Most folks already know what an audit is, but many don't know what to do with them once they're completed. Here we discuss whether or not you have to report the findings of an audit to anyone.
Many of our clients have hired us in the past to conduct audits at their operation. Invariably, at the end of the audit, a lot of folks want to know if they have to report the findings to anyone.
That's a fantastic question, since the results of that audit are basically a 'report card' into how your operation is doing, and many fear they have to turn this information over to someone.
In our opinion, we find many facilities tend to hold back on doing audits because they're afraid of turning the results over to someone. And I don't blame them! No one wants to admit wrong doing, regardless of the consequences.
The entire situation can be a bit tricky, but there are some ways to be protected in this process while still experiencing the benefit environmental audits can bring.
Okay, here’s our disclaimer. We’re not lawyers, and are not offering you legal advice in this article. Check with legal counsel before doing anything that might put you in jeopardy, so that you know what you’re getting yourself into and can make informed decisions.
Do I have to report the results of my environmental audit?
Let’s consider three scenarios:
A Facility with a Spill or Release - A facility finds out they aren’t in compliance one way or the other, or discover that their activities have resulted in the release of a hazardous material. In this case, the facility has a problem, and should certainly consult legal counsel and an environmental consultant. Non-compliance has to be addressed and a report-able release has to be reported. In both cases, you have an obligation to address the situation, and you may suffer consequences including regulatory enforcement action and fines depending on the underlying causes of the matter. Not the greatest option, but still better than doing nothing. So in this scenario, yes, if you started an audit and discovered a spill or release, you would have to report the results of the audit.
A Facility with No Spills - An industrial facility hires an environmental consultant to conduct a comprehensive audit, and during the audit some regulatory deficiency or environmental release is found. Same reporting obligations pertain. But if the discovery was made under an audit, you can usually get some form of immunity under your state’s “audit immunity” program or the USEPA’s Audit Policy, provided certain provisions are met. While this won’t completely let you off the hook, it usually offers a lot of protection if you found the issues, self-reported them, and proactively take steps to address the situation. It's a pretty good option, and one which we use regularly. In this case you're reporting on some aspects of the results.
A Facility Who Hires an Attorney - You can utilize a concept known as “attorney-client privilege”. The layman’s version is this: what is discussed between an attorney and their client is privileged information. Say an attorney hires an environmental consultant to conduct an audit. The environmental consultant reports back to the attorney and the attorney now can discuss the findings with the facility under their attorney-client privilege, and everyone’s findings are protected. This can buy some breathing room to develop a course of action, before “going public” by reporting the issues and taking care of them. You also have the benefit of legal counsel and a good environmental consultant should the results become a serious legal issue or penalty situation. Note that in this circumstance, you can still use audit immunity if you choose, provided you meet the requirements and provisions of the immunity program (which often include time constraints on reporting after date of discovery). We also do this a lot with attorneys, and this clearly is your best choice. An attorney could tell you better, but in this scenario you may not have to necessarily have to report the findings.
Reporting your Environmental Audit Findings
Given the possibility of fines, penalties, or shutting your facility down due to being out of compliance, I always recommend facilities look into audits. You may have nothing to report. You might be able to just "start" being in compliance by following the rules.
However if your facility has had a release or accident, which could have caused a threat to the environment or human health or safety, then an audit is probably going to be a requirement by the regulatory agency that's going to enforce regulations. In this case, you would most likely need to submit your findings to the applicable agencies.