OFFICE OF INSPECTOR GENERAL U.S. ENVIRONMENTAL PROTECTION AGENCY September 30, 2022 | Report No. 22-N-0061 THE EPA FAILED TO COMPLETE CORRECTIVE ACTIONS AS CERTIFIED TO ADDRESS OIG RECOMMENDATIONS Overview To fulfill its oversight function, the Office of Inspector General for the U.S. Environmental Protection Agency often conducts audits to determine whether the Agency implemented recommendations from prior OIG reports. In conducting these follow-up audits, we identified several instances where prior OIG recommendations were not implemented even though the Agency had certified that the corrective actions in response to the recommendations were completed. Thus, we initiated this review to summarize select OIG reports from 2011 through 2020 for which the EPA certified completion of agreed-to corrective actions but for which our later work found the actions were not completed. We conducted this review to provide considerations for the EPA to strengthen its corrective action certification process. When the Agency certifies to the completion of corrective actions that have not been completed, it leads to inaccurate data in the Agency's audit tracking system, limits the OIG's assurance that the corrective actions reported by the Agency are reliable, and may give the public and Congress the wrong impression regarding the EPA's progress in addressing OIG recommendations. Background The OIG was created to conduct and supervise audits and investigations relating to the Agency's programs and operations. According to Office of Management and Budget Circular A-50, Audit Followup, both the Agency and the OIG share responsibility for audit follow-up. EPA Manual 2750, Audit Management Procedures, establishes Agency policies and procedures for audit management and follow-up. According to EPA Manual 2750, the Office of the Chief Financial Officer administers the Agency's audit tracking system and uses the system to record, track, and monitor the Agency's progress in implementing agreed-to corrective actions. As of May 2022, the EPA was updating EPA Manual 2750. Figure 1 details the corrective action process found in EPA Manual 2750. The chief financial officer, as the Agency audit follow-up official, is responsible for ensuring that action officials implement the agreed-to corrective actions. The Agency provides the OIG with updates regarding EPA headquarters in Washington, D.C. (EPA image) Review Purpose: The U.S. Environmental Protection Agency Office of Inspector General conducted this review to summarize select EPA OIG reports from 2011 through 2020 for which the EPA falsely certified completion of agreed-to corrective actions for report recommendations. The project number for this review was QA-FY22-0072. This review supports the following EPA mission-related effort: • Operating efficiently and effectively. This review addresses the following top EPA management challenge: • Enforcing environmental laws and regulations. Report Contributors: LaSharn Barnes lantha Maness Christina Nelson Teresa Richardson Michelle Wicker Address inquiries to our public affairs office at (202) 566-2391 or OIG WEBCOMMENTS@epa.gov. Full list of EPA OIG reports. 22-N-0061 1 ------- Figure 1: EPA Manual 2750 corrective action process 1 The OIG issues its final report. The OIG and Agency reach 2 resolution on corrective actions within 180 days of final report The Agency updates its tracking 3 R system with corrective actions within 15 days of agreement of 0 a The Agency takes actions to implement corrective actions for OIG recommendations. The Agency provides updates, such as progress, status, delays, and completion dates of corrective actions, at least quarterly on its tracking system. If there are significant changes to a corrective action, the Agency must submit request for changes within one week of the decision to make a change to the agreed-to corrective actions. The OIG has 15 days to accept or reject the corrective Once all the corrective actions have been completed, the Agency provides the OIG a certification memorandum that certifies that all corrective actions have been The Agency provides the OIG with updates on overdue corrective actions every March 31 and September 30. These comments are included in the OIG's Semiannual Report to Congress. Source: EPA Manual 2750. (EPA OIG image) overdue corrective actions on March 31 and September 30 of each year. The OIG is required to prepare its Semiannual Report to Congress no later than April 30 and October 31 of each year. The Semiannual Report to Congress summarizes the activities of the preceding six-month period, which ends either March 31 or September 30. The Semiannual Report to Congress includes a list of unimplemented recommendations, also known as open recommendations, for which the EPA has not completed or implemented corrective actions. The OIG also issues an annual compendium of open and unresolved recommendations that analyzes the unimplemented recommendations included in the Semiannual Report to Congress. Scope and Methodolo A description of our scope and methodology is in Appendix A. What We Found Through our follow-up work, we discovered that EPA offices had not completed corrective actions for recommendations in seven OIG reports issued from 2011 through 2020, despite previously certifying completion of the agreed-upon actions. As shown in Figure 2, of the 48 corrective actions that the EPA Figure 2: Status of recommendations from seven prior OIG reports agreed to, 15 (roughly 31 percent) were certified as completed despite the Agency not completing them. The OIG provides the Agency with recommendations to improve the economy, efficiency, and effectiveness of the Agency's programs and operations. We discovered many of these 15 unimplemented OIG recommendations when conducting follow-up audits. The below summaries address 12 of these 15 recommendations, which were issued in four of the seven reports we reviewed, for which the Agency certified the corrective actions as completed when they were not. These summaries also illustrate the impacts of the unimplemented recommendations on the Agency's programs. Appendix B provides more detail regarding the actions taken by the Agency in response to the OIG's findings in the original reports. Source: OIG analysis of prior reports. (EPA OIG image) 22-N-0061 2 ------- Figure 3: Recommendation 14 from EPA OIG Report No. 17-P-0368 OLEM stated that it would work with the regions to develop and implement a method to track pre- and post-closeout program income until termination of the closed cooperative agreements. OLEM issued a memorandum on the closeout agreement process and a closeout agreement template on June 21, 2018, and certified completion of the corrective action on March 19, 2019. However, there was no method to track program income accurately and consistently. Because of a lack of current, accurate, and complete data, | the Agency was unable to determine whether an estimated $46.6 million of post-closeout program income was used in a | timely manner and for the purposes authorized. Source: OIG summary of agreed-to corrective actions. (EPA OIG image) EPA OIG Report No. 17-P-0368. Improved Management of the Brownfields Revolving Loan Fund Program Is Required to Maximize Cleanups, issued August 23, 2017. The OIG made 17 recommendations to the EPA's Office of Land and Emergency Management to improve the EPA's management of the Brownfields Revolving Loan Fund Program, including five recommendations related to the monitoring of program income. OLEM's Office of Brownfields and Land Revitalization proposed corrective actions to address all 17 recommendations. On March 19, 2019, the OBLR director certified completion of all corrective actions for the 17 recommendations. A brownfield site is a property for which the expansion, redevelopment, or reuse may be complicated by the presence or potential presence of a hazardous substance, pollutant, or contaminant. Through the Brownfields program, the EPA provides funding to local governments and other eligible entities to capitalize a revolving loan fund and to provide subawards to carry out cleanup activities at brownfield sites. It is estimated that there are more than 450,000 brownfield sites in the United States. Cleaning up and reinvesting in these properties increases local tax bases; facilitates job growth; utilizes existing infrastructure; takes development pressures off undeveloped, open land; and both improves and protects the environment. The Infrastructure Investment and Jobs Act provides the EPA with $1.5 billion for brownfield activities. In our follow-up audit, as detailed in EPA OIG Report No. 22-P-0033. Brownfields Program-Income Monitoring Deficiencies Persist Because the EPA Did Not Complete All Certified Corrective Actions, issued March 31, 2022, we determined, among other things, that the OBLR had not fully implemented corrective actions for the five prior report recommendations related to the monitoring of program income. For example, in response to our prior report's Recommendation 14, OLEM agreed to work with the regions to develop and implement a method to track pre- and post- closeout program income until termination of the closed cooperative agreements. According to the OBLR's certification memorandum, the OBLR's closeout process memorandum issued on June 2, 2018, addressed the recommendation. However, in our follow-up work, we found that the OBLR did not develop methods to track and monitor program income, as stated in the recommendation. See Figure 3. As result of not implementing all of our prior report's recommendations, the OBLR was unable to determine whether an estimated $46.6 million of post-closeout program income was used in a timely manner and for the purposes authorized under the closeout agreements. The OBLR also could not assess whether any of the $46.6 million of program income needed to be returned to the government. 22-N-0061 3 ------- Figure 4: Recommendations 4, 5, and 6 from OIG Report 11-P-0215 The OCSPP stated that it would develop a comprehensive management plan for the EDSP for Recommendations 4, 5, and 6. The OCSPP certified completion of the corrective actions on September 23, 2013. However, the OCSPP did not publish a comprehensive management plan until 2014, and that plan did not include all the agreed-to elements. Without management controls I the EPA could not make measurable progress toward compliance with statutory requirements to safeguard against endocrine-disrupting chemicals. Source: OIG summary of agreed-to corrective actions. (EPA OIG image) EPA OIG Report No. ll-P-0215. EPA's Endocrine Disruptor Screening Program Should Establish Management Controls to Ensure More Timely Results, issued May 3, 2011. The EPA's Endocrine Disruptor Screening Program screens and tests chemicals with endocrine- disrupting effects. We recommended that the EPA's EDSP develop and implement plans and performance measures to establish management control and accountability. The Office of Chemical Safety and Pollution Prevention agreed to develop a comprehensive management plan in response to Recommendations 4, 5, and 6. As depicted in Figure 4, the director of the OCSPP's Office of Science Policy and Coordination certified completion of the agreed-to corrective actions for these three recommendations, including the development of a comprehensive management plan, in a certification memorandum dated September 23, 2013. In our follow-up audit, as detailed in EPA OIG Report No. 21-E-0186. EPA's Endocrine Disruptor Screening Program Has Made Limited Progress in Assessing Pesticides, issued July 28, 2021, we determined that the OCSPP did not develop and publish a Endocrine disruptors are chemicals that mimic, block, or otherwise disrupt the normal functioning of hormones. People may be exposed to endocrine disruptors by consuming food or beverages, applying or being exposed to pesticides, or using cosmetics. A person's contact with these chemicals may occur through diet, air, skin, or water. Even low doses of endocrine- disrupting chemicals may be unsafe. The body's normal endocrine functioning involves very small changes in hormone levels, yet even these small changes can cause significant developmental and biological effects. This observation leads scientists to think that endocrine-disrupting chemical exposures, even at low amounts, can alter the body's sensitive systems and lead to health problems. comprehensive management plan until 2014, months after it had certified completion in September 2013. Furthermore, the 2014 plan did not include all the agreed-to elements, and the OCSPP had not updated the plan, leaving the EDSP without effective management control and accountability. Without effective internal controls, the Agency cannot demonstrate measurable progress toward compliance with statutory requirements to safeguard human health and the environment against endocrine- disrupting chemicals. EPA OIG Report No. 20-P-0120. EPA Needs to Improve Its Risk Management and Incident Response Information Security Functions, issued March 24, 2020. The OIG made three recommendations to the EPA's Office of Mission Support to facilitate its efforts to develop a resilient security posture that can prevent, detect, and respond to emerging cyberthreats. These recommendations included improvements in the EPA's risk management and incident response functions. The OMS certified completion of all agreed-to corrective actions on June 24, 2020, including implementation of a dashboard that provides a current inventory of approved software and 22-N-0061 4 ------- Figure 5: Recommendation 1 from EPA OIG Report 20-P-0120 The OMS agreed to (1) implement a dashboard that provides a current inventory of approved software for network endpoints and (2) establish a license entitlement inventory. The OMS implemented a dashboard of current inventory of approved software for network endpoints but did not establish a license entitlement inventory. As a result, the confidentiality, integrity, and availability of the Agency's systems and data remained at risk. Source: OIG summary of agreed-to corrective actions. (EPA OIG image) establishment of a license entitlement inventory. Figure 5 illustrates the resolution process for Recommendation 1. In our follow-up audit, as detailed in EPA OIG Report No. 21-E-0124, EPA Needs to Improve Processes for Updating Guidance, Monitoring Corrective Actions, and Managing Remote Access for External Users, issued on April 16, 2021, we found that corrective actions for two of these three prior recommendations would not be completed until December 2021, despite the OMS certifying completion of the corrective actions in June 2020. The corrective actions for Recommendation 1 of the prior report required two separate tasks to address the recommendation. However, the OMS only verified completion of one task, while the second task—the establishment of a license entitlement inventory—was not completed. Further, while the estimated completion date for the corrective actions for Recommendation 2 of the prior report was revised, the OMS certified that the actions were completed without verification and prior to the revised completion date. As a result, the confidentiality, integrity, and availability of the Agency's systems and data remained at risk until the corrective actions were completed. Under the Federal Information Security Modernization Act, agency heads are responsible for providing information security protections commensurate with the risk and magnitude of harm resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of information and information systems collected, maintained, or used by or on behalf of the agency. EPA OIG Report No. 18-P-0221, Management Weaknesses Delayed Response to Flint Water Crisis, issued July 19, 2018. The OIG made nine recommendations to improve the EPA's oversight of state drinking water programs, as well as its response to drinking water emergencies. Five of these recommendations were issued jointly to the Office of Water and the Office of Enforcement and Compliance Assurance, one was issued solely to the OW, and three were issued to EPA Region 5. The recommendations issued jointly to the OW and OECA included regular training for EPA drinking water staff, managers, and senior leaders on Safe Drinking Water Act tools and authorities (Recommendation 6) and the creation of a system to track citizen complaints and assess the risks associated with the complaints (Recommendation 8). OECA agreed to provide regular training nationally about SDWA tools and authorities, while the OW agreed to complete the training provided by OECA. Both OECA and the OW agreed to identify potential enhancements to existing systems or new system requirements to support tracking of citizen complaints. On December 10, 2020, OECA certified completion of all corrective actions assigned to OECA, including providing regular The Safe Drinking Water Act gives the EPA emergency authority to act when a contaminant may present an "imminent and substantial endangerment" to human health and when the appropriate state and local authorities have not acted to protect the public. 22-N-0061 5 ------- Figure 6: Recommendation 6 from EPA OIG Report 18-P-0221 OECA agreed to provide regular training to staff, managers, and senior leaders on SDWA tools and authorities. While OECA certified that training was provided, it could not confirm who received the training on SDWA tools and authorities. Because OECA did not fully implement the corrective action, EPA personnel may not be familiar on how to employ SDWA tools and authorities. Source: OIG summary of agreed-to corrective actions. (EPA OIG image) SDWA training for staff and managers. On July 7, 2021 the Office of Ground Water and Drinking Water certified completion of all corrective actions assigned to the OW. See Figure 6. In our follow-up audit, as detailed in EPA OIG Report No. 22-P-0046, The EPA Needs to Fully Address the OIG's 2018 Flint Water Crisis Report Recommendations by Improving Controls, Training, and Risk Assessments, issued May 17, 2022, we determined that OECA did not fully implement the agreed-to corrective actions for Recommendations 6 and 8. Specifically, OECA could not confirm who received training on SDWA tools and authorities and did not incorporate functions into its Report a Violation system to assess risks associated with citizen tips and to track resolution of these tips. As a result, EPA personnel may not be familiar with how to employ SDWA tools and authorities, and citizens' tips may not be effectively monitored and used to alert the EPA of public health concerns. Observations and Considerations For each of the 15 OIG recommendations issued in the seven reports identified by this review and discussed in Appendix B of this report, the Agency certified via certification memorandums sent to the OIG that agreed-to corrective actions were completed or implemented, when in fact they had not been completed. Inaccurate data in the audit tracking system limit the OIG's assurance that it can rely on the status of corrective actions reported by the Agency. These inaccurate data also impact the accuracy of the Semiannual Report to Congress. To correct the public record, the OIG included these 15 recommendations in "Appendix 3 - Reports With Corrective Actions Not Completed" in the Semiannual Report to Congress: October 1, 2021, to March 31, 2022 (Report No. EPA-350-R-22-001). To increase the accuracy and integrity of the Agency's audit follow-up reporting, we propose that the EPA consider: 1. Enhancing and strengthening the recommendation follow-up process. 2. Requiring the chief financial officer to verify completion of agreed-to corrective actions before submitting certification memorandums to the OIG. Agency Response and OIG Assessment On September 15, 2022, the EPA's Office of the Chief Financial Officer responded to the draft report. In this response, the chief financial officer states that the report may be missing information and data relevant to our findings and provided information to support this position. Further, the chief financial officer suggests that if we had sought clarification on the corrective actions implemented, we may have reached different conclusions on the status of the corrective actions identified within the report. Finally, the Office of the Chief Financial Officer provided technical comments on our draft report, 22-N-0061 6 ------- which we incorporated as appropriate. The Agency's full response to our draft report is in Appendix C. We do not agree that seeking additional clarification on the recommendations discussed in this report would have changed our conclusions. The information in this report was based on findings and conclusions identified during previously published follow-up audits, which were vetted thoroughly with the Agency as part of our standard audit reporting process. We identified that certain corrective actions were not completed but certified as such, and the Agency concurred with new recommendations that reiterated the unimplemented recommendations. Additionally, the recommendations in this report were listed as unimplemented in our Semiannual Report to Congress: October 1, 2021, to March 31, 2022; these status changes were provided to the EPA for comment prior to the issuance of that semiannual report. The Office of the Chief Financial Officer's response to our draft report provides information on the actions taken by the responsible offices in response to our prior reports and recommendations, but this information was already known to us and considered during our follow-up audits. For example, the Agency's response notes that: • The OCSPP developed a comprehensive management plan in 2014 to address recommendations in our EPA's Endocrine Disruptor Screening Program report. However, the plan was not updated to include all the required elements that were outlined in the agreed-to corrective action plan. • OECA issued a memorandum titled TSDF Inspection Prioritization Scheme on September 28, 2018, in response to recommendations in our Hazardous Waste Treatment, Storage and Disposal Facility Inspections report to revise OECA policies and procedures to clarify which facilities properly fall within the definition of a treatment, storage, and disposal facility.1 That memorandum was reviewed during our follow-up audit, which concluded that the agreed-to action had not been completed. • The OMS completed training on religious compensatory time for the EPA's human resources community in response to recommendations in our Religious Compensatory Time report.2 Our follow-up audit determined that this training was not provided to all employees who use religious compensatory time or to all supervisors who approve such time, as intended by the recommendation and as agreed to in the proposed corrective action. 1 EPA OIG, EPA Has Not Met Statutory Requirements for Hazardous Waste Treatment, Storage and Disposal Facility Inspections, but Inspection Rates Are High, Report No. 16-P-0104 (March 11, 2016). 2 EPA OIG, Enhanced Controls Needed to Prevent Further Abuse of Religious Compensatory Time, 16-P-0333 (September 27, 2016). 22-N-0061 7 ------- Appendix A Scope and Methodology We conducted this review from February to July 2022. We did not follow generally accepted government auditing standards or the Council of Inspectors General on Integrity and Efficiency's Quality Standards for Inspection and Evaluation. However, we did follow the OIG's quality-control procedures for ensuring that the information in this report is accurate and supported. Additionally, the Quality Standards for Federal Offices of Inspector General require that our work adheres to the highest ethical principles of integrity, objectivity, confidentiality, independence, and professional judgment, and we adhered to these principles in performing our work. The team reviewed prior OIG reports and communicated with the OIG employees who had performed the work. The team did not communicate with the Agency during our review or ask for additional information from the Agency regarding the completion or modification of agreed-to corrective actions associated with OIG recommendations. To answer our objective, we identified seven OIG reports issued from 2011 through 2020 for which the Agency action official certified that agreed-to corrective actions in response to the report recommendations were completed, when in fact not all actions were completed or implemented. We also reviewed the Inspector General Act of 1978, as amended; Office of Management and Budget Circular A-50 (revised); and EPA Manual 2750 to obtain an understanding of the OIG's responsibilities for issuing recommendations and the Agency's responsibilities for implementing corrective actions based on OIG recommendations. 22-N-0061 8 ------- Appendix B OIG Reports With Agreed-To Corrective Actions that Were Certified as Completed but that Were Not Completed Impact EPA's Endocrine Disruptor Screening Program Should Establish Management Controls to Ensure More Timely Results, 11-P-0215, May 3. 2011 4. Develop short-term, intermediate, and long-term outcome performance measures, and additional output performance measures, with appropriate targets and timeframes, to measure the progress and results of the program. (OCSPP) 5. Develop and publish a comprehensive management plan for EDSP, including estimates of EDSP's budget requirements, priorities, goals, and key activities covering at least a 5-year period. (OCSPP) 4. As the Agency develops its comprehensive Management Plan for the EDSP, existing performance measures will be re-evaluated with the goal of developing a set of measures that more comprehensively addresses EDSP activities across all offices and includes more outcome measures. Our initial thinking with respect to applying the guidance OIG has provided, in the context of the EDSP, is that short-term outcomes could consist of making weight- of-evidence determinations to decide whether a chemical will move on to EDSP Tier 2 testing (this is currently captured under our existing measures). Intermediate outcomes could consist of the hazard assessments that will result from Tier 2. Long-term outcomes could include a characterization of the regulatory actions that result from EDSP screening and testing, the impact of such actions on human health and the environment and other metrics. 5. EPA plans to develop a comprehensive Management Plan for the EDSP. The aforementioned EDSP21 Work Plan for integrating computational toxicology tools into the EDSP will be a key, initial component of the EDSP Management Plan. The EDSP Management Plan will cover at least 5 years into the future of the EDSP and will include the continued issuance of test orders, the development of a consolidated information infrastructure for the EDSP, and other aspects of the program. The Management Plan will address budget requirements for the EDSP and performance management, including performance measures and annual reviews. 4. Performance measures were developed and included in the 2014 strategic guidance, but the OIG found that, after this initial compliance, the EDSP had not documented performance measures and had not identified short-term, intermediate, and long-term targets to clarify expectations and guide work prioritization. 5. The program created an initial strategic planning document known as a comprehensive management plan, but they did not continue to develop a current document that would clarify priorities or guide program activities since 2014. Staff worked on and provided an updated document to leadership in 2019, but this document was never finalized or implemented. The EDSP has not had effective internal controls in place since 2015. According to the follow-up audit, as detailed in OIG Report No. 21-E-0186, without effective internal controls, the EPA cannot demonstrate measurable progress toward compliance with statutory requirements to safeguard human health and the environment against endocrine-disrupting chemicals. 22-N-0061 ------- Unimplemented recommendations OIG report (action office) Corrective action certified as completed Certified action not taken Impact 6. Annually review the EDSP program results, progress toward milestones, and achievement of performance measures, including explanations for any missed milestones or targets. (OCSPP) 6. The EDSP Management Plan will include a section that outlines the specifics for a new annual review process for the EDSP. This review process will be conducted internally, within OCSPP, and will be designed to ensure that proper management controls are in place so that progress and accountability within the EDSP can be determined. The schedule for this annual review, including the date of the first presentation of its conclusions to the Assistant Administrator for the Office of Chemical Safety and Pollution Prevention, will be outlined in the Management Plan. 6. The OIG team was unable to obtain evidence that annual reviews had been conducted. EPA Has Not Met Statutory Requirements for Hazardous Waste Treatment, Storage and Disposal Facility Inspections, but Inspection Rates Are High, 16-P-0104. March 11.2016 1. Implement management controls to complete the required Treatment, Storage and Disposal Facility inspections. (OECA) 1a. Formalize our existing process for prioritizing RCRA TSDF inspections based on the risks posed to human health and the environment. 1b. Revise Office of Enforcement and Compliance Assurance policies and procedures to clarify those facilities that properly fall within the definition of a TSDF. 1c. Even after taking steps 1 and 2, OECA's experience is that there will continue to be a fair number of very low priority facilities in the TSDF universe. OECA anticipates strategically prioritizing inspections and addressing hazardous waste management facilities that present the greatest concerns. EPA will approach OMB about whether a classification to the statute is appropriate or necessary. 1. OECA issued a memorandum titled "TSDF Inspection Prioritization Scheme," dated September 28,2018, instead of revising OECA policies and procedures to clarify those facilities that properly fall within the definition of a treatment, storage, and disposal facility, as agreed to. The EPA acknowledged the prioritization of facilities with the highest human health and environmental risk in the FY 2019 Budget in Brief, a document that the Office of Management and Budget reviews and accepts, instead of approaching the Office of Management and Budget about whether a clarification to the statute is appropriate or necessary, as agreed to. Treatment, storage, and disposal facility inspections have not been completed. Without such inspections, hazardous waste leaks can go unidentified, meaning that they may not be mitigated in a timely manner, which increases the possibility of human health exposure and environmental contamination. Human health exposure refers to the possibility of hazardous waste contaminating air, water, or land, which could expose humans to contaminants through breathing air, drinking water, or ingesting food grown in contaminated soil. Enhanced Controls Needed to Prevent Further Abuse of Religious Compensatory Time, 16-P-0333, September 27.2016 3. Develop training on the proper use of Religious Compensatory Time and require all managers approving, and employees using, Religious Compensatory Time to complete the course. (OMS) 3. We committed to training the HR Community who would in turn provide instruction to the supervisors in their regions/programs. The training session with the HR Community is complete. 3. The follow-up audit identified that employees and supervisors still lack an understanding of the policy, requirements, and responsibilities related to using and approving religious compensatory time. Employees and supervisors still lack an understanding of the policy, requirements, and responsibilities related to the use and approval of religious compensatory time. This lack of understanding could result in misuse or abuse of the authority and create a monetary liability for the EPA. According to the follow-up audit, EPA OIG Report No. 22-P-0019, as of November 2021. the EPA continued to have an unplanned monetary liability of $54,787 for the balance of religious compensatory hours that employees earned and carried. 22-N-0061 10 ------- OIG report Unimplemented recommendations (action office) Corrective action certified as completed Certified action not taken Impact Improved Management of the Brownfields Revolving Loan Fund Program Is Required to Maximize Cleanups. 17-P-0368. August 23, 2017 1. Develop a policy to reduce balances of available program income of Brownfields Revolving Loan Funds being held by recipients. The policy should establish a time frame for recipients to use or return the funds to the EPA (OLEM) 8. Develop and implement required training for all regional Brownfields Revolving Loan Fund staff. Have the training, include all program policy and guidance related to maintaining a Brownfields Revolving Loan Fund after the cooperative agreement is closed if program income exists. (OLEM) 13. Require regional project officers, through a policy, to be assigned and maintain information on all closed cooperative agreements with pre-and post- program income. (OLEM) 14. Develop and implement a method for the Office of Brownfields and Land Revitalization to track closed cooperative agreements with pre- and post-program income. (OLEM) 1. OBLR will work with the Regions to develop a policy regarding monitoring of accumulated program income on the cooperative agreements. The policy will also establish actions to be taken in certain timeframes to reduce balance of program income or require return of funds to EPA as appropriate. 8. OBLR will work with the Regions to develop and deliver a series of training sessions to regional Brownfields Revolving Loan Fund staff. The training will cover all program polices and guidance related to the management of Brownfields Revolving Fund after closeout with a focus on cooperative agreements that have program income after closeout. OBLR will use various formats to deliver training to project officers, e.g., during regularly scheduled meetings, webinars, SharePoint site, and in-person training etc. 13. OBLR will work with the Regions to develop and issue a policy regarding the assignment and maintenance of information on all closed cooperative agreements with pre- and post-program income. The policy will outline the mechanism OBLR will use to work with regional management to implement this policy. 14. OBLR will work with the regions to develop and implement a method such as a tool, a spreadsheet, or a database, to track pre- and post-close out program income until termination of the closed out cooperative agreements in accordance with the reporting requirements listed under the closeout agreement. Regional staff will be required to update and/or monitor the tool in accordance with the reporting requirements listed in the closeout agreements. OBLR will work with regional management to ensure proper use of this tool and completion of regular updates. OBLR staff will have access to this tool and will monitor that information is being reported and tracked as required. 1. The OBLR did not establish a time frame for grant recipients to use or return unspent program income funds to the government. 8. The OBLR did not develop a policy or provide training related to an EPA project officer's responsibilities for maintaining post-closeout information for closed cooperative agreements with program income. 13. The OBLR did not develop a policy or provide training related to an EPA project officer's responsibilities for maintaining post-closeout information for closed cooperative agreements with program income. 14. The OBLR did not develop methods for tracking closed cooperative agreements with program income or for tracking grant recipient compliance with post-closeout reporting requirements. The EPA lacks current, accurate, and complete data necessary for effective post-closeout monitoring of program income. Our follow-up audit, EPA OIG ReDort No. 22-P-0033. found that without correct data, the Office of Brownfields and Land Revitalization is unable to determine whether an estimated $46.6 million of post-closeout program income was used in a timely manner and for the purposes authorized under the closeout agreements or to assess whether any of the $46.6 million of program income needs to be returned to the government. 22-N-0061 11 ------- Unimplemented recommendations OIG report (action office) Corrective action certified as completed Certified action not taken Impact 16. Create a method for the Office of Brownfields and Land Revitalization, and EPA regional managers, to track compliance with reporting requirements for closed cooperative agreements. (OLEM) 16. OBLR will work with the regions to create a method to track compliance with reporting requirements for closed cooperative agreements. The tracking tool will be distributed to the regions. Regions will be responsible for tracking and making sure that the cooperative agreement recipients are complying with the reporting requirements. OBLR will monitor and discuss compliance with the regional Brownfield managers during regularly schedule conference calls. 16. The OBLR did not develop methods for tracking closed cooperative agreements with program income or for tracking grant recipient compliance with post-closeout reporting requirements. Management Weaknesses Delayed Response to Flint Water Crisis. 18-P-0221. July 19,2018 6. Provide regular training for EPA drinking water staff, managers, and senior leaders on Safe Drinking Water Act (SDWA) tools and authorities; state and agency roles and responsibilities; and any Safe Drinking Water Act amendments or Lead and Copper Rule revisions. (OECA) 8. Create a system that tracks citizen complaints and gathers information on emerging issues. The system should assess the risk associated with the complaints, including efficient and effective resolution. (OW) 6. EPA has provided and will continue to provide regular training nationally about SDWA tools and authorities, like sections 1414 and 1431, and various NPDWRs, including LCR. 8. Identify potential enhancements to existing systems and/or identify new system requirements that can support tracking of citizen complaints. In 2019, OW developed a "Protocol for Addressing Water Quality Concerns from the Public" to address this OIG recommendation. This protocol was shared with the OIG in March 2021. 6. The corrective action did not fully address the recommendation because OECA's corrective action did not meet the intent of Recommendation 6. The Agency provided training on SDWA §§1414 and 1431 tools and authorities to staff. However, the Agency was not able to provide documentation of which staff members, managers, or senior leaders attended the training. During our follow-up audit, a SDWA training was held on September 23, 2021. OECA provided the OIG with a list of attendees. 8. The corrective action did not fully address the recommendation because the EPA has two key systems that gather citizen tips. The OW implemented the SDWA hotline Protocol for Addressing Water Quality Concerns from the Public to manage drinking water-related tips, including assessment of tip risk and tracking of tip resolution. The OW corrective actions address Recommendation 8 to the extent possible. The Report A Violation system is an existing tool used by OECA to gather citizen tips on environmental issues regardless of media. The system does not assess risk or track information on the resolution of issues raised. Residents whose homes are served by lead service lines may continue to be exposed to lead in their drinking water, EPA personnel may not be familiar with how to employ Safe Drinking Water tools and authorities, and citizens' tips may not be effectively monitored and used to alert the EPA of public health concerns. 22-N-0061 12 ------- Unimplemented recommendations OIG report (action office) Corrective action certified as completed Certified action not taken Impact EPA Region 5 Needs to Act on Transfer Request and Petition Regarding Ohio's Concentrated Animal Feeding Operation Permit Proaram. 19-N-0154. May 15,2019 1. Issue a decision regarding Ohio's request to transfer from the Ohio Environmental Protection Agency to the Ohio Department of Agriculture its National Pollutant Discharge Elimination System program with respect to Concentrated Animal Feeding Operations and other elements of the program. (Region 5) 1. On July 8,2019, EPA Region 5 issued a memorandum to the OIG clarifying the "decision" EPA Region 5 would issue by December 31,2019. The decision that would be made by EPA Region 5 was if Ohio's request to transfer conformed with federal requirements or if it needed modifications. Consistent with that memorandum, EPA Region 5 issued two correspondences to fulfill this commitment/recommendation. 1. The region has yet to determine whether to allow Ohio to transfer its Concentrated Animal Feeding Operation program from Ohio Environmental Protection Agency to the Ohio Department of Agriculture. Regional staff stated that they were unable to take any action until the state made legislative changes. The long-standing delay in making a decision regarding Ohio's transfer request has affected federal and state oversight and created regulatory uncertainty with respect to concentrated animal feeding operations in the state. EPA Needs to Improve Its Risk Management and Incident Response Information Security Functions. 20-P-0120, March 24, 2020 1. Develop and maintain an up-to-date inventory of the software and associated licenses used within the Agency. (OMS) 2. Establish a control to validate that Agency personnel are creating the required plans of action and milestones for weaknesses that are identified from vulnerability testing but not remediated within the Agency's established time frames, per the EPA's information security procedures. (OMS) 1 A. OMS implemented a dashboard and review process that leverages existing capabilities and provides a current inventory of approved software for network endpoints. 1B. The agency is developing and deploying an enterprise Software Asset and Configuration Management (SACM) capability that will align license entitlement data with software inventories to fully realize the goal of this recommendation. 2. OMS documented a plan of actions and milestones for a monitoring, validation, and verification process. The process is used for all sources of vulnerabilities to include those from vulnerability scanning. 1. During a meeting on August 27, 2020, the OIG requested proof that the corrective actions had been completed. The OMS told us that it had not completed part b of its correction action plan and that the completion date would be October 2021. 2. The OMS was unable to provide evidence of completion of the corrective action and stated the completion date had been revised to December 31, 2022. The confidentiality, integrity, and availability of the Agency's systems and data remain at risk. 22-N-0061 13 ------- Appendix C Agency Response to Draft Report /tos\ P T= z UNITED STATES ENVIRONMENTAL PROTECTION AGENCY \ \\\/y Jr WASHINGTON, D.C. 20460 \ .c^° A<- PRO^ September 15, 2022 OFFICE OF THE CHIEF FINANCIAL OFFICER MEMORANDUM SUBJECT: FROM: Response to the Office of Inspector General Draft Report, Project No. OA-FY22-0072, "The EPA Failed to Complete Corrective Actions as Certified to Address OIG Recommendations, " dated September 12, 2022 Faisal Annn, Chief Financial Officer Office of the Chief Financial Officer Digitally ilgned by Amin Faical A"',r>-F'ltal rtmiri, raisai D1tf 2a23.09.1s 22:14:17-04W TO: Katheiine Tninble Assistant Inspector General for Audits Office of the Inspector General Thank you for the opportunity to respond to the issues raised in the subject draft report. The following is a summary of the U.S. Environmental Protection Agency's overall position. The EPA appreciates the Office of Inspector General1 s proposal to strengthen the agency's recommendations follow-up process. The Office of the Chief Financial Officer is incorporating enhancements to our already robust audit processes for documenting and confirming the completion of corrective actions in accordance with the agreed-to corrective action language. The EPA, however, does not agree with the OIG's assertion that the agency attempted to mislead the public by "falsely" certifying completion of the corrective actions outlined in the referenced draft report. The EPA believes the OIG's draft report may be missing information and data relevant to its findings. To provide clarification to support the agency's position, a summary of the EPA's concerns on the OIG's findings is provided below. AGENCY'S OVERALL POSITION The EPA believes that had the OIG sought clarification on the corrective actions implemented, the OIG may have reached different conclusions on the corrective actions identified within the draft report. Continuous engagement between the agency and the OIG is essential in striking an appropriate balance between maintaining IG independence and producing results that both create value for the EPA's leadership and fulfill congressional expectations. 22-N-0061 14 ------- The OCFO performed a review of the corrective actions within the OIG's draft report and followed up with the appropriate offices to obtain additional information. Our review found that, for all but two of the recommendations provided by the OIG in the draft report, the agency's leadership certified completion of the corrective actions based upon what it deemed as appropriate actions required at the time to address the agreed-to corrective action. For the two corrective actions identified as not being completed prior to certification, that office followed up with the OIG to provide clarification and implemented additional controls to prevent the oversight from occurring in the future. Additionally, while the EPA asserts the agreed-to corrective actions were completed as deemed appropriate at the time of certification, the agency also understands interpretations by current OIG and agency personnel may differ from those from prior years when the corrective action was agreed upon and implemented. The attachment provides responses and clarification to support the EPA's position that actions were taken and completed based upon the agreed-to corrective action language for all but two of the corrective actions the OIG identified as falsely certified. CONCLUSION The OCFO acknowledges the need to standardize the certification and validation process. A comprehensive update of EPA Manual 2750, Audit Management Procedures, was initiated in FY 2022. One of the topics for enhancements has been the recommendation follow-up process including additional internal controls and a validation process within OCFO. While the OIG had no official recommendations to issue, the agency deemed it appropriate to conduct a comprehensive review resulting in technical corrections that are provided in the attachment. Had the OIG taken the opportunity to engage with the EPA during its review, the agency would have been better positioned to address any remaining OIG concerns within the three-day response period. Based upon the results of the OCFO's review of the corrective actions discussed in the OIG's draft report, I request that the OIG take additional time prior to publishing its final report to consider the attached responses and clarification on the EPA's position. CONTACT INFORMATION If you have any questions regarding this response, please contact the agency's Audit Follow-up Coordinator, Susan Perkins at Perkins.Susan@epa.gov or (202) 564-8618. Attachment cc: Deputy Administrator Assistant Administrators - OW, OCSPP, OLEM, OMS, and OECA Deputy Assistant Administrators - OW, OCSPP, OLEM, OMS, and OECA Region 5 Administrator 22-N-0061 15 ------- David Bloom Lek Kadeli Meshell Jones-Peeler Richard Gray Brian Webb Nikki Wood Nicole Murley LaSharn Barnes Susan Perkins 22-N-0061 16 ------- Agency Response to OIG OA-FY22-0072 Attachment OIG Report Unimplemented Recommendations (Action Official) Corrective Action Certified as Complete by Action Official Certified Action not Taken EPA Program Office Response EPA's Endocrine Disruptor Screening Program Should Establish Management Controls to Ensure More Timely Results, ll-P-0215, May 3, 2011 4. Develop short-term, intermediate, and longterm outcome performance measures, and additional output performance measures, with appropriate targets and timeframes, to measure the progress and results of the program. (OCSPP) 4. As the Agency develops its comprehensive Management Plan for the EDSP, existing performance measures will be re-evaluated with the goal of developing a set of measures that more comprehensively addresses EDSP activities across all offices and includes more outcome measures. Our initial thinking with respect to applying the guidance OIG has provided, in the context of the EDSP, is that short-term outcomes could consist of making weight- of- evidence determinations to decide whether a chemical will move on to EDSP Tier 2 testing (this is currently captured under our existing measures). Intermediate outcomes could consist of the hazard assessments that will result from Tier 2. Long-term outcomes could include a characterization of the regulatory actions that result from EDSP screening and testing, the impact of such actions on human health and the environment and other metrics. 4. Performance measures were developed and included in the 2014 strategic guidance, but the OIG team found that, after this initial compliance, the EDSP had not documented performance measures and had not identified short-term, intermediate, and long-term targets to clarify expectations and guide work prioritization. Disagree: OCSPP has a robust process for certifying completion of corrective actions. This process, specified in the 2750 Agency audit guidance, requires responsible managers to sign a "certification memo" and provide documentation of the completed action, which is reviewed and retained by the AFC, and finally signed by the AA for OCSPP. This process was designed to capture the state of completion of items as of a specific date, not for time immemorial. OCSPP's Corrective Action for Recommendation 4 was to develop performance measures. The President's Budget was made public on 3/10/13, and the EDSP performance measures were published with that document. The EDSP Comprehensive Management Plan was published in June 2012, including performance measures, and again in February 2014 with additional enhancements. OCSPP provided documentation of this fact on multiple occasions. The OCSPP certification memo was dated 9/23/13, and it accurately stated that this Corrective Action was completed at that time. While it is appropriate for the OIG to re-evaluate the Agency's performance 10 years later in a subsequent audit and conclude that subsequent administrations may have changed the EDSP program, it is misleading to the public to assert that the recommendations from the 2011 audit were not implemented, and to imply that the 2013 Certification Memo was inaccurate. 22-N-0061 17 ------- Agency Response to OIG OA-FY22-0072 OIG Report EPA's Endocrine Disruptor Screening Program Should Establish Management Controls to Ensure More Timely Results, ll-P-0215, May 3, 2011 Unimplemented Recommendations (Action Official) 5. Develop and publish a comprehensive management plan for EDSP, including estimates of EDSP's budget requirements, priorities, goals, and key activities covering at least a 5-year period. (OCSPP) Corrective Action Certified as Complete by Action Official 5. EPA plans to develop a comprehensive Management Plan for the EDSP. The aforementioned EDSP21 Work Plan for integrating computational toxicology tools into the EDSP will be a key, initial component of the EDSP Management Plan. The EDSP Management Plan will cover at least 5 years into the future of the EDSP and will include the continued issuance of test orders, the development of a consolidated information infrastructure for the EDSP, and other aspects of the program. The Management Plan will address budget requirements for the EDSP and performance management, including performance measures and annual reviews. 22-N-0061 Attachment Certified Action not Taken EPA Program Office Response 5. The program created an initial strategic planning document known as a Comprehensive Management Plan (CMP), but they did not continue to develop a current document that would clarify priorities or guide program activities since 2014. Staff worked on and provided an updated plan to leadership in 2019, but this document was never finalized or implemented. Disagree: OCSPP's agreed-to corrective action was to develop a comprehensive Management Plan for the EDSP that covers at least 5 years into the future. There were no requirements for continued revision. The 2012 EDSP Comprehensive Management Plan covered the period of 2012 to 2017 and was superseded by the 2014 EDSP Comprehensive Management Plan covering the period of 2014 to 2019. The EDSP Comprehensive Management Plan was published in June 2012 and again in February 2014 and can be viewed at: https://www.epa.gov/sites/default/files/2015- 08/documents/edsp-comprehensive-management-plan- 2012.pdf. The OCSPP certification memo was dated 9/23/13, and it accurately stated that this Corrective Action was completed at that time. However, during the Trump Administration, the EDSP Program was defunded, and staff was re-assigned. During that period, no further action was taken. 18 ------- Agency Response to OIG OA-FY22-0072 Attachment OIG Report Unimplemented Corrective Action Certified as Complete by Certified Action not Taken EPA Program Office Response Recommendations Action Official (Action Official) EPA's Endocrine Disruptor Screening Program Should Establish Management Controls to Ensure More Timely Results, ll-P-0215, May 3, 2011 6. Annually review the EDSP program results, progress toward milestones, and achievement of performance measures, including explanations for any missed milestones or targets. (OCSPP) 6. The EDSP Management Plan will include a section that outlines the specifics for a new annual review process for the EDSP. This review process will be conducted internally, within OCSPP, and will be designed to ensure that proper management controls are in place so that progress and accountability within the EDSP can be determined. The schedule for this annual review, including the date of the first presentation of its conclusions to the Assistant Administrator for the Office of Chemical Safety and Pollution Prevention, will be outlined in the Management Plan. 6. The OIG team was unable to obtain evidence that annual reviews had been conducted. Clarification: OCSPP's Corrective Action for Rec 6 was to "include a section that outlines the specifics for a new annual review process for the EDSP" in the Comprehensive Management Plan for the EDSP. The Comprehensive Management Plan was published in June 2012 and includes the relevant provisions describing the annual review process. - It can be viewed at https://www.epa.gov/sites/default/files/2015- 08/documents/edsp-comprehensive-management-plan- 2012.pdf. The OCSPP certification memo was dated 9/23/13, and it accurately stated that this Corrective Action was completed at that time. Annual review plans were in place at certification of the corrective action. However, during the Trump Administration, the EDSP Program was defunded, and staff was re-assigned. During that period, no further action was taken on EDSP annual reviews. The current administration is prioritizing the follow-up recommendation issued in OIG report 21-E-0186. EPA Has Not Met Statutory Requirements for Hazardous Waste Treatment, Storage and Disposal Facility Inspections, but Inspection Rates Are High, 16-P- 0104, March 11, 2016 1. Implement management controls to complete the required Treatment, Storage and Disposal Facility inspections. (OECA) la. Formalize our existing process for prioritizing RCRATSDF inspections based on the risks posed to human health and the environment. 1. Office of Enforcement and Compliance Assurance (OECA) issued memo, 'TSDF Inspection Prioritization Scheme," dated 9/28/18, instead of revising OECA policies and procedures to clarify those facilities that properly fall within the definition of a TSDF, as agreed-to. EPA acknowledged the Disagree: The agreed upon corrective action language stated OECA would "formalize our existing process for prioritizing RCRATSDF inspections," and this action was performed through the publication of the "TSDF Inspection Prioritization Scheme," dated 9/28/18. In addition, since then OECA reissued the RCRA Compliance Monitoring Strategy: https://www.epa.gov/compliance/compliance- monitoringstrategy-resource-conservation-and-recovery-act 22-N-0061 19 ------- Agency Response to OIG OA-FY22-0072 OIG Report EPA Has Not Met Statutory Requirements for Hazardous Waste Treatment, Storage and Disposal Facility Inspections, but Inspection Rates Are High, 16-P- 0104, March 11, 2016 Unimplemented Recommendations (Action Official) 1. Implement management controls to complete the required Treatment, Storage and Disposal Facility inspections. (OECA) Corrective Action Certified as Complete by Action Official lb. Revise Office of Enforcement and Compliance Assurance policies and procedures to clarify those facilities that properly fall within the definition of a TSDF. EPA Has Not Met Statutory Requirements for Hazardous Waste Treatment, Storage and Disposal Facility Inspections, but Inspection Rates Are High, 16-P- 0104, March 11, 2016 1. Implement management controls to complete the required Treatment, Storage and Disposal Facility inspections. (OECA) lc. Even after taking steps 1 and 2, OECA's experience is that there will continue to be a fair number of very low priority facilities in the TSDF universe. OECA anticipates strategically prioritizing inspections and addressing hazardous waste management facilities that present the greatest concerns. EPA will approach OMB about whether a classification to the statute is appropriate or necessary. 22-N-0061 Attachment Certified Action not Taken EPA Program Office Response prioritized of facilities with the highest human health and environmental risk in the FY2019 Budget in Brief, a document OMB reviews and accepts, instead of approaching OMB about whether a clarification to the statute is appropriate or necessary, as agreed to. Disagree: The agreed upon corrective action language stated OECA would update policy and procedures. This action was memorialized as an interim step in the 9/28/18 memorandum the OIG references. In addition, EPA acknowledged the prioritization of facilities with the highest human health and environmental risk in the FY 2019 Budget in Brief, a document OMB reviews and accepts. OECA met the intent and spirit of the corrective actions through: 1) Issuing the Subject Memo - TSDF Inspection Prioritization Scheme; 2) Holding the March 8, 2018, EPA National RCRA Enforcement Managers Meeting where Prioritization Factors were formalized. Subsequently the agency released the RCRA Compliance Monitoring Strategy cited above. Clarification: The agency did not approach OMB directly on this matter, but shared information through the formal budgeting process. Specifically, the EPA documented the priority of facilities with the highest human health and the environment risk in the FY2019 Budget in Brief. OMB has the ability to review, question, and/or accept the information included in the Budget documents. The agreed upon corrective action language stated OECA would prioritize facilities in the TSDF universe with the greatest concerns, which was memorialized in the 9/28/18 memorandum the OIG references. 20 ------- Agency Response to OIG OA-FY22-0072 Attachment OIG Report Enhanced Controls Needed to Prevent Further Abuse of Religious Compensatory Time, 16-P-333, September 27, 2016 Unimplemented Recommendations (Action Official) 3. Develop training on the proper use of Religious Compensatory Time and require all managers approving, and employees using, Religious Compensatory Time to complete the course. (OMS) Corrective Action Certified as Complete by Certified Action not Taken Action Official 3. We committed to training the HR Community who would in turn provide instruction to the supervisors in their regions/programs. The training session with the HR Community is complete. 3. The follow up audit identified that employees and supervisors still lack an understanding of the policy, requirements, and responsibilities related to using and approving RCT. EPA Program Office Response Disagree: The OMS-OHR completed implementation on April 27, 2017. OHR implemented a "train the trainer" method of sharing policy and procedures information with the agency's Human Resource Community-with representation from the programs and the regions. The information was further disseminated with their respective human resource communities and organizations. OMS-OHR, in good faith, completed the work and certified the actions on May 30, 2017. In the OIG's follow-up audit, OA-FY21-0134, OMS provided documentation supportive of the FY2017 certification. The OIG final report, 22-P-0019, was issued on March 7, 2022. The report included a reissuance of the 2016 recommendation. Although OMS fully implemented the 2016 corrective action, OPM policies changed in intervening years. OMS concurred with the FY2022 recommendation and is currently working to complete the new corrective action. The OIG draft report notes that 'The follow up audit identified employees and supervisor still lack an understanding of policy, requirements, and responsibilities related to using and approving RCT." It must be noted that EPA took steps to communicate the regulatory requirements of RCT to personnel multiple times - even before the FY2022 OIG audit. Specifically: OMS leadership issued a mass mailer with a fact sheet in 2019; the HR Community, comprised of human resources professionals from each of the national program offices and regions across the agency, was notified of the new policy and a revised fact sheet was shared in April 2021; a First Line Supervisor Administrative update, issued agencywide, was provided in June 2021. OMS does not agree with the OIG characterization that it "failed to complete corrective actions" as noted as the current draft report title implies. 22-N-0061 21 ------- Agency Response to OIG OA-FY22-0072 Attachment OIG Report Unimplemented Recommendations (Action Official) Corrective Action Certified as Complete by Action Official Certified Action not Taken EPA Program Office Response Improved Management of the Brownfields Revolving Loan Fund Program Is Required to Maximize Cleanups, 17P-0368, August 23, 2017 1. Develop a policy to reduce balances of available program income of Brownfields Revolving Loan Funds being held by recipients. The policy should establish a time frame for recipients to use or return the funds to the EPA (OLEM) 1. OBLR will work with the Regions to develop a policy regarding monitoring of accumulated program income on the cooperative agreements. The policy will also establish actions to be taken in certain timeframes to reduce balance of program income or require return of funds to EPA as appropriate.. 1. OBLR did not establish a timeframe for grant recipients to use or return unspent program income funds to the government. Disagree: OIG report 22-P-0033 acknowledges that, for new closeout agreements executed after June 21, 2018, the Office of Brownfields and Land Revitalization did establish model closeout terms and conditions with a timeframe for the assessment of PI balances and the possibility of revoking the closeout agreement and returning funds when any recipient has over $500,000 of post closeout PI three years after the closeout date. Since assessment starts three years after the closeout date, the earliest the OBLR and the regions would start the assessment of PI balance for these closeout agreements is June 21, 2021. The OBLR initiated this assessment process with the regions. The OIG follow-up report also noted that this policy does not cover the large majority of closeout agreements that were executed prior to June 21, 2018. However, the report did not explain that this is because closeout agreements are bilateral agreements that cannot be changed by EPA without re-negotiation and recipient concurrence. While the OBLR and the regions can strive to maintain and align the same national closeout T&Cs for all active closeout agreements, it is beyond EPA's authority to unilaterally change the T&Cs of older closeout agreements. OGC concurs with this position. The OBLR previously determined that the workload of re-negotiating and updating all active closeout agreements to the latest closeout T&Cs is significant and not justified based on regional staff constraints. OLEM is taking additional action to address OIG's new concerns. See supporting documentation in Certification Memo for OIG Audit: "Improved Management of the Brownfields Revolving Loan Fund Program is Required to Maximize Cleanups" Report No. 17-P-0368, dated August 23, 2017, Dated March 19, 2019. 22-N-0061 22 ------- Agency Response to OIG OA-FY22-0072 Attachment OIG Report Unimplemented Corrective Action Certified as Certified Action not Taken EPA Program Office Response Recommendations Complete by Action Official (Action Official) Improved Management of the Brownfields Revolving Loan Fund Program Is Required to Maximize Cleanups, 17P-0368, August 23, 2017 8. Develop and implement required training for all regional Brownfields Revolving Loan Fund staff. Have the training, include all program policy and guidance related to maintaining a Brownfields Revolving Loan Fund after the cooperative agreement is closed if program income exists. (OLEM) 8. OBLR will work with the Regions to develop and deliver a series of training sessions to regional Brownfields Revolving Loan Fund staff. The training will cover all program polices and guidance related to the management of Brownfields Revolving Fund after closeout with a focus on cooperative agreements that have program income after closeout. OBLR will use various formats to deliver training to project officers, e.g., during regularly scheduled meetings, webinars, SharePoint site, and in-person training etc. 8. OBLR did not develop a policy or provide training related to EPA project officer's responsibilities for maintaining post- closeout information for closed cooperative agreements with program income. Disagree: This recommendation was implemented as certified. The Office of Brownfields and Land Revitalization provided guidance regarding maintaining information on closed cooperative agreements with program income, but the methods used for tracking and monitoring post-closeout activities was left up to the regional POs. The OBLR also conducted two trainings to explain the closeout process memorandum and template. In the OIG's follow-up work, they expressed concern with the extent to which the training discussed the EPA's responsibilities for maintaining information on closed cooperative agreements, such as tracking PI and recipient compliance with reporting requirements after the cooperative agreement is closed. OLEM is taking additional action to address OIG's new concerns. See supporting documentation in Certification Memo for OIG Audit: "Improved Management of the Brownfields Revolving Loan Fund Program is Required to Maximize Cleanups" Report No. 17- P0368, dated August 23, 2017, Dated March 19, 2019. Improved Management of the Brownfields Revolving Loan Fund Program Is Required to Maximize Cleanups, 17P-0368, August 23, 2017 13. Require regional project officers, through a policy, to be assigned and maintain information on all closed cooperative agreements with pre-and post- program income. (OLEM) 13. OBLR will work with the Regions to develop and issue a policy regarding the assignment and maintenance of information on all closed cooperative agreements with pre- and post-program income. The policy will outline the mechanism OBLR will use to work with regional management to implement this policy 13. OBLR did not develop a policy or provide training related to EPA project officer's responsibilities for maintaining post- closeout information for closed cooperative agreements with program income. See above response 22-N-0061 23 ------- Agency Response to OIG OA-FY22-0072 OIG Report Improved Management of the Brownfields Revolving Loan Fund Program Is Required to Maximize Cleanups, 17P-0368, August 23, 2017 Unimplemented Recommendations (Action Official) 14. Develop and implement a method for the Office of Brownfields and Land Revitalization to track closed cooperative agreements with pre- and post-program income. (OLEM) Corrective Action Certified as Complete by Action Official 14. OBLR will work with the regions to develop and implement a method such as a tool, a spreadsheet, or a database, to track pre- and post-close out program income until termination of the closed out cooperative agreements in accordance with the reporting requirements listed under the closeout agreement. Regional staff will be required to update and/or monitor the tool in accordance with the reporting requirements listed in the closeout agreements. OBLR will work with regional management to ensure proper use of this tool and completion of regular updates. 22-N-0061 Attachment Certified Action not Taken EPA Program Office Response 14. The OBLR did not develop methods for tracking closed cooperative agreements with program income or for tracking grant recipient compliance with postcloseout reporting requirements. Disagree: The Office of Brownfields and Land Revitalization did provide guidance to the regions on tracking closed cooperative agreements, to include post-closeout reporting. However, the specific method of how they were tracked was left to the regions. The OBLR did not have a suitable comprehensive database for this purpose, since the existing Assessment, Cleanup, and Redevelopment Exchange System (ACRES) database was primarily used to track program accomplishments and not for tracking PI or post-closeout reporting requirements. A deadline of September 30th for post-closeout annual report submission is included in Section IV.F.13 of the FY21T&Cs and will be included in annual model T&Cs going forward. The FY21 T&Cs were provided to the OIG via email on June 10, 2021. Therefore, closeout agreements executed after June 2021 already addressed the OIG's recommendation regarding including a deadline for report submission. OLEM is taking additional action to address OIG's new concerns. See supporting documentation in Certification Memo for OIG Audit: "Improved Management of the Brownfields Revolving Loan Fund Program is Required to Maximize Cleanups" Report No. 17-P-0368, dated August 23, 2017, Dated March 19, 2019. 24 ------- Agency Response to OIG OA-FY22-0072 OIG Report Improved Management of the Brownfields Revolving Loan Fund Program Is Required to Maximize Cleanups, 17P-0368, August 23, 2017 Unimplemented Recommendations (Action Official) 16. Create a method for the Office of Brownfields and Land Revitalization, and EPA regional managers, to track compliance with reporting requirements for closed cooperative agreements. (OLEM) Corrective Action Certified as Complete by Action Official 16.0BLR will work with the regions to create a method to track compliance with reporting requirements for closed cooperative agreements. The tracking tool will be distributed to the regions. Regions will be responsible for tracking and making sure that the cooperative agreement recipients are complying with the reporting requirements. OBLR will monitor and discuss compliance with the regional Brownfield managers during regularly schedule conference calls. Management Weaknesses Delayed Response to Flint Water Crisis, 18-P0221, July 19, 2018 6. Provide regular training for EPA drinking water staff, managers, and senior leaders on Safe Drinking Water Act (SDWA) tools and authorities; state and agency roles and responsibilities; and any Safe Drinking Water Act amendments or Lead and Copper Rule revisions. (OECA) 6. EPA has provided and will continue to provide regular training nationally about SDWA tools and authorities, like sections 1414 and 1431, and various NPDWRs, including LCR. 22-N-0061 Attachment Certified Action not Taken EPA Program Office Response 16. The OBLR did not develop methods for tracking closed cooperative agreements with program income or for tracking grant recipient compliance with postcloseout reporting requirements. See above response 6. The corrective action did not fully address the recommendation because OECA's corrective action did not meet the intent of Recommendation 6. The Agency provided training on SDWA §§ 1414 and 1431 tools and authorities to staff. However, the Agency was not able to provide documentation of which staff members, managers, or senior leaders attended the training. During our follow-up audit, a SDWA training was held on September 23, 2021. OECA provided the OIG with a list of attendees. Disagree: The intent of Recommendation 6 is for OECA to provide drinking water training. OECA met the intent of the recommendation because it developed, delivered, and documented this training. Whether or not OECA provided the names of staff members, managers, or senior leaders who attended the training is not relevant to whether the training was provided to meet the agreed-to corrective action. OECA performed additional training, based on a follow-up recommendation in OIG report 22-P-0046, and the follow-on corrective action has been closed. 25 ------- OIG Report Unimplemented Recommendations (Action Official) Corrective Action Certified as Complete by Action Official Certified Action not Taken EPA Program Office Response Management Weaknesses Delayed Response to Flint Water Crisis, 18-P0221, July 19, 2018 8. Create a system that tracks citizen complaints and gathers information on emerging issues. The system should assess the risk associated with the complaints, including efficient and effective resolution. 8. Identify potential enhancements to existing systems and/or identify new system requirements that can support tracking of citizen complaints. In 2019, OW developed a "Protocol for Addressing Water Quality Concerns from the Public" to address this OIG recommendation. This protocol was shared with the OIG in March 2021. 8. The corrective action did not fully address the recommendation because the EPA has two key systems that gather citizen tips. The OW implemented the SDWA hotline Protocol for Addressing Water Quality Concerns from the Public to manage drinking water-related tips, including assessment of tip risk and tracking of tip resolution. The OW corrective actions address Recommendation 8 to the extent possible. The RAV system is an existing tool used by OECA to gather citizen tips on environmental issues regardless of media. The system does not assess risk or track information on the resolution of issues raised. Disagree: In the agreed-to corrective action, the agency stated an existing system would be updated to track citizen complaints. Issue resolution was not included in the corrective action plan the OIG reviewed to consider this recommendation resolved, nor was an agency system specified. It appears the OIG's basis for this corrective action not being completed goes above and beyond the agreed upon corrective action plan. Additionally, in the recent OIG Final Report No. 22-P-0046, The EPA Needs to Fully Address the OIG's 2018 Flint Water Crisis Report Recommendations by Improving Controls, Training, and Risk Assessments, dated May 17, 2022, OECA agreed to and the IG accepted the corrective action: Establish and implement a plan to formalize controls into the Report a Violation system to assess the risks associated with tips retained by the EPA and track when and how the retained tips are closed out. EPA Region 5 Needs to Act on Transfer Request and Petition Regarding Ohio's Concentrated Animal Feeding Operation Permit Program, 19-N- 0154, May 15, 2019 1. Issue a decision regarding Ohio's request to transfer from the Ohio Environmental Protection Agency to the Ohio Department of Agriculture its National Pollutant Discharge Elimination System program with respect to Concentrated Animal Feeding Operations and other elements of the program. (Region 5) 1. On July 8, 2019, EPA Region 5 issued a memorandum to the OIG clarifying the "decision" EPA Region 5 would issue by December 31, 2019. The decision that would be made by EPA Region 5 was if Ohio's request to transfer conformed with federal requirements or if it needed modifications. Consistent with that memorandum, EPA Region 5 issued two correspondences to fulfill this commitment/recommendation. 1. The region has yet to determine whether to allow Ohio to transfer its Concentrated Animal Feeding Operation program from Ohio Environmental Protection Agency to the Ohio Department of Agriculture. Regional staff stated that they were unable to take any action until the state made legislative changes. Clarification: EPA implemented the corrective action to the extent possible, pending state action, at the time of certification and provided the necessary correspondence to OIG. The OIG accepted those actions as complete. The audit was closed by the OIG. Subsequently, due to a hotline complaint received by the OIG in July 2021, OIG decided to reclassify the recommendation from completed to unimplemented. 22-N-0061 26 ------- OIG Report Unimplemented Recommendations (Action Official) Corrective Action Certified as Complete by Action Official Certified Action not Taken EPA Program Office Response EPA Needs to Improve Its Risk Management and Incident Response Information Security Functions, 20-P0120, March 24, 2020 1. Develop and maintain an up-to-date inventory of the software and associated licenses used within the Agency. (OMS) 1A. OMS implemented a dashboard and review process that leverages existing capabilities and provides a current inventory of approved software for network endpoints.lB. The agency is developing and deploying an enterprise Software Asset and Configuration Management (SACM) capability that will align license entitlement data with software inventories to fully realize the goal of this recommendation. 1. During a meeting on 8/27/20 the OIG requested proof that the corrective actions had been completed, and OMS told us that it had not completed part b of their correction action plan and that the completion date would be October 2021. Agree: OMS agrees with OIG's position and acknowledges there was a misunderstanding with the steps taken by the office leading to erroneous certification. Although OMS certified in good faith, the office has since implemented corrective actions to prevent future errors. EPA Needs to Improve Its Risk Management and Incident Response Information Security Functions, 20-P0120, March 24, 2020 2. Establish a control to validate that Agency personnel are creating the required plans of action and milestones for weaknesses that are identified from vulnerability testing but not remediated within the Agency's established time frames, per the EPA's information security procedures. (OMS) 2. OMS documented a plan of actions and milestones for a monitoring, validation, and verification process. The process is used for all sources of vulnerabilities to include those from vulnerability scanning. 2. OMS was unable to provide evidence of completion of the corrective action and stated the completion date had been revised to [insert date]. Agree: OMS agrees with OIG's position and acknowledges there was a misunderstanding with the steps taken by the office leading to erroneous certification. Although OMS certified in good faith, the office has since implemented corrective actions to prevent future errors. 22-N-0061 27 ------- Distribution The Administrator Deputy Administrator Chief of Staff, Office of the Administrator Deputy Chief of Staff, Office of the Administrator Agency Follow-Up Official (the CFO) Agency Follow-Up Coordinator General Counsel Associate Administrator for Congressional and Intergovernmental Relations Associate Administrator for Public Affairs Director, Office of Continuous Improvement, Office of the Chief Financial Officer Audit Follow-Up Coordinator, Office of the Administrator 22-N-0061 ------- |