Page 1 of 13



### MEMORANDUM

To: Docket EPA-HQ-OAR-2014-0451

From: Tavara Culpepper, U.S. EPA, Air Branch

Monitoring, Assistance, and Media Programs Division Office of Compliance Office of Enforcement and Compliance Assurance

Date: July 2015

Subject: Using Third-Party Audits to Improve Compliance

Background

In developing the third-party auditing approach presented in th e proposed Emission Guidelines and Compliance Times for Municipal Solid Waste Landfill s (proposed landfills EG), EPA’s intent is for the third-party auditing to reduce burden on re gulators, improve consistency and prevent noncompliance. Historically, monitoring and repor ting has been designed to educate regulated entities on applicable regulatory requirements, allow regulators and facilities to detect and correct violations, and provide regulators with complia nce status information and evidence to bring enforcement actions and evaluate program outcomes

. 1 Today, monitoring and reporting requirements are increasingly being designed not just to ide ntify noncompliance after-the-fact but also to drive compliance proactively by generating inf ormation regulated entities can use to identify and address deficiencies before they become viol ations. The objective is to provide regulated entities with information they can use to preve nt or fix deficiencies early, before they become serious problems that must be addressed by enforcemen t actions or, worse, catastrophic events. The third-party auditing approach herein thus would provi de valuable benefits to regulated entities, regulators, and the public, alike.

In addition to employing monitoring (including third-party auditi ng) creatively in rules to drive compliance and prevent accidents proactively, EPA is usi ng electronic reporting for the exchange of information. EPA is also interested in desig ning monitoring and reporting provisions that function synergistically with disclosur e and transparency approaches to further drive high compliance. This includes new approaches to requir ing enhanced compliance certifications that are publicly accessible on the inte rnet. The proposed landfills EG seeks comments on all aspects of the potential usefulness and de sign of these types of approaches for third-party auditing approaches in the emission guidelines.

1 International Network for Environmental Compliance and Enforcement ( INECE); Principle 6: Monitoring Compliance http://www.inece.org/princips/ch6.pdf INECE is a wonderful resource, generally, for information on compliance monitoring and reporting. http://inece.org/?s=monitoring+and+reporting&x=0&y=0Page 2 of 13

Why EPA Believes Independent Third-Party Audits Can Impr ove Compliance

EPA believes a robust independent third-part audit program fo cusing on the review and approval of the design plans by competent and independent third-parti es could reduce burdens, ensure consistency, and improve compliance. In the proposed lan dfills EG, EPA requests comment on establishing a Third-Party Design Plan Certification Pro gram to replace the current approach that requires State review and approval of site-specific design plans and design plan revisions. Some criteria for auditor competence, independence, reporting, an d oversight requirements provisions might include the following:

• engage a third-party inspection team (team) and submit th eir members’ resumes and qualifications to EPA;

• team shall have at least one person with landfill in dustry expertise acceptable to EPA, one expert in environmental compliance auditing, and one e xpert in chemical process safety management;

• no team member may have previously performed work for th e respondents;

• no team member shall be allowed to work for the responden ts or any of respondents’ officers for five years after the inspections are comp lete;

• once the team gives the respondents notice of the fir st upcoming inspection, the team may no longer communicate with its respondents unless EP A is copied on the communication (communications during on-site inspections ar e excepted);

• follow-up inspections shall be unannounced with no notice to respondents but advance notice to EPA;

• the respondents shall have no control over the timing o f any of the follow-up inspections;

• EPA or the delegated authority shall have the right to a ccompany the team on any inspection;

• within 15 days of each inspection, the team must simulta neously submit to EPA and the respondents an inspection report, photographs, and digital vi deo of the inspection;

• the respondents shall not have the opportunity to review any draft or final inspection report before its submittal.

EPA developed the above provisions based on the theoretica l and empirical research for best practices for independent third-party audits.

Third-Party Program Benefits and Risks

Regulatory third-party auditing to complement or replace s ome self-auditing or government inspections has the potential to enhance accountability, im prove compliance, and produce more and better compliance data but only if it is structured t o ensure auditors are competent and independent. The Administrative Conference of the United St ates (ACUS), in its Recommendation on Agency Use of Third-Party Programs to Assess Regulatory Compliance (December 6, 2012), found that “[s]everal broad reasons suppor t the growing use of third-party programs in federal regulation. In many areas, federal r egulatory agencies are faced with assuring the compliance of an increasing number of entitie s and products without a corresponding growth in agency resources. Third-party programs may leverage private resources and expertise in ways that make regulation more effecti ve and less costly. In comparison with other regulatory approaches, third-party programs may also en able more frequent compliancePage 3 of 13

assessment and more complete and reliable compliance da ta.” 2 But to be effective and efficient, third-party programs must be well designed and implemented. 3

According to the Center for Chemical Process Safety (CCPS), ‘‘Third-party auditors (typically, consulting companies who can provide experienced auditors) p otentially provide the highest degree of objectivity.’’ 4 There are industry standards which recommend third-party audits for some types of operations, such as the American Petrole um Institute (API) Recommended Practice 751, Safe Operation of Hydrofluoric Acid Alkylation Units. In addition, some industry groups require certain types of third-party audits for their members, such as the Synthetic Organic Chemical Manufacturers Association, and the Ce nter for Offshore Safety. Relying on third-party verification in lieu of, or to complement, gov ernment inspections can thus “enable... regulatory agencies to focus their attention on a relat ively small number of accredited verifiers rather than the large universe of regulated entities” 5 but does not eliminate the need for continued government oversight of the parties. 6

Definition and Characteristics of True Independent Third -Party Compliance Verification

Third-party compliance verification, which includes third-par ty auditing, occurs when an independent third-party verifies to a regulator that a regulat ed entity is meeting or conforming to one or more compliance obligations. In the literature and regulations, the terms “verifier” (or “verification”), “certifier” (or “certification”), and/or “auditor” (or “auditing”) are all used to refer to third parties performing these functions. In the pr oposed landfills EG, consistent with the regulatory focus on auditing, the third-party program is ref erred to as auditing.

A “third party” is a private auditor or inspector, external to the facility. “Third party” excludes the regulated entity which is the first party and excludes second parties the regulated entities already have a relationship with, such as a customer, s upplier, consultant, or purchaser of the facility’s goods or services. 7 Independent third-party programs should not be confused with a second party program in which a regulated source employs a contractor or cons ultant, even when the contractor is a separate legal entity from the regulated facility and highly qualified. If a contractor reports to a facility directly, has other non-audit relationships with the facility, and the facility has the opportunity to provide input to the contr actor for the audit report and shape its final form and content, this is not an independent third -party program. EPA requests comment on whether, why, and how the Agency should approach designing th e auditing program for the emission guidelines to be a true, independent, third-party aud iting programs and not merely a form of enhanced self or second party auditing with contr actor assistance.

2 Administrative Conference of the United States (ACUS ); Administrative Conference Recommendation 2012-7 Agency Use of Third-Party Programs to Assess Regulatory Co mpliance (Adopted December 6, 2012) at 3.

3 Id. at 3-4.

4 Guidelines for Risk Based Process Safety, CCPS. http://www.aiche.org/ccps . ?

5 See Lederman, supra note 88, at 1739-43 (citing Neil A. Gunningham, Towards Effective and Efficient
Enforcement of Occupational Health and Safety Regulation: Two Paths t o Enlightenment , 19 C OMP

. L AB

. L. &

P OL ’ Y J. 547, 565 (1998)).

6 McAllister, supra note 29, at 46.

7 Id. at 1.Page 4 of 13

The third parties must be qualified to perform their work and the determination that a third party is so qualified is referred to as “accreditation,” i.e. , the process of providing credentials. The entity performing the accreditation may be the regulato r itself. It may also be a governmentapproved, third-party “accreditation body.” 8 The regulator retains the ultimate responsibility to monitor, determine, and enforce compliance but, as a pract ical matter, gives significant weight to the third-party auditing of compliance provided in the context of a regulatory program with effective standards, procedures, and oversight. 9 In practice, the third parties may also gather relevant compliance data, review and attest to it, and/or concur on reports, applications, or selfcertifications from regulated entities.

Examples of Independent Third-Party Programs in Other Rules

Third-party audits are required by other federal programs to e nsure safe operations, as well as by EPA, when appropriate, in specific rules. Examples appear below. For additional descriptions of more third-party regulatory programs in Food and Drug Admini stration (FDA), Consumer Product Safety Commission (CPSC), and Federal Communicat ion Commission (FCC) rules, see

the ACUS Third-Party Programs Final Report (October 22, 2012). 10

The Bureau of Safety and Environmental Enforcement (BSEE) promulgated revisions to their Safety and Environmental Management Systems (SEMS II) re quirements (78 FR 20423; April 5, 2013) to help ensure the safe operations of their regulated f acilities. BSEE’s Safety and Environmental Management Systems (SEMS) standard, 30 CFR 250, Subpart S, requires audits conducted by an independent third-party, subject to approval by BS EE, or by designated and qualified personnel if the employer implements procedures t o avoid conflicts of interest. BSEE’s SEMS II revisions to the standard require that, by June 4, 2015, the team lead for compliance audits must be independent and represent an accredited audi t service provider. In the preamble to its SEMS II final rule, BSEE discussed its third-party-aud iting requirements as follows: “Consistent audits performed by well trained and experienc ed auditors are critical to ensuring that SEMS programs are successfully implemented and mai ntained on the OCS. As a result, we are adopting industry best practices related to SEMS audits an d auditor qualifications. Industry is already voluntarily adopting these practices in many dee pwater operations. We believe that the application of these requirements to all OCS operation s will result in more robust and consistent SEMS audits.” (78 FR 20430; 04/05/2013.)

Third-party audits or other forms of compliance verificati on are also required by a variety of final or proposed EPA programs to promote compliance wi th regulatory standards. Examples of proposed or final federal environmental regulatory programs wi th built-in third-party verification

include the EPA wood heaters rule:

8 Id. at 2-3.

9 McAllister, supra note 29, at 5-6. See also ACUS, supra. n. 2, at 3: “Agencies that establish third-par ty programs generally cannot or do not delegate their regulatory auth ority to conformity assessment bodies. Rather, agenci es authorize conformity assessment bodies to perform cert ain technical tasks to assess conformity, and regulatory agencies rely on these assessments in their own enfor cement of regulatory requirements.”

10 L ESLIE K. M C A LLISTER

, T HIRD P ARTY P ROGRAMS F INAL R EPORT (2012), available at

http://www.acus.gov/report/third-party-programs-fin al-report

.Page 5 of 13

• EPA wood heaters rule : Residential wood heaters (which include stoves) contri bute significantly to particulate air pollution. Wood stove mo del lines that are in compliance

with the wood stoves rule are referred to as EPA-certi fied wood stoves. EPA's certification process requires manufacturers to verify that each of their wood stove model lines meet a specific particulate emission limit by under going emission testing at an EPAaccredited laboratory. 11

Third-party verification and certification approaches are employed today in a variety of state regulatory settings. Examples include:

• State CAA Title II vehicle inspection, maintenance, and emissions programs : Many states operate decentralized vehicle emissions programs with thir d-party verification, e.g., Missouri’s system which is structured to avoid fraud by connec ting the emissions analysis systems to the internet to provide direct f eedback with cameras to photograph license plates, VINs, and odometers, and a fingerprint s can system to limit use to verified personnel. 12

• California mandatory greenhouse gas (GHG) reporting programs : California requires major source industrial facilities, operators of petroleum and natural gas systems, and others to report their GHG emissions. The reports must be submitted via the Cal e-GGRT electronic reporting system. Reporting en tities are required to have their GHG emissions data reports verified each year by a third-party verification body accredited by the California Air Resources Board (CARB). 13 The following are some of the CARB’s requirements for becoming an accredited v erifier/auditor:

1. Minimal education requirement that includes a bachelor’s degree in science, technology, business, statistics, mathematics, environm ental policy, economics, or financial planning or sufficient relevant experience. 14

2. The verifier/auditor must have a minimum of two years professional work experience in emissions data management, emissions techn ology, emissions filed enforcement, or other technical skills that necessary t o conduct verification. 15

3. The verifier/auditor must complete a verification tr aining course and receive a passing score on the exit exam. 16

The CARB’s requirements for firms that wish to be acc redited as verifiers include:

1. The firm must have at least 5 full time staff including at least two lead verifiers (Auditors qualify as lead verifiers if they have met th e basic requirements listed

11 EPA, Wood Heater Compliance Monitoring Program,
https://www.federalregister.gov/articles/2015/03/16 /2015-03733/standards-of-performance-for-new-reside ntial-wood-heaters-new-residentialhydronic-heaters-and

12 See M O

. D EP ’ T OF N AT

. R ES

. AND M O

. S TATE H IGHWAY P ATROL , F IRST A NNUAL O VERSIGHT R EPORT OF THE
D ECENTRALIZED G ATEWAY V EHICLE I NSPECTION P ROGRAM (2008), available at

http://www.dnr.mo.gov/gatewayvip/docs/enforcementrp t.pdf

. 13 Supra, note 103.

14 McAllister, at 49 (referencing Cal. Code of Regs. Tit . 17, § 95132(b)(3)(A) (2010)).

15 McAllister, at 49 (referencing Cal. Code of Regs. tit . 17 § 95132(b)(3)(B) (2010).

16 Cal. Code of Regs. tit. 17 § 95132(b)(4) (2010).Page 6 of 13 above and have also worked as a lead verifier in another GH G emissions reporting program, such as California Climate Action Registry, or they have equivalent experience). 17

2. The firm must have at least $1 Million in liability ins urance, policies to prevent conflicts of interest, and plans to support verification- related staff technical training. 18

• Massachusetts Underground Storage Tank (UST) third-party inspection program : The owners/operators of most underground storage tanks in Massac husetts are required to have their USTs inspected by third-party inspectors every th ree years. The third-party inspectors are hired by the tank owners and operators but re port to the Massachusetts Department of Environmental Protection (MassDEP). The th ird parties conduct and document detailed inspections of USTs and piping systems, re view facility record keeping to ensure it meets UST program requirements, and su bmit reports on their findings electronically to MassDEP. 19

Scope of the Third-Party Approach in the Proposed Landfills EG

The EPA is also seeking comment on the possibility of establishing a third-party design plan certification program. The third-party program would suppleme nt or replace the current approach of requiring the EPA or state review and approval of site -specific design plans and plan revisions with a program by which independent third parties would review the design plans, determine whether they conform to applicable regulatory criteria, a nd report their findings to the approved state programs or the EPA (for states without approved pr ograms). The program would be designed to ensure that the third-party reviewers are compe tent, independent, and accredited, apply clear and objective criteria to their design plan reviews, and report appropriate information to regulators. Additionally, there would need to be mechanis ms to ensure regular and effective oversight of third-party reviewers by the EPA and/or sta tes that may include public disclosure of information concerning the third parties and their perform ance and determinations. Utilizing a third-party certification program could help to standardize and expedite design plan reviews, and reduce the burden on state regulators. The EPA is consider ing a broad range of possible design features for such a program.

For purposes of this approach, independent third party is defi ned in the proposed landfills EG as any person or persons not employed by the regulated statio nary source and knowledgeable of the process being audited and proper auditing techniques. Also under t he proposed landfills EG, an audit conducted by a third-party auditor, even if that auditor is an attorney, cannot be claimed as confidential or as a privileged attorney work product or attor ney-client communication.

The approach in the proposed landfills EG establishes a framework for an independent thirdparty auditing program. EPA acknowledges, however, that va rious aspects of the approach are

17 Cal. Code of Regs. tit. 17 § 95132(b)(1)(describing the firm r equirement of having a lead verifier); Cal. Code of Regs. tit. 17 § 95132(b)(2) (2010)(describing the lead verifier r equirements).

18 Cal. Code of Regs. tit. 17 § 95132(b)(1).

19 MassDEP, Third-Party Underground Storage Tank (UST) I nspection Program, http://www.mass.gov/eea/agencies/massdep/toxics/ust/third-par ty-ust-inspection-program.html

.Page 7 of 13

presented generally and will require fleshing out in the fina l rule. EPA is also considering alternative options and approaches to those presented expr essly today. As discussed herein, EPA seeks comment concerning enhancing this text as described in this section. The remainder of this section provides further notice of the alternative approac hes EPA is considering to prompt focused comments as to the approaches’ benefits, costs, and preferred design features.

Auditor Competence and Independence

Based on review of relevant literature, EPA believes th e most critical consideration in designing a successful third-party auditing program are building in provis ions and procedures for ensuring auditors are competent and independent. Noting the many pote ntial benefits of robust third-party verification programs in rules, a leading expert and auth or on auditor independence found the following:

“[C]autionary tales abound. Requiring annual reports that must be certified by independent accountants, financial regulation has relied extensively on a system much like third-party verification. Hired by the companies they audit, auditors have sometimes lacked independence and contributed to such financial disasters as th e savings and loan crisis of the 1990s and the collapse of Enron in the early 2000s.” (footnotes omitted) 20

“The same issues of auditor and certifier independence can be expected to appear in systems of third-party verification. Verifiers, like financial audi tors, have pecuniary interests and

unconscious biases that make them favor their clients. A lso, the verifier has two masters with different interests. The regulated entity wants the ver ifier to confirm and approve the data it puts forward to show compliance. The regulator wants the verifier to carefully and objectively examine the data. Verifiers, too, might be t empted to help clients engage in creative compliance. And unless prohibited, verifiers woul d likely seek non-verification work from their verification clients that may result in conflicts of interest.” 21

The theoretical and anecdotal literature of how to desig n independent third-party programs has now been supplemented and supported by empirical studies publis hed in peer reviewed journals. The empirical research examples follow.

In the first study, a randomized control design field expe riment in the State of Gujarat in India revealed major weaknesses in the typical existing third-party regulatory audit system and the potential for a series of market-based alterations to dra matically improve auditor accuracy. 22 India, Gujarat Pollution Control Board regulates more t han 20,000 industrial plants. From the universe of audit-eligible plants located in two populous and heavily polluted industrial regions, the researchers identified a study sample of 473 randomly- selected plants, stratified by region. Half of the plants were randomly assigned into a cont rol group. The other half of the plants, also

20 Id. at 3.

21 Id . at 39-40.

22 Esther Duflo et al., Truth-Telling By Third-Party Auditors And The Response of Pollut ing Firms: Experimental
Evidence From India, 128 Q. J. OF E CON . 4 at 1499-1545 (2013).Page 8 of 13

randomly assigned, were informed by the State of changes to their audit regulation that included the following:

• plants would be randomly assigned auditors they were requir ed to use (i.e., they could no longer chose their own auditors);

• auditors would be paid from a central pool rather than by t he plant for which they worked;

• auditor fees were set in advance at a flat rate (high e nough to cover pollution measurement and give the auditor a modest profit);

• a random sample of each auditor’s pollution readings woul d be verified with follow-up visits to the audited plants by an independent technical agency ;

• in year two of the experiment, the third-party auditors w ere informed that their pay would be linked to their reporting accuracy as measured by the tec hnical agency’s follow-up

visits.

The results of the experiment included several dramatic findings. Under the status quo system, the third-party auditors systematically reported false pol lution levels just below the applicable regulatory standard (also known as strategic misreporting ). The experimental changes, however, significantly improved the truthfulness of the third-part y auditors’ reports. The treatments caused

the auditors to become more truthful. This occurred even for auditors operating in both markets, i.e., auditors auditing firms in both the control and tre atment groups. And extremely importantly, once the plants understood that their auditors would hence forth be reporting more accurately to the State, they reduced their pollution emissions. This s tudy’s findings thus reinforce the importance and impact of including features to promote compete nt and independent reporting in third-party regulatory programs.

Some evidence suggests that the majority of some types o f financial audits are flawed due in part to insufficient auditor competence/independence and/or public t ransparency. Third-party auditing is a linchpin of financial reporting. But when th e Public Company Accounting Oversight Board released its third annual report on audit s of brokerage firms, it found, consistent with findings in its prior reports that only 13 percent of audits had been done correctly. In response, the Board reportedly has tried or will try t o increase accuracy through enhanced transparency by: 1) publicly identifying top auditing firms that f ail to change the practices that the board found inadequate; and 2) considering a rule to require auditing firms to identify the partner in charge of each audit. These kinds of structur al changes are intended to reduce the financial incentive third-party verifiers have to produce find ings that favor the company hiring

them.

In a leading law review article on Regulation by Third-Party Verification , the author draws from examples of third-party auditors in the finance industry t o provide these recommendations for examples of rule provisions to ensure auditor competence, independence, and objectivity:

“In the context of regulatory compliance, the competen ce of third-party verifiers should be at least comparable to the competence of regulatory agency i nspectors. Third-party verifiers should possess both technical expertise and professional j udgment.” (footnote omitted) 23

23 McCallister, supra. n. __.Page 9 of 13

1. “Auditing/Third parties should be prohibited from providing any addi tional services outside of the auditing process to the entity to be audit ed.

2. Auditors/Third parties should have fixed and limited contrac ts that cannot be terminated, and the contractual provisions cannot be changed.

3. Impose mandatory rotation of auditors/third parties so that the regulated entity would be prohibited from rehiring the same auditor/third party at the end of the contract.

4. Bar auditors/third parties from taking jobs with regulated entities they have audited for at least five years.

5. Strong government oversight that issue accreditation to the auditor/third party and has the power to disaccredit an auditor/third party that has not shown objectivity in the audit

process. 6. Ensure transparency in the third-party program allowing the public to access reports produced by the auditor/third party.” 24

In the rule for EPA’s Wood Heater Compliance Monitoring Program (discussed previously), in section III.D of the preamble to the proposed rule, EPA described the proposed approach for third-party certification program by an ISO-accredited cert ifying body and testing by ISOaccredited testing laboratories. This approach requires ma nufacturers to use third-party, independent ISO-accredited and EPA-approved test labs and certi fying entities to demonstrate compliance with a representative appliance for a model line. Under the rule, a third-party certifier (sometimes called third-party certifying body or p roduct certifying body) means an independent third party that is accredited under ISO-IEC Stan dards 17025 and 17065 to perform certifications, inspections and audits by an accreditatio n body. The accreditation body must be a full member signatory to the International Laboratory Accreditation Cooperation Mutual Recognition Arrangement and approved by the EPA for conducti ng certifications, inspections and audits under this subpart.

The Food and Drug Administration (FDA) administers a t hird-party audit program under the Food Safety Modernization Act of 2011 (FSMA) 25 The FDA has issued the following regulations to ensure the independence of third-party audito rs:

1. Third-party auditors may not perform a regulatory audit of an entity for which it has performed a consultative audit or a regulatory audit in th e previous 13 months. 26

2. Third-party auditors cannot be owned or operated by the same persons as the regulated entities the auditors must certify, must have procedures in place to protect against financial conflicts of interest, and must annually disclo se to FDA how they have complied with conflict of interest rules and procedures. 27

3. Third-party auditors cannot own or operate the regulated en tity that they certify, must have procedures in place to protect against financial conflic ts of interest, and must annually disclose to FDA. 28

24 Id.

25 Lesley K. McAllister, Third Party Programs to Assess Regulatory Compliance, Admin. Conference of the United States 10 (2012)(referencing the FSMA, Pub. L. No. 111-353, 124 Stat. 3885 (2011)).

26 21 U.S.C. § 384d(c)(4)(C)(i).

27 § 384d(c)(5)(A).

28 § 384d(c)(5)(B).Page 10 of 13

4. Audits performed by third-party auditors must be unannounced and shall place limits on the extent to which there may be financial affiliation s between auditors and audit agents and the regulated entities they certify. 29

5. The FDA also must promulgate regulations that establish ti ming, disclosure, fee payment, and other rules that decrease the potential for conflict s of interest. 30

EPA seeks comment on the potential necessity, applica bility, and suitability, in the final rule, of each of above provisions and approaches for enhancing auditor competence.

Audit Standards and Protocols

In its Administrative Conference Recommendation on Agency Use of Third-Party Programs to Assess Regulatory Compliance , the ACUS found:

“ Use of Existing Conformity Assessment Standards . The agency should consider relying on existing conformity assessment standards, particularly in ternational standards that set forth requirements for conformity assessment and accreditati on bodies. Incorporating existing standards may reduce costs for the agency and for the regul ated entities.” 31

The ACUS further found:

“When an agency incorporates existing standards into its re quirements for third parties, it can supplement those standards with program-specific rules. An agency may require, for example, that in addition to being accredited to an in ternational standard, a conformity assessment body must satisfy accreditation rules spec ific to the third-party program ...” 32

EPA seeks comment on what, if any, consensus standards landfill accrediting bodies – or EPA, if the emission guidelines established EPA as the accreditor – should use in assessing whether auditor candidates quality for accreditation. An exampl e could be the International Organization for Standardization ISO/IEC 17020:1998(E), General Criteria f or the Operation of Various Types of Bodies Performing Inspections (First Edition). EPA also seeks comment as to relevant and applicable consensus standards and protocols that might apply to the audits and be built and/or incorporated by reference into the rules. This inc ludes potentially relevant and applicable American National Standards Institute (ANSI), ASTM Int ernational (ASTM), European Committee for Standardization (CEM), International Or ganization for Standardization (ISO), and National Institute of Standards and Technology (NIST) st andards. EPA further seeks comment

on whether the final rule should include additional EPA-s pecific standards to complement the requirements in applicable consensus standards.

Public Disclosure/Transparency

29 § 384d(c)(5)(C)(i) and (iii).

30 § 384d(c)(5)(C)(ii).

31 ACUS, supra at 8.

32 Id

.Page 11 of 13

In its Administrative Conference Recommendation on Agency Use of Third-Party Programs to Assess Regulatory Compliance , the ACUS found, concerning government and public access to third-party program information:

“Access to Information. The agency should ensure that b oth the government and the public will have appropriate access to information about program operations. An agency’s development of third-party program rules and guidance shoul d include notice and an opportunity for public participation. Also, the agency shoul d provide information to the public about the roles and identities of the third parties a ssociated with a regulatory program. Finally, the agency should establish reporting rules that require third parties to provide information to the agency based on the following consid erations:

(a) The reporting rules should facilitate transparency. Information about the compliance of regulated entities should be available from the agency t o the public, comparable to what would be available in the absence of a third-party program. Ag encies may also be able to provide additional compliance information to the public that was not available before the third-party program;

ooo

(d) The agency might require conformity assessment bodies and/or regulated entities to report electronically, which may facilitate the provisio n of information to the public.” 33

EPA requests comment on each of the above third-party pro gram design features in connection with today’s third-party audit program for subject landfills

.

EPA is also considering the approach it should take, in t he emission guidelines, to balancing public access to third-party auditing program information and aud its and the need to protect Confidential Business Information (CBI) or potential natio nal security-related information. To balance these potentially competing interests, EPA is r eviewing a variety of approaches that may include limiting public access to portions of the audits and/ or posting public audit grades or scores to inform the public of the auditing outcomes, gene rally, without compromising confidential or sensitive information. This includes potent ially developing publicizing an audit “grading system.” EPA seeks comment generally on the is sue of releasing versus protecting such

information and how to balance these interests in the emission guidelines.

Regulator Oversight

In its Administrative Conference Recommendation on Agency Use of Third-Party Programs to Assess Regulatory Compliance , the ACUS found regulatory oversight of third-party progra ms: “(b) The reporting rules should facilitate appropriate a gency oversight. For example, conformity assessment bodies can be required to report to the agency potential conflicts of interest before performing a conformity assessment, or pr ovide the dates of their assessment activities so that the agency can conduct site visits;

ooo

33 See n. 2, supra., at 9.Page 12 of 13

Agency Oversight. The agency has a duty to exercise over sight to ensure that the third-party program is fulfilling its regulatory purpose. An agency sho uld generally set forth how it intends to conduct such oversight. For example, it may a nnually audit a certain number of accreditations or conformity assessments, or carry ou t a market surveillance program to test regulated products off-the-shelf. In exercising oversight, the agency should also take into account the following considerations:

(a) Beyond conducting direct oversight, an agency can re quire third parties to conduct additional assessment activities that provide further info rmation to the agency about program operation. For example, an agency may require accredit ation bodies annually to audit a certain number of conformity assessments, or it may r equire conformity assessment bodies to conduct particular types of surveillance on products they a ssess;

(b) The agency should establish procedures for receiving and re sponding to public complaints regarding potential noncompliance or other aspe cts of program operation. The agency could, for example, require a third party that has assessed the conformity of a regulated product or entity to investigate a complaint of no ncompliance. In any event, the agency should ensure that complaints are resolved in an appr opriate and timely manner; and

(c) The agency should make clear the possible adverse act ions that it may take against third parties that do not comply with program rules. A key ad verse action is removing third parties from the program. Third parties may be removed temporarily through a suspension of accreditation, or permanently through a withdrawal of a ccreditation.” 34

EPA requests comment on each of the above third-party pro gram design features in connection with today’s third-party audit program for landfills.

Facility and Third-Party Auditor Certification Statements

EPA experience shows that requiring a responsible corpora te or third-party official to attest to self-monitoring, reporting, and third-party auditing can help e nsure appropriate officials are personally familiar with the reported information and r eminds them of the penalties associated with knowingly submitting false information. For examp le, consider the self-certification language in an authorized state’s RCRA Subtitle C Site Ide ntification Form used by authorized

states:

“I certify under penalty of law that this document and a ll attachments were prepared under my direction or supervision in accordance with a system designed to assure that qualified personnel properly gather and evaluate the information subm itted. Based on my inquiry of the person or persons who manage the system, or those per sons directly responsible for gathering the information, the information submitted is t o the best of my knowledge and belief, true, accurate, and complete. I am aware that there are significant penalties for

34 ACUS, supra at 9-10.Page 13 of 13

submitting false information, including the possibility of f ines and imprisonment for knowing

violations.” 35

EPA intends to require corresponding language for the third-pa rty audit reports under the emission guidelines and requests comment on its design.

35 W. Va. Dep’t of Envt’l Prot., U.S. EPA RCRA Subtitle C Site Identification Form

, 4, available at http://www.dep.wv.gov/WWE/Programs/hazwaste/Documents/8700-12For m.pdf

.