Download PDF
June 18, 2015

EPA Announces Plans to Modernize Audit Policy

Bergeson & Campbell, P.C.

On June 10, 2015, and June 15, 2015, EPA held a webinar entitled “eDisclosure: EPA’s Plan to Modernize the Implementation of the Audit Policy and the Small Business Compliance Policy.” During the webinar, EPA set forth its plans to release in the fall 2015 a centralized online portal called eDisclosure to allow companies to submit self-disclosures electronically under EPA’s Incentives for Self-Policing: Discovery, Disclosure, Correction and Prevention of Violations (Audit Policy) and Small Business Compliance Policy. EPA stated that it is developing eDisclosure in an effort to continue to promote the benefits of self-disclosures while also saving time and resources by modernizing and streamlining the disclosure procedure.

Companies that satisfy all nine conditions of self-disclosure under the Audit Policy (i.e., systematic discovery; voluntary discovery; prompt disclosure; independent discovery and disclosure; correction and remediation; prevent recurrence; repeat violations are ineligible; certain types of violations are ineligible; and cooperation) are eligible for 100 percent penalty mitigation, while companies that satisfy conditions 2-9 (i.e., all except systematic discovery) are eligible for 75 percent penalty mitigation. A related policy for small businesses (those with 100 or fewer employees) modifies the conditions as further incentives (e.g., 100 percent penalty mitigation even if the discovery is not systematic, longer compliance timeframes).

Importantly, although EPA stated repeatedly that the launch of eDisclosure will not change any of the conditions to be satisfied to take advantage of the Audit Policy, there are important distinctions with which companies will need to familiarize themselves. EPA did not have screen shots or examples of the portal because it is still in development, but provided the following overview with regard to the process, timing, and implementation.

To initiate a self-disclosure, a company representative will need to register under EPA’s Central Data Exchange (CDX) unless that representative is already identity-proofed under the Cross Media Electronic Reporting and Recordkeeping Rule (CROMERR). Submissions on eDisclosure will be required with 21 days of discovery, which is the same timeframe that is required under the Audit Policy to satisfy the condition of “prompt” disclosure.

Self disclosures will now be divided into two tiers, with different procedures applicable to each.

  • Tier 1 Disclosures: The potential violations that will receive the most streamlined treatment are Emergency Planning and Community Right-to-Know Act (EPCRA) violations that meet all Audit Policy or Small Business Compliance Policy conditions. These Tier 1 disclosures do not include: (1) Comprehensive Environmental Response, Compensation, and Liability Act (CERCLA) 103/EPCRA 304 chemical release reporting violations; or (2) EPCRA violations with significant economic benefit as defined by the United States Environmental Protection Agency (EPA).
    Once a company submits information sufficient to qualify as Tier 1, the eDisclosure system will automatically issue an electronic Notice of Determination (eNOD) confirming that the violations are resolved with no assessment of civil penalties, conditioned on the accuracy and completeness of the submitter’s certified eDisclosure.
    EPA stated that its decision to offer this streamlined approach for these EPCRA violations is based on the fact that these types of violations comprise almost half of the self-disclosures received to date and they are the types of violations that are easy for EPA to confirm compliance. EPA also noted that the regulated community highlighted these violations as ones appropriate for streamlined treatment.
    One of the Audit Policy conditions is that a company correct the violation(s) at issue within 60 days (or within 90 days of submitting an online Small Business Compliance Policy disclosure) of the date of discovery of such violation(s). With eDisclosure, within 60 days of submitting an initial online Audit Policy disclosure (or within 90 days of submitting an online Small Business Compliance Policy disclosure), a company must submit a Compliance Report certifying that the violation(s) disclosed has been corrected and that the Audit Policy or Small Business Compliance Policy conditions have been met. It is important to note that the date of discovery and the date of disclosure will likely differ, so that the date when the violation(s) must be corrected and the date by which the Compliance Report is due will differ accordingly. Of particular significance, there is no possibility for companies to seek an extension of the time to correct Tier 1 EPCRA violation(s) or submit the Compliance Report.
    EPA will “spot check” submissions on eDisclosure to ensure compliance with the Audit Policy or Small Business Compliance Policy and eDisclosure requirements.
  • Tier 2 Disclosures: All violations that do not meet Tier 1 will be Tier 2, including: (1) all non-EPCRA violations; (2) EPCRA violations where the violator can only certify compliance with Audit Policy conditions 2-9 (i.e., discovery was not systematic), (3) CERCLA 103/EPCRA 304 chemical release reporting violations; and (4) EPCRA violations with significant economic benefit as that term is defined by EPA.
    For disclosures that qualify as Tier 2, the eDisclosure system will automatically issue an electronic Acknowledgement Letter (AL) confirming EPA’s receipt of the disclosure, and promising that EPA will make a determination as to eligibility for penalty mitigation if and when it considers taking an enforcement action for environmental violations.
    The timing to correct violation(s) and submit a Compliance Report is the same as Tier 1 with one important distinction. While companies disclosing Tier 1 violation(s) have no opportunity to seek extensions, companies disclosing under Tier 2 can seek up to 30 additional days (or 90 additional days if submitting an online Small Business Compliance Policy disclosure) to correct their violation(s) with no explanation. These extensions will be granted automatically through eDisclosure, with a similar extension to submit the Compliance Report. A company that needs more than 30 additional days can seek a longer extension not to exceed 180 days (or within 360 days of submitting an online Small Business Compliance Policy disclosure), after the date of discovery, provided the company includes a justification for the need for such an extension. EPA did not provide any guidance regarding the justification needed to seek an extension of time under the Audit Policy, but EPA did specify that for Small Business Compliance Policy disclosures, the justification must be based on the need for additional time to put into place pollution prevention measures.
    While these longer extension requests will be granted automatically through eDisclosure, with a similar extension to submit the Compliance Report, EPA states that the request will not be considered granted at the time of the request. Instead, EPA could later determine, if and when it considers taking an enforcement action, that the correction was not made promptly and thus this Audit Policy condition is not satisfied.
    EPA will screen Tier 2 submissions for “significant concerns (e.g., criminal conduct, imminent hazard)” and will scrutinize eDisclosures more carefully when extensions beyond 30 days are requested.

Other elements of eDisclosure include:

  • Confidentiality: EPA stated that eDisclosure will not be designed to receive or process any information claimed as Confidential Business Information (CBI). Instead, companies must submit sanitized (non-CBI) information through the eDisclosure, and then submit any CBI related to the disclosure manually through existing EPA procedures.
  • Public Disclosure: EPA emphasized that eDisclosure is not a searchable website for the public to obtain information about self-disclosure. That said, there is a possibility that EPA would release information regarding a disclosure in response to a Freedom of Information Act (FOIA) request. Under its policy as noted in a 1997 EPA memorandum, EPA believes that Audit Policy disclosures, but for CBI, can be released to the public once the case is “resolved.” Under the 1997 policy, “unresolved” cases are not subject to disclosure under FOIA. In an important change of position, EPA noted that going forward, it would no longer determine that all unresolved disclosures cannot be made available publicly. Instead, it will make a case-by-case determination whether it reasonably foresees that release would harm an interest protected by a FOIA exemption (e.g., FOIA Exemption 7(A) for “law enforcement proceedings”).
  • New Owners: EPA stated its intent to retain the incentives outlined in its “Interim Approach to Applying the Audit Policy to New Owners,” 73 Fed. Reg. 44991 (Aug. 1, 2008) but did not state that it would be changing the “interim” status of that Policy. A company seeking to self-disclose as a new owner will need to submit its disclosure manually and outside the automated eDisclosure system.
  • Pre-Existing, Unresolved Disclosures: A company that has already self-disclosed EPCRA violation(s) that would be considered a Tier 1 violation can resubmit its disclosure online within 90 days of EPA launching eDisclosure and at the same time certify that the violation(s) was corrected within 60 days of discovery. EPA will treat any other disclosure made before eDisclosure launches as a Tier 2 disclosure, with the Federal Register notice announcing eDisclosure serving as the AL. Pre-existing disclosures for which eDisclosure is not available are those already subject to an audit agreement, those in “significant” settlement negotiations, and those disclosures under the New Owner Policy. In these cases, EPA will resolve the disclosures with a Notice of Determination (NOD), Consent Agreement and Final Order (CAFO), or Consent Decree (CD), as appropriate.


EPA’s development of eDisclosure is a positive step indicating EPA’s support for and interest in encouraging continued use of its Audit Policy, including its related policies for small businesses and new owners. Companies with violations that fall within EPA’s Tier 1 category will be the biggest potential beneficiaries of eDisclosure, but all companies utilizing the system can benefit from a streamlined process.

There are some potential concerns with EPA’s approach, however. For example, EPA’s decision to change its policy regarding the potential public disclosure of unsettled cases is of concern. EPA admits it will only determine when a case is eligible for the Audit Policy when it decides to take an enforcement action. The effect of this policy change could be to deter disclosures that would be counter to EPA’s stated interest in modernizing and improving self-disclosure procedures.

EPA will issue in fall 2015 a Federal Register notice simultaneously with its launch of e-Disclosure to describe the new portal and how EPA plans to implement the Audit Policy and Small Business Compliance Policy. Although there is no formal comment period, stakeholders should consider providing input now while EPA is in the midst of developing eDisclosure.