How Voluntary Disclosure Works, What It Actually Requires, and When It's the Right Move for Your Facility
If an environmental audit turns up a violation, the instinct for a lot of facility managers is to sit on it. Nobody wants to hand a regulator a list of their own problems. But EPA actually has a formal program built around the opposite instinct: tell them yourself, on your terms, before they find it on theirs, and you're in a meaningfully better position. It's called the Audit Policy, and it's one of the more misunderstood tools in environmental compliance, partly because "self-reporting a violation" sounds like a bad idea until you understand what you actually get in return.
In this article, we'll break down what EPA's Audit Policy actually is, the conditions you have to meet to qualify for penalty relief, why not every audit finding belongs in this process, and why the agency in your day-to-day compliance life is probably your state, not EPA itself. If you're weighing whether an audit and possible self-disclosure make sense for your facility, reach out to RMA and we'll help you sort out where you actually stand.
Table of Contents
TL;DR
EPA's Audit Policy lets facilities self-report violations they find on their own in exchange for reduced (often eliminated) penalties, but only if you find it independently, disclose it in writing within 21 days, correct it within roughly 60 days, and it isn't a repeat problem or something that's already caused serious harm. Not every audit finding needs to go through this process. Plenty of issues are just fixed directly. And because many federal programs are delegated to state agencies, figuring out whether a violation is EPA's, your state's, or both is usually the first real question, which is why most facilities don't try to navigate this alone.
What Is EPA's Audit Policy?
EPA's Audit Policy, formally titled "Incentives for Self-Policing: Discovery, Disclosure, Correction and Prevention of Violations," is essentially a trade. If you find a violation at your facility on your own, and you tell EPA about it before the agency finds out independently, you end up in a much better position than if they'd caught it themselves. It's not amnesty. You're not walking away as if nothing happened. But it's real, meaningful leniency, and in a lot of cases it means a penalty that's dramatically smaller than what you'd otherwise face, sometimes reduced to nothing beyond correcting the problem.
The logic behind it isn't complicated. EPA has limited inspectors and limited time. A facility that's actively looking for its own problems, reporting them honestly, and fixing them is doing exactly what the agency wants every regulated facility to do. The Audit Policy rewards that behavior instead of treating every discovered violation the same, whether it came from a surprise inspection or a facility's own internal audit.
What Do You Have to Do to Qualify?
The Audit Policy isn't a blanket "tell us anything and you're fine" arrangement. There's a real set of conditions, and missing one doesn't necessarily disqualify you, but it does change how much relief you get.
First, you have to find the violation yourself, through a genuine audit or a documented compliance management effort, not because EPA or your state agency was already looking into it. Timing matters here. If an inspector is already on-site or an investigation is already underway, self-disclosure doesn't carry the same weight.
Second, disclosure has to be prompt. EPA generally wants written notice within 21 days of discovering the violation, submitted through the agency's online reporting system (eDisclosure). Waiting to see how things shake out, or trying to quietly fix it first and disclose later, works against you.
Third, you have to actually correct it, and EPA expects that correction on a defined timeline, usually within 60 days, though more complex fixes can sometimes get more time if you've explained why. Alongside the fix, EPA wants to see that you've put something in place to prevent it from happening again, not just patched the immediate problem.
Beyond those, a few disqualifying factors matter a lot. It can't be a repeat violation. If you've disclosed the same type of issue before, the Audit Policy generally won't cover it a second time. And there's a hard ceiling on severity. If a violation has already caused serious actual harm, or created imminent and substantial danger to people or the environment, this program isn't built to help with that. The Audit Policy exists for real, legitimate violations that need correcting, not for situations that have already crossed into a genuine emergency.
Meeting every condition gets you the most significant reduction available. Missing one or two doesn't necessarily knock you out of the program entirely. It just usually means a smaller reduction rather than the maximum benefit.
Does Every Audit Finding Need to Go Through the Audit Policy?
Not even close. This is one of the more common misunderstandings we run into. People assume that once an audit finds something, it has to be formally self-disclosed. In practice, a lot of what an audit turns up sits well below that threshold.
Say your permit was written before you added a new piece of equipment, and that equipment technically isn't accounted for in the current paperwork yet. That's a real gap, but it's the kind of thing that usually just gets corrected directly, the same way you'd handle a piece of routine facility maintenance. It doesn't need a formal disclosure process wrapped around it.
The Audit Policy really sits in the middle of the spectrum. It's built for violations that are real and worth taking seriously, where a facility genuinely benefits from the leniency it offers, but that haven't escalated into anything close to an emergency. Figuring out which category a given finding falls into, minor and correctable versus something that genuinely warrants self-disclosure, is exactly the kind of judgment call that benefits from experience, since treating every finding the same way (either ignoring all of them or formally disclosing all of them) is usually the wrong move in both directions.
EPA vs. Your State Agency: Who's Actually Enforcing You?
Here's something that trips people up constantly: this is called EPA's Audit Policy, but plenty of facilities go their entire operating history without EPA ever setting foot on-site. That's because EPA has delegated the day-to-day administration of many federal environmental programs to individual states. Your permits, your inspections, and your routine enforcement are often handled entirely at the state level, while EPA stays at the top providing oversight and retaining the authority to step in when it matters.
That distinction actually changes the first question you should be asking when an audit finds a violation. It's not "should we report this?" It's "whose rule did we actually violate?" Some requirements come straight from EPA. Others are federal programs your state administers on EPA's behalf, which usually means the state has its own version of a self-disclosure policy that may or may not mirror EPA's exactly. Still others are purely state requirements with no federal counterpart at all. And going a step further, some rules may be entirely at the local, city, township, or municipal level.
Depending on what the violation involves, the right path might be disclosing to EPA, disclosing to your state agency, disclosing to both, involving local agencies, or simply correcting the issue with no formal self-disclosure at all. Getting that wrong in either direction, over-disclosing something that didn't need it, or under-disclosing something that did, isn't a small mistake. It's exactly why most facilities don't try to sort this out entirely on their own.
How RMA Helps With Audits and Self-Disclosure Decisions
We've been conducting environmental audits and helping facilities weigh self-disclosure decisions since 1992, and this is genuinely one of the areas where an experienced set of eyes makes a real difference. We can conduct your audit, identify exactly which rules are actually in play, figure out whose jurisdiction each one falls under, whether that's EPA, your state, or both, and help you land on the right path forward. Sometimes that's a formal disclosure. Sometimes it's a straightforward fix with no disclosure needed at all. We'll tell you honestly which situation you're in.
If you want a real sense of what an audit costs before you commit to anything, our environmental audit pricing calculator asks a few quick questions about your facility and gives you an actual number instantly. No email required, no salesperson chasing you down afterward.
There's no pressure and no obligation here. If you're weighing an audit, or you've already got findings in hand and aren't sure what they mean for your facility, reach out to RMA. We'll help you figure out where you actually stand before you decide anything.
