A look into what EPA expects in our RMP 3-year audits

Recently EPA issued a Consent Decree in response to a company that had two (2) facilities inspected under the Risk Management Plan Rule (40 CFR Part 68).  The document was much like the many others I have posted here; however, this agreement contained a lengthy audit plan that EPA and the company agreed to as part of the resolution of the inspections.  This material could be viewed as an inside look at what EPA expects from 3-year audits.  I thought it was worth passing on, as we still see way too many 3-year audits being done that do not even scratch the surface!  It should be noted, that EPA took a two prong approach with this audit plan, as this company managed RMP from a corporate office with “pass down” to the two facilities in this agreement.  The audit plan included an audit of the Corporate Office for its role in RMP compliance, as well the two facilities involved in these inspections.  This company has more than these two facilities involved in these inspections.  Here is EPA’s audit plan…

Audit Performance

Within thirty (30) Days of the Effective Date, Defendants shall propose to EPA for its approval the name of a third party auditor or auditors and provide such party’s or parties’ qualifications to perform the audits that meet the requirements below.

• The proposed auditor for each Audit shall be a knowledgeable and experienced person or firm with expertise in risk management program requirements, as well as expertise in the risk management requirements of each Covered Process at Defendants’ Facilities.
  • Defendants may propose to replace any auditor or may propose to add any additional auditor by submitting a request to EPA pursuant to Paragraphs 17-21 (Approval of Deliverables). The request shall indicate the reason for the change or addition; the qualifications of the proposed auditor; and any other relevant information. The proposed auditor shall meet the criteria above.

Audits

Within ninety (90) Days of EPA’s approval of the auditor or auditors, the Defendants perform the audits and complete the Audit Reports as specified herein. All audits will be conducted in accordance with generally accepted audit practices.

The Corporate Office Audit shall include:

• the review of 40 C.F.R. Part 68 implementation materials and records for all Covered Processes and interviews with personnel who develop, or aid in developing, or implement, or aid in implementing the Risk Management Program for Defendants’ Facilities.
  • Personal interviews should include all Corporate Office personnel identified as holding a position in the management system for any of Defendants’ Facilities and, as deemed necessary by the third-party auditor, personnel from Defendants’ Facilities with relevant process knowledge to assist the auditors by providing process operations input.

Scope of Corporate Office Audit

• The Risk Management Program Audit for the Corporate Office will include
  • the identification of elements of the Risk Management Program for all Covered Processes at the Defendants’ Facilities that originate from the Corporate Office, including but not limited to documents developed by the Corporate Office for use at the Facilities, and documents developed by the Corporate Office for use at the Corporate Office, including elements whose implementation is initiated or wholly completed by the Facilities (development may be done by the Corporate Office).

Identification and Evaluation of Applicable Codes & Standards:

• The Corporate Office Audit will identify, for all recognized and generally accepted good engineering practices (RAGAGEP) identified by the Corporate Office as being applicable to all Covered Processes at the Defendants’ Facilities whether:
  • the current version is being used;
  • codes and standards, including but not limited to Chlorine Institute pamphlets and jurisdictional building, fire, electrical, and mechanical codes are appropriate to the chemicals, processes, and physical facilities;
  • any RAGAGEP not identified by the Corporate Office also apply, and if such do apply, the audit shall identify those practices.

Evaluation of Risk Management Program Elements:

• In addition to the above, the Corporate Office Audit shall evaluate
  • each of the following elements to determine whether they are adequate.
  • To the extent that the Corporate Office has a role in Defendants’ compliance with any of the following elements at the Facilities, the Corporate Office Audit shall evaluate those elements. If an element is not handled at all at the Corporate Office level, the Audit Report shall explicitly state that it applies only to the Facilities.

40 C.F.R. § 68, Subpart A – General Management System.

• The Corporate Office Audit shall evaluate
  • whether the management system, as written, meets the requirements of 40 C.F.R. § 68.15; and
  • whether the management system is adequately implemented at each of the Facilities, with clearly delineated lines of authority and decision making for implementation of the risk management program.
• The Audit will also evaluate
  • the effectiveness of the management system, in particular, the development and implementation of the risk management program elements developed by the Corporate Office and disseminated to each Facility.
• The Corporate Office Audit will determine whether the lines of communication between the Corporate Office and the Facilities are adequate and effective.

40 C.F.R. § 68, Subpart B – Hazard Assessment.

• The Corporate Office Audit shall assess compliance with this Subpart, including evaluation of worst-case and alternate-case scenarios, and identification of receptors.

40 C.F.R. § 68, Subpart D – Program 3 Prevention Program

(1) 40 C.F.R. § 68.65 – Process Safety Information (PSI).

• • The Corporate Office Audit shall confirm the Covered Processes at Defendants’ Facilities, including but not limited to repackaging, blending, warehousing, and storage, for all RMP-regulated chemicals, including but not limited to chlorine, sulfur dioxide, and ammonia for compliance with RAGAGEP as identified in part b of this paragraph. While the Corporate Office Audit will cover all aspects of the applicable RAGAGEP, it will specifically address the following areas:
    • safety systems (including but not limited to safety release valves and systems, chlorine detection and alarms, and the emergency action plan);
    • labeling; and overall condition of tanking, valves, and piping.
  • The auditor shall evaluate the PSI to ensure that changes to PSI based on recommendations from incidents are reviewed and integrated into Defendants’ PSI, including but not limited to Chlorine Institute Pamphlet 6.

(2) 40 C.F.R. § 68.67 – Process Hazard Analysis (PHA).

• • The Corporate Office Audit shall evaluate
    • whether PHAs required by 40 C.F.R. § 68.67 have been properly performed;
    • whether PHAs have recognized all known hazards for the regulated Covered Process(es), RMP-regulated chemicals, stationary source siting, and factors unique to each Facility (including associated controls and safety systems);
    • whether previously performed PHAs have fully identified issues and root causes of incidents; and
    • whether deficiencies set forth within the PHAs have been resolved adequately and in a timely manner.

(3) 40 C.F.R. § 68.69 – Operating Procedures.

• • The Corporate Office Audit shall evaluate
    • whether operating procedures are current, clear, complete, and consistent with recognized and accepted good engineering practices.

(4) 40 C.F.R. § 68.71 – Training.

• • The Corporate Office Audit shall evaluate whether training and refresher training is current and adequate.

(5) 40 C.F.R. § 68.73 – Mechanical Integrity.

• • The Corporate Office Audit shall evaluate whether the mechanical integrity program is adequate and consistent with RAGAGEP.

(6) 40 C.F.R. § 68.75 & 40 C.F.R. § 68.77 – Changes in Process.

• • The Corporate Office Audit shall evaluate whether Management of Change (MOC) and Pre-Startup Safety Review (PSSR) policies are sufficient, and, to the extent that the Corporate Office is involved in the implementation of MOC and PSSR at the Facilities, that they are being conducted appropriately.
    • As to MOC, the audit shall assess whether it includes all required elements and whether changes to PSI, PHA, operating procedures, mechanical integrity, training, and other program elements have been completed and documented.
    • As to PSSR, the audit shall determine whether PSSRs were completed prior to bringing equipment online and whether findings, recommendations, and action items were resolved or implemented.

(7) 40 C.F.R. § 68.79 – Compliance Audits.

• • The Corporate Office Audit shall evaluate whether
    • each compliance audit conducted during the five years prior to the effective date of this consent decree was properly performed in accordance with 40 C.F.R. § 68.79;
    • whether all elements of 40 C.F.R. § 68 Subpart D were fully evaluated;
    • whether all issues were identified and addressed; and
    • whether action items and timeframes were appropriate and were completed in a timely manner.

(8) 40 C.F.R. § 68.81 – Incident Investigation.

• • The Corporate Office Audit shall include
    • a review of all incidents during the five years prior to effective date of this consent decree in accordance with 40 C.F.R. §§ 68.42 and 68.81 that should have resulted in an incident investigation.
    • For incidents or near misses where an investigation occurred, a determination will be made whether the incident investigation was conducted properly, whether findings were appropriate, and whether appropriate action items were developed and implemented.

(9) Completion of Action Items.

• • The Corporate Office Audit shall evaluate whether action items arising from PHAs, Compliance Audits, and Incident Investigations are appropriate, are completed in a timely manner, and that such items are fully closed-out.

40 C.F.R. § 68, Subpart E – Emergency Response.

• The Corporate Office Audit shall evaluate
  • whether the emergency response program is adequate, coordinated with local emergency planners/responders, and
  • whether mechanisms for timely notification of first responders and the public are adequate and are being implemented.
  • The review will also be made of the notification mechanism for notifications to the state emergency response commission(s) and National Response Center.

40 C.F.R. § 68, Subpart G – Risk Management Plan.

• The Corporate Office Audit shall evaluate
  • whether the Risk Management Plan for each Facility is updated as required, in a timely manner following accidents or changes in the emergency contact and
  • that all required elements are included, accurate, and reflective of the program that is implemented at the Facility.

40 C.F.R. § 68, Subpart H – Other Requirements.

• The Corporate Office Audit will evaluate
  • whether the Corporate Office is in compliance with recordkeeping and retention requirements, and
  • any additional reporting requirements as specified in Subpart H.

Two Field Audits

The Field Audits shall include:

• the review of 40 C.F.R. Part 68 implementation materials and records for all Covered Processes;
• the inspection of on-site equipment, conditions, and practices; and interviews with plant personnel including operator technicians, maintenance personnel, contractors, plant management, administrative personnel, and participants in specific Risk Management Program related activities such as process hazard analyses and incident investigations (including personnel from each Facility, the Corporate Office, and from any of Defendants’ other facilities that participated in either of the two Facility’s Risk Management Program implementation activities).

Each Field Audit will include a review of applicable requirements in the following elements of 40 C.F.R. Part 68 with increased focus on the items listed under each regulatory Subpart below:

40 C.F.R. § 68, Subpart A – General Management System.

Each Field Audit shall evaluate whether:

• the management system, as written, meets the requirements of 40 C.F.R. § 68.15; and
• the management system is adequately implemented at each Facility, with clearly delineated lines of authority and decision-making for implementation of the risk management program.
• the effectiveness of the management system in ensuring Risk Management Program elements developed by the Corporate Office are communicated and implemented at the facility being audited.

 

40 C.F.R. § 68, Subpart B – Hazard Assessment.

Each Field Audit shall assess, for the subject Facility, compliance with this Subpart, including evaluation of worst-case and alternate-case scenarios and identification of receptors.

 

40 C.F.R. § 68, Subpart D – Program 3 Prevention Program

1. Process Safety Information (PSI).
   • Each Field Audit shall evaluate
     • whether the recognized and generally accepted good engineering practices (RAGAGEP) used by Defendants, including but not limited to industry codes, standards, pamphlets, and guidance documents, particularly those produced by the Chlorine Institute, are appropriate to the processes at the subject Facility.
     • Defendants’ RMP Covered Processes, including but not limited to repackaging, blending, warehousing, and storage, for all RMP regulated chemicals, including but not limited to chlorine, sulfur dioxide, and ammonia for consistency with RAGAGEP.
     • these specifications and ensure they comply with the RAGAGEP identified in the Corporate Office Audit.
   • Each Field Audit shall confirm that the chlorine handling and repackaging systems are constructed in compliance with current RAGAGEP.
     • While the Field Audits will cover all aspects of the applicable RAGAGEP, they will specifically address the following areas:
       • safety systems (including but not limited to safety release valves and systems, chlorine detection and alarms, and the emergency action plan);
       • labeling and overall condition of tanking, valves, and piping.
   • Each Field Audit shall evaluate the PSI to ensure that changes to PSI based on recommendations from incidents are reviewed and integrated into Defendants’ PSIs, including but not limited to Chlorine Institute Pamphlet 6.

 

40 C.F.R. § 68.67 – Process Hazard Analysis (PHA).

• Each Field Audit shall evaluate whether
  • PHAs required by 40 C.F.R. § 68.67 have been properly performed;
  • PHAs have recognized all known hazards for the regulated process(es), RMP-regulated chemicals, stationary source siting, and factors unique to each facility;
  • previously performed PHAs have fully identified issues and root causes of incidents; and
  • deficiencies set forth within the PHAs have been resolved adequately and in a timely manner.

40 C.F.R. § 68.69 – Operating Procedures.

• Each Field Audit shall evaluate whether operating procedures are current, clear, complete, consistent with RAGAGEP, and are being fully implemented at the subject facility.

40 C.F.R. § 68.71 – Training.

• Each Field Audit shall evaluate whether
  • training and refresher training is current, adequate, and understood
  • refresher training is conducted frequently enough

40 C.F.R. § 68.73 – Mechanical Integrity.

• Each Field Audit shall evaluate whether the mechanical integrity program is adequate, consistent with RAGAGEP, and adequately implemented pertaining to all components in all Covered Processes.

40 C.F.R. §§ 68.75 and 68.77 – Changes in Process.

• Each Field Audit shall evaluate whether Management of Change (MOC) and Pre-Startup Safety Review (PSSR) are being conducted appropriately.
  • As to MOC, the Field Audits shall assess whether it includes all required elements and whether changes to PSI, PHA, operating procedures, mechanical integrity, training, and other program elements have been completed and documented.
  • As to PSSR, the Field Audits shall determine whether PSSRs were completed prior to bringing equipment online and whether findings, recommendations, and action items were resolved or implemented.

40 C.F.R. § 68.79 – Compliance Audit.

• The Field Audits shall evaluate whether
  • each compliance audit conducted during the five years prior to the Effective Date of this Consent Decree was properly performed in accordance with 40 C.F.R. § 68.79,
  • all elements of 40 C.F.R. Part 28 Subpart D were fully evaluated,
  • all issues were identified and addressed, and
  • action items and timeframes were appropriate and completed in a timely manner.

40 C.F.R. § 68.81 – Incident Investigation.

• The Field Audits shall include
  • a review of all incidents at each subject Facility, both actual releases and near-misses during the five years prior to the Effective Date of this Consent Decree in accordance with 40 CFR §§ 68.42 and 68.81 that should have resulted in an incident investigation.
  • For incidents or near-misses where an investigation occurred, a determination will be made whether
    • the incident investigation was conducted properly,
    • findings were appropriate, and
    • appropriate action items were developed and implemented.

Completion of Action Items.

• The Field Audits shall evaluate whether action items arising from PHAs, Compliance Audits, and Incident Investigations are appropriate, are completed in a timely manner, and that such items are fully closed-out.

40 C.F.R. § 68, Subpart E – Emergency Response.

• The Field Audits shall evaluate whether
  • the emergency response program is adequate, coordinated with local emergency responders, and whether mechanisms for timely notification of first responders and the public are adequate and are being implemented.
  • The review will also be made of the notification mechanism for notifications to the state emergency response commissions(s) and National Response Center.

40 C.F.R. § 68, Subpart G – Risk Management Plan.

• The Field Audits shall evaluate whether
  • the Risk Management Plan for each facility is updated as required, in a timely manner following accidents or changes in the emergency contact, and 
  • all required elements are included, accurate, and reflective of the program that is implemented at the facility.

40 C.F.R. § 68, Subpart H – Other Requirements.

• The Field Audits shall evaluate whether the Facility is in compliance with recordkeeping and retention requirements, and any additional reporting requirements as specified in this Subpart.

Audit Reports and Audit Action Plans

a. Within 45 days of completion of each of the three audits (including the Corporate Office Audit and the two Field Audits), the third party auditor shall simultaneously submit copies of the respective Audit Report to EPA and to Defendants. Each Audit Report shall list any findings that the Auditor has judged to be in nonconformance with the procedures, protocols, and guidance established by Defendants, or with the RAGAGEP required to meet the applicable requirements of 40 C.F.R. Part 68 at the time of the Audit. For each Field Audit, the Audit Report shall assess whether the nonconforming findings from the Corporate Office Audit Report are applicable to the subject Facility, and also shall include an assessment of whether and how the Risk Management Program elements coordinated by the Corporate Office (including, but not limited to, model documents and ensuring use of up-to-date industry codes and standards) may be improved.

b. Within 60 Days of the auditor’s submittal of each Audit Report, Defendants shall submit an Audit Action Plan to EPA that shall outline Defendants’ response to each Audit Report’s findings, including any measures taken or that will be taken to address such findings, and a schedule for implementing any such measures, pursuant to the requirements of Paragraph 16, below.

c. Within 60 Days of Defendants’ submittal of the third Audit Action Plan, Defendants shall submit a Supplemental Audit Action Plan in which the findings and recommendations from each of the three Audit Reports and the action items developed in the three initial Audit Action Plans are reviewed to determine the applicability of such findings, recommendations, and action items at all Defendant’s chlorine repackaging plants, as listed in Appendix A, for all Covered Processes. For the recommendations and action items that are determined to be applicable to any Covered Processes at Defendants’ other chlorine repackaging facilities, Defendants shall outline their response to each such recommendation at the other repackaging facilities, including a detailed timeline for the implementation of applicable action items, pursuant to the requirements of Paragraph 16 below.

Completion of Audit Response Activities

a. Within six (6) calendar months of the date of its submittal of each Audit Action Plan, and the Supplemental Audit Action Plan respectively, Defendants shall address all findings and recommendations that do not require significant capital expenditures or engineering estimates that would preclude completion in that time frame. Within twelve (12) calendar months of the date of its submittal of each Audit Action Plan and of the Supplemental Audit Action Plan respectively, Defendants shall address all findings and recommendations whose resolution requires significant capital expenditures or engineering estimates, or if resolution cannot be addressed within that 12-month timeframe, shall comply with the requirements of Subparagraph 16.b below. For the purposes of this Paragraph, “significant capital expenditure” is defined as any expenditure greater than $100,000.

b. If the resolution of findings and recommendations cannot be completed within the timeframes established in subparagraph (a) above, Defendants may request extended timeframes. Subject to the sole discretion and approval of EPA, Defendants may request extra time by submitting documentation to EPA that: (i) identifies the unresolved findings and recommendations in the applicable category; (ii) summarizes steps taken to date to address those findings and recommendations; (iii) explains the reasons the findings and/or recommendations have not been addressed; (iv) provides anticipated actions to address the findings and recommendations; and (v) provides a detailed timeline for completion.

 

CLICK HERE for the official document