w

7

OFFICE OF INSPECTOR GENERAL

U.S. ENVIRONMENTAL PROTECTION AGENCY

>i j i v i

PANDEMIC


-------
EPA OIG's Response to the COVID-19 Pandemic

Introduction

The U.S. Environmental Protection Agency's Office of Inspector General is
continuing to meet challenges posed by the coronavirus pandemic—that is,
the SARS-CoV-2 virus and the resultant COVID-19 disease—by initiating
audits, evaluations, and investigations related to the pandemic's impact on
the EPA's and the U.S. Chemical Safety and Hazard Investigation Board's
missions to protect people, public health, and the environment. We are
examining and identifying how the pandemic has affected Agency
programs and operations, from emergency responses to releases of
hazardous substances to air quality enforcement to potential misconduct
and criminal activity. We are working with our oversight partners, including
other federal offices of inspectors general, the Pandemic Response
Accountability Committee under the Council of the Inspectors General on
Integrity and Efficiency, and the U.S. Government Accountability Office, to
coordinate our work and address matters of interagency or cross-
jurisdictional concern.

Our office recognizes that we are facing unprecedented times and has
reinforced our commitment to conferring with congressional and Agency
leadership; issuing reports; and investigating waste, fraud, and abuse.

1


-------
Actual and Potential Subjects of
Audits and Evaluations

¦	Enforcement and regulatory waivers
and flexibilities.

¦	Fraud schemes taking advantage of the crisis by
marketing unsafe and non-EPA-approved
products to the public.

¦	Agency staffing shortfalls implicating oversight of
critical environmental and public health
programs.

¦	Agency return to work and employee health and
safety upon reentry.

¦	Maintaining strong cyber and information
technology protections while most of the
workforce is teleworking.

¦	Ability of delegated state and tribal
environmental programs to meet critical
environmental and public health responsibilities.

¦	How EPA is administering its CARES Act funding.

2


-------
Pandemic-Related
Reports and Announced
Projects

Listed in chronological order,
starting with the most recent:

Report; Total National Reported Clean Air Act Compliance Monitoring
Activities Decreased Slightly During Coronavirus Pandemic, but State
Activities Varied Widely

Report #22-E-0008, November 17, 2021. We assessed how the coronavirus
pandemic impacted air compliance monitoring by EPA-delegated state and
local agencies to confirm that facilities that emit air pollution comply with
the Clean Air Act and federal air regulations. The pandemic marginally
impacted the total number of nationwide compliance monitoring activities.
However, activities varied widely among states and territories, with reported
changes in activities at high-emitting sources in fiscal year 2020 ranging from
an 88-percent decline to a 234-percent increase.

Report; EPA's Fiscal Year 2022 Top Management Challenges

Report #22-N-0004, November 12, 2021. Identifying and resolving top
management challenges are essential to the EPA's protection of human
health and the environment. In this statutorily required report, we outline
the Agency's most serious management and performance challenges, some
of which were made even more challenging by the pandemic. For example,
the pandemic magnified the daily injustices facing communities of color and
low-income communities, as well as increased the risk of cybersecurity
attacks on both the EPA's networks and the nation's water infrastructure.

©



PROJECT

3


-------
Report; Pandemic Highlights Need for Additional Tribal Drinking Water
Assistance and Oversight in EPA Regions 9 and 10

Report #21-E-0254, September 27, 2021. The coronavirus pandemic
negatively impacted the oversight and assistance that Regions 9 and 10
provide to the tribal drinking water systems under their purview, as well
as the capacity of these systems to provide safe drinking water. The
pandemic also underscored the limitations of both EPA resources and
tribal drinking water system resiliency. As a result, tribal drinking water
systems may be unable to operate safely and comply with drinking water
regulations. Access to safe and clean water is critical at all times, but even
more so during pandemic situations.

Report; EPA Effectively Planned for Future Remote Access Needs but
Should Disconnect Unneeded Services in Timely Manner

Report #21-P-0241, September 20, 2021. Continuing operations under the
duress of pandemics and natural disasters requires the Agency to adapt its
network to support a virtual workforce. We found that, in its solicitation
for network and telecommunications services under the U.S. General
Services Administration's Enterprise Infrastructure Solutions contract, the
EPA included a requirement that the selected vendor be able to support
12,500-20,000 concurrent remote users, which should meet the EPA's
future workforce needs. The EPA did not, however, disconnect unneeded
network and telecommunications services in a timely manner, thus
spending at least $7,850 for services it was not using.

Report; EPA's Emergency Response Systems at Risk of Having
Inadequate Security Controls

Report #21-E-0226, September 13, 2021. We evaluated whether the EPA's
System Security Plans provide sufficient details to allow the EPA to make
decisions regarding network security during emergencies, including during
remote telework conditions due to the coronavirus pandemic. The EPA did
not follow guidance from the National Institute of Standards and
Technology when determining the security categorization for

4


-------
five emergency response systems. EPA systems become more vulnerable
to security threats and data compromises if the Agency does not follow
the guidance, and the compromise of emergency response system data
could impact the EPA's ability to coordinate response efforts in
environmental disasters.

Report; EPA's National Vehicle and Fuel Emissions Laboratory Has Taken
Steps to Mitigate Impact of Coronavirus Pandemic on Mobile Source
Emission Compliance

Report #21-E-0158, June 7, 2021. We examined how the laboratory
operations and testing at the EPA's Office of Transportation and Air
Quality's National Vehicle and Fuel Emissions Laboratory, which addresses
emissions from a range of mobile sources, were impacted by the
coronavirus pandemic. NVFEL used virtual collaboration tools, conducted
remote auditing, and implemented reporting flexibilities to mitigate the
impact of the pandemic, which included closing the lab. We highlighted
NVFEL's efforts to minimize the potential for noncompliance during the
pandemic as well as the importance of returning to full testing capacity to
provide the most effective oversight of mobile sources.

Report; EPA Did Not Conduct Agencywide Risk Assessment of CARES Act
Appropriations. Increasing Risk of Fraud. Waste. Abuse, and
Mismanagement

Report #21-E-0128, May 4, 2021. We assessed the internal controls that
the EPA implemented to mitigate risks of fraud, waste, abuse, and
mismanagement over the Coronavirus Aid, Relief, and Economic Security
Act, known as the CARES Act, appropriations. We found that the Agency
did not conduct an agencywide risk assessment of internal controls or
incorporate requirements from the U.S. Office of Management and
Budget or the U.S. Government Accountability Office into its internal
control requirements. However, we also found that three of the EPA's

5


-------
program offices designed internal controls to identify and mitigate fraud,
waste, abuse, and mismanagement regarding the CARES Act funds.

Report; EPA Needs to Improve Processes for Updating Guidance.
Monitoring Corrective Actions, and Managing Remote Access for
External Users

Report #21-E-0124, April 16, 2021. Although we found that the EPA
consistently met the requirements listed in the FY2020 Inspector General
Federal Information Security Modernization Act of 2014 (FISMA) Reporting
Metrics, the deficiencies we found in the EPA's information technology
internal controls could exploit weaknesses in Agency applications and
hinder the Agency's ability to prevent, detect, and respond to emerging
cyberthreats. Those deficiencies include not reviewing outdated
procedures in a timely manner, not verifying whether corrective actions
are completed, and not enforcing information system control
requirements for the Agency's web application directory system.

Notification; Pandemic Impact on Authorized State RCRA Programs

Project #OE-FY21-O124, February 18, 2021. The OIG is conducting an
evaluation to examine the EPA Resource Conservation Recovery Act
Program's operations.

Notification; EPA's Grant Flexibilities Due to the Coronavirus Pandemic

Project #OA-FY21-0108, February 8, 2021. The OIG is conducting an audit
examining the EPA's implementation of the grant flexibilities permitted by
the Office of Management and Budget due to the coronavirus pandemic.

Notification; Survey of Remedial Project Managers on the Impact of the
Coronavirus Pandemic on Long-Term Cleanups at Superfund National
Priorities List Sites

Project #OE-FY21-0050, December 1, 2020. The OIG is conducting an
evaluation to determine the impact of the coronavirus pandemic on long-
term cleanup activities at Superfund National Priorities.

6


-------
Report; EPA's Initial Plans for Returning to the Office Incorporate CDC
Guidance but Differ by Location

Report #21-E-0030, November 30, 2020. The 13 locations we reviewed had
different guidance in their reopening plans on aspects such as face coverings,
social distancing, and cleaning and disinfecting. While some differences could
be warranted based on local conditions, the EPA should ensure that such
differences do not place employees at an increased risk of contracting or
spreading the COVID-19 disease as a result of their work location.

Report; CSB Discontinued Information Recovery Testing and Off-Site
Backup Storage During the Coronavirus Pandemic

Report #21-E-0016, November 18, 2020. SB & Company, which conducted
this evaluation, found that the CSB did not follow National Institute of
Standards and Technology guidance to perform disaster recovery testing on
major information systems during fiscal year 2020 and did not store backup
media at an off-site location. The CSB may not be readily able to recover its
systems' operations in the event of a disaster or isolated incident.

Report; EPA Has Sufficiently Managed Emergency Responses During the
Pandemic but Needs to Procure More Supplies and Clarify Guidance

Report #20-E-0332, September 28, 2020. We assessed whether the EPA
provided sufficient protective measures to its on-scene coordinators, who
respond to emergency incidents, during the coronavirus pandemic. More
than half of the on-scene coordinators who responded to our survey
reported that the coronavirus pandemic impacted their ability to respond to
emergencies. They also expressed concerns about the availability of personal
protective equipment and indicated that clarification was needed on the
EPA's COVID-19 guidance. Additionally, we found that COVID-19 testing was
not available to on-scene coordinators before or after deploying to an
incident.

7


-------
Report; EPA OIG's Response to the COVID-19 Pandemic

July 31, 2020. This report captures the OIG's early work to meet the
challenges posed by the COVID-19 pandemic, including audits, evaluations,
and investigations. This work is related to the pandemic's impact on the
EPA's and the CSB's missions, and on public health and the environment at
the core of those missions. Some potential and actual subjects of audits and
evaluations include the Agency's plan to return to work, cyber and
information technology protections, and Agency staffing shortfalls. Some
investigative topics include fraud schemes, cyberscams targeting EPA
employees and contractors, and misrepresentations of the EPA's
endorsement of products.

Report; EPA's Initial Implementation of CARES Act Section 3610

Report #20-N-0202, June 29, 2020. The Office of Acquisition Solutions
created and provided detailed guidance to EPA contracting personnel and
contractors related to reimbursements under the Coronavirus Aid, Relief,
and Economic Security Act, known as the CARES Act. The information in the
guidance documents was consistent with the federal statute.

Top Pandemic-Related Challenges Facing the EPA

June 17, 2020. The OIG identified initial challenges to the EPA's ability to
achieve its mission, including enforcement and fraud risks; state, tribe, and
territory program implementation; and risk communication to the public. The
OIG also identified internal challenges to maintaining a safe and productive
workforce, including returning to work safely, effective remote technology,
understanding organizational risk, and contract oversight.

Notification; Research for Future Audits and Evaluations Regarding Effects
of Coronavirus Pandemic (SARS-CoV-2 Virus and COVID-19 Disease) on EPA
Programs and Operations

Project #OA&E-FY20-0212, May 7, 2020. The OIG initiated an overall project
to research and identify topics for potential audits and evaluations related to
the EPA's response to the coronavirus pandemic.

8


-------
Potential Investigation
Targets

We take seriously our obligation to
investigate fraud related to the coronavirus
pandemic. We are particularly committed to investigating
schemes involving potential criminal activity or misconduct
that impacts the American people or thwarts the EPA's ability
to fulfill its mission, as well as to investigating conduct that
relies on, takes advantage of, or exploits a weakness or
vulnerability in an EPA program or operation.

Types of Investigations OIG is Undertaking or May
Undertake

¦	Fraud schemes relating to the EPA's programs and operations.

¦	Fraudulent claims for money that should be spent to advance an EPA
program.

¦	Improper avoidance of obligations to pay as required by an EPA
program.

¦	Misrepresentations of the EPA's endorsement of COVID disinfectant or
other products by fraudulently applying the Agency seal, identifier, or
product registration numbers to product labels or advertisements.

¦	Cyberscams targeting EPA employees, contractors, and grantees and
state and tribal programs overseen by EPA, as well as security threats
to the EPA.

Learn more about our investigative COVID-19 response or
contact the OIG Hotline.

41

9


-------
EPA OIG Hotline

Our office receives allegations of
fraud, waste, and abuse concerning
the COVID-19 pandemic and its

impact on EPA and CSB operations.

The EPA and public should be on the alert for some

common practices:

¦	Beware of companies placing the EPA seal or an EPA
registration number on their products claiming that they
meet EPA standards.

¦	Be cautious of imported products marketed as proven to
effectively block various epidemic viruses.

¦	Be on the lookout for websites claiming their products
contain EPA-approved active ingredients that kill 99.9
percent of all viruses and bacteria, including SAR-CoV-2 virus.
These companies may put the EPA logo on their websites to
falsely legitimize products. For a list of EPA-approved
disinfectants, please visit EPA Official List N: Disinfectants for
Use Against SARS-CoV-2.

¦	Be wary of companies claiming that their services are endorsed or
their equipment or material is certified by the EPA.

10


-------
Complaints Related to COVID-19

Total
complaints

Where COVID-19-Related Complaints Were Referred

OIG Office of Investigations

OIG Office of Audit or Office of
Special Review & Evaluation

Lake County, California | 1

U.S. Food and Drug ¦ .
Administration I '

EPA Region 9 Administrator | 1

EPA Criminal Investigation ¦ .
Division

11


-------
Prior OIG Reports Relevant to EPA's Handling of
Emergencies and Disasters

EPA's Emergency Response Systems at Risk of Having Inadequate
Security Controls

EPA's Office of Land and Emergency Management Lacked a
Nationally Consistent Strategy for Communicating Health Risks at
Contaminated Sites

Report; EPA Needs to Improve Its Emergency Planning to Better
Address Air Quality Concerns During Future Disasters

Report; EPA Needs to Improve Its Risk Management and Incident
Response Information Security Functions

Report; Management Alert - To Minimize Risk of Environmental
Harm, the Security Categorization of Electronic Manifest System Data
Needs to Be Re-Evaluated

Report; EPA Needs to Improve Its Risk Management and Incident
Response Information Security Functions

View more OIG reports ->

Related Resources

¦	Coronavirus.gov

¦	EPA's resources related to C0VID-19

¦	CIGIE's Pandemic Response Accountability Committee

12


-------