OFFICE OF INSPECTOR GENERAL U.S. ENVIRONMENTAL PROTECTION AGENCY CUSTOMER SERVICE * INTEGRITY * ACCOUNTABILITY I Compliance with the law Operating efficiently and effectively Additional internal Controls Would Improve the EPA's System for Electronic Disclosure of Environmental Violations Report No. 22-E-0051 June 30, 2022 ------- Report Contributors: Patrick Gilbride Natasha Henry Lauretta Joseph Julie Narimatsu Charles Triebwasser Abbreviations: EPA EPCRA OECA OIG U.S. Environmental Protection Agency Emergency Planning and Community Right-to-Know Act of 1986 Office of Enforcement and Compliance Assurance Office of Inspector General Key Definitions: eDisclosure The EPA's centralized web-based portal that receives and automatically processes self-disclosed civil violations of environmental law. Internal Control A process used by management to help an entity achieve its objectives. Cover Image: Under the EPA's Audit and Small Business Compliance policies, a regulated entity may receive incentives if it voluntarily discovers, reports via the eDisclosure system, and corrects its violations of federal environmental laws and regulations. (EPA OIG image) Are you aware of fraud, waste, or abuse in an EPA program? EPA Inspector General Hotline 1200 Pennsylvania Avenue, NW (2431T) Washington, D.C. 20460 (888) 546-8740 (202) 566-2599 (fax) OIG Hotline@epa.gov Learn more about our OIG Hotline. EPA Office of Inspector General 1200 Pennsylvania Avenue, NW (2410T) Washington, D.C. 20460 (202) 566-2391 www.epa.gov/oiq Subscribe to our Email Updates. Follow us on Twitter @EPAoig. Send us your Project Suggestions. ------- Office of Inspector General U.S. Environmental Protection Agency Glance 22-E-0051 June 30, 2022 Why We Did This Evaluation The U.S. Environmental Protection Agency's Office of Inspector General conducted this evaluation to determine whether the EPA's process for screening self-reported violations through its electronic disclosure, or eDisclosure, system is effective and ensures that significant concerns, such as criminal conduct and potential imminent hazards, are addressed by the Office of Enforcement and Compliance Assurance. The goal of the eDisclosure system is to provide an efficient mechanism for regulated entities to self-disclose—that is, voluntarily discover, report, and correct—violations of federal environmental laws and regulations. Self-disclosed violations are automatically processed under the EPA's audit policies. The EPA subsequently screens certain eDisclosure submissions to ensure that significant concerns, such as criminal conduct and potential imminent hazards, are properly addressed. This evaluation supports EPA mission-related efforts: • Compliance with the law. • Operating efficiently and effectively. This evaluation addresses a top EPA management challenge: • Enforcing environmental laws and regulations. Address inquiries to our public affairs office at (202) 566-2391 or OIG WEBCOMMENTS@epa.gov. List of OIG reports. Additional internai Controls Would Improve the EPA's System for Electronic Disclosure of Environmental Violations Without additional internal controls, the EPA cannot ensure that it effectively screens regulated entities' self-disclosures of environmental violations to identify and mitigate significant concerns, such as criminal conduct and potential imminent hazards. If not mitigated, these significant concerns could pose threats to human health and the environment. What We Found The eDisclosure system does not have adequate internal controls in place to ensure that the EPA's screening process is effective and that significant concerns, such as criminal conduct and potential imminent hazards, are identified and addressed by the Office of Enforcement and Compliance Assurance and the EPA regions. There is no formal, written national guidance or eDisclosure-specific training available on how EPA staff should conduct screening or delineate staff responsibilities. As a result, most regions are inconsistently screening for significant concerns or not screening at all because they either believe OECA is responsible for that task, do not have access to the eDisclosure system, or have other resource limitations. Further, the EPA does not have performance measures and does not systematically track eDisclosure system data. Finally, the eDisclosure system's reporting tool does not allow staff to effectively or robustly use or track eDisclosure submissions. Without national screening guidance, training, effective monitoring, and Central Data Exchange improvements, there is a risk that significant concerns are not being addressed and that the impacts of the EPA's eDisclosure system will remain limited and unknown. Recommendations and Planned Agency Corrective Actions We recommend that the assistant administrator for Enforcement and Compliance Assurance develop national guidance that includes a process for screening eDisclosure submissions for significant concerns; provide eDisclosure-specific training to EPA headquarters and regions to clarify expectations, establish staff responsibilities, and communicate best practices; develop performance measures for the eDisclosure system, as well as a monitoring plan to track its effectiveness; and assess eDisclosure system functionality to identify and implement improvements. OECA agreed with all four of our recommendations and proposed acceptable corrective actions and estimated completion dates. All recommendations are resolved with corrective actions pending. Where appropriate, we revised the report based on technical comments provided by OECA. ------- UNITED STATES ENVIRONMENTAL PROTECTION AGENCY WASHINGTON, D.C. 20460 THE INSPECTOR GENERAL June 30, 2022 MEMORANDUM SUBJECT: Additional Internal Controls Would Improve the EPA's System for Electronic Disclosure of Environmental Violations Report No. 22-E-0051 This is our report on the subject evaluation conducted by the Office of Inspector General of the U.S. Environmental Protection Agency. The project number for this evaluation was OSRE-FY21-Q212. This report contains findings that describe the problems the OIG has identified and corrective actions the OIG recommends. Final determinations on matters in this report will be made by EPA managers in accordance with established audit resolution procedures. The EPA's Office of Enforcement and Compliance Assurance is responsible for the issues discussed in the report. In accordance with EPA Manual 2750, your office provided acceptable planned corrective actions and estimated milestone dates in response to OIG recommendations. All recommendations are resolved, and no final response to this report is required. If you submit a response, however, it will be posted on the OIG's website, along with our memorandum commenting on your response. Your response should be provided as an Adobe PDF file that complies with the accessibility requirements of Section 508 of the Rehabilitation Act of 1973, as amended. The final response should not contain data that you do not want to be released to the public; if your response contains such data, you should identify the data for redaction or removal along with corresponding justification. FROM: Sean W. O'Donnell TO: Lawrence Starfield, Acting Assistant Administrator Office of Enforcement and Compliance Assurance We will post this report to our website at www.epa.gov/oig. ------- Additional Internal Controls 22-E-0051 Would Improve the EPA's System for Electronic Disclosure of Environmental Violations Table of Purpose 1 Background 1 eDisclosure System 2 Processing of eDisclosure Submissions 3 Responsible Offices 5 Scope and Methodology 5 Results 5 The EPA Does Not Have an Effective Screening Process 6 Monitoring and Performance Measures Could Strengthen eDisclosure System 8 The EPA Should Identify Other Opportunities to Improve eDisclosure System 9 Conclusions 9 Recommendations 10 Agency Response and OIG Assessment 10 Status of Recommendations 12 Appendixes A Agency Response to Draft Report 13 B Distribution 17 ------- Purpose The U.S. Environmental Protection Agency's Office of Inspector General initiated this evaluation to determine whether the EPA's process for screening regulated entities' self-disclosed environmental violations reported through the eDisclosure system is effective and ensures that significant concerns, such as criminal conduct and potential imminent hazards, are addressed by the Office of Enforcement and Compliance Assurance, or OECA. Top Management Challenge Addressed This evaluation addresses the following top management challenge for the Agency, as identified in OIG Report No. 22-N-0004. EPA's Fiscal Year 2022 Top Management Challenges, issued November 12, 2021: • Enforcing environmental laws and regulations. Background The EPA's Incentives for Self-Policing: Discovery, Disclosure, Correction and Prevention of Violations policy,1 commonly referred to as the Audit Policy, is designed to safeguard human health and the environment by providing incentives for a regulated entity to self-disclose—that is, voluntarily discover, report, and correct—its violations of federal environmental laws and regulations. According to the EPA, enforcement serves as a strong incentive for compliance and has led to more environmental auditing by regulated entities. Further, due to limited government resources, it is necessary for the regulated community to police themselves. The EPA believes the benefits provided by the Audit Policy will advance these compliance efforts. As a benefit for self-disclosing civil environmental violations, regulated entities are eligible for penalty mitigations, or reduced penalties. In addition, the EPA will generally not recommend criminal prosecution against those regulated entities that self-disclose criminal environmental violations, so long as specified criteria are met, such as prompt and voluntary disclosure, correction and remediation of the violation, and no actual harm or imminent and substantial endangerment. Besides its Audit Policy, the EPA has issued two other self-disclosure policies to promote compliance within the regulated community: • Small Business Compliance Policy. Provides tailored procedures and incentives to small businesses (those with 100 or fewer employees) to discover, disclose, and correct environmental problems. • Interim Approach to Applying the Audit Policy to New Owners, commonly referred to as the New Owner Audit Policy. Provides incentives for new owners who want to address environmental noncompliance that began before acquisition. These three policies form the basis of the EPA's Audit Policy Program. The EPA's national audit policy coordinator, who works within OECA, manages the implementation of the Audit Policy Program. Under this program, over 10,000 regulated entities voluntarily self-disclosed violations at nearly 1 Incentives for Self-Policing: Discovery, Disclosure, Correction and Prevention of Violations, 65 Fed. Reg. 19618, April 11, 2000. 22-E-0051 1 ------- 28,000 facilities from 1995 through 2020. More than half of these self-disclosed violations have been for Emergency Planning and Community Right-to-Know Act, or EPCRA, reporting violations. eDisclosure System In 2015, the EPA created an automated system for receiving and processing self-disclosures under its Audit Policy and Small Business Compliance Policy (Figure 1). Managed by OECA, this electronic disclosure, or eDisclosure, system is a centralized web-based portal that receives and automatically processes self-disclosed civil violations of environmental law by regulated entities. Regulated entities should report potential criminal violations outside the eDisclosure system. In addition, new owner disclosures under the New Owner Audit Policy are made outside the eDisclosure system. Figure 1: Disclosure process for Audit Policy Program policies Submitted in the eDisclosure System Emergency Planning and Community Right-to-Know Act EPCRA helps communities plan for chemical accidents. Among other things, it requires entities to report on the storage and release of hazardous and toxic substances. Not Submitted in the eDisclosure System Source: OIG summary of EPA Audit Policy Program. (EPA OIG image) The eDisclosure system uses the EPA's Central Data Exchange to accept the data submitted by regulated entities throughout the self-disclosure process—from the report of the violation after it is discovered to the final certification of compliance after the violation has been remediated. Once a regulated entity certifies compliance, the eDisclosure system automatically generates and sends the entity an electronic document regarding the processing of the self-disclosure. Although the eDisclosure system automatically processes disclosures, EPA staff are responsible for spot-checking certain submissions for accuracy and screening other disclosures (discussed below) to determine whether further investigation is appropriate for potentially significant concerns. 22-E-0051 2 ------- According to the EPA, the eDisclosure system results in faster and more efficient processing of self-disclosures while saving considerable time and resources for regulated entities and the EPA. More than 2,800 disclosures have been submitted to the EPA via the online eDisclosure system since it was launched in 2015. Processing of eDisclosure Submissions An eDisclosure submission is automatically processed by the eDisclosure system. However, to be eligible for full or partial penalty mitigation, a regulated entity must meet either all conditions or Conditions 2-9 as set forth in the Audit Policy,2 including self-disclosing the violation to the EPA within 21 days of its discovery and providing prompt corrective actions to remediate the violation (Table 1). Table 1: Summary of the Audit Policy's conditions for automated processing and penalty mitigation The nine conditions listed in the Audit Policy: 1. Systematic discovery. 2. Voluntary discovery. 3. Prompt disclosure in writing to the EPA within 21 days of discovery or such shorter time as may be required by law. 4. Independent discovery and disclosure. 5. Correction and remediation within 60 calendar days, in most cases, from the date of discovery. 6. Prevention of recurrence of the violation. 7. Disclosure involving nonrepeat violations. 8. Disclosure of an eligible violation. Certain types of violations are ineligible, such as those that result in serious actual harm; that may present an imminent and substantial endangerment; and that violate the terms of an administrative order, judicial order, or consent agreement. 9. Cooperation with the EPA, such as providing information as necessary and requested by the EPA. Source: OIG analysis of EPA information. (EPA OIG table) If a self-disclosure reported via the eDisclosure system meets all nine conditions or only fails to meet Condition 1, the eDisclosure submission may qualify for one of the following types of automated processing: • Category 1 disclosures include self-disclosed EPCRA violations that meet all nine of the penalty mitigation conditions.3 In response to completed submissions for Category 1 disclosures, the eDisclosure system automatically issues an electronic Notice of Determination confirming that the violations have been resolved with no assessment of penalties, on the condition that the disclosure was accurate and complete. The EPA will spot-check Category 1 disclosures for errors and inconsistencies and to ensure that they comply with EPCRA and meet EPA policies. • Category 2 disclosures include self-disclosures for non-EPCRA violations, EPCRA violations that meet Conditions 2-9 of Table 1, and any other violations excluded from Category 1 disclosures. Category 2 disclosures may involve imminent hazards, such as dangerous releases of chemicals. 2 According to the EPA, if an entity fails to meet Condition 1 (systematic discovery), it can still be eligible for 75-percent penalty mitigation and a recommendation for no criminal prosecution of the self-disclosed violation. 3 Category 1 disclosures cannot include (1) Comprehensive Environmental Response, Compensation, and Liability Act section 103 or EPCRA section 304 chemical release reporting violations or (2) EPCRA violations with significant economic benefit, as defined by the EPA. 22-E-0051 3 ------- In response to completed submissions for Category 2 disclosures, the eDisclosure system automatically issues an acknowledgement letter noting that the EPA has received the submission and that a determination regarding eligibility for penalty mitigation will be made if and when the EPA considers taking enforcement action for the violation.4 According to the Notice of eDisclosure Portal Launch, the EPA then screens Category 2 disclosures "within a few months" after they are submitted to identify significant concerns, such as criminal conduct and potential imminent hazards, and to determine whether further investigation is warranted. Table 2 summarizes the eDisclosure system's processing of Category 1 and 2 disclosures that meet applicable Audit Policy Program conditions. The system automatically issues an ineligibility letter if the disclosure was not made promptly, the compliance certification was not timely submitted, or the disclosure did not meet the conditions of the applicable self-disclosed violation policy. If and when the EPA considers taking an enforcement action related to the violation in that ineligible self-disclosure, the Agency will take into account all relevant facts and circumstances surrounding the self-disclosure, including any good faith efforts to comply. According to the EPA, these safeguards will help to ensure the integrity of the data submitted through the eDisclosure system. Table 2: Category 1 and 2 disclosures I Category 1 Category 2 Eligibility • EPCRA violations that meet all Audit Policy conditions. • EPCRA violations that meet all Small Business Compliance Policy conditions. • All non-EPCRA violations. • EPCRA violations for which the regulated entity can only certify compliance with Audit Policy Conditions 2-9. • EPCRA/CERCLA violations excluded from Category 1. eDisclosure system response Notice of Determination: Violations are resolved with no assessment of civil penalties, conditioned on the accuracy and completeness of the regulated entities' disclosures. Acknowledgement Letter: The EPA has received the disclosure and will make a determination as to eligibility for penalty mitigation if and when it considers taking enforcement action for environmental violations. EPA action The EPA will spot-check disclosures to ensure conformance with EPCRA, the Audit Policy, the Small Business Compliance Policy, and eDisclosure requirements. The EPA will screen disclosures for significant concerns, such as criminal conduct and potential imminent hazards. Source: OIG analysis of EPA information. (EPA OIG table) Note: "CERCLA" refers to the Comprehensive Environmental Response, Compensation, and Liability Act. Internal Controls Internal controls comprise the plans, policies, and procedures used to implement the regular operation of a program, as well as to achieve the program's goals and objectives. Every federal program is required to have internal controls, and federal managers are responsible for maintaining an effective internal control system. The U.S. Government Accountability Office's Standards for Internal Control in the Federal Government, known as the Green Book, contains standards for assessing management controls, including those related to program operations, performance evaluation, training for key roles, and implementation. The Green Book states that program objectives should be clearly defined to enable the identification of risks and define risk tolerances. It notes that management should implement control activities through 4 Even if a regulated entity fails to meet Condition 1 of the Audit Policy, it may still be eligible for a penalty mitigation and a recommendation for no prosecution of any criminal violations. 22-E-0051 4 ------- policies by documenting responsibilities and periodically reviewing for relevance and effectiveness. It also states that federal managers can use performance measures to evaluate performance in achieving objectives and consider training to enable individuals to develop competencies appropriate for key roles and reinforce standards of conduct. Per the Government Accountability Office, management monitors the design and effectiveness of the internal control system as a normal course of operations. The Office of Management and Budget's Circular No. A-123, Management's Responsibility for Enterprise Risk Management and Internal Control, issued on July 15, 2016, requires federal managers to use Government Accountability Office guidance to assess internal control effectiveness. Responsible Offices OECA manages the eDisclosure system within the Audit Policy Program and is responsible for the issues discussed in this report. Scope and Methodology We conducted this evaluation from June 2021 to May 2022 in accordance with the Quality Standards for Inspection and Evaluation published in January 2012 by the Council of the Inspectors General on Integrity and Efficiency. Those standards require that we perform the evaluation to obtain sufficient and appropriate evidence to support our findings. We focused on Category 2 disclosures of environmental violations, as our evaluation objective specifically addresses the screening process for self-disclosures. To answer our objective and obtain an understanding of the eDisclosure system, we reviewed EPA policy, relevant EPA guidance, and procedure documents. We reviewed the EPA's Audit Policy, Small Business Compliance Policy, New Owner Audit Policy, and regional eDisclosure standard operating procedures and other guidance. We analyzed materials provided by Audit Policy Program staff, including a sample of eDisclosure data from 2015 through 2021, as well as other internal documents. We interviewed OECA headquarters and regional staff and managers to gather their perspectives on the eDisclosure system and its progress. Results The EPA's Audit Policy Program does not have adequate internal controls to ensure that the process for screening Category 2 disclosures of environmental violations is effective and that significant concerns, such as criminal conduct and potential imminent hazards, are identified and addressed by OECA and the EPA regions. There is no formal, written national guidance or training that explains how staff should screen Category 2 disclosures or that describes staff responsibilities for the screening process. As a result, most regions are screening for significant concerns inconsistently or not at all, and some regional staff are confused about who is responsible for this task. Further, while the EPA believes that the eDisclosure program benefits the Agency and the regulated community, the EPA does not have performance measures and does not systematically track eDisclosure data to identify the impacts of the Audit Policy Program. In addition, the eDisclosure system is not fully optimized to allow staff to effectively use the data submitted to the system. Without national screening guidance, training, effective monitoring of the system data, and improvements to the system, there is a risk that significant 22-E-0051 5 ------- concerns are not being addressed and that the impacts of the eDisclosure system will remain limited and unknown. The EPA Does Not Have an Effective Screening Process Per the EPA's Notice of eDisclosure Portal Launch: Modernizing Implementation of EPA's Self-Policing Incentive Policies, the EPA will screen Category 2 disclosures to identify significant concerns, such as criminal conduct or potential imminent hazards.5 Half of the EPA's ten regions, however, stated that they are not screening for these concerns. According to OECA's document EPA's Audit Policy Program: Frequently Asked Questions, the EPA has denied penalty mitigation based on a significant concern fewer than 12 times in the nearly 28,000 facilities self- disclosing from 1995 through 2020. While significant concerns are rare, they can be serious. For example, one instance involved a hazardous release that resulted in evacuating the surrounding community. The eDisclosure system is not designed to flag for significant concerns. Rather, OECA told us that headquarters and regions should screen eDisclosure submissions to determine whether there is a significant concern, which may include: • An imminent and substantial endangerment. • Ongoing discharge, emission, release, threat of release, or other acts that may cause harm. • A potential for harm—for example, continued sale of an unregistered pesticide, improper storage of ignitable or reactive waste, or falsification of drinking water data. The EPA Has Only Informal Guidance for Screening Category 2 Disclosures There is no formal, written national guidance that defines and outlines the screening process for Category 2 disclosures of environmental violations. According to OECA and our analysis of internal OECA documents, the EPA's national audit policy coordinator works with the Audit Policy Coordination Team to complete the screening process to identify significant concerns for Category 2 disclosures (Figure 2). The Audit Policy Coordination Team includes regional audit policy contacts and staff from the EPA's Office of Criminal Enforcement, Forensics, and Training. OECA is responsible for screening Category 2 disclosures that span multiple regions or involve national program areas. EPA regional staff are responsible for 5 Notice of eDisclosure Portal Launch: Modernizing Implementation of EPA's Self-Policing Incentive Policies, 80 Fed. Reg. 76476, December 9, 2015. Figure 2: eDisclosure screening process National and regional audit policy coordinators retrieve new self-disclosures and send to appropriate staff for review. Assigned staff reviews submission to screen for potential hazards and identify significant concerns. Source: OIG summary of screening process. (EPA OIG image) 22-E-0051 6 ------- screening Category 2 disclosures for regulated entities within their specific regions. When there are self- disclosures that involve specific media, such as water or air, the national and regional coordinators engage with the appropriate headquarters or regional divisions with expertise in that media. Table 3 summarizes the responsibilities of the national and regional audit policy coordinators during the screening process. While eDisclosure is mostly automated, identification and final disposition of a potentially significant concern is made by EPA staff. Regional coordinator • Coordinates screening of eDisclosure submissions relevant to their specific region. • Engages with the appropriate regional offices for media-specific questions. • Refers potential criminal violations to the regional Criminal Investigation Divisions. Source: OIG summary of interviews and internal documents on the Category 2 screening process. (EPA OIG table) Note: "OCEFT" refers to the EPA Office of Criminal Enforcement, Training, and Forensics. As mentioned previously, these roles and responsibilities are not formalized in any national guidance document and are instead based on internal OECA guidance documents and the knowledge of OECA and regional staff. As we explain in the subsection below, the perception of the process is incorrect for some regions. The EPA Regions Inconsistently Screen Category 2 Disclosures and Lack a Common Understanding of Roles and Responsibilities While there is no national guidance regarding the screening process, EPA Regions 2, 5, and 8 have standard operating procedures for eDisclosure. These three regions' policies and procedures, however, do not specify how staff should evaluate eDisclosure submissions to determine whether a risk of harm exists. Half of the EPA's ten regions said that they do not screen Category 2 disclosures, even though such screening is a programmatic commitment outlined in the Notice of eDisclosure Portal Launch. For example: • Region 5 stated that it does not have staff responsible for eDisclosure screening and that it does not have access to the eDisclosure system. • Region 4 stated that it has insufficient resources to conduct screening. • Regions 6 and 9 believed that regional screening was being conducted by headquarters. As mentioned previously, OECA told us that regions are responsible for accessing the eDisclosure system and screening submissions related to regulated entities under their purview. Additionally, the EPA does not conduct regular training on the eDisclosure system. Some regional staff noted that they receive training on criminal conduct and how the Agency coordinates civil and criminal cases, but these trainings are not specific to eDisclosure submissions. Along with national guidance, Table 3: eDisclosure roles and responsibilities National audit policy coordinator • Coordinates screening of eDisclosure submissions that involve national programs and multiple regions. • Engages with the appropriate Office of Civil Enforcement division for media-specific questions. • Refers criminal violations received outside of the eDisclosure system to OCEFT. 22-E-0051 7 ------- eDisclosure-specific training will help ensure that headquarters and regional staff are aware of screening requirements by clarifying screening expectations, describing roles and responsibilities, and communicating best practices. The regional differences in the screening process show that Audit Policy Program implementation is inconsistent. Effective internal controls, such as national guidance and eDisclosure-specific training for national and regional staff, would help create an effective screening process to identify significant concerns, such as criminal conduct and potential imminent hazards, that could pose a threat to human health and the environment. These significant concerns could then be addressed by OECA and the EPA regions in a timely manner. Monitoring and Performance Measures Could Strengthen eDisclosure System Monitoring is an important component of internal control and encompasses activities that management establishes and operates to assess the quality of performance over time. According to the Office of Management and Budget's Circular No. A-123, continuous monitoring and other periodic assessments should provide the basis for the Agency's annual assessment of and report on internal controls. In OECA's New Owner Audit Policy, the EPA recognizes the importance of measuring outcomes and performance, including demonstrating that environmental compliance has improved and environmental benefits have been attained. OECA, however, has not established such performance measures and does not conduct any monitoring, such as annual reviews, to determine the effectiveness of the eDisclosure system implementation and performance. Neither OECA nor regional staff could recall any internal metrics or reviews being conducted of the eDisclosure system. Staff from seven of the EPA's ten regions reported that they believe that the eDisclosure system is a valuable tool. Some stated that the . , i i . , .... . Figure 3: Five-year snapshot of number of system helps regulated entities correct J: . . - - , , „ , eDisclosure submissions, fiscal year 2016-2020 mistakes and adhere to regulations, 622 while others noted that it streamlines EPA processes and reduces workload. One regional staff person said that the eDisclosure system has been helpful by identifying opportunities to offer compliance assistance. A staff person from a different region described the eDisclosure system as a method of compliance assistance that could be useful to other EPA programs and save resources. However, another staff person from that region noted that, when considering the number of regulated entities, the use of the eDisclosure system is low (Figure 3). Staff from two regions stated that they believe the eDisclosure system is typically only used by larger regulated entities that have more expertise. FY 2016 FY 2017 FY 2018 FY 2019 FY 2020 Source: EPA, EPA Celebrates Key Anniversaries by Releasing Updated Audit Policy FAQs, March 2021. (EPA OIG adaptation of EPA image) The EPA has acknowledged that while the Audit Policy program has been successful in resolving disclosed violations and has received positive feedback, its potential as a tool to promote compliance 22-E-0051 8 ------- and to produce significant pollutant reductions has not been fully realized. OECA stated that it has not conducted outreach, measurements, or assessments to track eDisclosure and program progress. Without effective monitoring, the EPA does not know the impact of the eDisclosure system on improving compliance and realizing environmental and human health benefit. Performance measures would help the Agency better assess the effectiveness and implementation of the eDisclosure system within the Audit Policy Program. The EPA Should Identify Other Opportunities to Improve eDisclosure System Through our analysis of eDisclosure data and interviews with OECA and EPA regional staff, we identified opportunities to improve the reporting tool of the eDisclosure system.6 While the eDisclosure system is not designed to automatically screen for significant concerns, improvements to the system's database and reporting tool could assist staff in the performance of their duties. Five of the EPA's ten regions either told us or described issues that indicate that the Agency should update the eDisclosure system. Recommended updates include: • Enabling real-time notifications when information is added to the eDisclosure system so that regional staff no longer have to manually check the system for any new eDisclosure submissions. • Optimizing the eDisclosure system and reporting tool to provide robust analyses and functions. OECA staff told us that there are limited resources to enhance the eDisclosure system and, therefore, its data is not being used as an analysis tool to monitor it. Our fieldwork confirmed this deficiency. We attempted to analyze eDisclosure data to determine how many regulated entities submitted multiple self-disclosures via the eDisclosure system. This is important because repeat violations at the same facility within three years or at multiple facilities owned or operated by the same entity within five years are ineligible for Audit Policy penalty mitigation. However, the eDisclosure reporting tool does not easily distinguish whether each row of data in the system database is a distinct eDisclosure submission, nor does it provide a mechanism for isolating distinct eDisclosure submissions. We were therefore unable to reliably identify potential repeat violations. With additional program monitoring and surveys of regional staff, the EPA could identify additional potential updates to the eDisclosure system to ensure that submissions are screened, to enhance staff ability to review data, and to track eDisclosure system performance. Conclusions The EPA's Audit Policy Program does not have adequate internal controls to ensure that the screening process for eDisclosure submissions is effective and that significant concerns are identified and addressed by the regions and OECA. While the EPA has committed to screening submissions, there is no formal, written national guidance or training on how staff should conduct this screening. As a result, some regional staff are not screening eDisclosure submissions or are screening them inconsistently. Additionally, the EPA has not conducted any monitoring or established any performance measures to determine whether the eDisclosure system and screening procedures are being consistently and effectively implemented. The eDisclosure system could also be improved to offer real-time notifications 6 The Green Book defines an information system as including the people, processes, data, and technology that management organizes to obtain, communicate, or dispose of information. 22-E-0051 9 ------- of new eDisclosure data and robust data analyses. By implementing these internal controls, the EPA can reduce the risk that significant concerns are not being addressed while also enhancing the impacts of the eDisclosure system. Recommendations We recommend that the assistant administrator for Enforcement and Compliance Assurance: 1. Develop national guidance that includes a process for screening eDisclosure submissions for significant concerns, such as criminal conduct and potential imminent hazards. 2. Provide eDisclosure-specific training to EPA Headquarters and regions to clarify expectations, establish staff responsibilities, and communicate best practices. 3. Develop performance measures for the eDisclosure system and a monitoring plan to track its effectiveness. 4. In coordination with EPA regions, assess eDisclosure system functionality to identify and implement improvements. Agency Response and OIG Assessment In its response to our draft report, OECA agreed with all four recommendations and proposed acceptable corrective actions with estimated completion dates (Appendix A). OECA also provided separate technical comments, which we used to update the report where appropriate. In its response to Recommendation 1, OECA noted that it has publicly stated that the eDisclosure system should not be used to disclose criminal conduct and that releases of hazardous substances above certain thresholds are required to be immediately reported. We agree with these comments and maintain that eDisclosure submissions, per OECA's policy, should be screened to ensure that these types of disclosures are detected. The EPA stated that it has already begun to coordinate with regional audit policy coordinators regarding the development of national guidance and will look at those regions that have already developed screening guidance. The EPA committed to developing national guidance that includes a process for screening eDisclosure submissions by the end of the fourth quarter of fiscal year 2023. This proposed corrective action meets the intent of our recommendation, which is resolved with corrective action pending. In its response to Recommendation 2, OECA discussed the ad hoc training it has conducted in the past, especially for new staff. OECA committed to conducting, by the end of the fourth quarter of fiscal year 2022, eDisclosure-specific training for all Audit Policy Program staff to clarify expectations, establish staff responsibilities, and communicate best practices. This proposed corrective action meets the intent of our recommendation, which is resolved with corrective action pending. In its response to Recommendation 3, OECA stated that it tracks the total number of submissions to the eDisclosure system in its Enforcement Annual Results and that this number has increased since 2015, indicating the system's success. During our review, we noted several areas where OECA or regional staff told us that this system has more potential as a tool to promote compliance and could benefit from more outreach. OECA committed to developing performance measures and a monitoring plan for the 22-E-0051 10 ------- eDisclosure system by the end of the fourth quarter of fiscal year 2023. This proposed corrective action meets the intent of our recommendation, which is resolved with corrective action pending. In its response to Recommendation 4, OECA stated that it had previously enhanced eDisclosure by creating a reporting tool that allows the EPA to easily download and analyze self-disclosure data. OECA did, however, state that the tool could be improved and that it maintains a list of suggested improvements based on feedback. OECA committed to assessing the eDisclosure system functionality to identify potential updates and to seek to implement improvements, dependent upon available resources, by the end of the fourth quarter of fiscal year 2023. It also clarified terminology that we incorporated into the report. This proposed corrective action meets the intent of our recommendation, which is resolved with corrective action pending. Note that the strike-through and red text in the corrective action table in the EPA's response is original. 22-E-0051 11 ------- Status of Recommendations RECOMMENDATIONS Rec. No. Page No. Subject Status1 Action Official Planned Completion Date 1 10 Develop national guidance that includes a process for screening eDisclosure submissions for significant concerns, such as criminal conduct and potential imminent hazards. R Assistant Administrator for Enforcement and Compliance Assurance 9/30/23 2 10 Provide eDisclosure-specific training to EPA Headquarters and regions to clarify expectations, establish staff responsibilities, and communicate best practices. R Assistant Administrator for Enforcement and Compliance Assurance 9/30/22 3 10 Develop performance measures for the eDisclosure system and a monitoring plan to track its effectiveness. R Assistant Administrator for Enforcement and Compliance Assurance 9/30/23 4 10 In coordination with EPA regions, assess eDisclosure system functionality to identify and implement improvements. R Assistant Administrator for Enforcement and Compliance Assurance 9/30/23 1 C = Corrective action completed. R = Recommendation resolved with corrective action pending. U = Recommendation unresolved with resolution efforts in progress. 22-E-0051 ------- Appendix A Agency Response to Draft Report tffcD STAf %PR0^ UNITED STATES ENVIRONMENTAL PROTECTION AGENCY WASHINGTON, D.C. 20460 OFFICE OF ENFORCEMENT AND COMPLIANCE ASSURANCE June 2. 2022 MEMORANDUM SUBJECT: FROM: TO: Response to the Office of Inspector General Draft Report, Additional Internal Controls Would Improve EPA's Electronic Disclosure of Environmental Violations, Pro) ect No. OSRE-FY21-0212, May 4, 2022 Lawrence E. Starfield, Acting Assistant Administrator Patrick Gilbride, Director Implementation, Execution, and Enforcement Office of Special Review and Evaluation Office of Inspector General I AVA/RPMPP Digitally signed by l-AAVV LAWRENCE STARFIELD STARFIELD Thank you for the opportunity to respond to the recommendations in the subject audit report. The following is our position on each of the report recommendations. The Office of Enforcement and Compliance Assurance (OECA) agrees with all recommendations and has provided a high-level intended corrective action and estimated completion date for each. Additionally, attached are technical comments on the draft report. AGENCY'S POSITION Recommendation 1 - Agree Develop national guidance that includes a process for screening eDisclosure submissions for significant concerns, such as criminal conduct and potential imminent hazards. RESPONSE: We accept Recommendation 1. OECA has already initiated a conversation with the regional Audit Policy Coordinators regarding development of national guidance that includes a process for screening eDisclosure submissions for significant concerns. Several regions have regional screening guidance; OECA will look to those as it develops the national guidance. While OECA agrees with this Recommendation and will implement it, it is important to note the following: 22-E-0051 13 ------- • EPA has stated publicly that eDisclosure should not be used to disclose criminal conduct. EPA screens eDisclosure submissions to ensure the system is not used to disclose criminal conduct. • Companies are required to immediately report oil spills and releases of hazardous substances above certain thresholds, so it is unlikely that they would use eDisclosure. In addition, companies with permits are usually required to notify the permitting authority of upsets or unpermitted releases. These sources of information are more likely to provide EPA with information that might lead to a determination of imminent hazard. Recommendation 2 - Agree Provide eDisclosure-specific training to EPA Headquarters and regions to clarify expectations, establish staff responsibilities, and communicate best practices RESPONSE: We accept Recommendation 2. While OECA has not conducted regularly scheduled training for eDisclosure, there was a training webinar in January 2016 after eDisclosure was launched, additional ad hoc training during the Audit Policy Coordinator calls when the system was updated, and similar training for new staff. For instance, when eDisclosure enhancements were finalized in 2020, OECA staff provided training on the updates to the Audit Policy Coordinators during a monthly call. Moreover in 2022, OECA staff has provided training to new Audit Policy staff in EPA Region 3 and 5. OECA will provide eDisclosure-specific training to all Audit Policy staff. Recommendation 3 - Agree with comments Develop performance measures for the eDisclosure system and a monitoring plan to track its effectiveness. RESPONSE: We accept Recommendation 3. Since 2016, OECA has included the number of submissions to the eDisclosure system in our Enforcement Annual Results. Immediately prior to the launch of eDisclosure in December 2015, there were approximately 300 self-disclosures a year; since then, that annual number has almost doubled. OECA believes that increased submissions to eDisclosure are an indicator of eDisclosure's success. OECA will develop performance measures and a monitoring plan to track eDisclosure's effectiveness. Recommendation 4 - Agree with comments In coordination with EPA regions, assess eDisclosure system functionality to identify and implement improvements, including potential updates to the Central Data Exchange. 22-E-0051 14 ------- RESPONSE: We accept Recommendation 4. OECA, in coordination with regional staff, will assess eDisclosure system functionality to identify improvements. OECA will seek to implement improvements, given available resources. OECA would like to provide an important edit to correct the terminology used in Recommendation 4 (see correcting edit in corrective action table below). Please also note that the terms "eDisclosure" and "Central Data Exchange" are used incorrectly throughout the report (see correcting edits in the attached technical comments). The two terms are not interchangeable. Regulated entities self-disclose via the eDisclosure system which is on the Central Data Exchange (CDX) network. OECA is responsible for the implementation of eDisclosure, but OECA is not responsible for the operation and maintenance of CDX. In 2019, OECA initiated enhancements to the eDisclosure system that incorporated feedback from users. One of these updates included the creation of the eDisclosure Search Report (reporting tool), which enables EPA to easily download and analyze self-disclosure data. The reporting tool data is also compiled for our Enforcement Annual Results. The reporting tool could be improved, and OECA already has ideas for how it can be upgraded. Additionally, OECA maintains a list of suggested improvements in eDisclosure based on feedback from the regulated community and EPA users. CORRECTIVE ACTION TABLE Recommendation High-level Intended Corrective Action(s) Estimated Completion Date 1 Develop national guidance that includes a process for screening eDisclosure submissions for significant concerns, such as criminal conduct and potential imminent hazards. Develop national guidance that includes a process for screening eDisclosure submissions for significant concerns, such as criminal conduct and potential imminent hazards. FY 2023, 4th quarter 2 Provide eDisclosure-specific training to EPA Headquarters and regions to clarify expectations, establish staff responsibilities, and communicate best practices. Provide eDisclosure-specific training to EPA Headquarters and regions to clarify expectations, establish staff responsibilities, and communicate best practices. FY 2022, 4th quarter 3 Develop performance measures for the eDisclosure system and a monitoring plan to track its effectiveness. Develop performance measures for the eDisclosure system and a monitoring plan to track its effectiveness. FY 2023, 4th quarter 4 In coordination with EPA regions, assess eDisclosure system functionality to identify and implement improvements, including potential updates to4he eDisclosure Central Data Exchange. a. Assess eDisclosure system functionality to identify potential updates to the eDisclosure system. b. Seek to implement improvements, including potential updates to the eDisclosure system, dependent upon available resources. FY 2023, 4th quarter FY 2023, 4th quarter 22-E-0051 15 ------- CONTACT INFORMATION If you have any questions regarding these comments, please contact Gwendolyn Spriggs, OECA's Audit Follow Up Coordinator, at spriggs.gwendolyn@epa.gov. Attachments cc: Rosemarie Kelley, Director, OECA/OCE Henry Barnet, Director, OECA/OCEFT Gwendolyn Spriggs, Audit Follow Up Coordinator, OECA 22-E-0051 16 ------- Appendix B Distribution The Administrator Deputy Administrator Chief of Staff, Office of the Administrator Deputy Chief of Staff, Office of the Administrator Agency Follow-Up Official (the CFO) Assistant Administrator for Enforcement and Compliance Assurance Principal Deputy Assistant Administrator for Enforcement and Compliance Assurance Agency Follow-Up Coordinator General Counsel Associate Administrator for Congressional and Intergovernmental Relations Associate Administrator for Public Affairs Director, Office of Continuous Improvement, Office of the Chief Financial Officer Director, Office of Administration and Policy, Office of Enforcement and Compliance Assurance Audit Follow-Up Coordinator, Office of the Administrator Audit Follow-Up Coordinator, Office of Enforcement and Compliance Assurance 22-E-0051 17 ------- |