Page 1 of 13

MEMORANDUM

To: Docket EPA-HQ-OAR-2014-0451 

From: Tavara Culpepper, U.S. EPA, Air Branch 

Monitoring, Assistance, and Media Programs Division 

 Office of Compliance 

 Office of Enforcement and Compliance Assurance 

Date: July 2015 

Subject: Using Third-Party Audits to Improve Compliance

Background 

In developing the third-party auditing approach presented in the proposed Emission Guidelines 

and Compliance Times for Municipal Solid Waste Landfills (proposed landfills EG), EPA’s 

intent is for the third-party auditing to reduce burden on regulators, improve consistency and 

prevent noncompliance. Historically, monitoring and reporting has been designed to educate 

regulated entities on applicable regulatory requirements, allow regulators and facilities to detect 

and correct violations, and provide regulators with compliance status information and evidence 

to bring enforcement actions and evaluate program outcomes.

1

 Today, monitoring and reporting 

requirements are increasingly being designed not just to identify noncompliance after-the-fact 

but also to drive compliance proactively by generating information regulated entities can use to 

identify and address deficiencies before they become violations. The objective is to provide 

regulated entities with information they can use to prevent or fix deficiencies early, before they 

become serious problems that must be addressed by enforcement actions or, worse, catastrophic 

events. The third-party auditing approach herein thus would provide valuable benefits to 

regulated entities, regulators, and the public, alike. 

In addition to employing monitoring (including third-party auditing) creatively in rules to drive 

compliance and prevent accidents proactively, EPA is using electronic reporting for the 

exchange of information. EPA is also interested in designing monitoring and reporting 

provisions that function synergistically with disclosure and transparency approaches to further 

drive high compliance. This includes new approaches to requiring enhanced compliance 

certifications that are publicly accessible on the internet. The proposed landfills EG seeks 

comments on all aspects of the potential usefulness and design of these types of approaches for 

third-party auditing approaches in the emission guidelines.

 

1

International Network for Environmental Compliance and Enforcement (INECE); Principle 6: Monitoring 

Compliance http://www.inece.org/princips/ch6.pdf INECE is a wonderful resource, generally, for information on 

compliance monitoring and reporting. http://inece.org/?s=monitoring+and+reporting&x=0&y=0
Page 2 of 13

Why EPA Believes Independent Third-Party Audits Can Improve Compliance 

EPA believes a robust independent third-part audit program focusing on the review and approval 

of the design plans by competent and independent third-parties could reduce burdens, ensure 

consistency, and improve compliance. In the proposed landfills EG, EPA requests comment on 

establishing a Third-Party Design Plan Certification Program to replace the current approach that 

requires State review and approval of site-specific design plans and design plan revisions. Some 

criteria for auditor competence, independence, reporting, and oversight requirements provisions 

might include the following: 

• engage a third-party inspection team (team) and submit their members’ resumes and 

qualifications to EPA; 

• team shall have at least one person with landfill industry expertise acceptable to EPA, 

one expert in environmental compliance auditing, and one expert in chemical process 

safety management; 

• no team member may have previously performed work for the respondents; 

• no team member shall be allowed to work for the respondents or any of respondents’ 

officers for five years after the inspections are complete; 

• once the team gives the respondents notice of the first upcoming inspection, the team 

may no longer communicate with its respondents unless EPA is copied on the 

communication (communications during on-site inspections are excepted); 

• follow-up inspections shall be unannounced with no notice to respondents but advance 

notice to EPA; 

• the respondents shall have no control over the timing of any of the follow-up inspections; 

• EPA or the delegated authority shall have the right to accompany the team on any 

inspection; 

• within 15 days of each inspection, the team must simultaneously submit to EPA and the 

respondents an inspection report, photographs, and digital video of the inspection; 

• the respondents shall not have the opportunity to review any draft or final inspection 

report before its submittal. 

EPA developed the above provisions based on the theoretical and empirical research for best 

practices for independent third-party audits. 

 

Third-Party Program Benefits and Risks 

Regulatory third-party auditing to complement or replace some self-auditing or government 

inspections has the potential to enhance accountability, improve compliance, and produce more 

and better compliance data but only if it is structured to ensure auditors are competent and 

independent. The Administrative Conference of the United States (ACUS), in its 

Recommendation on Agency Use of Third-Party Programs to Assess Regulatory Compliance 

(December 6, 2012), found that “[s]everal broad reasons support the growing use of third-party 

programs in federal regulation. In many areas, federal regulatory agencies are faced with 

assuring the compliance of an increasing number of entities and products without a 

corresponding growth in agency resources. Third-party programs may leverage private resources 

and expertise in ways that make regulation more effective and less costly. In comparison with 

other regulatory approaches, third-party programs may also enable more frequent compliance 
Page 3 of 13

assessment and more complete and reliable compliance data.”2 But to be effective and efficient, 

third-party programs must be well designed and implemented.3

According to the Center for Chemical Process Safety (CCPS), ‘‘Third-party auditors (typically, 

consulting companies who can provide experienced auditors) potentially provide the highest 

degree of objectivity.’’4 There are industry standards which recommend third-party audits for 

some types of operations, such as the American Petroleum Institute (API) Recommended 

Practice 751, Safe Operation of Hydrofluoric Acid Alkylation Units. In addition, some industry 

groups require certain types of third-party audits for their members, such as the Synthetic 

Organic Chemical Manufacturers Association, and the Center for Offshore Safety. Relying on 

third-party verification in lieu of, or to complement, government inspections can thus “enable... 

regulatory agencies to focus their attention on a relatively small number of accredited verifiers 

rather than the large universe of regulated entities”5 but does not eliminate the need for continued 

government oversight of the parties.6

Definition and Characteristics of True Independent Third-Party Compliance Verification 

Third-party compliance verification, which includes third-party auditing, occurs when an 

independent third-party verifies to a regulator that a regulated entity is meeting or conforming to 

one or more compliance obligations. In the literature and regulations, the terms “verifier” (or 

“verification”), “certifier” (or “certification”), and/or “auditor” (or “auditing”) are all used to 

refer to third parties performing these functions. In the proposed landfills EG, consistent with the 

regulatory focus on auditing, the third-party program is referred to as auditing. 

A “third party” is a private auditor or inspector, external to the facility. “Third party” excludes 

the regulated entity which is the first party and excludes second parties the regulated entities 

already have a relationship with, such as a customer, supplier, consultant, or purchaser of the 

facility’s goods or services.7 Independent third-party programs should not be confused with a

second party program in which a regulated source employs a contractor or consultant, even 

when the contractor is a separate legal entity from the regulated facility and highly qualified. If a 

contractor reports to a facility directly, has other non-audit relationships with the facility, and the 

facility has the opportunity to provide input to the contractor for the audit report and shape its 

final form and content, this is not an independent third-party program. EPA requests comment on 

whether, why, and how the Agency should approach designing the auditing program for the 

emission guidelines to be a true, independent, third-party auditing programs and not merely a 

form of enhanced self or second party auditing with contractor assistance. 

 

2 Administrative Conference of the United States (ACUS); Administrative Conference Recommendation 2012-7 

Agency Use of Third-Party Programs to Assess Regulatory Compliance (Adopted December 6, 2012) at 3.

3

Id. at 3-4.

4 Guidelines for Risk Based Process Safety, CCPS. http://www.aiche.org/ccps. ?

5

See Lederman, supra note 88, at 1739-43 (citing Neil A. Gunningham, Towards Effective and Efficient 

Enforcement of Occupational Health and Safety Regulation: Two Paths to Enlightenment, 19 COMP. LAB. L. &

POL’Y J. 547, 565 (1998)).

6

 McAllister, supra note 29, at 46.

7

Id. at 1.
Page 4 of 13

The third parties must be qualified to perform their work and the determination that a third party 

is so qualified is referred to as “accreditation,” i.e., the process of providing credentials. The 

entity performing the accreditation may be the regulator itself. It may also be a governmentapproved, third-party “accreditation body.”8

 The regulator retains the ultimate responsibility to 

monitor, determine, and enforce compliance but, as a practical matter, gives significant weight to 

the third-party auditing of compliance provided in the context of a regulatory program with 

effective standards, procedures, and oversight.9 In practice, the third parties may also gather 

relevant compliance data, review and attest to it, and/or concur on reports, applications, or selfcertifications from regulated entities. 

Examples of Independent Third-Party Programs in Other Rules 

Third-party audits are required by other federal programs to ensure safe operations, as well as by 

EPA, when appropriate, in specific rules. Examples appear below. For additional descriptions of 

more third-party regulatory programs in Food and Drug Administration (FDA), Consumer 

Product Safety Commission (CPSC), and Federal Communication Commission (FCC) rules, see 

the ACUS Third-Party Programs Final Report (October 22, 2012).10

The Bureau of Safety and Environmental Enforcement (BSEE) promulgated revisions to their 

Safety and Environmental Management Systems (SEMS II) requirements (78 FR 20423; April 5, 

2013) to help ensure the safe operations of their regulated facilities. BSEE’s Safety and 

Environmental Management Systems (SEMS) standard, 30 CFR 250, Subpart S, requires audits 

conducted by an independent third-party, subject to approval by BSEE, or by designated and 

qualified personnel if the employer implements procedures to avoid conflicts of interest. BSEE’s 

SEMS II revisions to the standard require that, by June 4, 2015, the team lead for compliance 

audits must be independent and represent an accredited audit service provider. In the preamble to 

its SEMS II final rule, BSEE discussed its third-party-auditing requirements as follows: 

“Consistent audits performed by well trained and experienced auditors are critical to ensuring 

that SEMS programs are successfully implemented and maintained on the OCS. As a result, we 

are adopting industry best practices related to SEMS audits and auditor qualifications. Industry is 

already voluntarily adopting these practices in many deepwater operations. We believe that the 

application of these requirements to all OCS operations will result in more robust and consistent 

SEMS audits.” (78 FR 20430; 04/05/2013.) 

Third-party audits or other forms of compliance verification are also required by a variety of 

final or proposed EPA programs to promote compliance with regulatory standards. Examples of 

proposed or final federal environmental regulatory programs with built-in third-party verification 

include the EPA wood heaters rule: 

 

8

Id. at 2-3.

9

 McAllister, supra note 29, at 5-6. See also ACUS, supra. n. 2, at 3: “Agencies that establish third-party programs 

generally cannot or do not delegate their regulatory authority to conformity assessment bodies. Rather, agencies 

authorize conformity assessment bodies to perform certain technical tasks to assess conformity, and regulatory

agencies rely on these assessments in their own enforcement of regulatory requirements.”

10 LESLIE K. MCALLISTER, THIRD PARTY PROGRAMS FINAL REPORT (2012), available at

http://www.acus.gov/report/third-party-programs-final-report.
Page 5 of 13

• EPA wood heaters rule: Residential wood heaters (which include stoves) contribute 

significantly to particulate air pollution. Wood stove model lines that are in compliance 

with the wood stoves rule are referred to as EPA-certified wood stoves. EPA's 

certification process requires manufacturers to verify that each of their wood stove model 

lines meet a specific particulate emission limit by undergoing emission testing at an EPAaccredited laboratory.11

Third-party verification and certification approaches are employed today in a variety of state 

regulatory settings. Examples include: 

• State CAA Title II vehicle inspection, maintenance, and emissions programs: Many states 

operate decentralized vehicle emissions programs with third-party verification, e.g., 

Missouri’s system which is structured to avoid fraud by connecting the emissions 

analysis systems to the internet to provide direct feedback with cameras to photograph 

license plates, VINs, and odometers, and a fingerprint scan system to limit use to verified 

personnel.12 

• California mandatory greenhouse gas (GHG) reporting programs: California 

requires major source industrial facilities, operators of petroleum and natural gas 

systems, and others to report their GHG emissions. The reports must be submitted via 

the Cal e-GGRT electronic reporting system. Reporting entities are required to have 

their GHG emissions data reports verified each year by a third-party verification body 

accredited by the California Air Resources Board (CARB).13 The following are some 

of the CARB’s requirements for becoming an accredited verifier/auditor: 

1. Minimal education requirement that includes a bachelor’s degree in science, 

technology, business, statistics, mathematics, environmental policy, economics, or 

financial planning or sufficient relevant experience.14 

2. The verifier/auditor must have a minimum of two years professional work 

experience in emissions data management, emissions technology, emissions filed 

enforcement, or other technical skills that necessary to conduct verification.15 

3. The verifier/auditor must complete a verification training course and receive a 

passing score on the exit exam.16

The CARB’s requirements for firms that wish to be accredited as verifiers include: 

1. The firm must have at least 5 full time staff including at least two lead verifiers 

(Auditors qualify as lead verifiers if they have met the basic requirements listed 

 

11 EPA, Wood Heater Compliance Monitoring Program, 

https://www.federalregister.gov/articles/2015/03/16/2015-03733/standards-of-performance-for-new-residential-wood-heaters-new-residentialhydronic-heaters-and

12 See MO. DEP’T OF NAT. RES. AND MO. STATE HIGHWAY PATROL, FIRST ANNUAL OVERSIGHT REPORT OF THE 

DECENTRALIZED GATEWAY VEHICLE INSPECTION PROGRAM (2008), available at 

http://www.dnr.mo.gov/gatewayvip/docs/enforcementrpt.pdf. 

13 Supra, note 103. 

14 McAllister, at 49 (referencing Cal. Code of Regs. Tit. 17, § 95132(b)(3)(A) (2010)). 

15 McAllister, at 49 (referencing Cal. Code of Regs. tit. 17 § 95132(b)(3)(B) (2010). 

16 Cal. Code of Regs. tit. 17 § 95132(b)(4) (2010). 
Page 6 of 13

above and have also worked as a lead verifier in another GHG emissions reporting 

program, such as California Climate Action Registry, or they have equivalent 

experience).17

2. The firm must have at least $1 Million in liability insurance, policies to prevent 

conflicts of interest, and plans to support verification-related staff technical 

training.18

• Massachusetts Underground Storage Tank (UST) third-party inspection program: The 

owners/operators of most underground storage tanks in Massachusetts are required to 

have their USTs inspected by third-party inspectors every three years. The third-party 

inspectors are hired by the tank owners and operators but report to the Massachusetts 

Department of Environmental Protection (MassDEP). The third parties conduct and 

document detailed inspections of USTs and piping systems, review facility record 

keeping to ensure it meets UST program requirements, and submit reports on their 

findings electronically to MassDEP.19 

Scope of the Third-Party Approach in the Proposed Landfills EG 

The EPA is also seeking comment on the possibility of establishing a third-party design plan 

certification program. The third-party program would supplement or replace the current approach 

of requiring the EPA or state review and approval of site-specific design plans and plan revisions 

with a program by which independent third parties would review the design plans, determine 

whether they conform to applicable regulatory criteria, and report their findings to the approved 

state programs or the EPA (for states without approved programs). The program would be 

designed to ensure that the third-party reviewers are competent, independent, and accredited, 

apply clear and objective criteria to their design plan reviews, and report appropriate information 

to regulators. Additionally, there would need to be mechanisms to ensure regular and effective 

oversight of third-party reviewers by the EPA and/or states that may include public disclosure of 

information concerning the third parties and their performance and determinations. Utilizing a 

third-party certification program could help to standardize and expedite design plan reviews, and 

reduce the burden on state regulators. The EPA is considering a broad range of possible design 

features for such a program. 

For purposes of this approach, independent third party is defined in the proposed landfills EG as 

any person or persons not employed by the regulated stationary source and knowledgeable of the 

process being audited and proper auditing techniques. Also under the proposed landfills EG, an 

audit conducted by a third-party auditor, even if that auditor is an attorney, cannot be claimed as 

confidential or as a privileged attorney work product or attorney-client communication. 

The approach in the proposed landfills EG establishes a framework for an independent thirdparty auditing program. EPA acknowledges, however, that various aspects of the approach are 

 

17 Cal. Code of Regs. tit. 17 § 95132(b)(1)(describing the firm requirement of having a lead verifier); Cal. Code of 

Regs. tit. 17 § 95132(b)(2) (2010)(describing the lead verifier requirements). 

18 Cal. Code of Regs. tit. 17 § 95132(b)(1).

19 MassDEP, Third-Party Underground Storage Tank (UST) Inspection Program, 

http://www.mass.gov/eea/agencies/massdep/toxics/ust/third-party-ust-inspection-program.html. 
Page 7 of 13

presented generally and will require fleshing out in the final rule. EPA is also considering 

alternative options and approaches to those presented expressly today. As discussed herein, EPA 

seeks comment concerning enhancing this text as described in this section. The remainder of this 

section provides further notice of the alternative approaches EPA is considering to prompt 

focused comments as to the approaches’ benefits, costs, and preferred design features. 

 

Auditor Competence and Independence 

Based on review of relevant literature, EPA believes the most critical consideration in designing 

a successful third-party auditing program are building in provisions and procedures for ensuring 

auditors are competent and independent. Noting the many potential benefits of robust third-party 

verification programs in rules, a leading expert and author on auditor independence found the 

following: 

“[C]autionary tales abound. Requiring annual reports that must be certified by independent 

accountants, financial regulation has relied extensively on a system much like third-party 

verification. Hired by the companies they audit, auditors have sometimes lacked 

independence and contributed to such financial disasters as the savings and loan crisis of the 

1990s and the collapse of Enron in the early 2000s.” (footnotes omitted)20 

“The same issues of auditor and certifier independence can be expected to appear in systems 

of third-party verification. Verifiers, like financial auditors, have pecuniary interests and 

unconscious biases that make them favor their clients. Also, the verifier has two masters with 

different interests. The regulated entity wants the verifier to confirm and approve the data it 

puts forward to show compliance. The regulator wants the verifier to carefully and 

objectively examine the data. Verifiers, too, might be tempted to help clients engage in 

creative compliance. And unless prohibited, verifiers would likely seek non-verification work 

from their verification clients that may result in conflicts of interest.”21

The theoretical and anecdotal literature of how to design independent third-party programs has 

now been supplemented and supported by empirical studies published in peer reviewed journals. 

The empirical research examples follow. 

In the first study, a randomized control design field experiment in the State of Gujarat in India 

revealed major weaknesses in the typical existing third-party regulatory audit system and the 

potential for a series of market-based alterations to dramatically improve auditor accuracy.22

India, Gujarat Pollution Control Board regulates more than 20,000 industrial plants. From the 

universe of audit-eligible plants located in two populous and heavily polluted industrial regions, 

the researchers identified a study sample of 473 randomly-selected plants, stratified by region. 

Half of the plants were randomly assigned into a control group. The other half of the plants, also 

 

20 Id. at 3. 

21 Id. at 39-40. 

22 Esther Duflo et al., Truth-Telling By Third-Party Auditors And The Response of Polluting Firms: Experimental 

Evidence From India, 128 Q. J. OF ECON. 4 at 1499-1545 (2013). 
Page 8 of 13

randomly assigned, were informed by the State of changes to their audit regulation that included 

the following: 

• plants would be randomly assigned auditors they were required to use (i.e., they could no 

longer chose their own auditors); 

• auditors would be paid from a central pool rather than by the plant for which they 

worked; 

• auditor fees were set in advance at a flat rate (high enough to cover pollution 

measurement and give the auditor a modest profit); 

• a random sample of each auditor’s pollution readings would be verified with follow-up 

visits to the audited plants by an independent technical agency; 

• in year two of the experiment, the third-party auditors were informed that their pay would 

be linked to their reporting accuracy as measured by the technical agency’s follow-up 

visits. 

The results of the experiment included several dramatic findings. Under the status quo system, 

the third-party auditors systematically reported false pollution levels just below the applicable 

regulatory standard (also known as strategic misreporting). The experimental changes, however, 

significantly improved the truthfulness of the third-party auditors’ reports. The treatments caused 

the auditors to become more truthful. This occurred even for auditors operating in both markets, 

i.e., auditors auditing firms in both the control and treatment groups. And extremely importantly, 

once the plants understood that their auditors would henceforth be reporting more accurately to 

the State, they reduced their pollution emissions. This study’s findings thus reinforce the 

importance and impact of including features to promote competent and independent reporting in 

third-party regulatory programs. 

Some evidence suggests that the majority of some types of financial audits are flawed due in part 

to insufficient auditor competence/independence and/or public transparency. Third-party 

auditing is a linchpin of financial reporting. But when the Public Company Accounting 

Oversight Board released its third annual report on audits of brokerage firms, it found, consistent 

with findings in its prior reports that only 13 percent of audits had been done correctly. In 

response, the Board reportedly has tried or will try to increase accuracy through enhanced 

transparency by: 1) publicly identifying top auditing firms that fail to change the practices that 

the board found inadequate; and 2) considering a rule to require auditing firms to identify the 

partner in charge of each audit. These kinds of structural changes are intended to reduce the 

financial incentive third-party verifiers have to produce findings that favor the company hiring 

them. 

In a leading law review article on Regulation by Third-Party Verification, the author draws from 

examples of third-party auditors in the finance industry to provide these recommendations for 

examples of rule provisions to ensure auditor competence, independence, and objectivity: 

“In the context of regulatory compliance, the competence of third-party verifiers should be at 

least comparable to the competence of regulatory agency inspectors. Third-party verifiers 

should possess both technical expertise and professional judgment.” (footnote omitted)23

 

23 McCallister, supra. n. __.
Page 9 of 13

1. “Auditing/Third parties should be prohibited from providing any additional services 

outside of the auditing process to the entity to be audited. 

2. Auditors/Third parties should have fixed and limited contracts that cannot be terminated, 

and the contractual provisions cannot be changed. 

3. Impose mandatory rotation of auditors/third parties so that the regulated entity would be 

prohibited from rehiring the same auditor/third party at the end of the contract. 

4. Bar auditors/third parties from taking jobs with regulated entities they have audited for at 

least five years. 

5. Strong government oversight that issue accreditation to the auditor/third party and has the 

power to disaccredit an auditor/third party that has not shown objectivity in the audit 

process. 

6. Ensure transparency in the third-party program allowing the public to access reports 

produced by the auditor/third party.”24

In the rule for EPA’s Wood Heater Compliance Monitoring Program (discussed previously), in 

section III.D of the preamble to the proposed rule, EPA described the proposed approach for 

third-party certification program by an ISO-accredited certifying body and testing by ISOaccredited testing laboratories. This approach requires manufacturers to use third-party, 

independent ISO-accredited and EPA-approved test labs and certifying entities to demonstrate 

compliance with a representative appliance for a model line. Under the rule, a third-party 

certifier (sometimes called third-party certifying body or product certifying body) means an 

independent third party that is accredited under ISO-IEC Standards 17025 and 17065 to perform 

certifications, inspections and audits by an accreditation body. The accreditation body must be a 

full member signatory to the International Laboratory Accreditation Cooperation Mutual 

Recognition Arrangement and approved by the EPA for conducting certifications, inspections 

and audits under this subpart. 

The Food and Drug Administration (FDA) administers a third-party audit program under the 

Food Safety Modernization Act of 2011 (FSMA)25 The FDA has issued the following 

regulations to ensure the independence of third-party auditors: 

1. Third-party auditors may not perform a regulatory audit of an entity for which it has 

performed a consultative audit or a regulatory audit in the previous 13 months.26

2. Third-party auditors cannot be owned or operated by the same persons as the regulated 

entities the auditors must certify, must have procedures in place to protect against 

financial conflicts of interest, and must annually disclose to FDA how they have 

complied with conflict of interest rules and procedures.27

3. Third-party auditors cannot own or operate the regulated entity that they certify, must 

have procedures in place to protect against financial conflicts of interest, and must 

annually disclose to FDA.28

 

24 Id. 

25 Lesley K. McAllister, Third Party Programs to Assess Regulatory Compliance, Admin. Conference of the United

States 10 (2012)(referencing the FSMA, Pub. L. No. 111-353, 124 Stat. 3885 (2011)). 

26 21 U.S.C. § 384d(c)(4)(C)(i). 

27 § 384d(c)(5)(A). 

28 § 384d(c)(5)(B). 
Page 10 of 13

4. Audits performed by third-party auditors must be unannounced and shall place limits on 

the extent to which there may be financial affiliations between auditors and audit agents 

and the regulated entities they certify.29 

5. The FDA also must promulgate regulations that establish timing, disclosure, fee payment, 

and other rules that decrease the potential for conflicts of interest.30 

EPA seeks comment on the potential necessity, applicability, and suitability, in the final rule, of 

each of above provisions and approaches for enhancing auditor competence. 

Audit Standards and Protocols

In its Administrative Conference Recommendation on Agency Use of Third-Party Programs to 

Assess Regulatory Compliance, the ACUS found: 

“Use of Existing Conformity Assessment Standards. The agency should consider relying on 

existing conformity assessment standards, particularly international standards that set forth 

requirements for conformity assessment and accreditation bodies. Incorporating existing 

standards may reduce costs for the agency and for the regulated entities.”31

The ACUS further found: 

“When an agency incorporates existing standards into its requirements for third parties, it can 

supplement those standards with program-specific rules. An agency may require, for 

example, that in addition to being accredited to an international standard, a conformity 

assessment body must satisfy accreditation rules specific to the third-party program ...”32

EPA seeks comment on what, if any, consensus standards landfill accrediting bodies – or EPA, if 

the emission guidelines established EPA as the accreditor – should use in assessing whether 

auditor candidates quality for accreditation. An example could be the International Organization 

for Standardization ISO/IEC 17020:1998(E), General Criteria for the Operation of Various 

Types of Bodies Performing Inspections (First Edition). EPA also seeks comment as to relevant 

and applicable consensus standards and protocols that might apply to the audits and be built 

and/or incorporated by reference into the rules. This includes potentially relevant and applicable 

American National Standards Institute (ANSI), ASTM International (ASTM), European 

Committee for Standardization (CEM), International Organization for Standardization (ISO), and 

National Institute of Standards and Technology (NIST) standards. EPA further seeks comment 

on whether the final rule should include additional EPA-specific standards to complement the 

requirements in applicable consensus standards. 

Public Disclosure/Transparency 

 

29 § 384d(c)(5)(C)(i) and (iii). 

30 § 384d(c)(5)(C)(ii). 

31 ACUS, supra at 8. 

32 Id. 
Page 11 of 13

In its Administrative Conference Recommendation on Agency Use of Third-Party Programs to 

Assess Regulatory Compliance, the ACUS found, concerning government and public access to 

third-party program information: 

“Access to Information. The agency should ensure that both the government and the public 

will have appropriate access to information about program operations. An agency’s 

development of third-party program rules and guidance should include notice and an 

opportunity for public participation. Also, the agency should provide information to the 

public about the roles and identities of the third parties associated with a regulatory program. 

Finally, the agency should establish reporting rules that require third parties to provide 

information to the agency based on the following considerations: 

(a) The reporting rules should facilitate transparency. Information about the compliance of 

regulated entities should be available from the agency to the public, comparable to what 

would be available in the absence of a third-party program. Agencies may also be able to 

provide additional compliance information to the public that was not available before the 

third-party program; 

ooo 

(d) The agency might require conformity assessment bodies and/or regulated entities to 

report electronically, which may facilitate the provision of information to the public.”33

EPA requests comment on each of the above third-party program design features in connection 

with today’s third-party audit program for subject landfills. 

EPA is also considering the approach it should take, in the emission guidelines, to balancing 

public access to third-party auditing program information and audits and the need to protect 

Confidential Business Information (CBI) or potential national security-related information. To 

balance these potentially competing interests, EPA is reviewing a variety of approaches that may 

include limiting public access to portions of the audits and/or posting public audit grades or 

scores to inform the public of the auditing outcomes, generally, without compromising 

confidential or sensitive information. This includes potentially developing publicizing an audit 

“grading system.” EPA seeks comment generally on the issue of releasing versus protecting such 

information and how to balance these interests in the emission guidelines. 

Regulator Oversight 

In its Administrative Conference Recommendation on Agency Use of Third-Party Programs to 

Assess Regulatory Compliance, the ACUS found regulatory oversight of third-party programs: 

“(b) The reporting rules should facilitate appropriate agency oversight. For example, 

conformity assessment bodies can be required to report to the agency potential conflicts of 

interest before performing a conformity assessment, or provide the dates of their assessment 

activities so that the agency can conduct site visits; 

ooo 

 

33 See n. 2, supra., at 9.
Page 12 of 13

Agency Oversight. The agency has a duty to exercise oversight to ensure that the third-party 

program is fulfilling its regulatory purpose. An agency should generally set forth how it 

intends to conduct such oversight. For example, it may annually audit a certain number of 

accreditations or conformity assessments, or carry out a market surveillance program to test 

regulated products off-the-shelf. In exercising oversight, the agency should also take into 

account the following considerations: 

(a) Beyond conducting direct oversight, an agency can require third parties to conduct 

additional assessment activities that provide further information to the agency about program 

operation. For example, an agency may require accreditation bodies annually to audit a 

certain number of conformity assessments, or it may require conformity assessment bodies to 

conduct particular types of surveillance on products they assess; 

(b) The agency should establish procedures for receiving and responding to public 

complaints regarding potential noncompliance or other aspects of program operation. The 

agency could, for example, require a third party that has assessed the conformity of a 

regulated product or entity to investigate a complaint of noncompliance. In any event, the 

agency should ensure that complaints are resolved in an appropriate and timely manner; and 

(c) The agency should make clear the possible adverse actions that it may take against third 

parties that do not comply with program rules. A key adverse action is removing third parties 

from the program. Third parties may be removed temporarily through a suspension of 

accreditation, or permanently through a withdrawal of accreditation.”34

EPA requests comment on each of the above third-party program design features in connection 

with today’s third-party audit program for landfills. 

Facility and Third-Party Auditor Certification Statements

EPA experience shows that requiring a responsible corporate or third-party official to attest to 

self-monitoring, reporting, and third-party auditing can help ensure appropriate officials are 

personally familiar with the reported information and reminds them of the penalties associated 

with knowingly submitting false information. For example, consider the self-certification 

language in an authorized state’s RCRA Subtitle C Site Identification Form used by authorized 

states: 

“I certify under penalty of law that this document and all attachments were prepared under 

my direction or supervision in accordance with a system designed to assure that qualified 

personnel properly gather and evaluate the information submitted. Based on my inquiry of 

the person or persons who manage the system, or those persons directly responsible for 

gathering the information, the information submitted is to the best of my knowledge and 

belief, true, accurate, and complete. I am aware that there are significant penalties for 

 

34 ACUS, supra at 9-10. 
Page 13 of 13

submitting false information, including the possibility of fines and imprisonment for knowing 

violations.”35 

EPA intends to require corresponding language for the third-party audit reports under the 

emission guidelines and requests comment on its design. 

 

35 W. Va. Dep’t of Envt’l Prot., U.S. EPA RCRA Subtitle C Site Identification Form, 4, available at

http://www.dep.wv.gov/WWE/Programs/hazwaste/Documents/8700-12Form.pdf.