w 7 OFFICE OF INSPECTOR GENERAL U.S. ENVIRONMENTAL PROTECTION AGENCY >i j i v i PANDEMIC ------- EPA OIG's Response to the COVID-19 Pandemic Introduction The U.S. Environmental Protection Agency's Office of Inspector General is continuing to meet challenges posed by the coronavirus pandemic—that is, the SARS-CoV-2 virus and the resultant COVID-19 disease—by initiating audits, evaluations, and investigations related to the pandemic's impact on the EPA's and the U.S. Chemical Safety and Hazard Investigation Board's missions to protect people, public health, and the environment. We are examining and identifying how the pandemic has affected Agency programs and operations, from emergency responses to releases of hazardous substances to air quality enforcement to potential misconduct and criminal activity. We are working with our oversight partners, including other federal offices of inspectors general, the Pandemic Response Accountability Committee under the Council of the Inspectors General on Integrity and Efficiency, and the U.S. Government Accountability Office, to coordinate our work and address matters of interagency or cross- jurisdictional concern. Our office recognizes that we are facing unprecedented times and has reinforced our commitment to conferring with congressional and Agency leadership; issuing reports; and investigating waste, fraud, and abuse. 1 ------- Actual and Potential Subjects of Audits and Evaluations ¦ Enforcement and regulatory waivers and flexibilities. ¦ Fraud schemes taking advantage of the crisis by marketing unsafe and non-EPA-approved products to the public. ¦ Agency staffing shortfalls implicating oversight of critical environmental and public health programs. ¦ Agency return to work and employee health and safety upon reentry. ¦ Maintaining strong cyber and information technology protections while most of the workforce is teleworking. ¦ Ability of delegated state and tribal environmental programs to meet critical environmental and public health responsibilities. ¦ How EPA is administering its CARES Act funding. 2 ------- Pandemic-Related Reports and Announced Projects Listed in chronological order, starting with the most recent: Report; Total National Reported Clean Air Act Compliance Monitoring Activities Decreased Slightly During Coronavirus Pandemic, but State Activities Varied Widely Report #22-E-0008, November 17, 2021. We assessed how the coronavirus pandemic impacted air compliance monitoring by EPA-delegated state and local agencies to confirm that facilities that emit air pollution comply with the Clean Air Act and federal air regulations. The pandemic marginally impacted the total number of nationwide compliance monitoring activities. However, activities varied widely among states and territories, with reported changes in activities at high-emitting sources in fiscal year 2020 ranging from an 88-percent decline to a 234-percent increase. Report; EPA's Fiscal Year 2022 Top Management Challenges Report #22-N-0004, November 12, 2021. Identifying and resolving top management challenges are essential to the EPA's protection of human health and the environment. In this statutorily required report, we outline the Agency's most serious management and performance challenges, some of which were made even more challenging by the pandemic. For example, the pandemic magnified the daily injustices facing communities of color and low-income communities, as well as increased the risk of cybersecurity attacks on both the EPA's networks and the nation's water infrastructure. © PROJECT 3 ------- Report; Pandemic Highlights Need for Additional Tribal Drinking Water Assistance and Oversight in EPA Regions 9 and 10 Report #21-E-0254, September 27, 2021. The coronavirus pandemic negatively impacted the oversight and assistance that Regions 9 and 10 provide to the tribal drinking water systems under their purview, as well as the capacity of these systems to provide safe drinking water. The pandemic also underscored the limitations of both EPA resources and tribal drinking water system resiliency. As a result, tribal drinking water systems may be unable to operate safely and comply with drinking water regulations. Access to safe and clean water is critical at all times, but even more so during pandemic situations. Report; EPA Effectively Planned for Future Remote Access Needs but Should Disconnect Unneeded Services in Timely Manner Report #21-P-0241, September 20, 2021. Continuing operations under the duress of pandemics and natural disasters requires the Agency to adapt its network to support a virtual workforce. We found that, in its solicitation for network and telecommunications services under the U.S. General Services Administration's Enterprise Infrastructure Solutions contract, the EPA included a requirement that the selected vendor be able to support 12,500-20,000 concurrent remote users, which should meet the EPA's future workforce needs. The EPA did not, however, disconnect unneeded network and telecommunications services in a timely manner, thus spending at least $7,850 for services it was not using. Report; EPA's Emergency Response Systems at Risk of Having Inadequate Security Controls Report #21-E-0226, September 13, 2021. We evaluated whether the EPA's System Security Plans provide sufficient details to allow the EPA to make decisions regarding network security during emergencies, including during remote telework conditions due to the coronavirus pandemic. The EPA did not follow guidance from the National Institute of Standards and Technology when determining the security categorization for 4 ------- five emergency response systems. EPA systems become more vulnerable to security threats and data compromises if the Agency does not follow the guidance, and the compromise of emergency response system data could impact the EPA's ability to coordinate response efforts in environmental disasters. Report; EPA's National Vehicle and Fuel Emissions Laboratory Has Taken Steps to Mitigate Impact of Coronavirus Pandemic on Mobile Source Emission Compliance Report #21-E-0158, June 7, 2021. We examined how the laboratory operations and testing at the EPA's Office of Transportation and Air Quality's National Vehicle and Fuel Emissions Laboratory, which addresses emissions from a range of mobile sources, were impacted by the coronavirus pandemic. NVFEL used virtual collaboration tools, conducted remote auditing, and implemented reporting flexibilities to mitigate the impact of the pandemic, which included closing the lab. We highlighted NVFEL's efforts to minimize the potential for noncompliance during the pandemic as well as the importance of returning to full testing capacity to provide the most effective oversight of mobile sources. Report; EPA Did Not Conduct Agencywide Risk Assessment of CARES Act Appropriations. Increasing Risk of Fraud. Waste. Abuse, and Mismanagement Report #21-E-0128, May 4, 2021. We assessed the internal controls that the EPA implemented to mitigate risks of fraud, waste, abuse, and mismanagement over the Coronavirus Aid, Relief, and Economic Security Act, known as the CARES Act, appropriations. We found that the Agency did not conduct an agencywide risk assessment of internal controls or incorporate requirements from the U.S. Office of Management and Budget or the U.S. Government Accountability Office into its internal control requirements. However, we also found that three of the EPA's 5 ------- program offices designed internal controls to identify and mitigate fraud, waste, abuse, and mismanagement regarding the CARES Act funds. Report; EPA Needs to Improve Processes for Updating Guidance. Monitoring Corrective Actions, and Managing Remote Access for External Users Report #21-E-0124, April 16, 2021. Although we found that the EPA consistently met the requirements listed in the FY2020 Inspector General Federal Information Security Modernization Act of 2014 (FISMA) Reporting Metrics, the deficiencies we found in the EPA's information technology internal controls could exploit weaknesses in Agency applications and hinder the Agency's ability to prevent, detect, and respond to emerging cyberthreats. Those deficiencies include not reviewing outdated procedures in a timely manner, not verifying whether corrective actions are completed, and not enforcing information system control requirements for the Agency's web application directory system. Notification; Pandemic Impact on Authorized State RCRA Programs Project #OE-FY21-O124, February 18, 2021. The OIG is conducting an evaluation to examine the EPA Resource Conservation Recovery Act Program's operations. Notification; EPA's Grant Flexibilities Due to the Coronavirus Pandemic Project #OA-FY21-0108, February 8, 2021. The OIG is conducting an audit examining the EPA's implementation of the grant flexibilities permitted by the Office of Management and Budget due to the coronavirus pandemic. Notification; Survey of Remedial Project Managers on the Impact of the Coronavirus Pandemic on Long-Term Cleanups at Superfund National Priorities List Sites Project #OE-FY21-0050, December 1, 2020. The OIG is conducting an evaluation to determine the impact of the coronavirus pandemic on long- term cleanup activities at Superfund National Priorities. 6 ------- Report; EPA's Initial Plans for Returning to the Office Incorporate CDC Guidance but Differ by Location Report #21-E-0030, November 30, 2020. The 13 locations we reviewed had different guidance in their reopening plans on aspects such as face coverings, social distancing, and cleaning and disinfecting. While some differences could be warranted based on local conditions, the EPA should ensure that such differences do not place employees at an increased risk of contracting or spreading the COVID-19 disease as a result of their work location. Report; CSB Discontinued Information Recovery Testing and Off-Site Backup Storage During the Coronavirus Pandemic Report #21-E-0016, November 18, 2020. SB & Company, which conducted this evaluation, found that the CSB did not follow National Institute of Standards and Technology guidance to perform disaster recovery testing on major information systems during fiscal year 2020 and did not store backup media at an off-site location. The CSB may not be readily able to recover its systems' operations in the event of a disaster or isolated incident. Report; EPA Has Sufficiently Managed Emergency Responses During the Pandemic but Needs to Procure More Supplies and Clarify Guidance Report #20-E-0332, September 28, 2020. We assessed whether the EPA provided sufficient protective measures to its on-scene coordinators, who respond to emergency incidents, during the coronavirus pandemic. More than half of the on-scene coordinators who responded to our survey reported that the coronavirus pandemic impacted their ability to respond to emergencies. They also expressed concerns about the availability of personal protective equipment and indicated that clarification was needed on the EPA's COVID-19 guidance. Additionally, we found that COVID-19 testing was not available to on-scene coordinators before or after deploying to an incident. 7 ------- Report; EPA OIG's Response to the COVID-19 Pandemic July 31, 2020. This report captures the OIG's early work to meet the challenges posed by the COVID-19 pandemic, including audits, evaluations, and investigations. This work is related to the pandemic's impact on the EPA's and the CSB's missions, and on public health and the environment at the core of those missions. Some potential and actual subjects of audits and evaluations include the Agency's plan to return to work, cyber and information technology protections, and Agency staffing shortfalls. Some investigative topics include fraud schemes, cyberscams targeting EPA employees and contractors, and misrepresentations of the EPA's endorsement of products. Report; EPA's Initial Implementation of CARES Act Section 3610 Report #20-N-0202, June 29, 2020. The Office of Acquisition Solutions created and provided detailed guidance to EPA contracting personnel and contractors related to reimbursements under the Coronavirus Aid, Relief, and Economic Security Act, known as the CARES Act. The information in the guidance documents was consistent with the federal statute. Top Pandemic-Related Challenges Facing the EPA June 17, 2020. The OIG identified initial challenges to the EPA's ability to achieve its mission, including enforcement and fraud risks; state, tribe, and territory program implementation; and risk communication to the public. The OIG also identified internal challenges to maintaining a safe and productive workforce, including returning to work safely, effective remote technology, understanding organizational risk, and contract oversight. Notification; Research for Future Audits and Evaluations Regarding Effects of Coronavirus Pandemic (SARS-CoV-2 Virus and COVID-19 Disease) on EPA Programs and Operations Project #OA&E-FY20-0212, May 7, 2020. The OIG initiated an overall project to research and identify topics for potential audits and evaluations related to the EPA's response to the coronavirus pandemic. 8 ------- Potential Investigation Targets We take seriously our obligation to investigate fraud related to the coronavirus pandemic. We are particularly committed to investigating schemes involving potential criminal activity or misconduct that impacts the American people or thwarts the EPA's ability to fulfill its mission, as well as to investigating conduct that relies on, takes advantage of, or exploits a weakness or vulnerability in an EPA program or operation. Types of Investigations OIG is Undertaking or May Undertake ¦ Fraud schemes relating to the EPA's programs and operations. ¦ Fraudulent claims for money that should be spent to advance an EPA program. ¦ Improper avoidance of obligations to pay as required by an EPA program. ¦ Misrepresentations of the EPA's endorsement of COVID disinfectant or other products by fraudulently applying the Agency seal, identifier, or product registration numbers to product labels or advertisements. ¦ Cyberscams targeting EPA employees, contractors, and grantees and state and tribal programs overseen by EPA, as well as security threats to the EPA. Learn more about our investigative COVID-19 response or contact the OIG Hotline. 41 9 ------- EPA OIG Hotline Our office receives allegations of fraud, waste, and abuse concerning the COVID-19 pandemic and its impact on EPA and CSB operations. The EPA and public should be on the alert for some common practices: ¦ Beware of companies placing the EPA seal or an EPA registration number on their products claiming that they meet EPA standards. ¦ Be cautious of imported products marketed as proven to effectively block various epidemic viruses. ¦ Be on the lookout for websites claiming their products contain EPA-approved active ingredients that kill 99.9 percent of all viruses and bacteria, including SAR-CoV-2 virus. These companies may put the EPA logo on their websites to falsely legitimize products. For a list of EPA-approved disinfectants, please visit EPA Official List N: Disinfectants for Use Against SARS-CoV-2. ¦ Be wary of companies claiming that their services are endorsed or their equipment or material is certified by the EPA. 10 ------- Complaints Related to COVID-19 Total complaints Where COVID-19-Related Complaints Were Referred OIG Office of Investigations OIG Office of Audit or Office of Special Review & Evaluation Lake County, California | 1 U.S. Food and Drug ¦ . Administration I ' EPA Region 9 Administrator | 1 EPA Criminal Investigation ¦ . Division 11 ------- Prior OIG Reports Relevant to EPA's Handling of Emergencies and Disasters EPA's Emergency Response Systems at Risk of Having Inadequate Security Controls EPA's Office of Land and Emergency Management Lacked a Nationally Consistent Strategy for Communicating Health Risks at Contaminated Sites Report; EPA Needs to Improve Its Emergency Planning to Better Address Air Quality Concerns During Future Disasters Report; EPA Needs to Improve Its Risk Management and Incident Response Information Security Functions Report; Management Alert - To Minimize Risk of Environmental Harm, the Security Categorization of Electronic Manifest System Data Needs to Be Re-Evaluated Report; EPA Needs to Improve Its Risk Management and Incident Response Information Security Functions View more OIG reports -> Related Resources ¦ Coronavirus.gov ¦ EPA's resources related to C0VID-19 ¦ CIGIE's Pandemic Response Accountability Committee 12 ------- |