OFFICE OF INSPECTOR GENERAL U.S. environmental, projection.agency FISCAL YEAR 2023 U.S. Chemical Safety and Hazard Investigation Board ------- Report Contributors: Kelly Chavarria Eric Lewis Adam Seefeldt Matthew Shuman Andre von Hoyer Abbreviations: C.F.R. Code of Federal Regulations CSB U.S. Chemical Safety and Hazard Investigation Board EPA U.S. Environmental Protection Agency OIG Office of Inspector General U.S.C. United States Code Cover Images: The OIG identified three top management challenges for the CSB: an understaffed board, critical staff vacancies and attrition rates, and cybersecurity weaknesses. (EPA OIG image) Are you aware of fraud, waste, or abuse in an EPA or CSB program? EPA Inspector General Hotline 1200 Pennsylvania Avenue, NW(2431T) Washington, D.C. 20460 (888) 546-8740 (202) 566-2599 (fax) OIG Hotline@epa.gov Learn more about our OIG Hotline. EPA Office of Inspector General 1200 Pennsylvania Avenue, NW(2410T) Washington, D.C. 20460 (202) 566-2391 www.epa.gov/oiq Subscribe to our Email Updates. Follow us on Twitter @EPAoig. Send us your Project Suggestions. ------- Office of Inspector General U.S. Environmental Protection Agency At a Glance October 21, 2022 What Are Management Challenges? The Reports Consolidation Act of 2000 requires each inspector general to prepare an annual statement summarizing what the inspector general considers to be "the most serious management and performance challenges facing the Agency" and to briefly assess the Agency's progress in addressing those challenges. For fiscal year 2023, we examined whether the U.S. Chemical Safety and Hazard Investigation Board addressed its management challenge for fiscal year 2022, which we identified in Report No. 22-N-0003, issued on November 10,2021. We determined that the understaffed board remains a top management challenge for the CSB. In addition, we identified two new top management challenges for the Agency: minimize mission critical staff vacancies and attrition rates and improve cybersecurity weaknesses. This report addresses the three CSB goals: • Prevent recurrence of significant chemical incidents. • Advocate safety and achieve change. • Create and maintain an engaged, high- performing workforce. Address inquiries to our public affairs office at (202) 566-2391 or OIG WEBPOSTINGS@epa.gov. List of OIG reports. Fiscal Year 2023 U.S. Chemical Safety and Hazard Investigation Board Management Challenges What We Found The U.S. Environmental Protection Agency Office of Inspector General identified three top management challenges that we believe represent the CSB's greatest vulnerability to waste, fraud, abuse, and mismanagement and present the most significant barriers to accomplishing the mission during fiscal year 2023. In addition to the challenge retained from our previous top management challenges report, we identified two new top management challenges that affect the CSB operations and that may prevent the CSB from efficiently and effectively driving chemical safety change through independent investigations to protect people and the environment. Management Challenge (initially identified in fiscal year 2019): Accomplishment of the CSB's Mission Remains Impaired Until the Full Board Is Confirmed The CSB has only two of five authorized members. The Clean Air Act Amendments of 1990 authorized the creation of the CSB and established a board of five members, including a chairperson, that is responsible for major budgeting decisions, strategic planning and direction, general oversight of the CSB, and approval of investigation reports and studies. The lack of a full board has inhibited the CSB's mission to conduct investigations to protect people and the environment. As noted in our Special Review of the U.S. Chemical Safety and Hazard Investigation Board Capabilities to Effectively Administer Its Programs and Operations, Board Order 028 prohibits a single board member from taking actions or giving any approvals where the order requires approval of the full board. The loss of one of the two current board members could prevent the CSB governing body from meeting its mission and goals. Management Challenge (new): Minimize Mission Critical Staff Vacancies and Attrition Rates Mission-critical staff positions have remained vacant for more than a year. Former CSB leadership did not ensure that sufficient staff were hired and retained to meet the CSB's mission. These staffing problems have affected the CSB's ability to carry out day-to-day operations in a timely manner, including deployments to new incidents, completion of investigations, and issuance of reports. Management Challenge (new): Improve Cybersecurity Weaknesses In May 2022 the CSB's two board members stated that they had little insight into the changes needed to improve cybersecurity because of limited information sharing from the then-chairperson. Although communication between the board members and the latest chairperson was strained, previous OIG reporting and recommendations regarding CSB cybersecurity deficiencies were available for board-member review. The board needs to implement the OIG's cybersecurity recommendations to ensure the reliability, availability, and accuracy of CSB data, as well as to protect Agency information technology systems from cyberthreats. ------- UNITED STATES ENVIRONMENTAL PROTECTION AGENCY WASHINGTON, D.C. 20460 THE INSPECTOR GENERAL October 21, 2022 Steve Owens Dr. Sylvia Johnson U.S. Chemical Safety and Hazard Investigation Board 1750 Pennsylvania Avenue NW, Suite 910 Washington, D.C. 20006 Dear Mr. Owens and Dr. Johnson: Enclosed is the Office of Inspector General's fiscal year 2023 management challenges report for the U.S. Chemical Safety and Hazard Investigation Board. The Report Consolidation Act of 2000 requires that I prepare an annual statement summarizing what the Office of Inspector General considers to be the "most serious management and performance challenges facing" the CSB. This statement is also to briefly assess the CSB's progress in addressing these challenges. We used audit, evaluation, and other analyses of CSB operations to arrive at the issue presented. We retained and expanded on the previous management challenge we identified in our report, Fiscal Year 2022 U.S. Chemical Safety and Hazard Investigation Board Management Challenges. This challenge, Accomplishment of the CSB's Mission Remains Impaired Until the Fall Board Is Confirmed, has an elevated urgency due to the three board vacancies and the resulting operational challenges, as detailed in our report, Special Review of the U.S. Chemical Safety and Hazard Investigation Board Capabilities to Effectively Administer Its Programs and Operations. Additionally, we identified two new challenges: Minimize Staff Vacancies and Attrition Rates to ensure deployments to new incidents are not impeded, investigations are not delayed, and reports are released in a timely manner, and Improve Cybersecurity Weaknesses to ensure information necessary to complete its mission is secure and will not compromise Agency systems. You are not required to provide a written response to this final report. We will post this report to our website at www.epa.gov/oig. Sincerelv, Sean W. O'Donnell Enclosure ------- Background The U.S. Chemical Safety and Hazard Investigation Board is authorized by the Clean Air Act Amendments of 1990 and became operational in January 1998. Headquartered in Washington, D.C., the CSB is an independent federal agency charged with investigating chemical incidents and hazards.1 According to the CSB's website, its mission is to "drive chemical safety change through independent investigation to protect people and the environment." The CSB examines all aspects of significant chemical incidents, including the cause (for example, equipment failure) and root cause (for example, why the equipment failed). The CSB does not issue fines or citations but does make recommendations to plants; regulatory agencies, such as the Occupational Safety and Health Administration and the U.S. Environmental Protection Agency; industry organizations; and labor groups. According to the CSB's website, the board's recommendations serve as the CSB's principal tool for achieving positive change; however, compliance with CSB recommendations is voluntary. According to the CSB, Congress designed the CSB to be nonregulatory and independent of other agencies so that its investigations might, where appropriate, review the effectiveness of regulations and regulatory enforcement. The Clean Air Act Amendments of 1990 provide for a CSB board that "shall consist of five members, including a Chairperson." The board members are appointed by the president and confirmed by the U.S. Senate. The board's chairperson serves as the chief executive officer and administrator. The board is responsible for major budgeting decisions, strategic planning and direction, general CSB oversight, and approval of CSB investigation reports and studies. Board members may also participate in accident investigations. Individual board members oversee the investigation and reporting of each incident examined by the CSB. The board must approve all findings, determinations of root cause, and safety recommendations. The U.S. Chemical Safety Board 2017-2021 Strategic Plan set three goals: 1. Prevent recurrence of significant chemical incidents through independent investigations. 2. Advocate safety and achieve change through recommendations, outreach, and education. 3. Create and maintain an engaged, high-performing workforce. The 2017-2021 Strategic Plan serves as a blueprint for current and future CSB priorities. As of September 2022, the CSB had not updated its five-year strategic plan. 1 42 U.S.C. § 7412(r)(6). 1 ------- CHALLENGE: Accomplishment of the CSB's Mission Remains Impaired Until the full Board is Confirmed (initially reported as a challenge in fiscal year 2019) INTRODUCTION AND OVERVIEW The Clean Air Act Amendments of 1990 state that the CSB governing body shall have the following composition and responsibilities: • Five members, including a chairperson, appointed by the president and confirmed by the U.S. Senate. Board members are term limited to five years. The statute permits removal of a board member, including the chairperson, for inefficiency, neglect of duty, or malfeasance in office. The Clean Air Act Amendments of 1990 require that board members be appointed based on technical qualification; professional standing; and demonstrated knowledge in the fields of accident reconstruction, safety engineering, human factors, toxicology, or air pollution regulation. • Investigate (or cause to be investigated), determine, and report to the public in writing the facts, conditions, circumstances, and cause or probable cause of any accidental release resulting in a fatality, serious injury, or substantial property damage. At the end of 2021, the CSB's governing body had four vacancies, which left a single person, the then-chairperson, to serve not only as the board's chairperson and chief executive officer but also as its sole member. Beginning in April 2021, we noted that three significant events occurred relating to the functionality of the CSB board: 1. In April 2021, before the confirmation of the two new board members, the then- chairperson implemented changes to Board Order 028, which, in part, governs the roles and responsibilities of the board. The changes gave the chairperson authority to make most decisions independent of the other board members. 2. In December 2021, the Senate confirmed two additional board members, which brought the board to three members, including the then-chairperson. The new board members began their tenure at CSB in February 2022. After their confirmations, the two new board members sought to amend Board Order 028 through a vote, but the vote was suspended by the then-chairperson. This vote was the culmination of a months-long conflict between the then-chairperson and the two new board members regarding the roles of the chairperson and the board. 3. On July 22, 2022, the then-chairperson resigned, leaving the board with just two members. The remaining two members named one member as the interim executive authority to assume the chairperson's responsibilities until the president nominates and the Senate confirms a new chairperson. 2 ------- LACK OF FULL BOARD IMPEDES CSB OPERATIONS In November 2021, we issued Fiscal Year 2022 U.S. Chemical Safety and Hazard Investigation Board Management Challenges, that detailed the risks of having just one board member. Although the CSB now has two board members, there are still risks to CSB operations, such as: • Any additional resignations would reduce the CSB board to one or no members. CSB operations would be hampered with just one member but could ultimately cease with no members, as CSB is a board-driven organization and key board responsibilities cannot be delegated to staff. • A tie vote could hamper CSB decision-making. • The revised Board Order 028 states that the board cannot perform certain functions with a quorum of one. With one or no members, the CSB would therefore not be able to perform many of the board's basic functions, such as passing a budget, approving investigative reports, and hiring senior personnel. Congress intended the CSB to have five board members. With two members, the CSB is still missing 60 percent of its congressionally authorized members. The five technically qualified board members are intended to perform specific duties, such as serving as the principal spokespersons at accident sites and conducting community meetings, hearings, and boards of inquiry during accident investigations. They also play a significant role in advocating the adoption of the CSB's recommendations by industry, labor, government, and others. Board members also regularly participate in conferences, in safety forums, and on committees, and they meet with leaders of other federal agencies. Two board members are unlikely to have all the technical qualifications or the time to perform the required board duties. In addition, CSB staff cannot assume board-specific duties. Without additional board members, the CSB's work to protect people and the environment is impaired. CONCLUSION Although the Senate confirmed two new board members in 2022, there was only slight improvement in the board's membership, as the then-chairperson resigned. The two new members of the board inherited an organization that is missing 60 percent of the board members, has low productivity, and is understaffed. The president must nominate, and the Senate must confirm, new board members as soon as possible, especially since the nomination and confirmation process has taken as long as 18 months to complete. 3 ------- CHALLENGE. Minimize Staff Vacancies and Attrition Rates INTRODUCTION AND OVERVIEW Understaffing and high attrition rates have long plagued the CSB. Efforts to reduce staff vacancies and attrition rates over the last several years have been unsuccessful. The lack of sufficient staffing for both management and nonmanagement positions has adversely affected the CSB's ability to investigate new safety incidents, complete investigations, and issue timely reports. Through June of FY 2022, the CSB had 17 backlogged investigations, no new incident deployments, three completed investigations, no issued reports, and no issued recommendations. UNDERSTAFFING AND HIGH ATTRITION RATES DELAY CSB REPORTING Our special review of the CSB's capabilities to administer its programs and operations effectively, as detailed in Special Review of the U.S. Chemical Safety and Hazard Investigation Board Capabilities to Effectively Administer Its Programs and Operations, highlighted several mission-critical staffing problems at the CSB. From fiscal years 2019 through 2021, CSB attrition rates averaged 22 percent. In contrast, the EPA's attrition rate during that same period was 7 percent. During fiscal year 2021, the CSB had nine management staff departures, including its director of human resources, director of administration, general counsel, chief information officer, and records management specialist. As of July 2022, the CSB had been without a general counsel since November 2020, and the records management specialist position had been vacant since June 2020. From July 2019 through February 2022, the CSB did not have a managing director, and although a managing director was hired in February 2022, that individual tendered a resignation in May 2022, once again leaving the position vacant on July 22, 2022. In August 2022, the recruitment package was developed and the CSB expected the vacancy announcement to be subsequently posted. For fiscal year 2021, the CSB was allocated 24 percent more full-time employees and 17 percent more resources than it was able to expend. In fiscal year 2022, these figures were on pace for similar percentages. As of August 2022, the CSB had 12 chemical incident investigators working on 17 open investigations. There were five vacant investigator positions for fiscal year 2022, and five additional investigator positions have been authorized for fiscal year 2023. CONCLUSION The CSB should reduce staff vacancies and lower attrition rates by improving senior management communication and leadership and promoting a healthy workplace environment. The CSB has failed to create new announcements for vacant positions, leaving some positions vacant for more than a year without any action. The lack of sufficient staffing will continue to impede deployments to new incidents and delay the completion of investigations and the release of timely reports, impacting the CSB's ability to meet its mission of protecting people and the environment. 4 ------- CHALLENGE. Improve Cybersecurity Weaknesses INTRODUCTION AND OVERVIEW Our oversight of the CSB has consistently identified deficiencies in the Agency's information security program. In March 2022, we issued a report, Contractor-Produced Report: CSB Is at Increased Risk of Losing Significant Data and Is Vulnerable to Exploitation, that addressed potential cybersecurity vulnerabilities at the CSB. Specifically, the report assessed the effectiveness of the CSB's information security program at "Level 2, Defined," which means that even though the Agency's policies, procedures, and strategies for its information security program are formalized and its strategies are documented, they are not consistently implemented. The report recommended that the CSB improve its cybersecurity program by consistently storing system backups at an off-site location that is a sufficient distance from its headquarters to prevent the significant loss of data. The report also recommended that the CSB develop and deploy a vulnerability disclosure policy to formalize security feedback and to comply with Office and Management and Budget Memorandum M-20-32 and U.S. Department of Homeland Security Binding Operational Directive 20-01. These corrective actions would prevent delays in reporting identified vulnerabilities that may be exploited and lead to the disruption of operations. In September 2022, we issued a management alert, Data Vulnergbilities Could Impgct the CSB's Ability to Cgrry Out Its Obliggtions Under the Federgl Informgtion Security Modernizgtion Act of 2014 (Contrgctor-Produced Report), on the evaluation of the CSB's compliance with the Department of Homeland Security's fiscal year 2022 reporting metrics for the Federal Information Security Modernization Act of 2014. The management alert outlined some findings that may have significant impacts on the confidentiality, integrity, and availability of the CSB's information technology resources. These vulnerabilities could impact the CSB's ability to fulfill its obligations and mission. THE CURRENT BOARD WAS NOT AWARE OF THE STATUS OF CYBERSECURITY In May 2022, the current board members stated that they had not been apprised of the status of cybersecurity. One board member noted that they were not aware of issues concerning cybersecurity and CSB plans to improve cybersecurity. The member attributed this lack of knowledge to the former chairperson, who resigned in June 2022, sharing minimal information on the issue. However, the OIG regularly publishes CSB reports, including CSB cybersecurity reports, that are available to the public and CSB. The CSB can find unimplemented recommendations in the OIG semiannual reports located here. 5 ------- CONCLUSION The board needs to ensure that the incoming chief information officer is aware of the recent OIG cybersecurity findings and develops a plan to address the findings and recommendations. Additionally, the Federal Information Security Modernization Act of 2014 requires federal agencies to develop, document, and implement information system programs to protect federal information and systems. While the CSB has formal policies, procedures, and strategies for its information security program and documented strategies, they are not consistently implemented. At the CSB's current assessment level, the risk that vulnerabilities may be exploited increases. Therefore, the CSB must improve its current information security program and increase it maturity level to ensure that information is protected, reliable, and available. 6 ------- |