special local needs registrations issued by states pursuant to Section 24(c) of FIFRA. A product cancellation is reported as a reregistration decision when a voluntary cancellation request is received, when the annual maintenance fee is not paid, or when a notice of intent to cancel due to unreasonable adverse effects is issued. In the case of a voluntary cancellation request, the process of finalizing the cancellation required by Section 6(f) of FIFRA may take about six months after receipt of the request to complete. EPA's FY 1998 Annual Financial Statements Page 71 ------- ~ EPA assembled children's activity pattern data for incorporation into the first generation exposure model. The Consolidated Human Activity Database (CHAD) provides consistent, comprehensive, and quality-assured activity data, facilitating assessments by providing more than 17,000 person-days of activity to modelers in an easy-to-use format. This data will be used to support the effort to reduce the risks to children's health caused by exposure to environmental toxics. ~ EPA continued to develop and evaluate biologically based dose response (BBDR) models to describe the underlying mechanisms of toxicity and to facilitate extrapolation from animal studies. These models will foster improved estimation of human risks from exposure to compounds such as methanol, dibromochloromethane, arsenic, acrylamide, and dioxin. ~ The Agency's research on biomarkers resulted in the validation of the use of single strand DNA breaks as a marker for oxidant exposure, use of mutation spectra from short-term tests for common mechanisms, development of markers of toxicity for use in low dose effects, and development of a consistent approach for measuring cholinesterase. Development of biomarkers provides validation of exposure and also provides for a more biologically defensible approach to quantifying risk of cancer and non-cancer health effects. Pesticides En forcement Performance Measures The enforcement and compliance assurance program deters noncompliance by maintaining levels of field presence and enforcement actions, particularly in high risk areas and/or where populations are disproportionately exposed. In FY 1998, EPA Headquarters issued 14 administrative penalty complaints for FIFRA violations, including several for violations of labeling for making false public health claims. The program used the following performance measures for assessing their success in FY 1998: Kev Performance Measures 1998 Goal 1998 Actual FIFRA APO Complaints 80 APO Complaints 187 APO Complaints FIFRA Inspections 125 Inspections 237 Inspections FIFRA Civil Referrals 3 Case Referrals 4 Case Referrals FIFRA Compliance Orders 10 Compliance Orders 18 Compliance Orders (Note: APO is Administrative Penalty Order.) Page 72 EPA's FY 1998 Annual Financial Statements ------- WATER INFRASTRUCTURE FINANCING The Clean Water State Revolving Fund (CWSRF) Program provides financial assistance to states, localities, and Indian tribes to protect the Nation's water resources by meeting the requirements of the Federal Water Pollution Control Act (FWPCA), commonly known as the Clean Water Act (CWA). With the passage of the Safe Drinking Water Amendments of 1996, the Drinking Water State Revolving Fund (DWSRF) has been authorized at $9.6 billion. This fund is designed to provide federal financial assistance to the states, localities, and Indian tribes to protect the Nation's drinking water resources. The DWSRF provides capitalization grants to state and tribal governments, funding low-interest loans for local drinking water systems that need to install or improve their drinking water treatment facilities. The fund is also used for source water protection, operator certification, and other priority activities. Program Description Water Infrastructure Financing consists of the following: the CWSRF, DWSRF, the U.S./Mexican Border Integrated Border Environmental Plan, grants for communities facing extraordinarily high needs and user charges, and wastewater infrastructure needs of Alaskan Native Villages. The State Revolving Fund (SRF) Programs provide federal financial assistance to states, localities, and Indian tribes to protect the Nation's water resources by providing funds for the construction of wastewater treatment and drinking water facilities. The SRFs are two of the Agency's premier tools for building the financial capacity of our partners. The Special Needs Program provides focused grant assistance to areas facing extraordinarily high needs in relation to household income (e.g., Boston Harbor and New Orleans), while the U.S./Mexican Border Program provides funds to support the planning, design and construction of high priority wastewater treatment projects along the U.S./Mexican Border and in the U.S. Colonias — low-income communities located within 100 kilometers of the border, which are generally unincorporated and lack basic services (i.e., safe drinking water, wastewater treatment facilities). The goal of this program is to reduce the incidence of waterborne diseases along the Mexican border and in the U.S. Colonias. Highlights and Accomplishments In FY 1998, the Agency obligated $2.8 billion for Water Infrastructure Financing. Under the CWSRF Program, EPA provides grants or "seed money" to all 50 states and Puerto Rico to capitalize state loan funds. The states, in turn, make loans to communities, individuals, and others for high-priority water quality activities. As money is paid back into the revolving fund, new loans are made to other recipients that need help in maintaining the quality of their water. States have contributed the required 20% match and, in some cases, leveraged their funds in the bond market to increase the total amount available for loans. Because of the funds' revolving nature, the federal investment can result in the construction of up to four times as many projects over a 20-year period as a one-time grant. Through 1998 , EPA has invested approximately $15 billion to capitalize the 51 CWSRFs. As of June 30, 1998, states reported they had issued 6,806 loans worth $22.9 billion for wastewater, storm water, combined sewer overflow, and nonpoint source projects. This includes approximately 800 loans to communities with populations of more than 100,000. In addition, states have issued approximately 6,000 loans to medium and small communities. A major benefit for municipalities and other loan recipients is the substantial financial savings they realize. When funded by a loan from this program, a project typically costs much less than it would if funded through the bond market. Many states offer low-interest loans to small and disadvantaged communities, providing an additional boost to get projects started. For example, a state can make a zero-percent loan to a community for 20 years, saving the community 50% of the total project costs over a similar loan at 7.5 %. The SRF Program's primary mission is to promote water quality. Aside from the financial savings, loan recipients realize significant environmental benefits, including protection of public health and conservation of local watersheds. The Safe Drinking Water Act (SDWA) Amendments of 1996 (Public Law 104-182) authorize a DWSRF to assist public water systems to finance the cost of infrastructure needed to achieve or maintain compliance with SDWA requirements and EPA's FY 1998 Annual Financial Statements Page 73 ------- protect public health. Section 1452 authorizes the Administrator of EPA to award capitalization grants to states, which in turn can provide low cost loans and other types of assistance to eligible systems. In addition to authorizing the infrastructure fund, the SDWA Amendments also place strong emphasis on preventing contamination problems through source water protection and enhanced water systems management. That emphasis transforms the previous law from a largely after-the-fact regulatory oriented program into a statute that can provide for the sustainable use of water. Central to this emphasis is the development of state prevention programs, including source water protection, capacity development and operator certification. States may use a portion of their capitalization grants to fund these eligible activities. The success of these activities will act to safeguard the DWSRF funds that are provided for improving system compliance and public health protection and help determine whether the new law's potential as a preventive environmental statute is realized. The DWSRF program will help ensure that the nation's drinking water supplies remain safe and affordable, that drinking water systems that receive funding will be properly operated and maintained, and that permanent institutions will exist in each state to provide financial support for drinking water needs for many years to come. Congress has placed particular emphasis on assisting smaller drinking water systems and those serving less affluent populations by providing greater funding flexibility for these systems under the DWSRF, to ensure that these systems have adequate technical, managerial, and financial resources to come into or maintain compliance and provide safe water. All FY 1997 DWSRF monies, which totaled over $1.2 billion, were awarded to the 50 states and Puerto Rico before the September 30,1998 deadline for these funds to be committed/obligated. In addition, 30 awards were made in FY 1998 using FY 1998 funds. Special Infrastructure projects were appropriated $393 million in FY 1998, including $253 million for Special Infrastructure Needs, $15 million for Rural and Alaskan Native Villages, $50 million for Colonias, and $75 million for the Mexican Border. The Agency has developed and issued guidance on how to award the $253 million in Special Infrastructure Needs funding for the 68 special projects authorized by the Department of Veterans Affairs, Housing and Urban Development, and Independent Agencies Appropriations Act of 1998, and awarded grants for approximately half of the projects by the end of the fiscal year. To support wastewater infrastructure development on Indian Lands, the Agency allocated an additional $12 million to the Border Region for tribal water and wastewater projects along the Mexican border for a total of $22 million. In addition, EPA continues to use Indian Health Services (IHS) as a primary mechanism of field level support for many Indian Lands projects. Future Trends To further the Agency's goal of providing an economical source of capital for the states to address their environmental problems, EPA proposes continued capitalization of the CWSRF at a level that will enable states to finance $2 billion annually in loan activity for several more decades. This level of funding helps to ensure that a long-term , low-cost source of financing is available to meet the $139.5 billion in wastewater infrastructure needs that have been documented throughout the United States. EPA will continue to encourage states to expand the availability of their CWSRF for a broader array of water quality infrastructure projects. EPA also will continue to encourage states to provide loans to small and disadvantaged communities which have difficulty constructing complex infrastructure projects or participating in the financial markets. One of EPA's efforts to assist small communities, such as tribes, is the Indian Set-Aside Program, funded through the CWSRF, which helps address the serious health problems some tribes face due to the lack of basic sewage treatment. EPA will continue to work with the Council of State Community Development Agencies and other federal agencies to facilitate the use of the CWSRF by small communities. Page 74 EPA's FY 1998 Annual Financial Statements ------- Serious public health problems due to water contamination and communicable waterborne diseases continue to be prevalent along the U.S./Mexican Border, as untreated domestic and industrial wastes flow into the rivers contaminating both sides of the Border. EPA will continue to support the U. S. /Mexican Border Plan and North American Free Trade Agreement (NAFTA) through wastewater treatment projects along the U.S./Mexican Border. In cooperation with the NAFTA Border Environment Cooperation Commission (BECC), EPA will help set priorities for funding wastewater infrastructure projects along the Border. In addition, EPA is working to provide the final appropriations provided in FY 1998 to the State of Texas to help finance wastewater projects in U.S. Colonias communities. EPA also will provide federal grants to the State of Alaska, subject to an appropriate cost share as determined by the Administrator, for necessary wastewater infrastructure projects in Native Alaskan Villages. In addition, EPA proposes continued capitalization of the DWSRF at a level that will enable states to finance $500 million annually in loan activity over the long term. This level of funding helps to ensure that a long-term, low-cost source of financing is available to meet the $138 billion in drinking water infrastructure needs that have been documented throughout the United States. EPA's FY 1998 Annual Financial Statements Page 75 ------- ------- PRINCIPAL FINANCIAL STATEMENTS EPA's FY 1998 Annual Financial Statements Page 77 ------- ------- CONTENTS Financial Statements Consolidating Statement of Financial Position Consolidating Statement of Net Cost Consolidating Statement of Changes in Net Position Combined Statement of Budgetary Resources Combined Statement of Financing Statement of Custodial Activity Notes to Financial Statements Note 1. Summary of Significant Accounting Policies Note 2. Fund Balances with Treasury Note 3. Cash, Foreign Currency and Other Monetary Assets Note 4. Investments Note 5. Accounts Receivable Note 6. Loans Receivable, Net - Non-Federal Note 7. Inventory and Related Property Note 8. Property, Plant and Equipment - Net Note 9. Debt Note 10. Other Liabilities Note 11. Leases Note 12. Federal Employee and Veterans' Benefits Note 13. Unexpended Appropriations Note 14. Amounts Held by Treasury Note 15. Contingencies Note 16. Grant Accrual Note 17. Environmental Cleanup Costs Note 18. Superfund State Credits Note 19. Superfund Preauthoriized Mixed Funding Agreements Note 20. Deferred Maintenance Note 21. Income and Expenses from Other Appropriations Note 22. Working Capital Fund Rebate Note 23. Custodial Non-Exchange Revenues Note 24. Statement of Budgetary Resources Note 25. Adjustments Note 26. Unobligated Balances Available Note 27. Obligated Balance, Net - End of Period Note 28. Difference in Outlays between Statement of Budgetary Resources and SF-133 Note 29. Statement of Financing EPA's FY 1998 Annual Financial Statements Page 79 ------- Note 30. Other Financing Sources Supplemental Information Requested by OMB Supplemental Statement of Budgetary Resources (Unaudited) Working Capital Fund Supplemental Statement of Financial Position (Unaudited) Working Capital Fund Supplemental Statement of Operations and Changes in Net Position (Unaudited) Annual Stewardship Information Page 80 EPA's FY 1998 Annual Financial Statements ------- EPA Hazardous Substance Superfund Trust Fund and All Other Funds Consolidating Statement of Financial Position As of September 30,1998 (Dollars in Thousands) Superfund Trust Fund All Others Combined Totals Intra-agency Consolidated Eliminations Totals ASSETS Entity Assets: Intragovernmental Assets: Fund Balance with Treasury (Note 2 and Note 3) Investments (Note 4) Accounts Receivable, Net (Note 5) Advances and Prepayments Total Intragovernmental Assets Accounts Receivable, Net (Note 5) Advances and Prepayments Loans Receivables and Related Foreclosed Property, Net (Note 6) Cash and Other Monetary Assets (Note 3) Inventory and Related Property, Net (Note 7) Marketable Securities Equity (Note 4) General Property, Plant and Equipment, Net (Note 8) Total Entity Assets Total Assets LIABILITIES Liabilities Covered by Budgetary Resources: Intragovernmental Liabilities: Accounts Payable Debt (Note 9) Other (Note 10) Total Intragovernmental Liabilities Accounts Payable Other (Note 10) Total Liabilities Covered by Budgetary Resources Liabilities not Covered by Budgetary Resources: Lease Liabilities (Note 11) Federal Employee and Veterans' Benefits (Note 12) Other (Note 10) Total Liabilities not Covered by Budgetary Resources Total Liabilities NET POSITION Unexpended Appropriations (Note 13) Cumulative Results of Operations Total Net Position Total Liabilities and Net Position $ 43,693 $10,227,484 $10,271,177 $ 5,074,520 1,191,538 6,266,058 ... 53,406 71,880 125,286 ... 2.448 72.353 74.801 (2.1811 5.174.067 11.563.255 16.737.322 (2.1811 592,065 99,160 691,225 ... 2,088 2,088 ... ... 111,821 111,821 ... ... 4,964 4,964 ... ... 74 74 ... 5,146 ... 5,146 ... 6.560 266.511 273.071 5.777.838 12.047.873 17.825.711 (2.1811 $5,777,838 $12,047,873 $17,825,711 ($2.1811 $ 159,299 $ 39,569 $ 198,868 $ ... 37,922 37,922 ... 3.606 8.335 11.941 (2.1811 162.905 85.826 248.731 (2.1811 134,252 424,815 559,067 394.516 198.449 592.965 691.673 709.090 1.400.763 (2.1811 38,653 38,653 5,279 21,497 26,776 ... 16.618 93.539 110.157 21.897 153.689 175.586 0 713.570 862.779 1.576.349 (2.1811 2,805,960 9,827,800 12,633,760 ... 2.258.308 1.357.294 3.615.602 5.064.268 11.185.094 16.249.362 0 $10,271,177 6,266,058 125,286 72.620 16.735.141 691,225 2,088 111,821 4,964 74 5,146 273.071 17.823.530 198,868 37,922 9.760 $5.777.838 $12.047.873 $17.825.711 ($2.1811 246.550 559,067 592.965 1.398.582 38,653 26,776 110.157 175.586 1.574.168 12,633,760 3.615.602 16.249.362 $17.823.530 NOTE: The accompanying notes are an integral part of these statements. EPA's FY 1998 Annual Financial Statements Page 81 ------- EPA Hazardous Substance Superfund Trust Fund and All Other Funds Consolidating Statement of Net Cost As of September 30,1998 (Dollars in Thousands) Superfund Trust Fund All Others Combined Intra-agency Consolidated Totals Eliminations Totals COSTS: Intragovernmental $ 429,357 $ 346,182 $ 775,539 $ — $ 775,539 With the Public 1,071,029 5,249,111 6,320,140 (265,699) 6,054,441 Expenses from Other Appropriations (Note 21) 5,542 (5,542) 0 — 0 Expenses of the Trust Fund Incurred by Treasury (Note 14) 35 ("1251 (901 ~ (901 Total 1.505.963 5.589.626 7.095.589 (265.6991 6.829.890 Less: Income from Other Appropriations (Note 21) Earned Revenues 5,542 538.903 (5,542) 157.054 0 695.957 (15.6991 0 680.258 Total Net Program Costs 544.445 961.518 151.512 5.438.114 695.957 6.399.632 (15.6991 (250.0001 680.258 6.149.632 DEFERRED MAINTENANCE (Note 20) NET COST OF OPERATIONS $961.518 $5.438.114 $6.399.632 ($250.0001 $6.149.632 NOTE: The accompanying notes are an integral part of these statements. Page 82 EPA's FY 1998 Annual Financial Statements ------- EPA Hazardous Substance Superfund Trust Fund and All Other Funds Consolidating Statement of Changes inNet Position As of September 30,1998 (Dollars in Thousands) Superfund All Combined Intra-agency Consolidated Trust Fund Others Totals Eliminations Totals Net Cost of Operations $ 961.518 $ 5.438.114 $ 6.399.632 ("$250.0001 $ 6.149.632 Financing Sources (Other Than Exchange Revenues): Appropriations Used 1,407,531 5,381,299 6,788,830 6,788,830 Taxes (and Other Non-Exchange Revenues) 81,658 88,515 170,173 ... 170,173 Trust Fund Revenue Collected by Treasury (Note 14) 5,044 136,213 141,257 ... 141,257 Turst Fund Income Earned by Treasury (Note 14) 291,816 60,935 352,751 ... 352,751 Trust Fund Appropriation Received (Note 14) 250,000 ... 250,000 (250,000) 0 Donations (Non-Exchange Revenue) ... 44 44 ... 44 Imputed Financing 30,155 161,853 192,008 ... 192,008 Transfers-In ... 32 32 ... 32 Other Interest 1,473 ... 1,473 ... 1,473 Other Financing Sources (Note 30) ("1.623.3931 ("109.5011 ("1.732.8941 ("1.732.8941 Net Results of Operations (517,234) 281,276 (235,958) 0 (235,958) Prior Period Adjustments 257 28.645 28.902 28.902 Net Changes in Cumulative Results of Operations (516,977) 309,921 (207,056) 0 (207,056) Increase (Decrease) in Unexpended Appropriations ("68.285") 752.735 684.450 684.450 Change in Net Position (585,262) 1,062,656 477,394 0 477,394 Net Position - Beginning of Period 5.649.530 10.122.438 15.771.968 15.771.968 Net Position - End of Period $ 5.064.268 $11,185,094 $16,249,362 $ 0 $16,249,362 NOTE: The accompanying notes are an integral part of these statements. EPA's FY 1998 Annual Financial Statements Page 83 ------- EPA Hazardous Substance Superfund Trust Fund and All Other Funds Combined Statement of Budgetary Resources As of September 30,1998 (Dollars in Thousands) Superfund Trust Fund All Others Combined Totals $1,421,999 805,627 (30,225) (375} $2.197.026 $6,142,594 1,948,038 283,984 C64.140') $8.310.476 $ 7,564,593 2,753,665 253,759 f64.5151 $10.507.502 $1,495,558 701.468 $2.197.026 $6,592,535 1.717.941 $8.310.476 $ 8,088,093 2.419.409 $10.507.502 $1,495,558 104,403 2,536,709 2.550.841 $6,592,535 257,694 7,950,031 8.750.289 $ 8,088,093 362,097 10,486,740 11.301.130 $1.377.023 $5.534.583 $ 6.911.606 Budgetary Resources: Budget Authority Unobligated Balances - Beginning of Period Spending Authority from Offsetting Collections Adjustments (Note 25) Total Budgetary Resources Status of Budgetary Resources: Obligations Incurred Unobligated Balances - Available (Note 26) Total, Status of Budgetary Resources Outlays: Obligations Incurred Less: Spending Authority from Offsetting Collections and Adjustments Obligated Balance, Net - Beginning of Period Less: Obligated Balance, Net - End of Period (Note 27) Total Outlays (Note 28) NOTE: See Note 24 for reconciliation of the Statement of Budgetary Resources to the Budget of the United States. NOTE: The accompanying notes are an integral part of these statements. Page 84 EPA's FY 1998 Annual Financial Statements ------- EPA Hazardous Substance Superfund Trust Fund and All Other Funds Combined Statement of Financing As of September 30,1998 (Dollars in Thousands) Superfund Trust Fund All Others Combined Totals Obligations and Nonbudgetary Resources Obligations Incurred Less: Spending Authority for Offsetting Collections and Adjustments Financing Imputed for Cost Subsidies Transfers-In (Out) and Donations Exchange Revenue Not in the Budget Total Obligations as Adjusted and Nonbudgetary Resources $1,495,558 (104,403) 30,155 (•434.500) $ 986.810 $ 6,592,535 (257,694) 161,853 76 86.746 $ 6.583.516 $ 8,088,093 (362,097) 192,008 76 (347.754) $ 7.570.326 Resources that Do Not Fund Net Cost of Operations Decrease (Increase) in Amount of Goods, Services, and Benefits Ordered but Not Yet Received or Provided ($ 24,870) ($ 729,505) ($ 754,375) Costs Capitalized on the Balance Sheet (2,479) (92,995) (95,474) Loans Receivable — 12,737 12,737 Inventory — 117 117 Liabilities (If Net Decrease) (Note 29) — (23,853) (23,853) Financing Sources that Fund Costs of Prior Periods (3.517) (326.312) (329.829) Total Resources that Do Not Fund Net Cost of Operations f$ 30.866) C$1.159.811) C$1.190.677) Costs that Do Not Require Resources Depreciation and Amortization Bad Debt Expense (Note 5) Other Gains and Losses Loss on Disposition of Assets Other Total Costs that Do Not Require Resources 2,403 324 (999) 1.728 21,170 11,729 (1) 392 n 8.881) 14.409 23,573 12,053 (1) 392 n 9.880) 16.137 Financing Sources Yet To Be Provided (Note 29) $ 3.846 3.846 Net Cost Of Operations $ 961.518 $ 5.438.114 $ 6.399.632 NOTE: The accompanying notes are an integral part of these statements. EPA's FY 1998 Annual Financial Statements Page 85 ------- EPA Hazardous Substance Superfund Trust Fund and All Other Funds Statement of Custodial Activity As of September 30,1998 (Dollars in Thousands) Sources of Collections: Cash Collections (by Type of Tax or Duty) Interest and Penalties, Net Other Custodial Revenue Net Collections Accural Adjustments Total Revenue Disposition of Collections: Transferred to Others Net of Refunds (by Recipient) Increase (Decrease) in Amounts To Be Transferred Retained by the Entity Total Disposition of Revenue Net Custodial Activity ($77,184) ($77,184) 74.752 74.752 (2,432) (2,432) 1.063 1.063 CI.369) (1.369) (12,481) (12,481) (92,258) (92,258) 103.370 103.370 CI.369) (1.369) NOTE: The accompanying notes are an integral part of these statements. Page 86 EPA's FY 1998 Annual Financial Statements ------- EPA Hazardous Substance Superfund Trust Fund and All Other Funds Notes to Financial Statements (Dollars in Thousands) Note 1. Summary of Significant Accounting Policies: A. Basis of Presentation These consolidating financial statements have been prepared to report the financial position and results of operations of the Environmental Protection Agency (Agency) for the Hazardous Substance Superfund (Superfund) Trust Fund and All Other Funds, as required by the Chief Financial Officers Act of 1990 and the Government Management Reform Act of 1994. The reports have been prepared from the books and records of the Agency in accordance with "Form and Content for Agency Financial Statements," specified by the Office of Management and Budget (OMB) in Bulletin 97-01, and the Agency's accounting policies which are summarized in this note. These statements are therefore different from the financial reports also prepared by the Agency pursuant to OMB directives that are used to monitor and control the Agency's use of budgetary resources. B. Reporting Entities The Environmental Protection Agency was created in 1970 by executive reorganization from various components of other Federal agencies in order to better marshal and coordinate Federal pollution control efforts. The Agency is generally organized around the media and substances it regulates — air, water, land, hazardous waste, pesticides and toxic substances. For FY 1998 the reporting entities are grouped as Hazardous Substance Superfund and All Other Funds. Hazardous Substance Superfund In 1980, the Hazardous Substance Superfund, commonly referred to as the Superfund Trust Fund, was established by the Comprehensive Environmental Response, Compensation, and Liability Act of 1980 (CERCLA) to provide resources needed to respond to and clean up hazardous substance emergencies and abandoned, uncontrolled hazardous waste sites. The Superfund Trust Fund financing is shared by Federal and state governments as well as industry. The Agency allocates funds from its appropriation to other Federal agencies to carry out the Act. Risks to public health and the environment at uncontrolled hazardous waste sites qualifying for the Agency's National Priorities List (NPL) are reduced and addressed through a process involving site assessment and analysis, and the design and implementation of cleanup remedies. Throughout this process, cleanup activities may be supported by shorter term removal actions to reduce immediate risks. Removal actions may include removing contaminated material from the site, providing an alternative water supply to people living nearby, and installing security measures. NPL cleanups and removals are conducted and financed by the Agency, private parties, or other Federal agencies. Through 1998, construction of cleanup remedies were completed at a total of 585 NPL sites (includes Federal and non-Federal sites). Superfund includes the Treasury collections and investment activity. The Superfund Trust Fund is accounted for under Treasury symbol number 8145. All Other Funds All Other Funds include Trust Fund appropriations, General Fund appropriations, Revolving Funds, Special Funds, the Agency Budgetary Clearing accounts, Deposit Funds, General Fund Receipt accounts, the Environmental Services Special Fund Receipt Account, the Miscellaneous Contributed Funds Trust Fund, and General Fund appropriations transferred from other Federal agencies as authorized by the Economy Act of 1932. Trust Fund appropriations are to the Leaking Underground Storage Tank (LUST) Trust Fund and the Oil Spill Response Trust Fund. General Fund appropriations are to State and Tribal Assistance Grants (STAG), Science and Technology (S&T), Environmental Programs and Management (EPM), Office of Inspector General (IG), Buildings and Facilities (B&F), and Payment to the Hazardous Substance Superfund. General Fund EPA's FY 1998 Annual Financial Statements Page 87 ------- appropriations that no longer receive current appropriations but have unexpended authority are the Asbestos Loan Program, Program and Research Operations (PRO), and Energy, Research and Development. Revolving Funds include the FIFRA Revolving Fund and Tolerance Revolving Fund which receive no direct appropriations; however, they do collect fees from public industry as a source of reimbursement for the services provided. In addition to FIFRA and Tolerance, a Working Capital Fund (WCF) was established and designated as a franchise fund to provide computer operations support and postage service for the Agency. A Special Fund was established to collect the Exxon Valdez settlement as a result of the Exxon Valdez oil spill. All Other Funds are as follows: The LUST Trust Fund was authorized by the Superfund Amendments and Reauthorization Act of 1986 (SARA) as amended by the Omnibus Budget Reconciliation Act of 1990. The LUST appropriation provides funding to respond to releases from leaking underground petroleum tanks. The Agency oversees cleanup and enforcement programs which are implemented by the states. Funds are allocated to the states through cooperative agreements to clean up those sites posing the greatest threat to human health and environment. Funds are used for grants to non-state entities including Indian tribes under section 8001 of the Resource Conservation and Recovery Act. The program is financed by a 0.1 cent a gallon tax on motor fuels which will expire in 2005, and is accounted for under Treasury symbol number 8153. The Oil Spill Response Trust Fund was authorized by the Oil Pollution Act (OPA) of 1990. The Oil Spill Response Trust Fund was established in FY 1993 and monies were appropriated to the Oil Spill Response Trust Fund. The Agency is responsible for directing, monitoring and providing technical assistance for major inland oil spill response activities. This involves setting oil prevention and response standards, initiating enforcement actions for compliance with OPA and Spill Prevention Control and Countermeasure requirements, and directing response actions when appropriate. The Agency carries out research to improve response actions to oil spills including research on the use of remediation techniques such as dispersants and bioremediation. Funding of oil spill cleanup actions is provided through the Department of Transportation under the Oil Spill Liability Trust Fund and reimbursable funding from other Federal agencies. The Oil Spill Response Trust Fund is accounted for under Treasury symbol number 8221. The State and Tribal Assistance Grants (STAG) appropriation provides funds for environmental programs and infrastructure assistance including capitalization grants for State revolving funds and performance partnership grants. Environmental programs and infrastructure supported are Clean and Safe Water; Capitalization grants for the Drinking Water State Revolving Funds; Clean Air; Direct grants for Water and Wastewater Infrastructure needs, Partnership grants to meet Health Standards, Protect Watersheds, Decrease Wetland Loss, and Address Agricultural and Urban Runoff and Storm Water; Better Waste Management; Preventing Pollution and Reducing Risk in Communities, Homes, Workplaces and Ecosystems; and Reduction of Global and Cross Border Environmental Risks. STAG is accounted for under Treasury symbol 0103. The Science and Technology (S&T) appropriation finances salaries; travel; science; technology; research and development activities including laboratory and center supplies; certain operating expenses; grants; contracts; intergovernmental agreements; and purchases of scientific equipment. These activities provide the scientific basis for the Agency's regulatory actions. In FY 1998 Superfund research costs were appropriated in Superfund and transferred to S&T to allow for proper accounting of the costs. Scientific and technological activities for environmental issues include Clean Air; Clean and Safe Water; Americans Right to Know About Their Environment; Better Waste Management; Preventing Pollution and Reducing Risk in Communities, Homes, Workplaces, and Ecosystems; and Safe Food. The Science and Technology appropriation is accounted for under Treasury symbol 0107. The Environmental Programs and Management (EPM) includes funds for salaries, travel, contracts, grants , and cooperative agreements for pollution abatement, control, and compliance activities and administrative activities of the operating programs. Areas supported from this appropriation include Clean Air; Clean and Safe Water; Preventing Pollution and Reducing Risk in Communities, Homes, Workplaces, and Ecosystems; Better Waste Management, Restoration of Contaminated Waste Sites, and Emergency Response; Reduction of Global and Cross Border Environmental Risks; Americans' Right to Know About Their Environment; Sound Science, Improved Understanding of Environmental Risk, and Greater Innovation to Address Environmental Problems; a Credible Deterrent to Pollution and Greater Compliance with the Law; and Effective Management. The Environmental Programs and Management appropriation is accounted for under Treasury symbol 0108. Page 88 EPA's FY 1998 Annual Financial Statements ------- The Office of Inspector General appropriation provides funds for audit and investigative functions to identify and recommend corrective actions on management and administrative deficiencies that create the conditions for existing or potential instances of fraud, waste and mismanagement. Additional funds for audit and investigative activities associated with the Superfund Trust Fund and the Leaking Underground Storage Tank Trust Fund are appropriated under those Trust Fund accounts and are transferred to the Office of Inspector General account. The audit function provides contract audit, internal and performance audit, and financial and grant audit services. The Office of Inspector General appropriation is accounted for under Treasury symbol 0112 and includes expenses incurred and reimbursed from the appropriated trust funds being accounted for under Treasury symbols 8145 and 8153. The Buildings and Facilities appropriation provides for the construction, repair, improvement, extension, alteration, and purchase of fixed equipment or facilities that are owned or used by the Environmental Protection Agency. The Buildings and Facilities appropriation is accounted for under Treasury symbol 0110. The Payment to the Hazardous Substance Superfund appropriation authorizes appropriations from the General Fund of the Treasury to finance activities conducted through Hazardous Substance Superfund. Payment to the Hazardous Substance Superfund is accounted for under Treasury symbol 0250. The Asbestos Loan Program was authorized by the Asbestos School Hazard Abatement Act of 1986 to finance control of asbestos building materials in schools. Funds have not been appropriated for this Program since FY 1993. For FY 1993 and FY 1992, the program was funded by a subsidy appropriated from the General Fund for the actual cost of financing the loans, and by borrowing from Treasury for the unsubsidized portion of the loan. The Program fund disbursed the subsidy to the Financing fund as loans were made, and disbursed administrative expenses to the providers. The Financing fund received the subsidy payment, borrowed from Treasury and disbursed loans and collects the asbestos loans. The Asbestos Loan Program is accounted for under Treasury symbol 0118 for the subsidy and administrative support, under Treasury symbol 4322 for loan disbursements, loans receivable and loan collections on post FY 1991 loans, and under Treasury symbol 2917 for pre FY 1992 loans receivable and loan collections. The Program and Research Operations appropriation provides salaries and travel associated with administering the operating programs within the Environmental Protection Agency. It incorporated personnel, compensation and benefit costs and travel, exclusive of the Hazardous Substance Response Trust Fund, the Leaking Underground Storage Tank Trust Fund, the Office of Inspector General and the Oil Spill Response Trust Fund. In FY 1996, Congress restructured the Agency's accounts. The Program and Research Operations appropriation was eliminated. Activity remaining from prior fiscal year appropriations is accounted for under Treasury symbols 0200 and 0201. The FIFRA Revolving Fund was authorized by the Federal Insecticide, Fungicide and Rodenticide Act Amendments of 1988, as amended by the Food Quality Protection Act of 1996. Fees are paid by industry to offset costs of accelerated reregistration, expedited processing of pesticides, and establishing tolerances for pesticide chemicals in or on food and animal feed. The FIFRA Revolving Fund is accounted for under Treasury symbol number 4310. The Tolerance Revolving Fund was authorized in 1963 for the deposit of tolerance fees. Fees are paid by industry for Federal services of pesticide chemicals in or on food and animal feed. Effective January 2, 1997, fees collected are now being deposited in the Reregistration and Expedited Processing Revolving Fund (4310). The fees collected prior to this date are accounted for under Treasury symbol number 4311. The Working Capital Fund (WCF) includes two activities: computer support services and postage. WCF derives revenue from these activities based upon fee for services. WCF's customers currently consist solely of Agency program offices. Accordingly, revenue generated by WCF and expenses recorded by the program offices for use of such services, along with the related advances/liabilities, are eliminated on consolidation. The WCF is accounted for under Treasury symbol 4565. The Exxon Valdez Settlement Fund has funds available to carry out authorized environmental restoration activities. Funding is derived from the collection of reimbursements under the Exxon Valdez settlement as a result of the oil spill. The Exxon Valdez Settlement fund is accounted for under Treasury symbol number 5297. EPA's FY 1998 Annual Financial Statements Page 89 ------- Appropriations transferred to the Agency from other Federal agencies include funds from the Appalachian Regional Commission and the Department of Commerce which provide economic assistance to state and local developmental activities, the Agency for International Development which provides assistance on environmental matters at international levels, and from the General Services Administration which provides funds for rental of buildings, and operations, repairs, and maintenance of rental space. The transfers appropriations are accounted for under Treasury symbols 0200, 1010, 1021, 2050, and 4542. Clearing Accounts include the Budgetary suspense account, Deposit in Transit differences, Unavailable Check Cancellations and Overpayments, and Undistributed and Letter of Credit differences. Clearing accounts are accounted for under Treasury symbols 3875, 3878, 3879, and 3880. Deposit funds include Fees for Ocean Dumping, Nonconformance Penalties, Suspense and payroll deposits for Savings Bonds, and State and City Income Taxes Withheld. Deposit funds are accounted for under Treasury symbols 6050, 6264, 6265, 6275, and 6875. General Fund Receipt Accounts include Hazardous Waste Permits; Miscellaneous Fines, Penalties and Forfeitures; General Fund Interest; Interest from Credit Reform Financing Accounts; Fees and Other Charges for Administrative and Professional Services; and Miscellaneous Recoveries and Refunds. General Fund Receipt accounts are accounted for under Treasury symbols 0895, 1099, 1435, 1499, 2410, 3200, and 3220. The Environmental Services Receipt account was established for the deposit of fee receipts associated with environmental programs, including radon measurement proficiency ratings and training, motor vehicle engine certifications, and water pollution permits. Receipts in this special fund will be appropriated to the S&T appropriation and to the EPM appropriation to meet the expenses of the programs that generate the receipts. Environmental Services are unavailable receipts accounted for under Treasury symbol 5295. The Miscellaneous Contributed Funds Trust Fund includes gifts for pollution control programs that are usually designated for a specific use by the donor and deposits from pesticide registrants to cover the costs of petition hearings when such hearings result in unfavorable decisions to the petitioner. Miscellaneous Contributed Funds Trust Fund is accounted for under Treasury symbol 8741. The accompanying financial statements include the accounts of all funds described in this note. Superfund may charge some administrative costs directly to the fund and charge the remainder of the administrative costs to the All Other Funds in the Agency-wide appropriations. The administrative costs funded by Agency-wide appropriations for Superfund for FY 1998 was $5.5 million. These amounts are included in the Income from Other Appropriations and Expenses from Other Appropriations on the Statement of Net Cost. The Superfund Trust Fund is allocated general support services costs (such as rent, communications, utilities, mail operations, etc.) that were initially charged to the Agency's S&T and EPM appropriations. During the year, these costs are allocated from the S&T and EPM appropriations to the Superfund Trust Fund based on a ratio of direct labor hours, using budgeted or actual full-time equivalent personnel charged to these appropriations, to the total of all direct labor hours. Agency general support services cost charges to the Superfund Trust Fund may not exceed the ceilings established in the Superfund Trust Fund appropriation. The related general support services costs charged to the Superfund Trust Funds was $47.5 million for FY 1998. C. Budgets and Budgetary Accounting Superfund Congress adopts an annual appropriation amount to be available until expended for the Superfund Trust Fund. A transfer account for the Superfund Trust Fund has been established for purposes of carrying out the program activities. As the Agency disburses obligated amounts from the transfer account, the Agency draws down monies from the Superfund Trust Fund at Treasury to cover the amounts being disbursed. Page 90 EPA's FY 1998 Annual Financial Statements ------- All Other Funds Congress adopts an annual appropriation amount for the LUST Trust Fund and for the Oil Spill Response Trust Fund to remain available until expended. A transfer account for the LUST Trust Fund has been established for purposes of carrying out the program activities. As the Agency disburses obligated amounts from the transfer account, the Agency draws down monies from the LUST Trust Fund at Treasury to cover the amounts being disbursed. The Agency draws down all the appropriated monies from the Treasury's Oil Spill Liability trust fund to the Oil Spill Response Trust Fund when Congress adopts the appropriation amount. Congress adopts an annual appropriation for STAG, Buildings and Facilities, and for Payments to the Hazardous Substance Superfund to be available until expended; adopts annual appropriation for S&T, EPM and for the Office of the Inspector General to be available for two fiscal years. When the appropriations for the General Funds are enacted, Treasury issues a warrant to the respective appropriations. As the Agency disburses obligated amounts, the balance of funds available to the appropriation is reduced at Treasury. The Asbestos Loan Program is a commercial activity financed by a combination from two sources: one for the long term cost of the loan and another for the remaining non-subsidized portion of the loan. Congress annually adopts a one year appropriation, available for obligation in the fiscal year for which it is appropriated, to cover the estimated long term cost of the Asbestos loans. The long term costs are defined as the net present value of the estimated cash flows associated with the loans. The portion of each loan disbursement that does not represent long term cost is financed under a permanent indefinite borrowing authority established with the Treasury. The annual appropriation bill limits the amount of obligations that can be made for direct loans. A permanent indefinite appropriation is available to finance the costs of subsidy re-estimates that occur after the year in which the loan is disbursed. No appropriation was adopted by Congress for FY 1998; therefore, there was no new financing available to the Asbestos Loan Program for FY 1998. Funding of the FIFRA and the Tolerance Revolving Funds is provided by fees collected from industry to offset costs incurred by the Agency in carrying out these programs. Each year the Agency submits an apportionment request to OMB based on the anticipated collections of industry fees. Funding of the WCF is provided by fees collected from other Agency appropriations collected to offset costs incurred for providing the Agency administrative support for computer support and postage. Funds transferred from other Federal agencies is funded by a non expenditure transfer of funds from the other Federal agencies. As the Agency disburses the obligated amounts, the balance of funding available to the transfer appropriation is reduced at Treasury. Clearing accounts, Deposit accounts, and Receipt accounts receive no budget. Rather amounts are recorded to the Clearing and Deposit accounts pending further disposition. Amounts recorded to the Receipt accounts capture amounts receivable to or collected for the General Fund of the Treasury. D. Basis of Accounting Superfund and All Other Funds Transactions are recorded on an accrual accounting basis and on a budgetary basis (where budgets are issued). Under the accrual method, revenues are recognized when earned and expenses are recognized when a liability is incurred, without regard to receipt or payment of cash. Budgetary accounting facilitates compliance with legal constraints and controls over the use of Federal funds. All interfund balances and transactions have been eliminated. EPA's FY 1998 Annual Financial Statements Page 91 ------- E. Revenues and Other Financing Sources Superfund The Superfund receives most funding needed to support the program through appropriations that may be used within statutory limits, for operating and capital expenditures (primarily equipment). Additional financing for the Superfund Trust Fund is obtained through reimbursements from other Federal agencies, from States for State Cost Share, and from potentially responsible parties (PRPs) for future costs. Revenues collected through cost recovery are deposited with the Trust fund at Treasury. All Other Funds The majority of All Other Funds receive funding needed to support programs through appropriations, which may be used, within statutory limits, for operating and capital expenditures. Under Credit Reform provisions, the Asbestos Loan Program received funding through appropriations to support the subsidy cost of loans which may be used within statutory limits. The Asbestos Direct Loan Financing fund, an off-budget fund, receives additional funding to support the loan disbursements through collections from the Program fund for the subsidized portion of the loan and through borrowing from Treasury for the non-subsidized portion. The last year Congress provided appropriations for this fund was 1993, accordingly no new funding has been available for this program. The FIFRA and the Tolerance Revolving Funds receive funding, which is now deposited with the FIFRA Revolving Fund, through fees collected for services provided. The FIFRA Revolving Fund also receives interest on invested funds. The WCF receives revenue through fees collected for services provided to Agency program offices. Such revenue is eliminated with related Agency program expenses on Consolidation. The Exxon Valdez Settlement Fund received funding through reimbursements. Appropriations are recognized as Other Financing Sources when earned, i.e., when goods and services have been rendered without regard to payment of cash. Other revenues are recognized when earned, i.e., when services have been rendered. F. Funds with the Treasury Superfund and All Other Funds The Agency does not maintain cash in commercial bank accounts. Cash receipts and disbursements are handled by Treasury. The funds maintained with Treasury are Appropriated Funds, Revolving Funds and Trust Funds. These funds have balances available to pay current liabilities and finance authorized purchase commitments. G. Investments in U.S. Government Securities All Other Funds Investments in U.S. Government securities are maintained by Treasury and are reported at amortized cost net of unamortized discounts. Discounts are amortized over the term of the investments and reported as interest income. The FIFRA Revolving Fund, which is included in All Other Funds, holds the investments to maturity, unless they are needed to finance operations of the fund. No provision is made for unrealized gains or losses on these securities because, in the majority of cases, they are held to maturity. H. Marketable Equity Securities Superfund During FY 1993 and FY 1996, the Agency received marketable equity securities, valued at a total $5.1 million, which are still held, from a company in settlement of Superfund cost recovery actions. The Agency records marketable securities Page 92 EPA's FY 1998 Annual Financial Statements ------- at cost as of the date of receipt. Marketable securities are held by Treasury, and reported at their cost value in the financial statements until sold. I. Accounts Receivable and Interest Receivable Superfund The Comprehensive Environmental Response, Compensation, and Liability Act (CERCL A) as amended by the Superfund Amendments and Reauthorization Act (SARA) provides for the recovery of costs from potentially responsible parties (PRPs). However, cost recovery expenditures are expensed when incurred since there is no assurance that these funds will be recovered. It is the Agency's policy to record accounts receivable from PRPs for Superfund site response costs when a consent decree, judgment, administrative order, or settlement is entered. These agreements are generally negotiated after site response costs have been incurred. It is the Agency's position that until a consent decree or other form of settlement is obtained, the amount recoverable should not be recorded. The allowance for uncollectible PRP accounts receivable is determined on a specific identification basis as a result of a case-by-case review of receivables at the regional level, and a general reserve for those not specifically identified. The Agency also records accounts receivable from states for a percentage of Superfund site remedial action costs incurred by the Agency within those states. As agreed to under Superfund State Contracts (SSCs), cost sharing arrangements under SSCs may vary according to whether a site was privately or publicly operated at the time of hazardous substance disposal and whether the Agency response action was removal or remedial. SSC agreements are usually for 10% or 50% of site remedial action costs. States may pay the full amount of their share in advance, or incrementally throughout the remedial action process. Allowances for uncollectible state cost share receivables have not been recorded, because the Agency has not had collection problems with these agreements. All Other Funds The majority of receivables for All Other Funds represent interest receivable for Asbestos and FIFRA and both accounts receivable and interest receivable to the General Fund of the Treasury. A summary of accounts receivable as of September 30, 1998 is contained in Note 5. J. Loans Receivable All Other Funds Loans are accounted for as receivables after funds have been disbursed. The amount of Asbestos Loan Program loans obligated but not disbursed are disclosed in Note 6. Loans receivable resulting from obligations on or before September 30, 1991 are reduced by the allowance for uncollectible loans. Loans receivable resulting from loans obligated on or after October 1,1991 are reduced by an allowance equal to the present value of the subsidy costs associated with these loans. The subsidy cost is calculated based on the interest rate differential between the loans and Treasury borrowing, the estimated delinquencies and defaults net of recoveries offset by fees collected and other estimated cash flows associated with these loans. K. Appropriated Amounts Held by Treasury Superfund and All Other Funds For the Superfund and LUST Trust Funds, and for amounts appropriated to the Office of Inspector General from the Superfund and LUST Trust Funds, cash available to the Agency that is not needed immediately for current disbursements remains in the respective Trust Funds managed by Treasury. At the end of FY 1998 approximately $2.9 billion remained EPA's FY 1998 Annual Financial Statements Page 93 ------- in the Treasury managed Superfund Trust Fund and approximately $73.2 million remained in the LUST Trust Fund to meet the Agency's disbursement needs. L. Advances and Prepayments Superfund and All Other Funds Advances and prepayments represent funds advanced or prepaid to other entities both internal and external to the Agency for which a budgetary expenditure has not yet occurred. M. Property, Plant, and Equipment Superfund and All Other Funds The Fixed Assets Subsystem (FAS) implemented in FY 1997 maintains EPA-held personal and real property records. The FAS automatically generates depreciation entries monthly based upon the acquisition date. Purchases of EPA-held and contractor-held personal equipment are capitalized if the equipment is valued at $25 thousand or more and has an estimated useful life of at least two years. Prior to implementing FAS, depreciation was taken on a modified straight-line basis over a period of six years depreciating 10% the first and sixth year, and 20% in years two through five. All EPA-held personal equipment purchased before the implementation of FAS was assumed to have an estimated useful life of five years. New acquisitions of EPA-held personal equipment are depreciated using the straight-line method over the specific assets' useful lives, ranging from two to 15 years. Real property consists of land, buildings, and capital and leasehold improvements. Real property, other than land, is capitalized when the value is $75 thousand or more. Land is capitalized regardless of cost. Buildings are valued at an estimated original cost basis, and land is valued at fair market value. Depreciation for real property is calculated using the straight-line method over the specific assets' useful lives, ranging from 10 to 102 years. Leasehold improvements are amortized over the lesser of their useful lives or the unexpired lease terms. In addition to property and improvements not meeting the capitalization criteria, expenditures for minor alterations, and repairs and maintenance are expensed as incurred. N. Liabilities Superfund and All Other Funds Liabilities represent the amount of monies or other resources that are likely to be paid by the Agency as the result of a transaction or event that has already occurred. However, no liability can be paid by the Agency without an appropriation or other collection of revenue for services provided. Liabilities for which an appropriation has not been enacted are classified as unfunded liabilities and there is no certainty that the appropriations will be enacted. Liabilities of the Agency, arising from other than contracts, can be abrogated by the Government acting in its sovereign capacity. O. Borrowing Payable to the Treasury All Other Funds Borrowing payable to Treasury results from loans from Treasury to fund the Asbestos direct loans described in part B and C of this note. Periodic principal payments are made to Treasury based on the collections of loans receivable. Page 94 EPA's FY 1998 Annual Financial Statements ------- P. Interest Payable to Treasury All Other Funds The Asbestos Loan Program makes periodic interest payments to Treasury based on its debt to Treasury. At the end of FY 1998, there was no outstanding interest payable to Treasury since payment was made through September 30. Q. Annual, Sick and Other Leave Annual, sick and other leave is expensed as taken during the fiscal year. Sick and other leave earned but not taken is not accrued as a liability. Annual leave earned but not taken as of the end of the fiscal year is accrued as an unfunded liability. Accrued unfunded annual leave is included in the Statement of Financial Position as a component of "Liabilities not Covered by Budgetary Resources: Other Governmental Liabilities". As of September 30,1998 the unfunded annual leave liability for the Superfund Trust Fund was $16.6 million and for All Other Funds was $78.8. The difference in the year-end accruals for unfunded annual leave is reported as "Unfunded Expense" in the Statement of Net Cost. R. Retirement Plan The majority of the Agency's employees participate in the Civil Service Retirement System (CSRS), to which the Agency makes matching contributions equal to 7% of pay. On January 1,1987, the Federal Employees Retirement System (FERS) went into effect pursuant to Public Law 99-335. Most employees hired after December 31,1983, are automatically covered by FERS and Social Security. Employees hired prior to January 1,1984 were allowed to either join FERS and Social Security or remain in CSRS. A primary feature of FERS is that it offers a savings plan to the Agency employees which automatically contributes 1 percent of pay and matches any employee contribution up to an additional 4 percent of pay. For most employees hired after December 31,1983, the Agency also contributes the employer's matching share for Social Security. With the issuance of "Accounting for Liabilities of the Federal Government" (SFFAS-5), which was effective for the FY 1997 financial statements, accounting and reporting standards were established for liabilities relating to the Federal employee benefit programs (Retirement, Health Benefits and Life Insurance). SFFAS-5 requires that employing agencies recognize the cost of pensions and other retirement benefits during their employees' active years of service. SFFAS-5 requires that the Office of Personnel Management, as administrator of the Civil Service Retirement and Federal Employees Retirement Systems, the Federal Employees Health Benefits Program, and the Federal Employees Group Life Insurance Program, provide EPA with the 'Cost Factors' to compute EPA's liability for each program. Note 2. Fund Balances with Treasury: The Treasury maintains EPA's fund accounts and processes all of EPA's receipts and disbursements. Superfund and All Other Funds Superfund and All Other Funds Entity Assets Non-Entitv Assets Total Trust Funds: Lust Oil Spill Superfund $43,693 4,203 62 $ $43,693 4,203 62 EPA's FY 1998 Annual Financial Statements Page 95 ------- Entity Assets Non-Entitv Assets Total Revolving Funds: FIFRA 5,216 — 5,216 Tolerance 155 — 155 Working Capital Fund 41,040 — 41,040 Appropriated Funds 10,180,516 — 10,180,516 Other Fund Types ^3.708) — ^3.708) Total $10.271.177 $ 0 $10.271.177 Note 3. Cash, Foreign Currency and Other Monetary Assets: Entity Assets Non-Entitv Assets Cash: Superfund $ 43,693 $ — All Others 10.227.484 — Total Cash $10.271.177 $ 0 Other Monetary Assets: All Others Total Other Monetary Assets Total Cash and Other Monetary Assets Note 4. Investments: 4.964 4.964 $10.276.141 $ 0 $ 0 -Amounts for Balance Sheet Reporting- Superfund Intragovernmental Securities: Governmental Securities: Uniroyal Tech All Others Intragovernmental Securities: Cost $5,295,501 $ 5,146 $1,243,052 Amortized Method Unamortized (Premium) Discount Market Value $220,981 $5,074,520 $ 3,615 51,514 1,191,538 Investments, Net $5,074,520 $ 3,615 $1,191,538 Required Market Value Disclosure $3,615 Page 96 EPA's FY 1998 Annual Financial Statements ------- CERCLA, as amended by SARA, authorizes EPA to recover monies to clean up Superfund sites from responsible parties (RP). Some RP's file for bankruptcy under Title 11 of the U. S. Code. In bankruptcy settlements, EPA is an unsecured creditor and is entitled to receive a percentage of the assets remaining after secured creditors have been satisfied. Some RPs satisfy their debts by issuing marketable securities in the reorganized company. The Agency does not intend to exercise ownership rights related to these securities, and instead will convert these securities to cash as soon as practicable. Note 5. Accounts Receivable: Superfund All Others Intergovernmental Assets: Accounts & Interest Receivable $ 53,406 $ 71,880 Less: Allowance for Doubtful Accounts — — Total $ 53.406 $ 71.880 Governmental Assets: Unbilled Accounts Receivable $ 80,483 $ 8 Accounts & Interest Receivable 861,225 166,644 Less: Allowance for Doubtful Accounts C349.643') C67.492') Total $ 592.065 $ 99.160 The agency has incurred bad debts in relation to it's collection efforts for Superfund and All Others as follows: Superfund All Others Bad Debt Expense $ 146,522 $ 12,035 Contra Bad Debt Expense (\46.198s) ^306) Net Bad Debt Expense The Allowance for Doubtful Accounts is determined on a specific identification basis as a result of a case-by-case review of receivables at the regional level, and a reserve on a percentage basis for those not specifically identified. Note 6. Loans Receivable, Net - Non-Federal: For the Asbestos Loan Program, loans disbursed from obligations made prior to FY 1992 are net of an allowance for estimated uncollectible loans, if an allowance was considered necessary. Loans disbursed from obligations made after FY 1991 are governed by the Federal Credit Reform Act. The Act mandates that the present value of the subsidy costs (i.e., interest rate differentials, interest subsidies, anticipated delinquencies, and defaults) associated with direct loans be recognized as an expense in the year the loan is made. The net present value of loans is the amount of the gross loan receivable less the present value of the subsidy. An analysis of loans receivable and the nature and amounts of the subsidy and administrative expenses associated entirely with Asbestos Loan Program loans is provided in the following sections. EPA's FY 1998 Annual Financial Statements Page 97 ------- Loans Loans Receivable, Allowance Receivable, Gross - 1998 for 1998 * Net -1998 Pre-Credit Reform $ 76,074 $ — $ 76,074 Post Credit Reform 56.086 f20.3391 35.747 Total $132.160 $C20.339Nl $111.821 * Allowance for Pre-Credit Reform loans = Allowance for Estimated Uncollectible Loan Allowance for Post Credit Reform loans = Allowance for Subsidy Cost (present value) Subsidy Expenses for Post Credit Reform Loans: Interest Expected Fee Total Differential Defaults Offsets Current Year's Loans: S121 M21 Total Direct Loan Expenses: $2^211 $2^221 Other Information: At the end of FY 1998, $4.4 million for loan obligations established after credit reform remained unpaid and were canceled, because the subsidy appropriated for these loans was also canceled. No expenses were incurred for subsidy reestimates. Note 7. Inventory and Related Property: Superfund All Others Operating Materials and Supplies Held for Use in Normal Operations $ — $ 74 Total $ — $ 74 Note 8. Property, Plant and Equipment - Net Superfund property, plant and equipment, consists of personal property items held by contractors and the Agency. EPA also has property funded by various other Agency appropriations. The property funded by these appropriations are presented in the aggregate under "All Others" and consists of real, EPA-Held and Contractor-Held personal, and capitalized-leased property. Purchases of EPA-Held and Contractor-Held personal property are capitalized if the equipment is valued at $25 thousand or more and has an estimated useful life of at least two years. The Agency depreciates EPA-Held personal property using a straight-line method over the asset's useful life ranging from two to 15 years. Contractor-Held personal property is depreciated over five years using a modified straight-line method. Real property, other than land, is capitalized when the value is $75 thousand or more and is depreciated using the straight-line method over the specific asset's useful life ranging from 10 to 102 years. Leasehold improvements are amortized over the lesser of their useful lives or the unexpired lease term. Late in fiscal 1997, the Agency implemented a new property accounting and accountability system entitled the "Fixed Assets Subsystem (FAS)". FAS replaced the Personal Property Accountability System (PPAS) and manually-maintained spreadsheets to account for EPA-held personal and real property respectively. Historical data was converted to the FAS. In fiscal 1998, a mass transfer of property was executed to the WCF from other appropriations. Page 98 EPA's FY 1998 Annual Financial Statements ------- The fiscal 1997 ending balances for real property was adjusted because an accounting omission in fiscal 1997 caused real property to be understated by $435 thousand for the All Others appropriation. This resulted in an adjustment to property, plant and equipment for All Others, with a corresponding adjustment to the capital asset component of equity. There was no effect to the Statement of Operations and Changes in Net Position. Schedule of Property, Plant, and Equipment by Fund EPA-Held Equipment Contractor-Held Equipment Land and Buildings Capital Leases (Note 11) Total PP&E Superfund Acquisition Accumulated Value Depreciation $21,191 10,179 $(16,981) (7,829) All Others Net Book Value $4,210 2,350 $6.560 Acquisition Accumulated Value Depreciation $136,372 48,780 258,367 40,913 $(97,462) (44,240) (68,142) (8,077) Net Book Value $38,910 4,540 190,225 32,836 $266.511 Note 9. Debt: Other Debt - All Others Debt to Treasury Beginning Balance $ 37.922 Net Borrowing Ending Balance $ 37.922 Classification of Debt: Intragovernmental Debt Total Debt $ 37.922 $ 37.922 Note 10. Other Liabilities: Other Liabilities Covered by Budgetary Resources: Intragovernmental - All Others WCF Advances Other Total Intragovernmental - Superfund Other Total Non-Current Current Total $ — $2,181 $2,181 _ 6.154 6.154 $ 0 $8.335 $8.335 $ _ $3.606 $3.606 $ — $3.606 $3.606 EPA's FY 1998 Annual Financial Statements Page 99 ------- Non-Current Current Total All Others Accrued Funded Payroll & Benefits $46,258 Custodial Liability 129,304 Other Liabilities — Total $175.562 Superfund Cash Out - Non Federal $324,622 Resources Payable to Treasury 10,872 Other 13.784 Total $349.278 Other Liabilities Not Covered by Budgetary Resources: Non-Current All Others Contingent Liabilities - Unfunded $335 Accrued Clean-up Costs - Unfunded Accrued Unfunded Annual Leave 74.209 Total $74.544 Superfund Accrued Unfunded Annual Leave $ Total $ 0 $10,254 944 11.689 $22.887 $57,899 2,321 (14.982) $45.238 Current ($128) 14,505 4.618 $18.995 $16.618 $16.618 $56,512 130,248 11.689 $198.449 $382,521 13,193 (1.198) $394.516 Total $207 14,505 78.827 $93.539 $16.618 $16.618 Note 11. Leases: Capital Leases: Summary of Assets Under Capital Lease: Land and Buildings Accumulated Amortization All Others $40,913 $8,077 EPA has three capital leases for land and buildings housing scientific laboratories and/or computer facilities. All of these leases include a base rental charge and escalator clauses based upon either rising operating costs and/or real estate taxes. The base operating costs are adjusted annually according to escalators in the Consumer Price Indices published by the Bureau of Labor Statistics (U.S. Department of Labor). These leases terminate in fiscal years 2010, 2013 and 2025. The charges are expended out of the EPM appropriation. The total future minimum lease payments of the capital leases are listed below. Page 100 EPA's FY 1998 Annual Financial Statements ------- Future Payments Due: Fiscal Year 1999 2000 2001 2002 2003 After 5 Years All Others $6,295 6,295 6,295 6,295 6,295 108.785 Total Future Minimum Lease Payments Less: Imputed Interest Net Capital Lease Liability Liabilities not covered by Budgetary Resources Operating Leases: 140,260 (101.607) 38.653 $ 38.653 The General Services Administration (GSA) provides leased real property (land and buildings) as office space for EPA employees. GSA charges a Standard Level Users Charge that approximates the commercial rental rates for similar properties. EPA has five direct operating leases for land and buildings housing scientific laboratories and/or computer facilities. Most of these leases include a base rental charge and escalator clauses based upon either rising operating costs and/or real estate taxes. The base operating costs are adjusted annually according to escalators in the Consumer Price Indices published by the Bureau of Labor Statistics (U.S. Department of Labor). Three leases terminate in 2000. In fiscal 1997 and 1998, EPA entered into two leases, which terminate in fiscal 2017 and 2003 respectively. The charges are expended out of the EPM appropriation. The total minimum future costs of the operating leases are listed below. Fiscal Year All Others 1999 $6,139 2000 6,109 2001 36 2002 34 2003 34 Beyond 2003 334 Total F uture Minimum L ease P ay ments Note 12. Federal Employee and Veterans' Benefits: FECA Accrual - Unfunded FECA Liability - Unfunded Total Superfund Superfund $1,404 3.875 $5.279 Total Land & Buildings $6,139 6,109 36 34 34 334 $12.686 All Others $6,398 15.099 $21.497 EPA's FY 1998 Annual Financial Statements Page 101 ------- Note 13. Unexpended Appropriations: Unexpended Appropriations: Unobligated Available Unavailable Undelivered Orders Total Superfund $ 220,352 2.585.608 $ 2.805.960 All Others $ 1,376,968 99,362 8.351.470 $ 9.827.800 Total 1,597,320 99,362 10.937.078 12.633.760 Note 14. Amounts Held by Treasury: Amounts Held by Treasury for Future Appropriations consists of amounts held in trusteeship by the U.S. Department of Treasury in the "Hazardous Substance Superfund Trust Fund" (Superfund) and the "Leaking Underground Storage Tank Trust Fund" (LUST). Superfund (Audited) Superfund is supported primarily by an environmental tax on corporations, cost recoveries of funds spent to clean up hazardous waste sites, and fines and penalties. Prior to December 31, 1995, the fund was also supported by other taxes on crude and petroleum and on the sale or use of certain chemicals. The authority to assess those taxes expired on December 31,1995 and has not been renewed by Congress. It is not known if or when such taxes will be reassessed in the future. The following reflects the Superfund Trust Fund as maintained by the U.S. Department of Treasury. The amounts contained in these statements have been provided by the Treasury. Outlays represent appropriations received by EPA's Superfund Trust Fund, such funds are eliminated on consolidation with the Superfund Trust Fund maintained by Treasury. Undistributed Balances: Available for Investment Unavailable for Investment Total Undisbursed Balance Investments, Net of Discounts Total Assets Liabilities & Equity Debt Equity Total Liability and Equity Combined $ 980 $ 980 5.074.520 $ 5.075.500 5.075.500 $ 5.075.500 EPA 2.949.665 $ 2.949.665 2.949.665 ; 2.949.665 Treasury > 980 > 980 2.124.855 ; 2.125.835 2.125.835 ; 2.125.835 Page 102 EPA's FY 1998 Annual Financial Statements ------- Combined EPA Treasury Receipts Crude and Petroleum $ (2,604) $ — $ (2,604) Certain Chemicals 2,413 — 2,413 Corporate Environmental 79,060 — 79,060 Cost Recoveries 319,605 — 319,605 Fines & Penalties 5.044 — 5.044 Total Revenue 403,518 — 403,518 Appropriations Received 250,000 — 250,000 Interest Income 291.816 — 291.816 Total Receipts $ 945.334 $ — $ 945.334 Outlays Return of Appropriations $ — $ (35) $ 35 Transfers to EPA — (1.473.197) 1.473.197 Total Outlays — (1.473.232) 1.473.232 Net Income $ — $ 527.898 $ (527.898) LUST (Unaudited) LUST is supported primarily by a sales tax on motor fuels to clean up LUST waste sites. The following represents LUST Trust Fund as maintained by the U. S. Department of Treasury. The amounts contained in these statements have been provided by Treasury and are unaudited. Outlays represent appropriations received by EPA's LUST Trust Fund, such funds are eliminated on consolidation with the LUST Trust Fund maintained by Treasury. Undisbursed Balances Available for Investment Unavailable for Investment Total Undisbursed Balance Investments, Net of Discounts Total Assets Liabilities & Equity Debt Equity Total Liability and Equity Combined $ 126 126 1.182.039 $ 1.182.165 $ — 1.182.165 $ 1.182.165 EPA 73.207 $ 73.207 73.207 $ 73.207 Treasury $ 126 126 1.108.832 $ 1.108.958 1.108.958 $ 1.108.958 EPA's FY 1998 Annual Financial Statements Page 103 ------- Combined EPA Treasury Receipts Highway TF Tax $ 126,232 $ — $ 126,232 Airport TF Tax 11,791 — 11,791 Inland TF Tax 844 — 844 Gross Revenue 138,867 — 138,867 Less: Reimbursement to G/F C2.654') — C2.654') Net Revenue 136,213 — 136,213 Interest Income 60.935 — 60.935 Net Receipts $ 197.148 $ — $ 197.148 Outlays Treasury Operating Expenses $ — $ 125 $ 125 Transfers to EPA — C62.758) C62.758) Total Outlays — f62.6331 (62.633) Net Income $ — $134.515 $(134.515) Note 15. Contingencies: EPA is a party in various administrative proceedings, legal actions, and claims brought by or against it. These include: Various personnel actions, suites, or claims brought against the Agency by employees and others. Various contract and assistance program claims brought against the Agency by vendors, grantees and others. The legal recovery of Superfund costs incurred for pollution cleanup of specific sites, to include the collection of fines and penalties from responsible parties. Claims against recipients for improperly spent assistance funds which may be settled by a reduction of future EPA funding to the grantee or the provision of additional grantee matching funds. Superfund Under CERCLA fl06 (a), EPA issues administrative orders that require parties to clean up contaminated sites. CERCLA f 106(b) allows a party that has complied with such an order to petition EPA for reimbursement from the Fund of its reasonable costs of responding to the order, plus interest. To be eligible for reimbursement, the party must demonstrate either that it was not a liable party under CERCLA f 107 (a) for the response action ordered, or that the Agency's selection of the response action was arbitrary and capricious or otherwise not in accordance with law. There are currently thirteen CERCLA f 106(b) administrative claims and four pending lawsuits. If the claimants are successful, the total losses on the administrative and judicial claims could amount to approximately $54.9 million and $5.3 million, respectively. The Environmental Appeals Board has not yet issued final decisions on the administrative claims; therefore a definite estimate of the amount of the contingent loss cannot be made. The claimants chance of success in these outstanding cases is characterized as reasonably possible. The claimants chance of success in three of the four pending Page 104 EPA's FY 1998 Annual Financial Statements ------- lawsuits is also reasonably possible. The outcome of the remaining lawsuit is considered as probable for the claimant totaling $185 thousand. There are a number of outstanding CERCLA f 106(a) cleanup orders where the recipients of the orders have not yet completed the ordered response actions. Each such recipient could potentially file a claim with EPA for reimbursements under CERCLA f 106(b) of its costs of responding to the order once it has completed the ordered actions. EPA is responsible to indemnify response action contractors (CERCLA f 119) for legal costs that will eventually exceed or have exceeded the deductible specified in the current indemnification agreements. Such payments by the United States would be recoverable government response costs. EPA has only one claim which is considered remote. EPA contractors have submitted response action contractor claims. No claims were material. All Others There were no material litigation, asserted or unasserted claims or assessments involving all other appropriated funds of the Agency. Judgement Fund In cases which are paid by the U.S. Treasury Judgement Fund, the Agency must recognize the full cost of a claim regardless of who is actually paying the claim. The Agency is involved in various other actions that in the aggregate do not exceed $1.2 million. EPA also has one probable claim that is not estimable. In addition, EPA is party to certain pending litigation upon which EPA believes it has a reasonable legal position. No estimate has been provided for a loss. In the opinion of EPA's management and General Counsel, the ultimate resolution of any legal actions still pending will not materially affect EPA's operations or financial position. Note 16. Grant Accrual: Grant accruals represent grantee expenses that were not reported to EPA for reimbursement as of September 30, 1998. We selected a statistical sample of grant recipients from our grantee universe to use as our basis to calculate our accrual. We sent confirmation letters to the sample grantees, asking them to provide the amount of unbilled grant expenses as of September 30, 1998. We calculated the unbilled grant expense rates. Finally, we used weighted-average rates to compute the overall unbilled grant expense accruals. Superfund $ 22,867 All Others $212,157 Note 17. Environmental Cleanup Costs: EPA has five sites that require clean up stemming from its activities. Four of these sites will be paid from the Treasury Judgement Fund amounting to $206 thousand. EPA estimates that clean up on the other site will be approximately one thousand dollars. EPA also holds title to a site in Edison, New Jersey, which was formerly an Army Depot. While EPA did not cause the contamination, the Agency could potentially be liable for a portion of the clean up costs. However, it is expected that the Department of Defense and the General Services Administration will bear all or most of the cost of remediation. EPA's FY 1998 Annual Financial Statements Page 105 ------- Future Clean up Cost EPA has nine sites that require future clean up associated with permanent closure. The estimated cost will be approximately $14.5 million. Since the clean up costs associated with permanent closure are not primarily recovered though user fees, EPA has elected to recognize the estimated total cleanup cost as a liability upon implementation. EPA could also be potentially liable for cleanup costs at two GSA-leased sites; however, the amounts are not known. Of the $14.5 million, $11.9 million represents the estimated expense to close the current RTP research facility. These costs will be incurred within the next three years. The $2.6 million represents the future decontamination and decommissioning costs of EPA's research facilities. Note 18. Superfund State Credits: Authorizing statutory language for Superfund and related Federal regulations require States to enter into Superfund State Contracts (SSCs) when EPA assumes the lead for a remedial action in their State. The SSC defines the State's role in the remedial action and obtains the State's assurance that they will share in the cost of the remedial action. Under Superfund's authorizing statutory language, States will provide EPA with a ten percent cost share for remedial action costs incurred at privately owned or operated sites, and at least fifty percent of all response activities (i.e., removal, remedial planning, remedial action, and enforcement) at publicly operated sites. In some cases, States may use EPA approved credits to reduce all or part of their cost share requirement that would otherwise be paid by the States. Credit is limited to State site-specific expenses EPA has determined to be reasonable, documented, direct out-of-pocket expenditures of non-Federal funds for remedial action. Once EPA has reviewed and approved a State's claim for credit, the State must first apply the credit at the site where it was earned. The State may apply any excess/remaining credit to another site when approved by EPA. As of September 30, 1998, total outstanding State credits has been estimated at $11 million. Note 19. Superfund Preauthorized Mixed Funding Agreements: Under Superfund Preauthorized Mixed Funding Agreements, settling Potentially Responsible Parties (PRPs) agree to perform response actions at their sites with the understanding that EPA will reimburse the PRPs a percentage of their total response action costs. EPA's authority to enter into mixed funding agreements is provided under Section 111(a)(2) of the Comprehensive Environmental Response, Compensation, and Liability Act (CERCLA) of 1980. Under Section 122(b)(1) of CERCLA, as amended by the Superfund Amendments and Reauthorization Act (SARA) of 1986, a PRP may assert a claim against the Superfund Trust Fund for a portion of the costs they incurred while conducting a preauthorized response action as agreed to under a mixed funding agreement. As of September 30, 1998, EPA had 12 outstanding preauthorized mixed funding agreements with obligations totaling $44.5 million. A liability is not recognized for these amounts until the PRP's work has been performed and has been approved by EPA for payment. EPA will not disburse any funds under these agreements, however, until the PRP's application, claim, and claims adjustment processes have been reviewed and approved by EPA. Note 20. Deferred Maintenance: The EPA classifies property, plant, and equipment as following: 1) EPA-Held Equipment, 2) Contractor-Held Equipment, 3) Land and Buildings, and, 4) Capital Leases. The condition assessment survey method of measuring deferred maintenance is utilized. The Agency adopts requirements or standards for acceptable operating condition in conformance with industry practices. One deferred maintenance project was identified in the Land and Buildings category, with an estimated total cost of $325 thousand. This project included repairing and resurfacing weathered and cracked parking lots and driveways. In addition, one deferred maintenance project was identified in the EPA-Held Equipment category with an estimated cost of $45 thousand. Maintenance for gas chromatograph system was postponed until 1999. No deferred maintenance was reported for the other two categories. Page 106 EPA's FY 1998 Annual Financial Statements ------- Note 21. Income and Expenses from other Appropriations: The Statement of Net Cost reports program costs that include the full costs of the program outputs and consist of the direct costs and all other costs that can be directly traced, assigned on a cause and effect basis, or reasonably allocated to program outputs. During FY 1998, EPA had three appropriations which funded a variety of programmatic and non-programmatic activities across the Agency, subject to statutory requirements. The Environmental Programs and Management (EPM) appropriation was created to fund personnel compensation and benefits, travel, procurement, and contract activities. Two prior year appropriations, Program and Research Operations (PRO) and Abatement Control and Compliance (AC&C) generated expenses. PRO funded travel, personnel compensation and benefits. AC&C funded procurement and contract activities. All of the expenses from EPM, PRO and AC&C were distributed among EPA's two Reporting Entities: Superfund and All Others. This distribution is calculated using a combination of specific identification of expenses to Reporting Entities, and a weighted average that distributes expenses proportionately to total programmatic expenses. As illustrated below, this estimate does not impact the net effect of the Statement of Net Costs. Income From Other Expenses From Other Appropriations Appropriations Net Effect Superfund $ 5,542 ($5,542) $ 0 All Others (5,542) 5,542 0 Note 22. Working Capital Fund Rebate: The Working Capital Fund's (WCF) net revenue of $111.6 millions is comprised of $3.9 million from postage operations and $107.7 million from Enterprise Technology Services Division (ETSD). The WCF revenue reflects a $6.7 million rebate that was included in the September billing cycle. This was the result of an analysis of potential revenue versus projected cost anticipated through the end of the year. The rebate was made during FY 1998 as the WCF refined its revenue to meet appropriation requirements. Note 23. Custodial Non-Exchange Revenues: EPA uses the accrual basis of accounting for the collection of fines, penalties and miscellaneous receipts. Collectability by EPA of the fines and penalties is based on the responsible parties' willingness and ability to pay. Fines, Penalties & Miscellaneous Receipts Fines, Penalties & Miscellaneous Revenue (EPA) J22JJ2 Accounts Receivable Fines, Penalties & Miscellaneous Receipts Accounts Receivable $81,868 Less: Allowance for Doubtful Accounts 47.472 Accounts Receivable (Net) 224^22= EPA's FY 1998 Annual Financial Statements Page 107 ------- Note 24. Statement of Budgetary Resources: A reconciliation of budgetary resources, obligations incurred, and outlays, as presented in the audited Statement of Budgetary Resources, to amount included in the Budget of the United States Government for the year ended September 30, 1998, is as follows: Budgetary Obligations Resources Incurred Outlays Audited Superfund Statement of Budgetary Resources $2,197,026 $ 1,495,558 $ 1,377,023 Restatement of Available Authority based on budget controls (517,910) Restatement of Reimbursable Authority 1,536 Recoveries netted with obligations 175,925 (175,925) Receivables excluded from Statement of Budgetary Resources — — (2,919) Adjustments to Unliquidated Obligations results from audit review — 41,364 Other (Note 25) 375 83.917 614 Budget of the United States Government Audited All Others Statement of Budgetary Resources $8,310,476 $6,592,535 $5,534,583 Restatement of Available Authority based on budget controls (83,980) Restatement of Reimbursable Authority 12,244 Recoveries netted with obligations 48,808 (48,808) Receivables excluded from Statement of Budgetary Resources — — (69,987) Adjustments to Unliquidated Obligations results from audit review — 119,279 Other (Note 25) C28D 2.327 (1.504) Budget of the United States Government $2^222^2^2 $^£^222 3^4^022 Note 25. Adjustments: Includes a $375 thousand difference in Superfund and a $281 thousand difference in All Others. Note 26. Unobligated Balances Available: The Superfund Trust Fund has an unobligated balance of $701 million in unexpired authority. All Others has an unobligated balance of $1.7 billion which includes $1.6 billion in unexpired authority and $99 million in expired authority. The unexpired authority is available to be apportioned by the Office of Management and Budget for new obligations at the beginning of FY 1999. Unobligated balances of expired authority is not available for new obligations. However, the expired authority is available for upward adjustments of obligations incurred as of the end of the fiscal year. Page 108 EPA's FY 1998 Annual Financial Statements ------- Note 27. Obligated Balance, Net - End of Period: Undelivered Orders at the end of the period are $2.6 billion for the Superfund Trust Fund and $8.8 billion for All Others. These amounts include adjustments of $16 million to the Superfund and $216 million to All Others. These adjustments are primarily for additional grant accruals related to unbilled liabilities at the end of the fiscal year and for deobligations of Undelivered Orders that are no longer needed. These adjustments were not included in the Budget of the United States Government. Note 28. Difference in Outlays Between Statement of Budgetary Resources and SF-133: Outlays between the Statement of Budgetary Resources and the SF-133 differ by $2 million for Superfund and $72 million for All Others. Of the difference, $3 million for Superfund and $70 million for All Others is represented by the exclusion of refunds receivable from the Obligated Balance, Net Beginning of Period on the Statement of Budgetary Resources, whereas receivables had been included on the SF -13 3. The different presentations result from a change in policy effective March 1, 1998, wherein receivables are not a budgetary resource until collected. Other outlay differences of $1 million for Superfund and $2 million for All Others are unidentified. Note 29. Statement of Financing: Increases in Unfunded Liabilities relate to unfunded annual leave and Federal Employees Compensation Act (FECA) special benefit fund. For Superfund, the amount totaled $3.8 million and is reflected in Financing Sources Yet To Be Provided. For All Others, the amount was $7.9 million, which is included in the total Net Decrease in Liabilities of $23.9 million. Note 30. Other Financing Sources: Consists primarily of Appropriations to EPA from the Superfund and Lust Trust Funds held at Treasury (Treasury Trust Funds). Such appropriations are reported as non expenditure transfers on the financial statements of the respective Treasury Trust Funds. Upon consolidation with Trust funds held by EPA, the Treasury Trust Fund Appropriation non expenditure transfers are reported as Other Financing Sources to offset Appropriations Used and Trust Fund revenues. Superfund Lust Treasury Trust Fund Transfers $1,473,232 $ 62,633 Other 150.161 46.868 Total $1.623.393 $ 109.501 EPA's FY 1998 Annual Financial Statements Page 109 ------- EPA Required Supplemental Information Hazardous Substance Superfund Trust Fund and All Other Funds Supplemental Statement of Budgetary Resources (Unaudited) As of September 30,1998 (Dollars in Thousands) Environmental Miscellaneous Consolidated Programs & Science & LUST All All STAG Management Technology FIFRA Trust Fund Others Others Budgetary Resources: Budget Authority $3,213,125 $1,803,600 Unobligated Balances - Beginning of the Period 1,351,061 280,942 Spending Authority from Offsetting Collections 17,040 48,651 Adjustments (2.7041 Total Budgetary Resources Status of Budgetary Resources: Obligations Incurred $3,442,416 $1,884,842 Unobligated Balances - Available 1.138.810 245.647 Total, Status of Budgetary Resources Outlays: Obligations Incurred $3,442,416 $1,884,842 Less: Spending Authority from Offsetting Collections and Adjustments 17,040 74,074 Obligated Balance, Net - Beginning of Period 6,185,434 974,037 Less: Obligated Balance, Net - End of the Period 7.013.753 944.098 Total Outlays $2.597.057 $1.840.707 $631,000 $ 131,989 15,928 50,414 18,828 9.614 89 $65,000 $429,869 $6,142,594 2,542 165,576 1,948,038 6 149,045 283,984 181 (71.3201 (64.1401 $4.581.226 $2.130.489 $823.017 $34.845 $67.729 $673.170 $8.310.476 $678,528 $19,344 144.489 15.501 $64,978 $502,427 $6,592,535 2.751 170.743 1.717.941 $4.581.226 $2.130.489 $823.017 $34.845 $67.729 $673.170 $678,528 $19,344 45,485 18,917 411,169 1,493 517.570 1.517 $526.642 $ 403 {.310.476 $64,978 $502,427 $6,592,535 187 101,991 257,694 71,167 306,731 7,950,031 74.687 198.664 8.750.289 $61.271 $508.503 $5.534.583 Page 110 EPA's FY 1998 Annual Financial Statements ------- EPA Required Supplemental Information Working Capital Fund Supplemental Statement of Financial Position (Unaudited) As of September 30,1998 (Dollars in Thousands) ASSETS Entity Assets: Intragovernmental Assets: Balance With Treasury $41,040 Avances and Prepayments 1 Governmental Assets: Operating Materials and Supplies, Net 13 Avances and Prepayments 3 Property and Equipment, Net 15,379 Other Governmental Assets 5.319 Total Assets $61.755 LIABILITIES Intragovernmental Liabilities: Accounts Payable $ 1,303 Other Intragovernmental Liabilities 12,962 Governmental Liabilities: Accounts Payable 18,316 Other Governmental Liabilities 719 Total Liabilities 33.300 NET POSITION Balances: Paid in Capital 23,293 Cumulative Results of Operations 5.162 Total Net Position 28.455 Total Liabilities and Net Position EPA's FY 1998 Annual Financial Statements Page 111 ------- EPA Required Supplemental Information Working Capital Fund Supplemental Statement of Operations and Changes in Net Position (Unaudited) As of September 30,1998 (Dollars in Thousands) REVENUE AND FINANCING SOURCES Revenues from Services to the Public $ 118,309 Other Revenues and Financing Sources 6,584 Less: Rebate - WCF 6.696 Total Revenues and Financing Sources 118.197 EXPENSES Program or Operating Expenses 98,748 Imputed Expenses 6,584 Depreciation and Amortization 8,570 Funded Accrued Annual L eave 135 Loss on Sale of Assets 53 Total Funded Expenses 114.090 Excess (Shortage) of Revenues and Financing Sources Over Total Expenses NET POSITION Net Position, Beginning Balance $ 20,550 Excess (Shortage) of Revenues and Financing Sources Over Total Expenses 4,107 Plus (Minus) Non Operating Changes 3.798 Net Position, Ending Balance Page 112 EPA's FY 1998 Annual Financial Statements ------- EPA Required Supplemental Information Annual Stewardship Information For the Fiscal Year Ended September 30,1998 INVESTMENT IN THE NA TION'S RESEARCH AND DEVEIOPMENT: Public and private sector institutions have long been significant contributors to our nation's environmental and human health research agenda. EPA's Office of Research and Development, however, is unique among scientific institutions in this country in combining research, analysis, and the integration of scientific information across the full spectrum of health and ecological issues and across both risk assessment and risk management. This broad scope has resulted in scientific and engineering expertise, physical facilities, and equipment that permit and encourage integrated multimedia and multidisciplinary research on environmental issues. As part of a regulatory Agency that establishes national priorities and sets national standards, ORD research is conducted to protect human and ecosystem health in a cost-effective manner and to provide a firm scientific and technical foundation for environmental decisions and standards. Among the Agency's highest research priorities is a program to expand the understanding of near- and long- term effects of the environment on children. Another priority is the Particulate Matter (PM) research program, which focuses on review, implementation, and eventual attainment of the National Ambient Air Quality Standards (NAAQS). For FY 1998, the full cost of the Agency's Research and Development activities totaled $561 million. A breakout of the expenses is below (Dollars in thousands): Programmatic Expenses: $507,828 Allocated Expenses: $ 53,322 INVESTMENT IN THE NA TION'S INFRASTRUCTURE: The Agency makes significant investments in the Nations's drinking water and clean water infrastructure. The investments are the result of three programs: The Construction Grant Program which is being phased out, and two State Revolving Fund programs. Construction Grants Program: During the 1970s and 1980s, the Construction Grants Program was a source of federal funds, providing more than $60 billion of direct grants for the construction of public wastewater treatment projects. These projects, which constituted a significant contribution to the nation's water infrastructure, included sewage treatment plants, pumping stations, and collection and intercept sewers, rehabilitation of sewer systems, and the control of combined sewer overflows. The construction grants led to the improvement of water quality in thousands of municipalities nationwide. Congress set 1990 as the last year that funds would be appropriated for Construction Grants. Projects funded in 1990 and prior will continue until completion. Beyond 1990, EPA shifted the focus of municipal financial assistance from grants to loans that are provided by State Revolving Funds. State Revolving Funds: The Environmental Protection Agency provides capital, in the form of capitalization grants, to state revolving funds which state governments use to make loans to individuals, businesses, and governmental entities for the construction of water treatment infrastructure. When the loans are repaid to the state revolving fund, the collections are used to finance new loans for new construction projects. The capital is reused by the states and is not returned to the Federal Government. The Agency is also appropriated funds to finance the construction of infrastructure outside the Revolving Funds. These are reported below as Other Infrastructure Grants. The Agency's expenses related to investments in the Nation's Water Infrastructure are outlined below: Construction Grants: Clean Water SRF: Safe Drinking Water SRF: Other Infrastructure Grants: Allocated Expenses: $ 444,817 $1,109,017 $ 94,936 $ 138,363 $ 187,649 EPA's FY 1998 Annual Financial Statements Page 113 ------- STEWARDSHIP LAND HUMAN CAPITAL The Agency holds title to certain land and land rights related to remedial clean-up sites. The land rights are in the form of easements to allow access to clean-up sites or restrict usage of remediated sites. In some instances, the Agency takes title to the land during remediation, and returns it to private ownership upon the completion of clean-up. As of 9/30/98, the Agency possesses the following land and land rights: Superfund Sites with Easements 22 Superfund Sites with Land acquired 18 Agencies are required to report expenses incurred to train the public with the intent of increasing or maintaining the nation's economic productive capacity. Training, public awareness, and research fellowships are components of many of the Agency's programs, and are effective in achieving the Agency's mission of protecting public health and the environment, but the focus is on enhancing the nation's environmental, not economic, capacity. Training and Awareness Grants $39,131 Fellowships $11,084 Allocated Expenses $ 5,273 Page 114 EPA's FY 1998 Annual Financial Statements ------- ACRONYMS EPA's FY 1998 Annual Financial Statements Page 115 ------- ------- ACRONYMS ACPs AFO AHERA ALAPCO AMI ANPRM AOC APGs APO ASHAA BBDR BCCP BEACH BECC B&F BRLF BRS CAA CAFO CAGs CAMEO CBEP CCAP CCL CDC CEPPO CERCLA CFCs CFO Act CHAD CI CIPP COOP CSI CSRS CTAC CWA CWSRF Area Contingency Plans Animal Feeding Operations Asbestos Hazard Emergency Response Act Association of Local Air Pollution Control Officials Advanced Measurement Initiative Advanced Notice of Proposed Rulemaking Administrative Order on Consent Annual Performance Goals Administrative Penalty Order Asbestos School Hazard Abatement Act Biologically Based Dose Response Business Continuity and Contingency Planning Beaches Environmental Assessment, Closure, and Health Border Environment Cooperation Commission Buildings and Facilities Brownfields Revolving Loan Fund Biennial Reporting Systems Clean Air Act Concentrated Animal Feeding Operations Community Advisory Groups Computer Aided Management of Emergency Operations Community Based Environmental Programs Climate Change Action Plan Contaminant Candidate List Centers for Disease Control Chemical Emergency Preparedness and Prevention Office Comprehensive Environmental Response, Compensation and Liability Act Chi orofluorocarb ons Chief Financial Officers Act of 1990 Consolidated Human Activity Database Compression Ignition Critical Infrastructure Protection Plan Continuity of Operations Planning Common Sense Initiative Civil Service Retirement System Combustion Technical Assistance Center Clean Water Act Clean Water State Revolving Fund EPA's FY 1998 Annual Financial Statements Page 117 ------- CZARA Coastal Zone Act Reauthorization Amendments DBPs Disinfection By-Products DCIs Data Call-Ins DEIS Draft Environmental Impact Statement DOE Department of Energy DOJ Department of Justice DWSRF Drinking Water State Revolving Fund ECOS Environmental Council of the States EDA Economic Development Administration EJP Environmental Justice Program EPA Environmental Protection Agency EPCRA Emergency Planning and Community Right-To-Know Act EPM Environmental Programs and Management ETS Environmental Tobacco Smoke ETSD Enterprise Technology Services Division FACA Federal Advisory Committee Act FAS Fixed Assets Subsystem FASAB Federal Accounting Standards Advisory Board FEMA Federal Emergency Management Agency FERS Federal Employees Retirement System FFDCA Federal Food, Drug and Cosmetic Act FFMIA Federal Financial Management Improvement Act FIFRA Federal Insecticide, Fungicide and Rodenticide Act FIFRA '88 1988 Amendments to FIFRA FMFIA Federal Managers Financial Integrity Act FQPA Food Quality Protection Act FRM Final Rulemaking FRP Facility Response Plan FWPCA Federal Water Pollution Control Act FY Fiscal Year GLCPA Great Lakes Critical Protection Act GMRA Government Management Reform Act of 1994 GPRA Government Performance and Results Act of 1993 GS General Schedule GSA General Services Administration HABs Harmful Algal Blooms HAPs Hazardous Air Pollutants HCBD Hexachlorobutadiene HCFCs Hydrofluorocarbons Page 118 EPA's FY 1998 Annual Financial Statements ------- HHS Health and Human Services HQ Headquarters HSWA Hazardous and Solid Waste Amendments HUD Housing and Urban Development HWIR Hazardous Waste Identification Media and Process Rule IAQ Indoor Air Quality IDEA Integrated Data for Enforcement Analysis IESWT Interim Enhanced Surface Water Treatment IG Inspector General (also Office of Inspector General) IHS Indian Health Services IM Inspection and Maintenance IR-4 Program Inter-Regional Research Project Number 4 IRIS Integrated Risk Information System ITC Interagency Testing Committee IWI Index of Watershed Indicators LAN Local Area Network LDR Land Disposal Restrictions LEPCs Local Emergency Planning Committees LUST Leaking Underground Storage Tank MACT Maximum Achievable Control Technology MAIA Mid Atlantic Integrated Assessment MARS SIM Multi-Agency Radiation Survey and Site Investigation Manual MIMS Multimedia Integrated Modeling System MMTCE Million Metric Tons of Carbon Equivalent MOA Memorandum of Agreement MPG Miles Per Gallon MPPRCA Marine Plastics Pollution Research and Control Act MPRSA Marine Protection, Research and Sanctuaries Act MSW Municipal Solid Waste NAAQS National Ambient Air Quality Standards NAFTA North American Free Trade Agreement NAPLs Non-Aqueous Phase Liquids NAREL National Air and Radiation Environmental Laboratory NCP National Contingency Plan NEPA National Environmental Policy Act NEPPS National Environmental Performance Partnership Program NGA National Governors Association NHAPS National Human Activity Patterns Survey NHEXAS National Human Exposure Assessment Survey NOx Nitrogen Oxide EPA's FY 1998 Annual Financial Statements Page 119 ------- NOAA National Oceanic and Atmospheric Administration NODAs Notices of Data Availability NPDES National Pollutant Discharge Elimination System NPL National Priorities List NPS Nonpoint Source NSR New Source Review NSR/PSD New Source Review/Prevention of Significant Deterioration NVFEL National Vehicle and Fuel Emissions Laboratory OAQPS Office of Air Quality Planning and Standards OAR Office of Air and Radiation OC Office of the Comptroller OCFO Office of the Chief Financial Officer OECA Office of Enforcement and Compliance Assurance OECD Organization for Economic Cooperation and Development OERR Office of Emergency and Remedial Response OIG Office of Inspector General OMB Office of Management and Budget OPA Oil Pollution Act OPPT Office of Pollution Prevention and Toxics ORD Office of Research and Development OSLTF Oil Spill Liability Trust Fund OSPS Outreach and Special Projects Staff OSRE Office of Site Remediation Enforcement OSW Office of Solid Waste OSWER Office of Solid Waste and Emergency Response OTAG Ozone Transport Assessment Group OTR Ozone Transport Region OUST Office of Underground Storage Tanks OW Office of Water PALs Plant-wide Applicability Limits PBTs Persistent Bioaccumulative Toxics PCBs Polychlorinated Biphenyls PDD Presidential Decision Directive PM Particulate Matter pm25 Fine Particulate Matter PM10 Coarse Particulate Matter PMN Premanufacture Notice PPA Pollution Prevention Act PP&E Property, Plant and Equipment PPAS Personal Property Accountability System PPGs Performance Partnership Grants PRO Program and Research Operations Page 120 EPA's FY 1998 Annual Financial Statements ------- PRPs Potentially Responsible Parties PRTRs Pollutant Release and Transfer Registries PSD Prevention of Significant Deterioration PWS Public Water System PWSS Public Water System Supervision RBCA Risk-Based Corrective Action RCRA Resource Conservation and Recovery Act RCRIS Resource Conservation and Recovery Information System RD/RA Remedial Design and Remedial Actions RED Reregi strati on Eligibility Decision RIA Regulatory Impact Analysis ROD Record of Decision RMPs Risk Management Plans RP Responsible Party SARA Superfund Amendments and Reauthorization Act SDWA Safe Drinking Water Act SDWIS Safe Drinking Water Information System SEPs Supplemental Environmental Projects SERCs State Emergency Response Commissions SFFAS Statement of Federal Financial Accounting Standard SFIP Sector Facility Indexing Project SIPs State Implementation Plans SITE Superfund Innovative Technology Evaluation SPA Shore Protection Act S02 Sulfur Dioxide SOL Statute of Limitation SOS Southern Oxidant Study SPA Shore Protection Act SPCC Spill Prevention Control and Countermeasures SRF State Revolving Fund SSCs Superfund State Contracts S&T Science and Technology STAPPA State and Territorial Air Pollution Program Administrators STAG State and Tribal Assistance Grants SWAP Source Water Assessment Program SWTR Source Water Treatment Rule TEA-21 Transportation Equity Act for the 21st Century TMDL Total Maximum Daily Load TRI Toxic Release Inventory TSCA Toxic Substances Control Act EPA's FY 1998 Annual Financial Statements Page 121 ------- UAOs Unilateral Administrative Orders UIC Underground Injection Control UNECE United Nations Economic Commission for Europe USD A U.S. Department of Agriculture UST Underground Storage Tank UWAs Unified Watershed Assessments WCF Working Capital Fund WIN Waste Information Needs WIPP Waste Isolation Pilot Plant WMPT Waste Management Prioritization Tool WRDA Water Resources Development Act Y2K Year 2000 1,3-BCP 1,3-Bichloropropne Page 122 EPA's FY 1998 Annual Financial Statements ------- For more information, contact: Financial Management Division U.S. Environmental Protection Agency 401 M Street, SW (2733R) Washington, DC 20460 EPA's FY 1998 Annual Financial Statements Page 123 ------- APPENDIX II AGENCY'S RESPONSE TO THE DRAFT REPORT Audit Report 99B0003 ------- August 16, 1999 MEMORANDUM SUBJECT: Audit of EPA's Fiscal 1998 Financial Statements Draft Audit Report No. E1AML8-20-7017 FROM: Sallyanne Harper /s/ Chief Financial Officer (2710) TO: James O. Rauch Assistant Inspector General for Audit (2421) Thank you for providing us the opportunity to comment on and provide our consolidated response to the recommendations made in the draft Fiscal 1998 Financial Statement audit report. Attachment I contains both the general and specific comments on the draft audit report. Attachment II contains the Agency's consolidated response to the report's recommendations. We appreciate the cooperation of you and your staff over the past several months to resolve outstanding issues. We also appreciate your offers to participate with us on various workgroups, such as the systems replacement workgroup, to address a number of issues raised in the audit. As you know, we are committed to continued improvements in financial management, with specific emphasis on improving the process that produces the Agency's financial statements. We have provided, in Attachment II, information on the actions that are planned or are already underway to implement improvements in the areas cited in your draft report. However, there are several recommendations that the draft audit report classified under reportable conditions that we believe should not be included in this category. The basis for our opinion on their classification is described in the Attachments. With respect to compliance with the Federal Financial Management Improvement Act, we continue to believe that we are substantially in compliance with the requirements of that law. In those areas where the audit cites deviations from procedural requirements, we have documented the steps we have taken to remedy those findings. If you have any questions regarding our response, please contact Jack Shipley, Director of the Financial Management Division, at 202-564-4905. Attachments cc: II- 1 ------- Steven A. Herman, Assistant Administrator for Endorsement and Compliance Assurance (2201 A) Romulo L. Diaz, Assistant Administrator for Administration and Resources Management (3101) Inspector General (2410) Assistant Administrator for Administration and Resources Management (3101) Acting Assistant Administrator for Solid Waste and Emergency Response (5101) Assistant Administrator for Enforcement and compliance Assurance (2201 A) General Counsel (2310) Comptroller (2731) Director, Office of Administration (3201) Director, Office of Acquisition Management (3801R) Director, Office of Grants and Debarment (3901R) Director, Office of Administration and Resources Management, Cincinnati, OH Director, Office of Administration and Resources Management, RTP, NC Acting Director, Office of Information Resources Management (3401) Director, Office of Site Remediation Enforcement (2271 A) Director, Office of Emergency and Remedial Response (5201G) Director, Annual Planning and Budget Division (2732) Director, Grants Administration Division (3903R) Director, Enterprise Systems Division (3409) Director, Facilities Management and Services Division (3204) Director, Financial Services Division (2734R) Director, Enterprise Technology Services Division, OIRM, RTP, NC Financial Management Officers at Regions 1, 2, 3, 4, 5, and 9, Cincinnati, Las Vegas, and Research Triangle Park Divisional Inspectors General for Audit Chief, Financial Reports and Analysis Branch (2733R) Chief, Program and Cost Accounting Branch (2733R) Chief, Financial Systems Branch (2733R) Chief, Financial Policies, Procedures and Compliance Branch (2733R) Chief, Washington Financial Management Center (2734R) Acting Chief, Security and Property Management Branch (3204) Kathy Sedlak O'Brien, Agency Audit Follow-up Coordinator (2724) Brigid Rapp, Audit Liaison for the Office of the Chief Financial Officer (2710) Saundra Womack-Butler, Audit Liaison for the Office of Administration and Resources Management (3102) Gwendolyn Spriggs, Audit Liaison for Office of Acquisition Management (3802R) Elizabeth Harris, Audit Liaison for the Office of Solid Waste and Emergency Response (5103) Tom Pastore, Audit Liaison for the Office of Administration (3201) Linda Garrison, Audit Liaison for the Office of Information Resources Management (3401) Greg Marion, Audit Liaison for the Office of Enforcement and Compliance Assurance (2201 A) John Showman, Audit Liaison for the Grants Administration Division (3901R) Pat Gilchriest, Audit Liaison for the Administrator's Office (1104) II-2 ------- A1 Demarcki, Audit Liaison for the Financial Management Division and the Financial Services Division (2733R) William Stewart, Audit Liaison for the Office of General Counsel (2311) Roland Cyr, Audit Liaison for the Financial Audit Division (2422) II-3 ------- ATTACHMENT I GENERAL AND SPECIFIC COMMENTS ON THE DRAFT AUDIT REPORT E1AML8-20-7017 FISCAL YEAR 1998 FINANCIAL STATEMENTS AUDIT EXECUTIVE SUMMARY Evaluation of Internal Control Page ii. Material Weakness. Second Paragraph. Second Sentence The draft audit report points out difficulties in preparing the financial statements and notes "conversion of accounting information from EPA's predecessor accounting system" as one of the weaknesses. The OIG found only six grants in error out of the numerous open obligations converted, and the balances for these six grants were not material to the financial statements. In addition, SFOs received procedures on how to review the converted data and enter any missing obligations. Based on these considerations, we believe that the presentation of the 1989 data conversion as a serious weakness is not warranted. [See Appendix III, Note 1 for additional OIG Comments] Page ii. Reportable Conditions The report includes documenting automated controls within the Agency's accounting system as a reportable condition. The accounting system documentation is in compliance with the applicable Federal financial system requirements as determined by a recent independent review conducted by the Department of Treasury's Financial Management Service Center for Applied Financial Management. Consequently, the accounting system documentation should not be considered a reportable condition. [See Appendix III, Note 2 for additional OIG Comments] Page ii last paragraph. Page iii. First Paragraph, and on Pages 12 and 13. "Other Noncompliance Issues." "EPA is not complying with appropriation law when making disbursements for grants funded with more than one appropriation." The report recognizes that this finding did not cause a material misstatement to the financial statements nor was it a substantial noncompliance. Nonetheless, the audit report describes the issue as "significant." Regarding current status, for the past few months, we have been providing information to OGC so that OGC can finalize its legal opinion on our accounting practices with respect to grants funded with multiple appropriations. While we expect this process to proceed expeditiously, and we will make changes in our accounting practices if required as a result of OGC's opinion, we disagree with the classification of this issue. First, II-4 ------- only a very small percentage of Agency grants currently have balances of unliquidated obligations from more than one appropriation-we estimate 1% or less now, and declining (see second point below). The Grants Administration Division has acted to discourage multiple appropriation funded grants in response to the OIG's recommendations on this issue in prior reports, which has reduced the number of affected grants. And as we have noted in earlier communications, the OIG's concerns are about a temporary charging situation, and when grants are closed, charges would have been made to the appropriate accounts. Second, and very important, Policy Announcement 98-10, Accounting for Resources under the Government Performance and Results Act (GPRA), changed the way that grants, as well as other Agency transactions, are charged. For all grants funded with FY99 and later funds, obligations and payments are allocated to PRCs, which are appropriation specific, and therefore the temporary charging practices that were of concern are resolved. Because of the changes in grant award practices and the very major change in accounting policies and procedures, we believe the residual of multiple appropriation funded grants does not merit reporting as a significant finding and should be excluded from the final report. [See Appendix III, Note 3 for additional OIG Comments] Compliance with the Federal Financial Management Improvement Act Page iii. Second Paragraph While we agree with the audit that we are, to a degree, in non-compliance with the Federal Financial Management Improvement Act (FFMIA), we disagree that our systems are in substantial non-compliance. We requested the Department of Treasury's Financial Management Service Center for Applied Financial Management to review EPA's financial and "mixed" systems. After a review of both our documentation and actual procedures, Treasury has informed us that these systems meet OMB Circulars A-127 and A-130 in all material respects. Based on this review and the preliminary conclusions from a separate review conducted by the National Security Agency (NSA), we disagree with the audit's finding that these systems are in substantial non-compliance with the FFMIA. [See Appendix III, Note 4 for additional OIG Comments] Page iv The draft report recommends we develop a remediation plan to address the Federal Financial Management Improvement Act (FFMIA) audit issues and recommendations. We will prepare action plans to address security weaknesses and areas of non-compliance, as appropriate. However, a remediation plan is unnecessary based on our position that the financial systems are in substantial compliance with FFMIA requirements. [See Appendix III, Note 5 for additional OIG Comments] II- 5 ------- INTRODUCTION EVALUATION OF INTERNAL CONTROL Page 6. Material Weaknesses. Second Paragraph. Second Sentence The report points out difficulties in preparing the financial statements and notes "conversion of accounting information from EPA's predecessor accounting system" as one of the weaknesses. The OIG found only six grants in error out of the numerous open obligations converted, and the balances for these six grants were not material to the financial statements. In addition, SFOs received procedures on how to review the converted data and enter any missing obligations. Based on these considerations, we believe that the presentation of the 1989 data conversion as a serious weakness is not warranted. [See Appendix III, Note 1 for additional OIG Comments] Page 8. fourth bullet item, third sentence. "Agency management believes the documentation is sufficiently detailed, but acknowledges the IFMS data dictionary should be upgraded." We acknowledge that the IFMS data dictionary could be improved, but also believe that the recommended IFMS data dictionary enhancements and related on-going maintenance would only be cost effective, given the system's maturity and life-cycle stage, in the context of the replacement of our legacy systems. [See Appendix III, Note 6 for additional OIG Comments] Pages 8-10. starting with the fifth bullet item The draft audit report discusses controls and processes managed by OIRM. The OIG issued specific audit reports covering these issues to the Director for Information Resources Management, and we recognize that OIRM will respond directly to these issues. Page 10. First Sentence The report states that the systems issues addressed to the Director for Information Resources Management "warrant mention in this report because they relate to the Agency's financial statements." Although this appears to be a statement of the obvious interrelationships of all parts of a "system," we have not had a detailed discussion of this issue. We request the audit report elaborate on how the issues raised on the regional systems and with OIRM on pages 8-10 relate to the financial statements. Because of OCFO's responsibility for the integrity of all Agency financial systems, we are eager to work with OIRM and OIG to address any and all systems issues related to financial statements. [See Appendix III, Note 7 for additional OIG Comments] II-6 ------- Page 10. Second to last Paragraph The report discusses an audit of the contract covering the operations, maintenance, and enhancement of IFMS, MARS, and CPARS. We recommend that this discussion be removed from this section since it appears to address a different topic and does not relate to the financial statements. [See Appendix III, Note 8 for additional OIG Comments] Page 11. third bullet This section of the report discusses deficiencies in the Agency's security planning. With regard to financial systems, we believe the financial and "mixed" systems are in substantial compliance with the applicable requirements of FFMIA, as we discussed previously in this Attachment. [See Appendix III, Notes 4 and 5 for additional OIG Comments] TESTS OF COMPLIANCE WITH LAWS AND REGULATIONS Page 12. Federal Financial Management Improvement Act Compliance Section "We found EPA was not in substantial compliance with the FFMIA requirements because of weaknesses in the Agency's financial statement preparation process." We agree that the Agency's financial statement process needs improvements to ensure timeliness. However, as we note in our "General Comments" below, we do not agree that the financial statement process is in substantial non-compliance with FFMIA. We also disagree with the following sentence: "As a result, the Agency does not have reasonable assurance that existing controls would prevent unauthorized disclosure or manipulation of data, ..." As noted above, Treasury's Financial Management Service Center for Applied Financial Management recently issued reports on nine EPA financial and "mixed" systems. These systems were found to meet OMB Circular A-127 and A-130 requirements "in all material respects." [See Appendix III, Note 9 for additional OIG Comments] MATERIAL WEAKNESSES IMPROVEMENTS NEEDED IN THE AGENCY'S PROCESS FOR PREPARING FINANCIAL STATEMENTS AND AGENCY ENCOUNTERED SIGNIFICANT DIFFICULTIES IN PREPARING THE STATEMENTS OF BUDGETARY RESOURCES AND FINANCING GENERAL COMMENT This is a consolidated response to the two proposed material weaknesses entitled "Improvements Needed in the Agency's Process for Preparing Financial Statements" and "Agency Encountered Significant Difficulties in Preparing the Statements of Budgetary Resources and Financing." The first finding addresses financial statement preparation in II-7 ------- general, and the second addresses difficulties specific to the preparation of one statement, the Statement of Budgetary Resources. We found many of the reported issues and recommendations overlapped, and believe a comprehensive analysis will be more beneficial for the Agency. Management's goal is to prepare reliable, timely Financial Statements. The unqualified audit opinions on the FY 1998 Financial Statements demonstrates the accomplishment of our reliability objective. The primary focus of both audit findings was on making improvements to accomplish our timeliness objective. We agree with the draft report that the financial statement preparation and audit processes require substantial coordination among EPA offices. We have developed a comprehensive strategy for FY 1999 which will facilitate our offices' accomplishment of meeting the March 1, 2000, deadline. We are finalizing our FY 1999 financial statement preparation and audit action plan and will discuss it with the OIG for their concurrence upon review and approval by OCFO. Several of the delays cited in the two findings highlight the need for improved coordination and cooperation between our offices. We should note that in all instances our Offices reached agreement prior to the delay, and some delays, such as with the Required Supplemental Stewardship Information, were at the OIG's request. [See Appendix III, Note 10 for additional OIG Comments] Page 1-1. paragraph 1 "...our Office and the Office of the Chief Financial Officer agreed that the OCFO would provide us a complete set of draft financial statements...by November 17, 1998,...Although committed to the above milestones, the OCFO encountered difficulties in preparing, reliable, financial statements...and did not meet the March 1 report issuance date." In the planning phase of the audit, our offices agreed that it was not prudent to delay the submission of draft financial reports until all external data components were available to management and incorporated into the draft. The incomplete line items and footnotes cited in the Draft Audit Report were covered by this agreement. The supporting schedules provided to the OIG in July 1999 were the result of audit inquiries arising from the field audit work being done at that date. While this audit process was marked by a high degree of cooperation between our Offices, we recognize there is always room for improvement and that improved coordination would have likely prevented much of the confusion that caused the delays. [See Appendix III, Note 11 for additional OIG Comments] Page 1-2. Paragraph 1. Obtaining Information from Other Agency Offices and External Sources "Delays in obtaining information from various entities inside and outside the Agency prevented the timely calculation of the grant accrual, deferred maintenance, and environmental liability amount." II- 8 ------- We agree that the current process is cumbersome and imposes undue reporting requirements on the public. We are hopeful that we can reach agreement on a more efficient methodology for FY 1999 such as an analytical approach to compute this accounting estimate without sending questionnaires to the Agency's grantees . We plan to meet with the OIG soon on this issue. Page 1-2. Paragraph 2. Implementing New Financial Accounting Standards and OMB Financial Statement Guidance The discussion in the draft audit report of the implementation of the Supplementary Stewardship Reporting is factually inaccurate in several key regards. A draft of the report was provided to the OIG on November 17, 1998, along with the Agency's draft financial statements. This draft included complete data for investment in non-federal property, investment in research and development, and stewardship land. As agreed, human capital was not included in the draft because there were questions about the applicability of the standard to EPA's training and awareness grant programs. To help resolve the question of applicability, the OIG committed to perform additional research that supported their position and to provide a fact sheet for FMD to review by October 31, 1998. If there was still disagreement, the parties agreed to discuss the matter with the Executive Director of the FASAB. The OIG's fact sheet was not completed until November 14, 1998, which delayed the meeting with FASAB until November 19. After the meeting with FASAB, FMD agreed to include human capital in the 1998 Stewardship Report. FMD issued a second draft of the Stewardship Report on December 6 which included human capital. In October 1998, FMD and the OIG agreed that the activities in question of being human capital investment could be captured by running a simple report for two grant sub-object classes. This data was available for audit in October 1998, but we did not receive audit questions until December 1998, when the audit began. [See Appendix III, Note 12 for additional OIG Comments] Page 1-4. First Paragraph OIG staff agreed that the BFY 1989 and prior balances for unliquidated obligations and budget authority are not materially misstated. Therefore, the reference to conversion problems should be deleted from the audit report — in the first paragraph of page 1-4 of the draft report, and also in the "Data Conversion Errors" section of page 1-6. Since only $7.5M of the $239.9 M unliquidated obligations from BFY 1989 and prior where conversion errors, there is concrete evidence that this problem could not "have occurred in all unliquidated obligation balances appropriated in 1989 and prior." The draft audit report includes incorrect amounts on page 1-5. "Agency's Actions to Correct Weakness in the Fiscal 1998 Deobligation Process," understates the amounts of unliquidated obligations reviewed. The correct amounts are as follows: $153.9M for IAGs, $45.8M for II-9 ------- contracts, $704.4M for nonconstruction grants, and $324.8M for construction grants. [See Appendix III, Note 13 for additional OIG Comments] Page 1-5. First and Second paragraphs Unliquidated Obligation (ULO) balances were reported in the CFO Financial Statements for the first time in FY 1998. The Agency reviews inactive unliquidated obligation balances annually, and program managers are instructed to initiate deobligation action for all unneeded balances. After audit field work began, the OIG raised two distinct issues: 1) ULO balances at year end were significantly overstated; and 2) the beginning balance at 10/1/98 must be reviewed to ensure an accurate beginning balance. Management developed methodologies to resolve the issues, developed corrective action plans, and agreed with the OIG on time frames to resolve the issues for the FY 1998 Financial Statements. Management and the OIG met with GAO and OMB on January 27, 1999, and agreed EPA would proceed with a special review to ensure fair presentation of ULO balances. The sentiment among all parties was that it was better for EPA to submit financial statements with unqualified audit opinions after March 1, 1999, than to submit unreliable statements on time. EPA's financial managers completed the ambitious action plan and delivered the final piece of the completed analysis to the OIG on March 10, 1999. The OIG performed its field audit between March and June 1999, and concurred with the adjustments on June 28, 1999. Page 1-6. Last Paragraph through Page 1-7. First Paragraph. Difference Existed Between EPA's General Ledger and Its Budgetary Reports Material differences existed between EPA's general ledger, the numerous draft versions of its Statement of Budgetary Resources, and the reports on Budget Execution (SF-133s) submitted to OMB." Regarding the SF-133 adjustments, many adjustments were not posted into the FY 1998 Agency's core financial system because management decided it was not prudent to hold open the General Ledger until the completion of the SF-133. To do so would have caused serious delays for the other financial statements. We are expediting the preparation of the SF 133 through automation beginning in FY 1999; this will allow us to keep the prior year books open for a reasonable time to ensure all SF-133 adjustments are posted to the General Ledger. Budgetary reporting has changed significantly over the past three years due to changes in OMB requirements and budget execution. In 1996, OMB Circular A-34 was modified to require that budgetary reports be produced using entirely different sets of General Ledger accounts. This change required significant modifications and additions to the budgetary General Ledger, which were not completed until Fiscal Year 1998. Also, budget execution process changes were not completely implemented until Fiscal Year 1998. These significant changes made preparing the II- 10 ------- SF-133 directly from the budgetary General Ledger impossible. General Ledger balances were adjusted to ensure the accuracy of the reports. Management and the OIG agreed the Statement of Budgetary Resources would be prepared using the actual SF-133s submitted to OMB, and copies of the SF-133s were provided to the OIG for review in June 1998. Numerous technical factors prevented a complete reconciliation between the SF 133s and the General Ledger, and instead, management agreed to produce the Statement of Budgetary Resources from the General Ledger. Through a compromise of alternatives and cooperative efforts with the OIG, there were a number of iterations of the Statement of Budgetary Resources before arriving at a final Statement. Some of the iterations were a result of approaches to the presentation of the Statement, whereas other iterations were a result of the special review to arrive at an acceptable adjustment to unliquidated obligations. The Statement of Financing is a reconciliation between the Statement of Net Cost and the Statement of Budgetary Resources; this statement could not be finalized until the Statement of Budgetary Resources was finalized. Completion of this report was prepared timely when considering the fact that the Statement of Financing could not be derived directly from a standard U.S. General Ledger crosswalk because such a crosswalk was not available throughout the Federal Government for the FY 1998 reports. Additional reporting was required on some General Ledger accounts in order to arrive at various components that impacted either the Statement of Net Cost or the Statement of Budgetary Resources. We are automating this process for the FY 2000 statements, and we do not anticipate having a similar problem with preparing a timely FY 1999 Statement of Financing. [See Appendix III, Note 14 for additional OIG Comments] REPORTABLE CONDITIONS AGENCY NEEDS TO ESTABLISH PROCEDURES FOR TRACKING UNILATERAL ADMINISTRATIVE ORDERS Page 2-1. First Paragraph. Last Sentence The statement that reads "Consequently, regions were circumventing controls designed to ensure funds are safeguarded against unauthorized use or disposition" should be deleted. This statement's reference to circumventing of controls is misleading. In the first place, UAO's were not covered in existing financial management policies because they were not seen as events leading to financial transactions. Rather, UAOs were enforcement tools designed to compel Responsible Parties to undertake site clean-up. A demand for payment of oversight or enforcement costs under a UAO is not sufficient itself to recognize an accounts receivable. Secondly, the report's reference to "ensure funds are safeguarded against unauthorized use or disposition" is not germane to this issue. The question here involves whether a UAO event 11-11 ------- triggers a financial transaction to establish an account receivable, not how funds are used or disposed of. [See Appendix III, Note 15 for additional OIG Comments] FURTHER IMPROVEMENTS NEEDED IN MANAGING EPA'S ACCOUNTS RECEIVABLE Specific Comments: (These comments directly coincide with the Agency responses to OIG recommendations. Please note the changes proposed to the OIG recommendations) Page 2-3. First Paragraph It is not clear to us why the issue of timely billing of Superfund oversight costs and the unbilled oversight accrual reductions are included in this reportable condition. We strongly believe that this portion of the reportable condition should be eliminated. The Agency, as reported and certified by the regional offices, has achieved an up-to-date billing status and also has had an accepted unbilled accrual methodology in place for 3 years. The regional certifications and schedules on the up-to-date billing status were given to the OIG for review in December 1998. OCFO staff were never advised that OIG had any issues or problems regarding their review of the regional submissions. When the billing issue was raised in the FY 1997 audit, the CFO responded with appropriate corrective action, and the desired results achieved. [See Appendix III, Note 16 for additional OIG Comments] Some Accounts Receivable Were Not Timely Recorded and Billed Page 2-3. Second Paragraph We believe the OIG reference of two late billing scenarios for oversight costs are anecdotal situations which do not reflect on the Agency's current billing of oversight costs. Putting these amounts in the report would lead a reader to believe those situations were the norm and reflective of the Agency's billing practices, when these were unique scenarios and do not represent Agency practices. These scenarios should be eliminated entirely. [See Appendix III, Note 16 for additional OIG Comments] Page 2-3 and 2-4. Second paragraph Modify the sentence that starts "As a result the amount from $162 million to $71 million", to read "from $162 million to $62 million." The 16th month general ledger reflects $71 million, however the detail which supports the Consolidated Statement of Financial Position for FY 1998, dated April 15, 1999, reflects $61,837,454 in the unbilled oversight account (acct. 132C). The difference is due to regional adjustments accepted and approved by the OIG. Accordingly, this change should be implemented. II- 12 ------- We are concerned by this statement as it implies that there are oversight dollars that we can bill and have not done so. This is either a mis-wording or a possible misunderstanding by the OIG regarding unbilled oversight costs. There will always be a balance for unbilled oversight. Since the Agency bills on a yearly basis (a practice required under most Consent Decrees), it is fully expected that every site, at some point, will have eleven months of outstanding costs that have not been billed. Accordingly, the subject sentence should be eliminated entirely to avoid the potential for misinterpretation. [See Appendix III, Note 16 for additional OIG Comments] AUTOMATED APPLICATION PROCESSING CONTROLS FOR THE INTEGRATED FINANCIAL MANAGEMENT SYSTEM COULD NOT BE ASSESSED Page 2-16. Paragraph 2. Second Sentence "We continue to believe that systems documentation is a reportable condition, because it does not comply with Federal systems documentation requirements for an integrated financial management system, as stated in JFMIP's Framework for Federal Financial Management Systems. The IFMS systems documentation is in compliance with applicable requirements, as supported by a recent in-depth independent review by the Department of Treasury's Finance Management Service Center for Applied Financial Management (Center). The Center assessed IFMS documentation as of September 30, 1998 for compliance with the following OMB, JFMIP, and GAO guidance: OMB Circular A-127, "Financial Management Systems, JFMIP's Framework for Federal Financial Management Systems (FFMSR-0. January 1995), GAO's Framework for Federal Financial Management System Checklist Systems Reviewed Under the Federal Financial Management Improvement Act of 1996 (GAO Financial Management Series, May 1998), and GAO's Assessing the Reliability of Computer Processed Data (GAO, April 1991). In their May 24, 1999 report, the Center concluded that the IFMS documentation is in compliance with OMB Circular A-127 Financial Management Systems, JFMIP requirements and GAO guidance. We provided the OIG with a copy of this report and suggested the auditors acknowledge the report and consider the report findings. [See Appendix III, Note 2 for additional OIG Comments] Page 2-16. Paragraph 2. Third sentence "Office of the Comptroller (OC) managers continue to believe that IFMS documentation is sufficiently detailed, but acknowledge the IFMS data dictionary should be upgraded." II- 13 ------- We believe the IFMS documentation is sufficiently detailed in the context of our legacy system, but the second part of that sentence should be clarified. The Center's review of our documentation recommended that when we transition to a new system we should prepare a detailed data dictionary. We concur with that recommendation and do not believe the current data dictionary needs to be upgraded for the existing IFMS system. [See Appendix III, Note 6 for additional OIG Comments] COMPLIANCE WITH LAWS AND REGULATIONS EPA IS NOT IN SUBSTANTIAL COMPLIANCE WITH FEDERAL FINANCIAL MANAGEMENT SYSTEM REQUIREMENTS Page 3-1. Second Paragraph "In the Agency's remediation plan, dated March 31, 1999, EPA's Comptroller advised OMB that all corrective actions were completed...To the contrary, our fiscal 1998 audit work again identified weaknesses in the Agency's security planning..." The Agency completed the security plans called for in our remediation plan. As of March 31, 1999, the date the memo was signed, the memo accurately portrayed the status at the time. During Fiscal Year 1999 the auditors reviewed our completed security plans. These security plans substantially comply with applicable requirements. [See Appendix III, Note 17 for additional OIG Comments] Page 3-1. Paragraph 4. Last Sentence "We believe that the security concerns are of a paramount nature, and EPA need to take reasonable corrective actions to mitigate the threat of financial data being intentionally or accidently compromised by either external or internal sources." We agree that security is an important, high priority item, and have controls in place to mitigate the threat of the compromise of financial data. [See Appendix III, Note 18 for additional OIG Comments] Page 3-1. Fifth Paragraph "We have been diligently meeting with senior Financial Management Division, Financial Services Division and Grants Administration Division officials...and have provided additional information to them..." OIG did not consider much of the additional information provided by FMD and FSD management. II- 14 ------- Before the issuance of the Draft Audit Report No. E1AML8-20-7017, dated July 30, 1999, the OIG provided some of the Report's findings to OCFO in their draft (January 1999) and final (March 9, 1999) AAAS Position Paper #1, EPA is not in Substantial Compliance with System Requirements under the Federal Financial Management Improvement Act of 1996 (AAAS #11 OCFO provided OIG with written responses to both the draft and the final versions of AAAS #1. The response to the January 26, 1999, draft of AAAS #1, was signed by both the Director, Financial Management Division (FMD) and the Director, Financial Services Division (FSD) on February 8, 1999. The response to the March 9, 1999, final AAAS #1, was signed by the Director, FSD, on June 3, 1999. Both responses offered general information about system security and detailed information about specific systems. The report does not appear to have considered this information, especially the June 3, 1999, response. As another example, OCFO provided a copy of the independent review final report from Booz- Allen Hamilton dated December 15, 1995. As issued, this Booz-Allen Hamilton report fulfills the independent review requirements of both A-127 and A-130, yet the draft report does not mention nor acknowledge the importance of the report. [See Appendix III, Note 19 for additional OIG Comments] Page 3-2. First Paragraph. First Sentence "EPA is not in substantial compliance with..." We disagree with this statement. We believe that EPA's financial systems are in substantial compliance with the FFMIA (the Brown Bill). We have implemented the OMB and JFMIP requirements. This was confirmed by the independent Treasury review and the ongoing NSA security assessment. [See Appendix III, Notes 4 and 5 for additional OIG Comments] Page 3-2. Second Bullet "Management had not approved security plans..." This sentence is misleading. The chart below shows the security plan approval status as of September 30, 1998. Plan Owner Approval Status as of 9/30/98 CDOTS OAM Security plan was completed and approved by the SIRMO and system owner. The word "draft" was mistakenly not removed from the plan document, and the SIRMO did not formally sign the plan until mid- October 1998. ICMS OAM Same as CDOTS. II- 15 ------- SPEDI OAM Same as CDOTS. CIS OAM Same as CDOTS. CTS Region 5 No security plan. However, CTS is not an Agency- wide system. CTS has no interface to IFMS, and no systems issues related to Region 5 receivables were identified during the audit. ETAMS OCFO Security plan was under development at the time OCFO placed the system "on hold" in early 1998. The project was placed "on hold" due to significant security concerns raised during system development. Subsequently, because the Agency's payroll system is to be replaced, management decided to not expend any additional resources on this system. BAS OCFO Plan approval expired on 6/30/98. Open action items remained for the security training/handbook, continuity planning (LAN), risk assessment, and revised incident reporting. The system operated while the open items were being addressed. TM+ OCFO Security plan was under development, and TM+ was under phased development. At 9/30/98 TM+ was functioning as a forms generator on a pilot basis. While the above plans were not formally approved, two of the systems were not operational and posed no security risk. The four OAM systems were approved but the documentation was not timely. One system had a recently expired security plan. Only one system lacked a security plan altogether, and this system was a regional system not interfaced to the core financial system. Although these systems are not technically in compliance, the risks posed by these noncompliances is minimal and do not support an opinion of substantial noncompliance. [See Appendix III, Note 20 for additional OIG Comments] Page 3-2. Fourth Paragraph "Our review of compliance with OMB Circular A-130 was limited to evaluating the approved system security plans and supporting documentation from financial or mixed-financial management system under development or operational as of September 30,1998..." On page 3-3, immediately following Table 1, the auditors state, "We did not verify the security controls identified in the system security plans were operational." II- 16 ------- In essence, the OIG limited its review to security documentation and did not review, observe, or otherwise test actual security operating controls. This scope limitation appears to be in conflict with the statements made on page 15 that the OIG (among other things) "tested significant controls to determine whether the controls were effective," and on page 16 that it interviewed personnel and reviewed applicable policies and procedures. Apparently, this actual testing and interviewing was not performed with respect to system security controls. [See Appendix III, Note 21 for additional OIG Comments] Page 3-4. Table 2 The "yes/no" indicator does not accurately reflect the degree of noncompliance. An area can have only minor noncompliances and still receive a "no" response in Table 2. [See Appendix III, Note 22 for additional OIG Comments] Page 3-5. First and Second Paragraphs The discussion does not accurately reflect the facts. For IFMS, MARS, CPARS, EPAYS, and GICS, the final report issued by Booz-Allen & Hamilton, Inc. is dated December 15, 1995. This makes the report less than three years old as of September 30, 1998, and thus within the requirements of OMB Circular A-130. While EPA questioned the classification of review findings included in the report, and in 1996 issued a revised version indicating management's classification of the findings, this does not impair the original final report issued by Booz-Allen & Hamilton. In addition to this independent review, EPA had contractors conduct formal risk assessments for MARS and CPARS (dated June 3, 1996, and July 1, 1996, respectively). These risk assessments were to complement, not replace, the independent assessments required by OMB Circulars A-127 and A-130. With respect to ARTS, we maintain that the OIG reviews represent at least a partial independent review of ARTS within three years of September 30, 1999. In addition, ARTS does not meet the definition of a major application, and was a stand-alone data base until 1996. Since six of the eight systems clearly meet the requirement for an independent review every three years, with one system under development (and, therefore, classified as A"N/A" in Table 2), and the remaining system in at least partial compliance, we strongly believe that the Agency is in substantial compliance with regard to the independent review requirements. [See Appendix III, Note 23 for additional OIG Comments] Page 3-5. Third Paragraph "none of the plans, including CPS, had referenced operational security problems identified by an independent review..." II- 17 ------- While we agree that the security plans should reference the findings included in the independent reviews, and at least reference the action plans developed to address the findings, the findings have been addressed in separate documents and these documents have been reviewed and accepted by management. Management considered these documents, as well as the security plans, when authorizing the systems for operation. We believe, then, that the omission of the independent review findings from the security plans is a technical noncompliance, but poses little security risk since management is fully aware of the independent review findings, action plans, and status. [See Appendix III, Note 24 for additional OIG Comments] Page 3-5. Fourth Paragraph. Last Sentence "Furthermore, we considered security plans which used older criteria (i.e., prior to the February 1996 version of OMB Circular A-130) to be based on outdated requirements." ... "In the interim, agencies should continue to use the Appendix of OMB Bulletin No. 90-08 as guidance for the technical portion of their security plans." OMB Circular A-130, Appendix III, B.a.2. directs NIST to update and expand security guidance. NIST did not issue security plan guidance (NIST 800-18) in final until December 30, 1998. Therefore, as of September 30, 1998, agencies were instructed to use OMB Bulletin 90-08 for security plan guidance. All plans used the 1996 EPA OIRM Security Planning guidance document as their security plan guide. This guide incorporates OMB circulars and NIST Guidance. [See Appendix III, Note 25 for additional OIG Comments] Page 3-5. Fifth Paragraph. "We provided detailed comments to management for security control deficiencies, noting each category to be documented by OMB Circular A-130. These detailed comments identified specific OMB, NIST or Agency requirements, and were provided separately because they were voluminous." We reviewed each of the detailed comments provided by the auditors, and noted a number of disagreements with the auditor's findings. Comment Classification Number of Specific Audit Findings Disagreement with auditors on the applicable requirements, based on OMB Circular A-130 Appendix III "general" system vs. "major" application requirements. EPA complies. 95 II- 18 ------- NIST 800-18 used as security plan guidance criteria; NIST 800-18 was not issued in final until 12/30/98. OMB Bulletin 90-08 was the security plan guidance in effect as of 9/30/98. EPA complies. 7 EPA and auditors disagree on whether the content of EPA provided documentation complies with Federal requirements. 43 Subtotal - EPA concludes the Agency is in compliance 145 NIST 800-12, 800-14, and GAO Y2K guidance used by auditors as criteria for security plan content. EPA concludes these documents do not specifically apply to security plan content. EPA, however, concludes that in some of these cases, documentation could be improved. 62 EPA agrees that the Agency is not in compliance 27 Subtotal - EPA not in full compliance 89 Total specific IG findings 234 The 89 specific findings where EPA is not in full compliance fall into three major areas: EPA needs to implement general and application specific training. While this is a control weakness, EPA believes the risk is not substantial due to informal on-the-job training and built-in system controls. Security plans need to better identify the system interfaces and specific edits or other reconciliation controls. Documentation exists, but can be expanded and better consolidated and referenced. Security plans need to better reference disaster recovery plans. EPA recognizes these control weaknesses, but does not believe they warrant a substantial noncompliance opinion. In addition, our February 1999 and June 1999 memos address this point. The security plans in place on September 30, 1998, are the first security plans developed by FSD. These security plans carefully considered the requirements from OMB and NIST that were in effect at that time, and attempted to strike a balance between providing enough detail for proper evaluation, and protecting sensitive information from unauthorized eyes. Additional information is available to authorized persons on request from the system managers. [See Appendix III, Note 26 for additional OIG Comments] Page 3-6. First Paragraph "For example,... we determined that the security plans for IFMS,..." II- 19 ------- The draft report criticizes the security plans for not describing or referencing "a minimum set of specific controls used for managing user accounts." The plans do, in fact, describe the overall controls, and this meets the OMB and NIST requirements in effect as of September 30, 1999. Moreover, the draft report confuses requirements for system security with guidelines for the contents of security plans. For example, the report cites NIST Publication 800-14. NIST 800-14 sets forth a framework for system security in the federal government. (See NIST 800-14, §1.4). However, as we pointed out in our June memo, a guidance framework is quite distinct from the requirements for a written security plan. NIST security plan guidance is in NIST Publication 800- 18, which postdates the 1998 Financial statement Audit. The level of detail in the CPS security plan meets the OMB and NIST requirements that were in effect on September 30, 1998. Although our revised security plan for CPS, approved by the SIRMO May 27, 1999, adds somewhat more detail to comply with the new NIST guidance, we continue to believe that offering too much detail in a security plan is in itself a security risk. In addition, the auditors make strong conclusions regarding security controls given that the auditors "did not verify the security controls identified in the system security plans were operational." In essence, the auditors limited their review to security documentation and did not review, observe, or otherwise test actual security operating controls. This does not appear to be consistent with the applicable auditing standards. At the end of Fiscal Year 1998, EPA established an interagency agreement with the Treasury Department's Financial Management Service Center for Applied Financial Management to perform independent reviews of nine financial or mixed-financial systems as required by OMB Circulars A-127 and A-130. The reviews tested how well these systems complied with OMB Circulars A-127 and A-130, and JFMIP Core Financial and Personnel & Payroll requirements. These reviews concluded that these nine systems met the above requirements "in all material respects." The systems reviewed included: the Integrated Financial Management System (IFMS), EPA's Payroll & Personnel System (EPAYS), the Combined Payroll Redistribution & Reporting System (CPARS), the Management Accounting & Reporting System (MARS), the Asbestos Receivable Tracking System (ARTS), the Contracts Payment System (CPS), the Grants Information & Control System (ICMS), and the Small Purchase Electronic Data Interchange (SPEDI) system. [See Appendix III, Note 26 for additional OIG Comments] Page 3-6. Third Paragraph The OIG found seven out of eight systems deficient in this area. Both our February and June memos address our contingency and disaster recover plans in detail. Contrary to the assertions in the Report, our contingency and disaster recovery plans meet all requirements in effect on 11-20 ------- September 30, 1998. To summarize: Contingency and disaster recovery planning is well coordinated between divisions. Systems that interface with each other have related plans that are tested jointly, and systems at RTP are included in ETSD's plans for the mainframe and the NCC facility. OCFO and ETSD plans were provided to the auditors. The report states that the OIG review of compliance with OMB 's system security requirements was limited to evaluating approved security plans. We find no government- wide or EPA requirement that a security plan address (or, for that matter cross reference) specific disaster scenarios or document each and every procedure. In addition, the auditors' standard for contingency planning in this draft report is substantially more stringent in this report than in AAAS #1 dated March 9, 1999. AAAS #1 has four requirements for contingency plans. This report expanded the criteria for compliance for two of these requirements, and adds three new requirements. Following the standards in AAAS #1 and this draft report, OIG considered a security plan to be inadequate whenever any one of the following was applicable to the disaster recovery or contingency plan. AAAS #1 Standard (P- 7) July 30 Report Standard (P 3-6) OIG considers the security plan inadequate "whenever the system- specific disaster recovery plan:" OIG considers a security plan to be inadequate "whenever the application's contingency plan:" • was inconsistent with its corresponding security plan • was inconsistent with its corresponding security plan • did not include a prioritized list of program- critical functions and the effect that the inability to perform each program-critical functions would have on the organization • did not address specific disaster scenarios • did not address contingencies and related disaster scenarios • did not address specific system requirements for continuity of operations • did not address resource requirements and related time frames for continuity of operations related to the application • did not contain the application schedule and procedures for backup 11-21 ------- • did not assign or document specific procedures (e.g., initial response, back up operations and recovery) to be followed in response to each contingency and related disaster scenario • had not been tested • had not been tested Neither the AAAS #1 requirements nor this draft report's requirements match the requirements for contingency planning in the OIG's original comments on our security plans. In addition, and the requirements for contingency planning in the OIG's original comments on these security plans are not consistent from system to system. For example, the auditors comments on CPS require seven separate items for a contingency/disaster recovery plan. The comments on IFMS identify require only five of the items required. In addition, the OIG does not cite any specific instances of "violations" of its standards. For example, although the first item cited in the report mentions inconsistencies between security plans and contingency plans, it is silent about instances of inconsistencies. Finally, the requirement to have a Continuity of Operations Plan (COOP) was not in effect September 30, 1998, and should not be considered in the audit of FY 1998 financial statements. OCFO, in fact, issued its COOP in March 1999, in time to meet the established deadline. While the security plans did not specifically document the steps covered in GAO's Year 2000 Computing Crisis: Business Continuity and Contingency Planning, dated August 1998, the financial systems were either Year 2000 compliant or on schedule to be Year 2000 compliant, and the schedules met OMB guidance. Subsequent independent testing verified the completeness and sufficiency of the Agency's Year 2000 remediation. In addition, all required Y2K plans and updates have been prepared and submitted to OMB in timely fashion. While the Agency is in the process of preparing a formal Business Continuity and Contingency Planning (BCCP) document, the document merely formalizes the steps the Agency already planned to take. Contrary to the assertions in the draft report, procedures in effect as of September 30, 1998, protect OCFO applications against a wide range of contingencies and disasters and include procedures for a wide range of testing and verification, as well as for reversal of disaster recovery when the situation returns to normal. As the report correctly points out, the procedures for OCFO applications, except for MARS, are included in the Enterprise Technology Systems Division (ETSD) disaster recovery plan for NCC as of September 30, 1999 (report, pages 3-7). The contingency plans are reviewed frequently, and disaster recovery drills take place twice a year. During Fiscal Year 1998, these plans were successfully tested, such that EPA's core financial systems were operational at the test site, ready for EPA use. 11-22 ------- While the MARS application was not specifically mentioned in the ETSD plan, MARS is, in fact, an ad-hoc reporting tool, and its omission would not diminish the Agency's ability to run standard reports nor limit the Agency's ability to produce ad-hoc information through other tools (such as SAS). The MARS application itself was included in the ETSD plan, though it was not specifically labeled. While the MARS data base was not part of the disaster recovery plan, we did not consider its omission serious as its data is derived from other data bases which are covered in the ETSD plan. Subsequent to September 30, 1998, EPA decided to also include the MARS data base in the disaster recovery plan to make ad-hoc reporting immediately easier should a disaster occur. The absence of the MARS data base from the disaster recovery plan as of September 30, 1998, did not pose a serious risk to EPA, but more of a potential inconvenience, had a disaster occurred. [See Appendix III, Note 26 for additional OIG Comments] Page 3-7. Third Paragraph "If the security training program was scheduled for development and not operational during fiscal 1998, then we looked for more rigorous system controls to compensate for the lack of security training." As the OIG notes on page 3-3, "We did not verify the security controls identified in the system security plans were operational." In essence, the auditors limited their review to security documentation and did not review, observe, or otherwise test actual security operating controls. Other compensating controls were in effect, as we pointed out to the auditors. For example, the systems themselves require periodic password changes. Users typically receive on-the-job security training. While we recognize the need for more formal security training, and have taken steps to provide such training, we feel the weaknesses noted in the security training area do not warrant a substantial noncompliance finding. Indeed, when Treasury's Center for Applied Financial Management independently reviewed this area during early Fiscal Year 1999 (when our training program had not been changed substantially) they did not consider our security training to be a serious weakness. [See Appendix III, Note 26 for additional OIG Comments] Page 3-7. Fourth Paragraph "We considered approval authorization to be in compliance with Federal regulations and agency policy if... the program manager responsible for the GICS and P2000 systems had not signed the security plan... " The P2000 system was not yet operational, and the plans were approved by the SIRMO. The Grants Administration Division management was aware of the security plan and its contents, and approved the GICS application operation. The fact that the "wrong" system owner approved the plan resulted in little, if any, security risk to EPA, and we feel this finding is not, and should not, be considered a "substantial noncompliance" finding. [See Appendix III, Note 26 for additional OIG Comments] 11-23 ------- Page 3-8. First Paragraph See our comment for Page 3-2 above. Page 3-8. Second Paragraph "responsible financial and mixed-financial systems managers did not treat the completion of a review of operational controls and development of security plans as a priority." As noted in our comments for page 3-5 above, six of the eight financial and mixed-financial systems reviewed were in compliance with the independent review requirement, one system was under development (therefore the requirement did not apply), and one system was in partial compliance. With regard to security plans, we devoted considerable staff time to identifying security requirements and documenting security controls in our security plans. For example, we added additional staff in the OCFO immediate office to assist the SIRMO with security plan development, review, and coordination. Management reviewed and approved the plans, and received numerous briefings regarding system security measures. Page 3-8. Fourth Paragraph This paragraph should have a separate heading. It is not part of the "priority task" issue. Page 3-9. Second Paragraph We maintain the security plans are not required to contain the level of detail called for in the draft report. The plans do contain discussions of authorization/access controls, integrity controls, audit trails, confidentiality controls, application controls, etc., sufficient to meet the applicable security plan requirements and sufficient for management to consider the risks and controls over the various financial systems. In addition, management receives other information on financial systems security. For example, management received and reviewed the action plans addressing the findings from the December 1995 Booz-Allen Hamilton independent review. Management takes these other sources of information into account as well when evaluating the appropriate level of systems security. [See Appendix III, Note 26 for additional OIG Comments] Page 3-10. RECOMMENDATIONS The draft report makes only very general recommendations (e.g., "develop an overall remediation plan," "develop security plans ... which address the critical security controls...and bring these 11-24 ------- systems into compliance..."). We request that the OIG provide specific recommendations that address the specific deficiencies it believes need to be addressed. Page 3-10. Agency Comments and OIG Evaluation We suggest the auditors also consider the comments made in the June 3, 1999 memorandum from FSD and consider the other documents (e.g., the Booz-Allen Hamilton final report dated December 15, 1995) provided by EPA. 11-25 ------- ATTACHMENT II RESPONSE TO RECOMMENDATIONS DRAFT AUDIT REPORT E1AML8-20-7017 FISCAL 1998 FINANCIAL STATEMENTS AUDIT RECOMMENDATIONS/RESPONSE The next several pages are responses and corrective actions to specific OIG's recommendations to the Draft Audit Report. MATERIAL WEAKNESSES IMPROVEMENTS NEEDED IN THE AGENCY'S PROCESS FOR PREPARING FINANCIAL STATEMENTS 1.18 We recommend the Chief Financial Officer evaluate the OCFO's process for preparing the financial statements, including the OCFO resources assigned, necessary improvements to IFMS, control processes within the Financial Reports and Analysis Branch, and the Year-End Closing process; RESPONSE: We disagree with the categorization of the OCFO financial statement preparation process as a material weakness. We believe that the recommendation is primarily based on the fact that our process did not produce timely financial statements to meet the March 1, 1999, deadline. EPA made a conscious decision to delay the final preparation to address issues to ensure unqualified opinions. There were delays this year as both the OIG and OCFO worked to identify and develop the means to implement and audit new reporting requirements. In the final analysis, we prepared reliable statements but were not timely in doing so. We believe that the facts do not support a material weakness as defined by auditing standards. We do agree this was a compliance issue that should be included in the audit report. We prepared a draft Planning Document for the FY 1999 audit with specific time frames and proposed roles and responsibilities. This effort will also evaluate the controls process not just within FRAB but within the OCFO. OCFO management is currently evaluating resource needs for the process. Concerning IFMS improvements, we are working to automate the SF 133 and anticipate that this automation along with FACTS II will streamline the preparation of the Statement of Budgetary Resources and the Statement of Financing. We plan to complete these efforts by October 30, 1999, which will enable us to meet the FY 1999 reporting requirements. We will brief the OIG by 11-26 ------- September 30, 1999, on our time frame to ensure the deliver of the audited financial statements to OMB by the March 1, 2000, deadline. Corrective Action Target Date Complete evaluation of the OCFO process for August 31, 1999 preparing financial statements Implement the new automated reporting process October 30, 1999 using the Standard General Ledger for the SF-133 and Statement of Budgetary Resources. 1.2 We recommend the Chief Financial Officer update the Agency's policies and procedures for preparation of annual financial statements to reflect the new legislative requirements, new accounting standards, and new format and presentation requirements. The procedures should include milestone dates and activities for completion, OCFO and other offices' roles and responsibilities, descriptive processes for preparing the financial statements, and plans for obtaining the needed information and providing reliable supporting documentation; RESPONSE: We agree with this recommendation and are initiating a project to update the Agency's policies and procedures for accounting functions related to the financial statements. The types of information described in the recommendation would be the types of material that we would include in the policies and procedures. Although the preparation of the update will occur concurrent with the work on the FY 1999 financial statements, many of the actual process steps have already been reviewed and accepted by the OIG as part of their reports issued for the fiscal years 1997 and 1998 financial statements. In many instances, this will be a matter of putting existing information together in one document. Corrective Action Target Date Issue Final Policies and Procedures on Preparing March 31, 2000 Financial Statements 1.3 We recommend the Chief Financial Officer establish a quality review process to ensure that the draft financial statements including the footnotes, supplemental information, and overview are complete and reliable, and the Comptroller certifies such documents prior to submittal for audit; RESPONSE: We agree that the quality review process can be strengthened and are now formalizing a Financial Statement Quality Control Group within FMD. We are also developing an approach to ensure consistency, accuracy, and, among other things, our compliance with new requirements in OMB Circular 97-01 (Form and Content and Audit 11-27 ------- Requirement). However, we do not agree that the Comptroller should certify the documents prior to submittal for audit. We believe the certification of the Director, FMD, is appropriate. This approach will be implemented beginning with the FY 1999 statements. Corrective Action Target Date Establish Quality Control Group December 3, 1999 AGENCY ENCOUNTERED SIGNIFICANT DIFFICULTIES IN PREPARING THE STATEMENTS OF BUDGETARY RESOURCES AND FINANCING 2.1 We recommend the Chief Financial Officer review all fiscal year 1989 and prior unliquidated obligation and authority balances and make any necessary adjustments; RESPONSE: We agree with this recommendation and have already implemented it (in April 1999) as part of the FY 1999 Review of Unliquidated Obligations. OCFO/FMD provided guidance to all offices regarding identification and correction of erroneous unliquidated obligation balances from BFY 1989 and prior. By August 20, 1999, FMD will distribute to the FMOs a list of BFY 1989, and prior open obligations in IFMS and request that they work with the appropriate offices to ensure that any erroneous balances are properly removed from the books by September 30, 1999. We also plan to initiate a review of the IFMS budget authority balances for these fiscal years and make any necessary adjustments. We anticipate completing this process in mid-FY 2000. OIG staff previously agreed with FMD's approach and timing for dealing with these issues. 2.2 We recommend the Chief Financial Officer develop reports for the annual review of unliquidated obligations which highlight older open unliquidated obligations; RESPONSE: We do not agree with this recommendation because OCFO provides the responsible officials with reports listing all inactive obligations (no activity for 180 days) grants, contracts and IAGs for the annual review of unliquidated obligations. OCFO requires officials to review all inactive obligations including older open unliquidated obligations. Thus, the Agency maximizes its ability to efficiently use resources available and identify, deobligate and reuse these funds. The reports that OCFO provides comply with EPA and GAO review requirements. 2.3 We recommend the Chief Financial Officer require responsible officials to justify unliquidated obligation balances whose period of performance has ended, if the balances are not deobligated; RESPONSE: We do not agree with this recommendation since FMD has already implemented more stringent requirements. The March 25, 1999, guidance memorandum for the FY 1999, "Review of Unliquidated Obligations," requires responsible Agency 11-28 ------- officials to maintain documentation in their office's files justifying all unliquidated balances retained on the inactive obligation lists, as defined in the response to 2.2 above, that will be available for audit review. 2.4 We recommend the Chief Financial Officer follow up on responsible officials' deobligations to verify appropriate actions were taken; RESPONSE: While we agree with the thrust of this recommendation, we want to clarify the roles and responsibilities for the verification process. Verification of deobligations requires two action plans: one for those identified during FMD's special analysis and another for deobligations identified by the allowance holders during the annual review of unliquidated obligations. FMD is maintaining a list of deobligation actions identified during the special analysis and audit of unliquidated obligations. In August 1999, we will contact the responsible FMOs if these deobligation entries have not been entered into IFMS. We share OIG's goal of ensuring that these are processed prior to FY 99 year end. The approach for documents identified during the annual review is different. As stated in our February 9, 1999, response to the original draft position paper, OC PA No. 96-04, "Review of Unliquidated Obligations," requires the responsible officials to certify that their office completed the annual review and to take appropriate action to deobligate unneeded funds. The policy does not require them to report proposed deobligations to OCFO staff. The responsible officials have the responsibility for verifying the deobligation of unneeded funds. OIG and OCFO were previously informed that finance office staff plans to assist the responsible officials by providing follow-up reports that show documents with changed unliquidated obligation balances. These reports will be produced after all review certifications are received in FMD and the finance offices have completed processing deobligation requests. The reports will be distributed to the responsible offices so they can verify that all unneeded funds actually have been deobligated. (This information was included in the March 25, 1999, guidance for the annual review.) When we distribute these reports, by August 31, 1999, we will instruct the responsible offices to: Corrective Action Target Date Follow up with the appropriate procurement On-Going and/or finance office(s) regarding any unneeded funds that have not been deobligated, Monitor the document's fund status in IFMS On-Going (or CPS for contracts) until the deobligation has been processed, and 11-29 ------- Provide FMD at year end with the document number October 30, 1999 and funding information for any unneeded funds identified during the review that were not deobligated 2.5 We recommend the Chief Financial Officer prepare the SF-133s from the general ledger; RESPONSE: We agree with the recommendation because beginning in FY 1999, we began preparing the SF133 report directly from the General Ledger. We are now well underway in automating this process and plan to implement this process by October 30, 1999. 2.6 We recommend the Chief Financial Officer prepare and retain support for all journal entries and adjustments made to produce the SF-133s; RESPONSE: We agree with this recommendation as all the above referenced documentation is maintained by FRAB. It is Agency policy to prepare and retain support for all journal entries and adjustments to the SF-133's. We believe that the OIG is referring to those entries made to the SF-133's after the FY98 General Ledger was closed and these adjustments were manually reflected in the next year's beginning balances. This was the result of our decision not to hold the General Ledger open until November when the SF-133s were due. However, beginning in FY99, we will reflect all SF-133 adjustments in the General Ledger. 2.7 We recommend the Chief Financial Officer require supervisory approval, evidenced by a signature and date, to help ensure that procedures have been followed; RESPONSE: We disagree with this recommendation. Hard copies of the SF-133s are produced after they are electronically transmitted for post review purposes. The present electronic format, unlike previous years, does not provide for the supervisors' signature before transmission. Supervisory certification will be incorporated in the new FACTS II transmission (which will include the SF -133 and year end close-out reports). We will ensure that we annotate hard copies maintained within FRAB. AGENCY NEEDS TO ESTABLISH PROCEDURES FOR TRACKING UNILATERAL ADMINISTRATIVE ORDERS 3.1 We recommend the Chief Financial Officer track in IFMS all demands for payment issued under UAOs 11-30 ------- RESPONSE: We partially agree with this recommendation. We believe that this recommendation should only refer to the tracking of Superfund UAOs, and not all UAOs. Our partial disagreement is due to our understanding of the conclusions reached at the March 9, 1999, meeting between the OIG, OGC, OECA, and OCFO that Agency efforts should be focused on tracking Superfund UAOs only at this time. The OCFO has already taken steps to address the tracking of Superfund UAOs. Currently, the OCFO has a draft policy in place that will be effective at the beginning of fiscal year 2000. The policy requires regional offices to use IFMS to track as an Agency general ledger memo entry, all Superfund UAO Demands. This procedure will allow the Agency to track the UAO Demands and to continue the practice and policy of not recognizing these Demands as accounts receivable. Corrective Action Target Date Issue Final Policy for Tracking UAOs September 30, 1999 Implement and Monitor Policy Ongoing 3.2 We recommend the Chief Financial Officer determine if other demands for payment are issued by the agency, the respective amounts demanded, and whether a need exists to track the amounts demanded in IFMS. RESPONSE: We partially agree with this recommendation. We believe that this recommendation should refer to other Superfund Demands and not "other Demands" for the same reasons discussed in our response to recommendation 3.1 above. The OCFO will address and determine other Superfund Demands which may or may not require tracking. Corrective Action Target Date Determine other Superfund Demands April 1, 2000 that may or may not require Tracking 3.3 We recommend the Chief Financial Officer revise RMDS to clearly differentiate between administrative orders (particularly administrative orders on consent and UAOs), describe when the administrative orders need to be established as an accounts receivable in IFMS or separately tracked as a demand for payment in IFMS, and describe all other demands for payment that need to be tracked in IFMS. RESPONSE: We partially agree with this recommendation. We believe that "other Demands" for payments should be deleted from this recommendation for the same reasons discussed under 3.1 above. The OCFO has already taken steps to clearly 11-31 ------- differentiate between Superfund administrative orders and describe when they need to be tracked in IFMS. This will be addressed after proper coordination with OECA, OSWER, and OGC taking into consideration the varying levels of enforcement tools available to the Agency. A final draft policy is in place which will supplement RMDS and includes: a clarification of the difference between Administrative Orders on Consent and Unilateral Administrative Orders (UAOs), and a discussion if these documents can be used to record accounts receivable; and guidelines for separately recording oversight accounts receivable to enhance the Agency's ability to track oversight amounts for management and reporting purposes. Corrective Action Target Date Issue Final Policy September 30, 1999 Update policy to for tracking other May 31, 2000 Superfund Demands, if needed 3.4 We recommend the Assistant Administrator for Enforcement and Compliance Assurance develop guidance for ORCs, program offices and finance offices regarding the types of instruments used in Superfund enforcement process. For each instrument, describe when to establish an accounts receivable or separately track as a demand for payment, and describe the Agency's basis for legal liability under each instrument, describe when to establish an accounts receivable or separately track as a demand for payment, and describe the Agency's basis for legal liability under each instrument, and RESPONSE: OSRE/OECA previously responded to these audit recommendations 3.4 and 3.5 in memoranda dated February 17 and February 26, 1999. 3.5 We recommend the Assistant Administrator for Enforcement and Compliance Assurance Clarify the model language to be used by ORCs, program offices and finance offices to clearly differentiate between demands for payment and bills for payment used in the Superfund enforcement process. RESPONSE: See response to Recommendation 3.4 FURTHER IMPROVEMENTS NEEDED IN MANAGING EPA'S ACCOUNTS RECEIVABLE 4.1 We recommend the Chief Financial Officer continue to provide training on calculating the allowance for doubtful accounts (ADA), particularly in the area of 11-32 ------- developing the percentage portion of the allowance and maintaining proper supporting documentation, RESPONSE: We agree with this recommendation. OIG personnel worked with OCFO staff to develop a method to simplify the calculations on the ADA and alleviate the workload. We agreed to conduct a pilot program on the OIG recommended method, a modified approach on collection history, to test the effectiveness of the new method. However, the method recommended by the OIG resulted in the percentages increasing dramatically to unacceptable levels, and we then directed the FMOs to recalculate the percentages in accordance with established procedures in RMDS-2540, Chapter 9. Unfortunately, three regions did not follow HQ's instructions for the recalculation. The auditors discovered and reported on the non- compliance by the three regions. We took prompt action to have these regions comply with these instructions. Considering the OIG as part of our internal controls, we believe that these actions clearly demonstrate that our internal control system worked well, as planned. We will continue to provide training in this area during our annual workshops. Corrective Action Target Date Provide Training on Ongoing Calculating Allowances for Doubtful Accounts We recommend the Chief Financial Officer review finance offices' management and accounting for accounts receivable during regularly scheduled Quality Assurance Reviews to ensure FMOs understand and are following guidance on accounts receivable, RESPONSE: We concur that quality assurance reviews are useful in assisting FMOs to comply with accounting guidance. When we conduct quality assurance reviews, we tailor the topics covered to specific issues of concern at the location being visited. We also consider training as part of our quality assurance program to help ensure FMOs understand guidance on financial management and accounting. During the June 14-18, 1999, Superfund Cost Recovery and Financial Management Training Conference in Alexandria, VA, accounts receivable was the central focus of several sessions and was discussed during a number of other sessions. Corrective Action Target Date Determine which regions require quality Annually assurance reviews Conduct FMO training As needed ------- Conduct quality assurance reviews to ensure FMOs are properly following accounting guidance. As needed We recommend the Chief Financial Officer instruct the FMOs to follow-up with ORCs and program offices when responses to requests for receivable collectibility information are not received timely; instruct the FMOs to assess how communication with the ORCs and the program offices can be improved; and reemphasize FMOs' responsibilities in ongoing training sessions; RESPONSE: The Agency continuously emphasizes the need for more effective accounts receivable and collections management. We continue to make improvements in this area and believe that we are doing a better job of managing our accounts receivable and collections. Specifically, we have taken the following actions: (a) During our Superfund Cost Recovery and Financial Management Training Conference held in Alexandria, VA on June 14-18, 1999, Headquarters, Regional Program Office, Office of Regional Counsel, and Financial Management Office attendees were provided with accounts receivable training for addressing these issues and participated in group discussions concerning these areas. During these sessions, accounts receivable policy and procedures were reviewed and discussed, and the need for timely preparation and/or transmission of source documents (e.g., Consent Decrees, Administrative Orders on Consent, bills, etc.) by the RPO and ORC to the FMOs was reemphasized. We will continue to provide training and workshops each year. (b) FMD continues to meet periodically with the Department of Justice (DOJ) to discuss the status of EPA's settlement collections made by DOJ and the timely transmission of entered Consent Decrees (CDs) needed by the Agency to record accounts receivable. During these meetings, we continue to emphasize the importance of DOJ providing EPA with entered CDs in a timely manner. As part of our ongoing efforts to improve the timeliness of receiving entered CDs, we are currently working with DOJ and OECA to develop a process whereby DOJ can electronically notify (i.e., e-mail) the respective FMO when a CD has been entered. Timely notification of entered CDs would enable FMOs to record corresponding accounts receivable more efficiently. Also, in the future, FMOs may be able to record accounts receivable upon receipt of DOJ's notification. Work is currently ongoing in this area. (c) OECA and the OCFO prepared a joint memorandum entitled Superfund Accounts Receivable Collections, dated July 26, 1999, asking the regions to place more emphasis on collecting outstanding accounts receivable. The memo tasked the regions to review their outstanding accounts receivable to: 11-34 ------- determine if any debts can be referred to Treasury or DOJ for enforcement and debt collection; determine the status of any debts referred to DOJ for enforcement; determine the status of any bankruptcies to ensure that proofs of claim have been filed and amounts are reduced (i.e., written-off) where appropriate based on bankruptcy judgments; determine the collectibility of all outstanding debts; update accounts receivable status codes to ensure that the current disposition of outstanding receivables is accurately reflected in IFMS; ensure that dunning letters have been issued where appropriate; and determine if penalties have accrued as a result of any overdue receivables and to pursue them where appropriate. The regions also have been asked to prepare a plan within one month of this memo that includes the: steps that will be taken to address overdue receivables; roles and responsibilities of each organization performing these tasks; estimated time frames for completing these steps; and primary regional contact for this effort. (d) OECA and OCFO met in July 1999 to discuss the establishment of a Superfund collections workgroup. The planned workgroup would consist of representatives from OECA, OCFO, FMO, ORC, OGC, FMD, DOJ, and Treasury. The workgroup would reevaluate the Agency's accounts receivable process and how it currently handles delinquent debts, and reexamine the roles and responsibilities of those offices and agencies (i.e., DOJ and Treasury) involved in these processes. The information collected by the workgroup would be used to determine: if duplicative efforts could be eliminated; if additional policy and guidance, or clarification is needed; areas where improvements and streamlining can be made. Also, the workgroup would reevaluate how and when the Agency refers debts to DOJ or Treasury for enforcement and debt collection. Corrective Action Target Date Provide periodic training and workshops on Annually the management of accounts receivable and collections Meet with DOJ Monthly 4.4 We recommend the Assistant Administrator for Enforcement and Compliance Assurance conduct periodic regional reviews and/or site visits to assess the Regional 11-35 ------- process for meeting guidelines in the July 16,1998, memo to Regional Counsels entitled "Effective Debt Management," RESPONSE: We disagree with this recommendation. OSRE and FMD began this review by issuing a memorandum dated July 26, 1999, to the Regional Comptrollers, Waste Division Directors, and the Office of Regional Counsel Branch Chiefs addressing Superfund Accounts Receivable Collections. The memorandum requires each region to prepare and submit to Headquarters, within a month of the receipt of the memorandum, a plan to address overdue receivables. As a coordinated effort among the financial management offices, offices of regional counsel, program offices and the DOJ, each plan should define the roles and responsibilities of each organization in performing the steps in addressing overdue receivables, the estimated time frames to complete these steps, and a primary regional contact. OSRE and FMD will continue to work with the regions to monitor their progress in addressing the overdue receivables. 4.5 We recommend the Assistant Administrator for Enforcement and Compliance Assurance discuss the issues raised in the July 16, 1998, memo, particularly the need for timely establishment of accounts receivable at the upcoming cost recovery conference; RESPONSE: We disagree with this recommendation. OECA provided a detailed presentation on these issues at the Cost Recovery Conference that was held the week of June 14, 1999. Moreover, region-specific aging accounts receivable analyses were provided to each Division Director and Office of Regional Counsel at the Policy Managers Meeting that was held March 23-25, 1999. 4.6 We recommend the Assistant for Administrator for Enforcement and Compliance Assurance revise the Department of Justice IAG to require DOJ to directly transmit to the ORCs and Regional finance offices copies of final source documents (i.e., Consent decrees, judgements) required to establish the recording of accounts receivable within seven days of entry by the courts, and notify both the ORC and finance offices of any changes in the status of the collectibility of the debt within 30 days of such determinations; RESPONSE: We agree with this recommendation and OSRE, FMD, and DOJ have been working to implement an electronic network to satisfy the requirements for establishing the recording of accounts receivables. Data management personnel have acquired the necessary software to implement this electronic system. We believe that this system will be more effective and prompt in transmitting the source documents. After addressing any initial system problems and ensuring the effectiveness of the electronic system, the Department of Justice IAG will be revised. 4.7 We recommend the Chief Financial Officer and the Assistant Administrator for Enforcement and Compliance Assurance work together to assure the roles and 11-36 ------- responsibilities of offices involved in the oversight billing process are maintained so that the Agency can sustain its emphasis on timely billing and collection of oversight costs; RESPONSE: We agree with this recommendation. The roles and responsibilities of the regional offices in carrying out the oversight billing process were documented by each region in April 1998. The roles and responsibilities vary among regions, and the OCFO will continue to emphasize the need to have clear regional roles and responsibilities for this process. Corrective Action Target Date Maintain roles and responsibilities Ongoing for the regional oversight billing process 4.8 We recommend the Chief financial Officer and Assistant Administrator for Enforcement and Compliance Assurance work together to develop and implement performance measures for the Senior Resource Officials to assess how well the regions are managing their oversight costs billings and other cost recovery activities. Tie the performance measures into EPA Goal 10, Effective Management, which calls for EPA to "establish a management infrastructure that will set and implement the highest quality standards for effective internal management and fiscal responsibility; RESPONSE: This was completed in July 1999. The OCFO has implemented the recently developed SRO Performance Measure on Superfund oversight billing. The first measurement period will be FY 2000. We also have developed a new Financial Management Core Measure on Oversight billing which automatically ties in to Goal 10, Objective 2, and Subobjective 1. Within Subobjective 1, annual performance goal # 2 requires core finance activities meet OCFO Core Financial Management Performance Measures. Corrective Action Target Date Develop and Implement the SRO Measure on Superfund oversight billing Completed 7/28/99 ADDITIONAL CONTROLS NEEDED IN INTERAGENCY AGREEMENT INVOICE APPROVAL PROCESS 5.1 We recommend the Director, Grants Administration Division provide each certified project officer a concisely worded (one page so that it can be posted in their work space) checklist on the process to be followed when they receive an approval form; 11-37 ------- RESPONSE: We do not agree with this recommendation. We believe the Invoice Approval form to be generally self-explanatory. It would be more beneficial for the Grants Administration Division to develop and issue a GAD Fact Sheet for Agency Managers explaining the requirement and the need for timely responses. Corrective Action Target Date Issue GAD Fact Sheet March 31, 2000 5.2 We recommend the Director, Grants Administration Division consider expanding the IAG portion of the project officer training/refresher course to give more emphasis to the importance of timely and properly completing the approval form. Consider having an official from CFMC present this portion of the course or prepare the materials to be used; RESPONSE: We share your views on the need to continue to emphasize the importance of timely and accurately completing the invoice approval form. Beginning in FY 2000, Grants Administration Division will place additional emphasis on the importance of timely, proper completion of the payment approval form. We will also add a copy of the form to the IAG appendix. CFMC is willing to participate in the project officer training courses as the Division's travel budget will allow each year. During fiscal year 1999 CFMC attended the Region III project officer training course. CFMC reviewed the responsibilities of the project officers for the timely processing of IAG invoice approval forms. Corrective Action Target Date Participate in GAD Ongoing Project Officer Training Course 5.3 We recommend the Director, Grants Administration Division consult with the Director, Financial Services Division, on ways to identify for the CFMC the project officer's supervisor, so the supervisor can be notified when the project officer has not completed and returned the approval forms; RESPONSE: We partially agree with this recommendation. It would take considerable research to determine delinquent project officers' supervisors, so GAD proposes that the CFMC instead send notices to the approval official who signed the agreement. Generally, approval officials will be in the chain of command of project officers, although in many cases not the project officers' immediate supervisors. In order to determine whether this will be acceptable, we will present it as a recommendation to the Grants 11-38 ------- Customer Relations Council (GCRC). If they have significant objections, we will work with the GCRC members to develop an alternative approach and notify the Inspector General's office of the change in approach and put the final approach in place by March 31, 2000. Corrective Action Target Date Work with GCRC members to develop an March 31, 2000 and alternative approach and notify OIG office of change in approach 5.4 We recommend the Director, Financial Services Division direct the Chief, Cincinnati Financial Management Center to notify the project officer's supervisor if the invoice approval form is not returned promptly, so the supervisor can forward the form to an alternate project officer if the primary project officer is on extended leave; or hold the project officer accountable if the form has not been returned timely. RESPONSE: While we agree in principle with this recommendation, identifying the project officers' supervisor and keeping that information current is a huge undertaking. The Grants Management Division and CFMC feel that the IAG approving official could be sent the follow up letters on the late invoice approval forms. As described in the response to the previous recommendation, CFMC will work with the Grants Administration Division to use the IAG approving official for second requests. Once the Grants Management Division has cleared the use of the approving official with the GCRC, CFMC will begin sending the approving official the second requests for invoice approval. 5.5 We recommend the Director, Financial Services Division direct the Chief Cincinnati Financial Management Center compile a list of project officers with outstanding, late or incomplete invoice approval forms and forward to the SROs on a quarterly basis, asking for their assistance in getting project officers to timely and properly complete the forms. We agree in principle with this recommendation. We agree to provide the SROs a list of the delinquent project officers, but propose to send the list semiannually rather than quarterly. Initially CFMC plans to provide the SROs the names of project officers who have been chronically delinquent in returning the invoice approval form. This list will be provided to the SROs semiannually in November and April. We believe the recommendation to provide this information to the SROs quarterly is overly burdensome. While CFMC does have an automated system to produce the invoice approval forms, the system does not track statistics on the submission of the approval forms. At this time the data for such reports have to be accumulated manually. It is more reasonable from a 11-39 ------- workload prospective to provide the listings semiannually. Semiannual reports will decrease manual workload while providing the SROs the information they need. Furthermore, the reports should raise the level of awareness and accountability the OIG and OCFO wish to achieve. CONTINUED IMPROVEMENTS NEEDED IN ACCOUNTING FOR CAPITALIZED PROPERTY 6.1 We recommend the Chief Financial Officer, in conjunction with the Assistant Administrator for Administration and Resources Management continue to work to strengthen controls designed to ensure that property is timely and accurately recorded in the Agency's property accountability system, FAS. Specifically, reemphasize to the appropriate Agency personnel their responsibilities to: provide descriptive information about an existing parent property item in the procurement request for capital improvements; and report receipt of accountable and capital property to the appropriate PMO in a timely manner when property acquisitions are directly delivered to the ordering official, and forward copies of appropriate documentation to the PMO RESPONSE: We concur with the above recommendation. We believe it important to emphasize, however, that the appropriate Agency personnel who needs to be reminded of their property management responsibilities are not necessarily Property or Financial Management personnel. Users of Agency property, such as custodial officers, project officers, funds certifying officers and managers, and other ordering official, must be made aware of Agency property management requirements. To correct this problem OARM's role in this effort will be to coordinate with specific organizations when property records indicate they are not complying with Agency property management policy. In addition to site visits performed by OARM's Facilities Management Services Division (FMSD), FMSD in conjunction with FMD, plans to take every opportunity to present briefings, conduct training sessions (such as the Fixed Asset Subsystem training conducted February 2-4, 1999), attend organizational meetings, and participate in any way to disseminate information and guidance concerning accurate documentation and timely processing of required receiving documents. As mentioned in the Audit report, during October 1998, the Financial Management Division (FMD) issued Transmittal Notice (TN) 99-03, "Guidelines on Preparing Requisitions for Property and Related Goods." This guidance provided detailed instruction on preparing purchase requests for capital improvements. The instructions give examples of how to prepare requisition for capital improvements when descriptive information concerning an existing parent property is required. FMSD will issue a 11-40 ------- memorandum to Agency Senior Resources Officials: (1) reminding them of their responsibility to follow Agency property management policy along with a copy of the FMD TN 99-03 and (2) requesting that they distribute it to their respective project officers, ordering, and funds certifying officers. Finally, ETSD is scheduling a joint review session with RTP FMSD, RTP OAM and FMD to address WCF property accounting problems. At the conclusion of this session, ETSD expects to have a plan of action for correcting problems before the end of this fiscal year. Corrective Action Target Date Issue a memorandum to September 30, 1999 Senior Resource Officials EPA-wide distribution. Implement Action Plan September 30, 1999 to Correct WCF Property Accounting Problems REVENUE WAS NOT PROPERLY RECORDED ON SUPERFUND STATE CONTRACTS (SSCs) 7.1 We recommend the Chief Financial Officer assist the regions in identifying and correcting problems causing errors in their advances and unbilled accounts receivable, and RESPONSE: We agree with this recommendation. During the FY 1998 SSC revenue recognition process, there were problems with the spreadsheet formulas relative to State Costs Share (SSC) Credits. This problem has been corrected for the FY 1999 spreadsheets. We will work with individual regions in FY 1999 to assure SSC revenue has been properly recorded and to assure related account balances are correct. 7.2 We recommend the Chief Financial Officer continue to emphasize the need for regional personnel to perform analytical reviews of their account balances. RESPONSE: We agree with the recommendation. We conducted a workshop in June 1999 in which one of the sessions dealt specifically with the General Ledger and the need for continual account analysis. In addition, we have performed account analysis here at headquarters. We have identified accounts that need to be analyzed and have communicated this information to the regions. We will continue to analyze the accounts and work with regions in getting account balances corrected. 11-41 ------- AUTOMATED APPLICATION PROCESSING CONTROLS FOR THE INTEGRATED FINANCIAL MANAGEMENT SYSTEM COULD NOT BE ASSESSED 8.0 (NO RECOMMENDATIONS RECEIVED) EPA IS NOT IN SUBSTANTIAL COMPLIANCE WITH FEDERAL FINANCIAL MANAGEMENT SYSTEM REQUIREMENTS 9.1 We recommend the Chief Financial Officer develop an overall remediation plan which specifies resources, remedies and intermediate target dates associated with bringing ARTS, CPARS, CPS, EPAYS, IFMS, MARS, ETAMS, TM+ and BAS systems into substantial compliance with OMB, NIST and Agency requirements, and addresses the critical security controls shown in Table 2. RESPONSE: We do not agree with this recommendation. We believe that the Agency financial systems cited above are substantially in compliance with OMB, NIST and Agency requirements. See Attachment I, pages 11 - 22 for detail discussions supporting the CFO position on this recommendation. 9.2 We recommend the Director for Acquisition Management develop security plans for CDOTS, ICMS, SPEDI, and CIS which address the critical security controls depicted in Table 2 above, and bring these systems into compliance with OMB Circular A-130, NIST and Agency requirements RESPONSE: We do not agree with this recommendation. We believe that the Agency procurement systems cited above are substantially in compliance with OMB, NIST and Agency requirements. Also in support of our position, the facts related to this issue are as follows: — The Contracts Information System (CIS) has been in operation for a number of years and has had an approved Security Plan in the past. Although security controls for CIS have not changed, security information for this system is being incorporated into the ICMS Security Plan. — A Security Plan for the ICMS family of applications, which includes ICMS, SPEDI and CDOTS, was approved by the Security Information Resources Management Officer (SIRMO). The SIRMO has directed OAM to address issues brought up in an extensive critique of the Security Plan by OIRM's IRM Policy and Evaluation Division to add information to specific sections of the plan. — OAM's Office Director, as owner of these applications, has been briefed on the status of the ICMS Security Plan, has assigned the responsibility for system security to OAM's 11-42 ------- Technical Information Officer, and has granted authorization to operate these systems, with direction to the Technical Information Officer to comply with the SIRMO's instructions and guidance. 9.3 We recommend the Director for Grants Administration address the critical security controls, as indicated in Table 2, needed to bring the P2000 Security Plan into compliance with OMB Circular A-130, NIST and Agency requirements. RESPONSE: We disagree with this recommendation. The GAD Systems Security Plan as of September 30, 1998, represents a sufficient level of detail as required by EPA guidelines. A revised Security Plan is under review as part of our ongoing reviews and is expected to be completed by June 2000 to include requirements for the operation of the Partnership 2000/Integrated Grant Management System, which is under development. Corrective Action Target Date Issue P2000/IGMS Security Plan June 2000 9.4 We recommend the Director for Grants Administration coordinate with GICS data owners and address the critical security controls, shown in Table 2, necessary to bring the GICS Security Plan into compliance with OMB A130, NIST and Agency requirements. We disagree with this recommendation. The GAD Systems Security Plan as of September 30, 1998, represents a sufficient level of detail as required by EPA guidelines. GAD agrees to coordinate with the Office of Water, the co-owner of GICS data, and jointly address the additional critical security controls necessary to keep the GICS Security Plan in compliance with OMB, NIST and Agency requirements. The Plan has already been revised as part of our ongoing reviews to incorporate a sufficient level of detail as required by OMB and NIST standards and arrangements are being made to conduct an independent audit of the system. Corrective Action Target Date Issue Revised GICS Security Plan March 31, 2000 9.5 We recommend the Region 5 Assistant Regional Administrator for Resources Management develop a Security Plan for the CTS financial system which addresses the critical security controls shown in Table 2 and makes the system compliant with OMB Circular A-130, NIST, and Agency requirements. RESPONSE: We agree with this recommendation and have subsequently submitted a Security Plan to our SIRMO for review and approval. 11-43 ------- Corrective Action Target Date Issue CTS Security Plan March 31, 2000 II- ------- APPENDIX III ADDITIONAL OIG COMMENTS ON THE AGENCY'S RESPONSE 1. The CFO agreed that problems occurred in converting data from EPA's predecessor accounting system and that the result of these problems may still exist. Accordingly, the CFO agreed to take corrective action in fiscal 1999. Since the facts of this situation are not in dispute and no evidence can be provided that the problem has been resolved, we will continue to include this issue in the report. 2. We acknowledge that operations personnel from the Department of Treasury's Financial Management Service Center for Applied Financial Management (Center) reported that EPA's "accounting system documentation" was compliant with Federal financial system requirements. However, the Center's report only addressed the issue at a high level; thereby, not providing details which would allow us to understand (1) which specific portions of the IFMS "user" manuals adequately depicted automated system control processes, and (2) the thought process used to arrive at the report's conclusion. In addition, the report presented data that contradicted facts which we previously obtained from the same source, e.g., percentage of IFMS customization. Therefore, on July 13, 1999, we requested access to the review team's working papers. To date, we have not received materials which could explain the review team's logic or support their conclusions. Auditing standards require that we satisfy ourselves as to the work of others before placing reliance on it for audit purposes. Therefore, until we can assess the review team's analysis, we cannot place reliance on the Center's findings. As a result, we will continue to consider system documentation a reportable condition. We plan on evaluating the basis for the Center's report findings as a part of our fiscal 1999 audit work. 3. Since the Agency has not finalized its legal position, formally revised its grant awarding practices, nor instituted guidance to provide assurance its internal control practices would not violate 31 USC 1301, we continue to believe this issue is a significant noncompliance. 4. The Agency bases its position on two sources, which occurred after the end of the reporting period. Auditors have not had the opportunity to review products issued from these sources. Auditing standards require that we satisfy ourselves as to the work of others before placing reliance on it for audit purposes. Therefore, we must continue to rely on our own analysis in determining the degree of FFMIA non-compliance until we can access the referenced reports and, if necessary, evaluate analytical work papers associated with the findings. 5. The Agency's declaration that its financial systems are substantially compliant with FFMIA requirements is based primarily on products developed after the end of the reporting period. These products were not available for OIG review and evaluation. As previously stated, auditing standards require that we assess any work products before we rely on them for audit purposes. Ill - 1 Audit Report 99B0003 ------- Therefore, we cannot place reliance on the Agency's position. We recommend that management develop a remediation plan which includes action plans to address security weaknesses. 6. We have revised this paragraph to more clearly explain the Agency's current position on developing technical system documentation and a data dictionary. However, we will continue to consider system documentation a reportable condition until such time as we can assess the Center review team's analysis. 7. We have revised this paragraph of the report to explain how general control deficiencies associated with regional general support systems could impact the integrity of financial data and, therefore, affect data presented in EPA's financial statements. 8. We removed all references to our audit of EPA's management of the technical support contract for its Core financial systems because the report findings addressed issues which did not directly relate to the financial statements. 9. As of the date of the CFO's response, August 16, 1999, Treasury's Financial Management Service Center for Applied Financial Management had not issued final reports on EPA financial or mixed systems with regard to compliance with OMB Circular A-127 and A-130 requirements. As such, audit staff could not obtain copies of the reports nor gain access to supporting analytical work papers. Auditing standards require that we satisfy ourselves as to the work of others before placing reliance on it for audit purposes. Therefore, at this time, we cannot agree that these systems meet the referenced requirements. During the fiscal 1999 financial statement audit, we plan on assessing Treasury's detailed findings and analytical support. As part of that assessment, we will determine whether the operations personnel who performed the reviews (1) fully understood the implications of inadequately documented security controls, and (2) formed reasonable opinions regarding which controls were "material" in determining such compliance. 10. We believe that these findings address two separate issues, one dealing with the controls over the overall financial statement preparation process and the other with the Agency's budgetary accounting practices. Agency management is ultimately responsible for the timely and reliable preparation of the financial statements. Delays in the timely issuance of the financial statements were the result of Agency management's efforts to attain an unqualified opinion. We continued our efforts in cooperation with the Agency so that impediments to the preparation of the financial statements could be identified and process improvements could be made for the preparation of future financial statements. 11. Agency management is responsible for establishing and maintaining effective internal controls over financial reporting and financial reports, including providing reliable information to support the financial statements. Our audit work continued into July 1999 as additional, reliable information was provided to support the financial statements. 12. Since Agency management disagreed with the need to report investment in human capital as Stewardship Information per the accounting standard for Supplementary Stewardship Reporting, Audit Report 99B0003 III-2 ------- we performed additional audit work to support our position. On November 19, 1998, the issue was resolved based on discussions with FASAB staff. We continue to maintain our position that the facts as presented are accurate. As we cooperatively worked with the Agency to resolve this issue and made numerous attempts to obtain supporting documentation, we are unclear as to the Agency's statement that "this data was available for audit in October 1998, when the audit began;" however, the data was not provided to us sooner. 13. We believe our amounts for unliquidated obligations reviewed are correct and have documentation to support these numbers. 14. The CFO plans to expedite the preparation of the SF-133 through automation beginning in fiscal 1999. The SF-133 will be prepared directly from the general ledger without manual adjustments. We concur with the Agency's planned corrective actions in this area. 15. Effective funds control practices should require all unilateral administrative orders and all other demands for payment to be tracked and controlled to ensure funds are properly safeguarded against unauthorized use or disposition. Regardless of whether the Agency establishes a receivable when a UAO is issued, Agency guidance in this area that is not clear or subject to interpretation represents a weakness in controls over Agency assets that we have a responsibility to report to management. 16. We agree that the reference to the fiscal 1998 unbilled oversight cost balance should be changed from $71 million to $62 million. Audit adjustments approximating $9 million were posted to the trial balance after the general ledger closed. We believe that the unbilled oversight cost issue, as it pertains to an ongoing series of accounts receivable issues, warrants reportable condition status. The OIG has consistently communicated any issue that requires material adjustments to the financial statement as a reportable condition, at a minimum. As mentioned above, audit adjustments approximating $9 million were necessary to fairly present the financial statements. Further, we believe that part of the reported $62 million of fiscal 1998 unbilled oversight costs could have been billed. Per a memo issued in April 1998 by the Office of Comptroller and Office of Enforcement and Compliance Assurance, pre- fiscal 1998 oversight costs incurred on sites with anniversary dates between June 1 and September 30 were not required to be billed in order to become "current" on oversight billings. The Agency's self-imposed definition of being "current" was arbitrary and not supported by an official performance measure. Being "current" does not directly impact the financial statement opinion. Nevertheless, any implications that part of the $62 million unbilled oversight costs could have been billed in fiscal 1998 or prior, are valid and not misleading. 17. We modified the paragraph to include Agency management's belief that the completed security plans substantially comply with requirements. We have continued to emphasize that our audit work identified numerous weaknesses deficiencies and demonstrated that, from a content perspective, the security plans did not sufficiently address controls issues for the financial management systems. We credited the Agency's efforts to improve security planning for the III-3 Audit Report 99B0003 ------- financial systems, but stated that recent improvements would have no bearing on compliance during fiscal 1998. 18. If security controls and procedures are in place to protect financial data, they have not been adequately documented in the security plans as required by Federal requirements. Security plans must adequately define security controls and procedures, because it is through this vehicle that management is obligated to evaluate system strengths, threats and vulnerabilities, calculate risks, and ensure that the proper level of protection is provided. Otherwise, neither management nor audit staff can be reasonably assured that operational threats to financial data have been minimized. Accordingly, no change has been made to the report. 19. Agency comments do not negate the validity of the paragraph in question, i.e., (paraphrased) audit staff discussed these issues with Agency managers on numerous occasions and provided additional information to clarify our findings. Furthermore, Attachment 3 of the draft report included a three page "Agency Comments and OIG Evaluation" section, in which we summarized the prior comments of all four action officials, by recommendation, and provided our evaluation of those comments. This entire section has been modified to reflect the Agency's formal response to the draft audit report and our subsequent position regarding FFMIA compliance with Federal financial management system requirements. 20. The Agency's response supported our conclusion that, as of September 30, 1998, "management had not approved security plans for the remaining eight financial or mixed financial systems." Agency management acknowledged that: (1) OAM's SIRMO did not finalize four system security plans (CDOTS, ICMS, SPEDI, CIS) until mid-October; (2) OCFO management continued to operate the Budget Automation System even though its security plan expired on June 30, 1998, as a result of unfulfilled action items; (3) no security plan existed for a major regional system used to track recovered Superfund costs; and (4) a system being developed for Agency-wide deployment (TM+) did not have an approved security plan. We decided to remove ETAMS from the list of financial systems, based on the Agency's statement that "because the Agency's payroll system is to be replaced, management decided to not expend any additional resources on this system." We modified the report to reflect the exclusion of ETAMS. 21. We revised the methodology section of the report to clarify that financial audit staff tested significant manual controls to determine whether such controls were effective. Therefore, the scope limitation mentioned in reference to the review of system security documentation does not conflict with the extent of control tests performed by financial audit staff. Moreover, GAO endorsed our multi-year plan for auditing ADP general controls in support of financial statement audits. In the plan, we scheduled separate audits to address the adequacy of operational security controls because GAO wanted agencies to thoroughly examine all major categories of ADP general controls. One audit report was issued in fiscal 1999, while at least two more audits will begin in the current and upcoming fiscal year. Audit Report 99B0003 III-4 ------- 22. We modified Table 2 of the report to more accurately reflect the degree of noncompliance found with regard to the five critical security controls. Moreover, we modified the paragraph preceding the referenced table, clarifying that "the designation 'NC' indicates that a system was noncompliant in some respects with requirements for the critical control, but we did not consider the critical control substantially noncompliant. Therefore, an 'NC' denotes that parts of a critical security control may have been compliant, although other aspects were missing or needed improvement." 23. We have allowed the Booz-Allen & Hamilton, Inc. final report to serve as an independent assessment of operational controls, although we remain concerned that Agency management negated some of the report's "independence" by excluding several of the reported nonconformances from the Agency's corresponding internal report and subsequent corrective action plan. As a result, we have revised the findings associated with this particular security control for the following systems: IFMS, MARS, CPARS and EPAYS. We continue to report on ARTS because, as of September 1998, it still was classified as a major application system. However, we downgraded ARTS to a noncompliance standing with respect to Critical Control #1. We took this action on the basis that the OIG's independent review of this application (1) addressed some of the security functions addressed in OMB Circular A-130, and (2) was issued within three years prior to the period under review. We reiterate that the OIG's review did not cover many areas which would be expected of an independent audit or review under current OMB Circular A-130 requirements. However, ARTS will not be included in our fiscal 1999 audit regarding FFMIA compliance because the system owner subsequently reclassified ARTS as a non-major application. 24. The security plan is the vehicle under which management is obligated to weigh, in the aggregate, reported system strengths and risks, and approve or disapprove system operations. When management formally approves (i.e., signs) a system plan, they provide tangible assurance that they: (1) are aware of particular control deficiencies, (2) knowingly accept the risk of operations during the interim, and (3) have practical plans to address the reported weaknesses in a timely manner. Other documents, although related, are not recognized as providing the same level of "tangible assurance." For this reason, a security plan needs to include or reference any report findings which play a part in management's decision to authorize operations. Whereas the Agency may have addressed findings through other documents, they did not reference or include important review findings in the security plan; therefore, the plan could not provide tangible assurance that management fully understood and evaluated the risks of operation before granting that authorization. Therefore, we still believe that operational security problems should be included or referenced in the security plan. Accordingly, we moved portions of the referenced paragraph to the section entitled Critical Security Control #2 - Security Plan Level of Detail. 25. In its response, the Agency quotes Section B.a.2. of OMB Circular A-130, Appendix III, to justify using the Appendix of OMB Bulletin No. 90-08 as guidance for the technical portion of its security plans. Section B.a.2 applies to security plans for "general support systems" and, III - 5 Audit Report 99B0003 ------- therefore, is inapplicable guidance for the review of major application system security plans. Moreover, Section B of Appendix III only contains "explanatory" and "descriptive language" meant to assist readers in "understanding the requirements of the Appendix," which are found under Section A. In fact, Section A.3.b., Controls for Major Applications, does not mention the interim use of Bulletin 90-08, and the corresponding section (that is, B.b.2.) under Section B, Descriptive Information, limits its reference to the Bulletin. Specifically, Section B.b.2 only states that (1) technical security controls (e.g., tests to filter invalid entries) defined in the Bulletin will continue until that guidance is replaced by NIST's security planning guidance [B.b.2.e)]; and (2) the system test and certification processes, previously required in connection with independent reviews or audits of application controls, will remain in Bulletin 90-08, and can be used to supplement the current review process, whenever appropriate (B.b.3). Also, we note that EPA Directives specifically mention adherence to NIST guidance in the preparation of system security plans. We have made a minor change to the report to clarify our meaning. 26. Agency management provided many pages of response related to our FFMIA findings, and disregarded the majority of our specific audit findings for the following, primary reasons: they generally disagreed with audit staffs interpretation of the Federal requirements, they believed that certain Federal and Agency criteria were not applicable either to the contents of security plans or to the period under review, the Center's review, performed by operations rather than audit personnel, concluded that nine financial systems met Federal requirements "in all material respects," or they made additional improvements to security plans/programs in the months since our review. At this time, we cannot place reliance on the Agency's general assertions because: management has not provided reasonable support to justify a different interpretation or exclusion of Federal and Agency criteria, the Center's reports and supporting analytical work papers were not available to audit staff for assessment purposes, and improvements made subsequent to the end of the reporting period do not affect compliance as of September 30, 1998. Furthermore, OCFO management canceled the meeting we had scheduled between our office, their staff and Agency security managers to discuss the applicability of NIST, OMB and EPA Directives to the evaluation of security plans. Lastly, while we commend management for making continued improvements to their security programs and system security plans, we reiterate that this particular report must comment on the state of compliance as of September 30, 1998. Subsequent improvements will be evaluated during the fiscal 1999 audit of FFMIA compliance. In addition, we plan to review the Center's reports and supporting analytical work papers during our review of the fiscal 1999 financial statements. In the interim, auditing standards prohibit us Audit Report 99B0003 III-6 ------- from relying on the work of others unless we first satisfy ourselves as to the quality and acceptability of such products. Therefore, we must continue to rely on our audit analysis, and will report the resulting audit findings to Agency officials and the Office of Management and Budget. Where appropriate, we revised the report and our recommendations to reflect management's position and acknowledge ongoing efforts to improve compliance with Federal requirements. Ill-7 Audit Report 99B0003 ------- APPENDIX IV REPORT DISTRIBUTION LIST Chief Financial Officer (2710) Inspector General (2410) Assistant Administrator for Administration and Resources Management (3101) Acting Assistant Administrator for Solid Waste and Emergency Response (5101) Assistant Administrator for Enforcement and Compliance Assurance (2201 A) General Counsel (2310) Comptroller (2731) Director, Office of Administration (3201) Director, Office of Acquisition Management (3801R) Director, Office of Grants and Debarment (3901R) Director, Office of Administration and Resources Management, Cincinnati, OH Director, Office of Administration and Resources Management, RTP, NC Acting Director, Office of Information Resources Management (3401) Director, Office of Site Remediation Enforcement (2271A) Director, Office of Emergency and Remedial Response (5201G) Director, Annual Planning and Budget Division (2732) Director, Grants Administration Division (3903R) Director, Enterprise Systems Division (3409) Director, Facilities Management and Services Division (3204) Director, Financial Management Division (2733R) Director, Financial Services Division (2734R) Director, Enterprise Technology Services Division, OIRM, RTP, NC Financial Management Officers at Regions 1, 2, 3, 4, 5, and 9, Cincinnati, Las Vegas, and Research Triangle Park Divisional Inspectors General for Audit Chief, Financial Reports and Analysis Branch (2733R) Chief, Program and Cost Accounting Branch (2733R) Chief, Financial Systems Branch (2733R) Chief, Financial Policies, Procedures and Compliance Branch (2733R) Chief, Washington Financial Management Center (2734R) Acting Chief, Security and Property Management Branch (3204) Kathy Sedlak O'Brien, Agency Audit Follow-up Coordinator (2724) Brigid Rapp, Audit Liaison for the Office of the Chief Financial Officer (2710) Saundra Womack-Butler, Audit Liaison for the Office of Administration and Resources Management (3102) Elizabeth Harris, Audit Liaison for the Office of Solid Waste and Emergency Response (5103) Tom Pastore, Audit Liaison for the Office of Administration (3201) Linda Garrison, Audit Liaison for the Office of Information Resources Management (3401) Greg Marion, Audit Liaison for the Office of Enforcement and Compliance Assurance (2201A) John Showman, Audit Liaison for the Grants Administration Division (3901R) Pat Gilchriest, Audit Liaison for the Administrator's Office (1104) A1 Demarcki, Audit Liaison for the Financial Management Division and Financial Services Division (2733R) William Stewart, Audit Liaison for the Office of General Counsel (2311) Roland Cyr, Audit Liaison for the Financial Audit Division (2422) Audit Report 99B0003 ------- ------- For additional copies of this report, please contact: Environmental Protection Agency Office of the Inspector General Financial Audit Division Mail Code 2422 401 M Street, S.W. Washington, D.C. Telephone: 202-260-1397 FAX: 202-260-1398 ------- |