Not a trick question but boy do we get “the look” when we ask the question just as it is written in 68.79 and .119(o). What do OSHA and EPA mean by certifying an audit? Who does this certification? Is this a formal exercise of certifying? Why did OSHA/EPA use this term in the standard? Here is my take…
Both OSHA and RMP use similar language in their auditing element:
§68.79 Compliance audits.
(a) The owner or operator shall certify that they have evaluated compliance with the provisions of this subpart at least every three years to verify that procedures and practices developed under this subpart are adequate and are being followed.
(o) Compliance Audits. (1) Employers shall certify that they have evaluated compliance with the provisions of this section at least every three years to verify that the procedures and practices developed under the standard are adequate and are being followed.
Should we be doing some “certification” of our audit reports? Well, I would not go to extremes, as we have seen companies who actually had their PM sign on a blank provided on the cover page of the report to “certify” the report. Sadly, that was the last time anyone touched the report! On the other hand, I have seen both OSHA and EPA take issue with an “ignored audit report(s)” using the lack of management “certification” as grounds for discussion. But I have NEVER seen nor heard anyone being cited because a report was not “certified.”
So why did OSHA and EPA use this type of language? In the proposed rule, OSHA used the word “certify” in two spots within the auditing element. Although one use of the word was replaced with the word “document,”; the use in (o)(1) remained. In the preamble, we can understand why OSHA chose to use this language (certify vs. document)…
Some rulemaking participants (e.g., Ex. 38, 48, 64, 71, 158; Ex. 143) disagreed with the term “certify” and suggested that other terms such as “document”,”respond to,” or “resolve” would be more descriptive of OSHA’s intent.
The purpose of this proposed paragraph is to assure that employers determine an appropriate response to each of the report findings and if employers identify a deficiency that needs to be corrected, that they “document” the correction of the deficiency. Therefore, proposed paragraph (o)(4) is contained in the final rule as proposed except that the word “certify” has been replaced by the word “document.”
Unfortunately, there is no discussion around the use of the word “certify” in (o)(1) or in EPA’s RMP rule, but having been involved in many PSM and RMP inspections, I can say that what OSHA and EPA want to see is that management has accepted the results of the audit AND they are engaged in the action plans for each of the findings/recommendations. When they come across a facility where management is completely disengaged from the entire audit process and the development of action plans to address findings/recommendations, they tend to think that if the PM signed his/her name to the report, that would tie them to the report. In other words – they signed it, so they can’t play dumb about what’s inside it!
But as I said before, simply signing a document does not tie one to that document. Seriously, most RMPs state the PM is the “person responsible for RMP 40 CFR Part 68 implementation,” and this could not be further from reality. I have been known to write one last finding during RMP audits when the PM never came to the opening conference, never attended a daily debrief, never made time to participate in the audit (e.g., never had time to be interviewed as to their role), and did not participate in the official close out of the audit. For the person to be “responsible for RMP 40 CFR Part 68 implementation” and never participate in the least bit in the 3-year audit is most likely the root cause for the facility’s poor performance. These are the situations in which OSHA/EPA wanted someone in management to “certify” the audit report.
Who does this certification? As I said above, the most likely person to “certify” the audit should be the person listed in the RMP as “responsible for RMP 40 CFR Part 68 implementation”. If the facility does not fall under RMP, we should default to the PM. I have seen some companies with extensive facilities have each unit manager certify his/her findings related to his/her operations. This is driving accountability/ownership to a level where “the rubber meets the road,”; but it is rare to see this. We see EHS managers “certifying” audit reports, and we also see these same EHS managers struggling to get management engaged in the corrective action plans; so my advice is the certification should come from the top, but that is me talking and NOT OSHA or EPA.
Is this a formal exercise of certifying? Not really. As I said in the opening, we have seen formal certifications on audit reports, and although they catch your eye, we often are disappointed to find that was the last time that level of management even saw the report. So this is NOT about some formal process; it is instead a means to drive ownership of the report findings in the hopes that management will be engaged in the corrective action plans. A wise and retired OSHA AD once told me that all corrective actions stemming from audits, PHAs, II’s, MI inspections, etc., should be assigned to senior management personnel. Of course, these senior members of management would not be the ones actually to do the work to close out the items, but they are fully responsible for providing the resources to get them closed out. This goes back to the “intent” of why OSHA/EPA used the term “certify.”
Process Safety Management is meant to be a fully functioning “management system”. Auditing is just one element of the 14-part management system. Having “management” disengaged from the very “management system” they are responsible for implementing and overseeing is just crazy. The auditing process should be arranged/scheduled and managed by the PSM/RMP leader, but senior management MUST participate and set expectations for resolving the items in a timely manner. Without this, the report is not worth the paper it is written on!