U.S. ENVIRONMENTAL PROTECTION AGENCY

OFFICE OF INSPECTOR GENERAL

EPA Needs to Improve 

Management of the 

Cross-Media Electronic 

Reporting Regulation Program 

in Order to Strengthen 

Protection of Human Health 

and the Environment 

Report No. 14-P-0143 March 21, 2014 

Scan this mobile 

code to learn more 

about the EPA OIG. 
 

Report Contributors:	 Rudolph M. Brevard 

 Warren Brooks 

 Christina Nelson

 Jeremy Sigel 

Abbreviations 

AG Attorney General 

CFR Code of Federal Regulations 

CROMERR Cross-Media Electronic Reporting Regulation 

EPA U.S. Environmental Protection Agency 

FY Fiscal Year 

IT Information Technology 

OEI Office of Environmental Information 

OGC Office of General Counsel 

OIC Office of Information Collection 

OIG Office of Inspector General 

OMB Office of Management and Budget 

PSM Program and Stakeholder Management 

TRC Technical Review Committee 

Hotline Suggestions for Audits or Evaluations 

To report fraud, waste or abuse, contact To make suggestions for audits or evaluations, 

us through one of the following methods: contact us through one of the following methods:
 

email: OIG_Hotline@epa.gov email: OIG_WEBCOMMENTS@epa.gov 

phone: 1-888-546-8740 phone: 1-202-566-2391 

fax: 1-202-566-2599 fax: 1-202-566-2599 

online: http://www.epa.gov/oig/hotline.htm online: http://www.epa.gov/oig/contact.html#Full_Info 

write:	 EPA Inspector General Hotline write: EPA Inspector General 

1200 Pennsylvania Avenue, NW 1200 Pennsylvania Avenue, NW 

Mailcode 2431T Mailcode 2410T 

Washington, DC 20460
 Washington, DC 20460 
 

 

 

 

U.S. Environmental Protection Agency 14-P-0143 

March 21, 2014 Office of Inspector General 

At a Glance 

Why We Did This Review 

The U.S. Environmental 

Protection Agency (EPA) 

Cross-Media Electronic 

Reporting Regulation 

(CROMERR) specifies the 

requirements for states, tribes 

and local governments that 

operate delegated programs to 

accept electronic reporting, 

including electronic signatures, 

from regulated facilities under 

most environmental 

regulations. Once a system is 

put in place that satisfies the 

requirements of CROMERR, 

regulated facilities can file 

electronic reports instead of 

paper reports. This will reduce 

the amount of paper created 

and transferred and, thus, 

reduce the cost of reporting 

and compliance monitoring. 

This initiative ultimately helps 

the EPA strengthen its 

enforcement of regulations to 

protect human health and the 

environment. 

This report addresses the 

following EPA themes: 

 Embracing EPA as a high 

performing organization. 

 Working toward a 

sustainable future. 

For further information, 

contact our public affairs office 

at (202) 566-2391. 

The full report is at: 

www.epa.gov/oig/reports/2014/ 

20140321-14-P-0143.pdf 

EPA Needs to Improve Management of the Cross-Media 

Electronic Reporting Regulation Program in Order to 

Strengthen Protection of Human Health and the Environment 

What We Found 

The EPA lacks documented procedures that An absence in 

reflect current operations of the CROMERR management controls program. Such procedures are an integral could lead the EPA to 

component of an effective management control receive electronic 

program as outlined in Office of Management and documents that are 

Budget Circular A-123. While CROMERR unacceptable in 

administrative or judicial applications require State Attorney General (or the enforcement proceedings. chief administrative official in the case of tribes 

and local governments) approval, the EPA lacks 

processes to ensure approvals from designated officials. The EPA has neither 

implemented monitoring activities to verify a CROMERR system’s functionality 

before and after approval nor implemented processes to ensure CROMERR 

applications are completed, reviewed and approved within required time frames. 

The EPA had not made it a priority to keep procedures current for implementing 

CROMERR business practices. Many of the noted deficiencies could have been 

averted with management emphasis. We noted that 20 percent of the reviewed 

CROMERR applications lacked support for State Attorney General 

determinations. We noted that one state changed its CROMERR process without 

notifying the EPA and another implemented its CROMERR application differently 

than what the EPA approved. Without current documented business practices, 

the EPA increases its risks that CROMERR applications may not be processed 

according to prescribed requirements and meet the high level of integrity needed 

for enforcement activities.

 Recommendations and Planned Agency Corrective Actions 

In addition to updating its current procedures, we recommend that the EPA: 

 Create a process to verify a state’s compliance with CROMERR and 

implement a completeness review process consistent with CROMERR. 

 Develop internal guidance for staff to use in determining acceptable 

evidence for designation from the State Attorney General (or the chief 

administrative official). 

The agency concurred with our recommendations and provided a complete 

corrective action plan. We consider these recommendations resolved. 

 Noteworthy Achievements 

The EPA is developing a new management system which will allow CROMERR 

stakeholders to monitor their CROMERR applications through the agency review 

process. 
 

 

 

 

UNITED STATES ENVIRONMENTAL PROTECTION AGENCY 

WASHINGTON, D.C. 20460 

THE INSPECTOR GENERAL 

March 21, 2014 

MEMORANDUM 

SUBJECT:	 EPA Needs to Improve Management of the Cross-Media Electronic Reporting Regulation 

Program in Order to Strengthen Protection of Human Health and the Environment 

 Report No. 14-P-0143 

FROM:	 Arthur A. Elkins Jr. 

TO:	 Renee P. Wynn, Acting Assistant Administrator and Chief Information Officer 

 Office of Environmental Information 

Avi Garbow, General Counsel 

Office of General Counsel 

This is our report on the subject audit conducted by the Office of Inspector General (OIG) of the 

U.S. Environmental Protection Agency (EPA). This report contains findings that describe the problems 

the OIG has identified and corrective actions the OIG recommends. The Office of Information 

Collection within the Office of Environmental Information is the primary office responsible for the 

agency program that we reviewed. The Office of General Counsel is responsible for reviewing Attorney 

General certifications for the agency program reviewed. 

This report represents the opinion of the OIG and does not necessarily represent the final EPA position. 

Final determinations on matters in this report will be made by EPA managers in accordance with 

established audit resolution procedures. 

Action Required 

The agency concurred with all seven recommendations. We accept the EPA’s response and planned 

corrective actions and no further response is needed. We will post this report to our website at 

http://www.epa.gov/oig. 

If you or your staff have any questions regarding this report, please contact Richard Eyermann, 

acting Assistant Inspector General for Audit, at (202) 566-0565 or eyermann.richard@epa.gov; 

or Rudolph M. Brevard, Director, Information Resources Management Audits, at (202) 566-0893 

or brevard.rudy@epa.gov. 
 

 

 

 

 

 

 

 

EPA Needs to Improve Management of the Cross-Media 14-P-0143 

Electronic Reporting Regulation Program in Order to 

Strengthen Protection of Human Health and the Environment 

Table of Contents 

Chapters 

1 Introduction ........................................................................................................ 1

 Purpose ....................................................................................................... 1 

Background ................................................................................................. 1 

 Responsible Offices .................................................................................... 2 

 Noteworthy Achievements ........................................................................... 3 

Scope and Methodology.............................................................................. 3 

2 Updated Procedures Needed to Aid in Consistent Review of 

 CROMERR Applications ....................................................................................... 5
 

Outdated Documented CROMERR Business Practices ............................. 5 

Inconsistent Standards for Determining AG Designee ................................ 6 

 Recommendations ...................................................................................... 7 

Agency Response and OIG Evaluation ....................................................... 7 

3 Improvements Needed in the Monitoring and Reviewing of 

 CROMERR Applications ....................................................................................... 9 

EPA Lacks Internal Controls to Monitor Systems With 

CROMERR Applications ........................................................................ 9 

EPA Does Not Adhere to Required Completeness Review 

Time Frames for CROMERR Applications ............................................ 10 

 Recommendations ...................................................................................... 11 

Agency Response and OIG Evaluation ....................................................... 11 

Status of Recommendations and Potential Monetary Benefits.............................. 13 

Appendices 

A CROMERR System Checklist ............................................................... 14
 

B Summary of States’ Input on CROMERR Implementation ............................. 25 

C Agency Response to Draft Report.................................................................... 26 

D Subsequent Agency Response to Draft Report (OEI)..................................... 31 

E Distribution ......................................................................................................... 34 
 

 

Chapter 1

Introduction 

Purpose 

We sought to determine to what extent the U.S. Environmental Protection Agency 

(EPA) has implemented a management control structure for the Cross-Media 

Electronic Reporting Regulation (CROMERR). 

Background 

On October 13, 2005, the EPA established a framework for acceptance of 

electronic reports from regulated entities. Information systems receiving 

electronic reports for programs that states, tribes or local governments are 

authorized to manage must meet CROMERR standards in accordance with 

Code of Federal Regulations (CFR) Title 40 Part 3. CROMERR is intended to 

reduce the cost and burden of electronic reporting while maintaining the level of 

corporate and individual responsibility and accountability that exists in the paper 

environment. CROMERR requires an electronic report from facilities that are 

regulated under EPA-authorized programs to make the signatory responsible to 

the same extent as the signatory’s handwritten signature would on a paper 

document. Such electronic reports must be sufficient for admission as evidence. 

CROMERR supports many of the benefits of electronic reporting, including: 

 Allowing government agencies and regulated entities to interact 

electronically. 

 Fostering more rapid and accurate environmental reporting and posting of 

compliance information. 

 Making data more readily available. 

 Maintaining consistency with emerging industry practices. 

States, tribes and local governments must submit a CROMERR application to 

receive the EPA’s approval prior to receiving electronic reports. The certification 

for a CROMERR application from the State Attorney General (AG)—or the chief 

administrative official in the case of tribes and local governments—documents 

that the states, tribes and local governments have legal authority to receive 

electronic reports. The EPA’s Office of General Counsel (OGC) is responsible for 

reviewing the certifications. After receiving an application, the Technical Review 

Committee (TRC), consisting of representatives from each of the EPA’s program 

and regional offices, has 75 days to review the application for completeness. 

14-P-0143 1 
 

 

Once an application is determined to be complete, the EPA has 180 days to approve 

or deny the application via the TRC.1 According to EPA Delegation 1-120, the 

OGC and the Office of Enforcement and Compliance Assurance must concur or 

non-concur on actions to be taken on applications prior to the Office of 

Environmental Information (OEI) publishing the approval notice in the Federal 

Register. As of January 29, 2013, the EPA has approved 35 of the 81 CROMERR 

applications received from various states. 

Not Yet 

Approved, 46 

Approved, 35 

Graph 1: Status of CROMERR Applications Submitted to the EPA 

Source: OIG Analysis 

Responsible Offices 

The Office of Information Collection (OIC) within OEI is the focal point for 

information collection and the development and implementation of innovative 

collection policies and approaches for the agency. OIC is responsible for oversight 

of the CROMERR program. OIC enables the agency to protect human health and 

the environment through informed decisions and actions. 

The General Law Office within the OGC provides legal advice to the agency. 

OGC is the chief legal adviser to the EPA, providing support for agency rules and 

policies, and is responsible for reviewing CROMERR applications and verifying 

the AG’s certification as well as identifying any legal issues with the application. 

1

 The EPA can extend the approval review time frame to 360 calendar days for applications that are submitted late in 

the deadline period. The CROMERR deadline period was extended to January 13, 2010, to assist state, tribes and 

local governments in complying with CROMERR. 

14-P-0143 2 
 

Noteworthy Achievements 

OEI is developing the Program and Stakeholder Management (PSM) system, a 

tailored vendor product, which allows CROMERR stakeholders (members from 

OEI, OGC, and the Office of Enforcement and Compliance Assurance, as well as 

regional and state personnel) to monitor CROMERR applications through the 

application review process. The system is a relational database housed in a cloud 

environment that uses CROMERR application data to create reports. By using the 

PSM’s calendar, dashboard and email functions, representatives from OIC stated 

they will send email reminders to stakeholders based on the review and approval 

of CROMERR deadlines. They also plan to use PSM to retain program 

knowledge not readily available in CROMERR guidance through linkage to 

common issues and lessons learned. 

Scope and Methodology 

We conducted our audit from February 2012 to August 2013 in accordance with 

generally accepted government auditing standards. These standards require that 

we plan and perform the audit to obtain sufficient, appropriate evidence to 

provide a reasonable basis for our findings and conclusions based on our audit 

objectives. We believe that the evidence obtained provides a reasonable basis for 

our conclusions based on our audit objectives. 

We assessed the EPA’s documented CROMERR processes, procedures and 

business practices against the Office of Management and Budget (OMB) 

Circular A-123, Management’s Responsibility for Internal Control in Federal 

Agencies. We compared the CROMERR program procedures and standards to 

OMB Circular A-123 to determine whether management defined internal control 

requirements for control environment, risk assessment, control activities, 

information and communication, and monitoring activities. We identified internal 

controls used to manage the CROMERR program by interviewing agency 

personnel responsible for implementing the program. The EPA provided the 

Office of Inspector General (OIG) with a demonstration of the information system 

that the EPA is developing to track CROMERR applications submitted for 

approval to obtain an understanding of the system’s features and functions. 

OIC provided the OIG with a list of all CROMERR applications. The OIG 

selected a judgmental sample of 10 approved CROMERR applications and used 

the CROMERR system checklist, the template for documenting system 

conformance with CROMERR standards, to determine whether the sample 

CROMERR applications met the requirements. The checklist is divided into five 

categories that match with the five phases of the e-reporting process (Registration, 

Signature Process, Submission Process, Signature Validation, and Creation of the 

Copy Record). Appendix A contains the CROMERR checklist. 

We also selected a judgmental sample of five reviewed CROMERR applications 

to test the timeliness of the review process. We reviewed the hard copy date 

14-P-0143 3 
 

stamps or electronic documentation for these applications to determine the 

submission date. We were able to determine the date the applicant received the 

completeness review and, if applicable, the date the EPA approved the 

application. We compared these dates with the required CFR time frames for the 

completeness and approval reviews. 

From our analysis of all CROMERR applications, we selected the following state 

locations with applications in various stages (submitted, completed and approved) 

of the CROMERR review process: 

 Delaware Department of Natural Resources and Environmental Control. 

 Iowa Department of Natural Resources. 

 New Mexico Environment Department. 

 North Carolina Department of Environment and Natural Resources. 

During the site visits, we interviewed employees involved in creating the 

CROMERR application, developing and managing the system(s) for the 

application, and administrative users of the system(s). If the CROMERR 

application was operational or in development, we were given a demonstration of 

how others use the system. 

From the telephone interviews and state visits, we received input from state 

personnel regarding how to improve the CROMERR program. Appendix B 

contains a list of the states’ suggestions. 

We did not follow up on prior recommendations since there were no prior audits 

conducted on the EPA’s CROMERR program. 

14-P-0143 4 
 

Chapter 2

Updated Procedures Needed to Aid in Consistent 

Review of CROMERR Applications 

The EPA lacks current policies and procedures to reflect the control activities for 

the CROMERR processes. In particular, the EPA had not updated several key 

CROMERR business processes since implementing the program. The EPA also 

lacked formal written processes to ensure consistency in making AG 

determinations for submitted applications. Federal guidance requires the EPA to 

maintain policies and procedures to reflect the current control activities for all of 

their programs, which includes CROMERR processes. EPA management had not 

made it a priority to keep CROMERR business processes up to date. Without 

current documented business practices, the EPA faces the possibility that 

CROMERR applications may not be processed according to prescribed 

requirements or with the benefit of personnel with expertise on how the 

CROMERR process operates. Furthermore, management had not developed 

internal guidance for staff to use for making AG determinations. We found that 20 

percent of reviewed applications lacked explicit support for AG determinations, 

which could have been prevented with more management oversight and internal 

guidance. 

Outdated Documented CROMERR Business Practices 

The documented business practices do not reflect the current implementation of 

the CROMERR program. These documented business practices include: 

	 EPA Procedure for Approval of State, Tribal, or Local Government 

Authorized or Delegated Program Applications for Implementing 

CROMERR. 

 EPA Procedure for Implementation of CROMERR for EPA Systems.
 

 Technical Review Committee Charter.
 

 CROMERR authorized program review for approval flowchart. 

In particular, the Exchange Network Policy and Planning Workgroup and Quality 

Information Counsel-Exchange Network Subcommittee no longer participate in 

the CROMERR program. However, the workgroup and subcommittee are 

included in the written CROMERR business practices. Also, the EPA has not 

updated CROMERR procedures and other business practice documentation (such 

as flowcharts). Additionally, the TRC documentation does not reflect the current 

process or participants. We also found that the EPA provides inconsistent 

information about where states should submit their CROMERR applications. 

OMB Circular A-123 provides guidance to agency management to assess and 

monitor internal controls for agency programs. Specifically, control activities include 

“policies, procedures and mechanisms in place to help ensure the agency objectives 

14-P-0143 5 
 

are met.” The objective of these internal controls is to ensure the effectiveness and 

efficiency of operations and compliance with laws and regulations. 

While the EPA has written policies and procedures detailing internal controls 

around the CROMERR process, the EPA had not placed priority on keeping 

business processes up-to-date. This includes notification to regions and program 

offices about open alternate TRC representative slots, which would affect the 

review of CROMERR applications in the event the primary representative is 

unable to participate. This lack of a notification process has led to seven regions 

with no alternate TRC representatives assigned. Outdated documentation stating 

differing locations of where to send CROMERR applications can lead to the 

applicant sending applications to a program or regional official instead of the 

OIC, affecting the response time of the EPA’s application completeness review. 

Furthermore, there are a limited number of personnel directly involved in the 

review and approval process for applications. If these employees were to leave the 

EPA for an extended period, personnel assigned to implement the CROMERR 

program will not have reliable documentation to perform the application 

completeness review. 

Inconsistent Standards for Determining AG Designee 

The EPA lacks consistency in determining the sufficiency of evidence needed to 

support signing the State AG or equivalent certification for a CROMERR 

application. Based on our analysis of 10 approved CROMERR applications, 20 

percent of the State AG or equivalent certification letters lacked explicit 

supporting documentation to show a designation from the State AG or equivalent 

to the designee who signed the certification. 

Title 40 CFR Part 3 Subpart D §3.1000(b)(1)(i) requires CROMERR applicants to 

submit a certification that they have sufficient legal authority to implement 

electronic reporting. The signature of the State AG (or chief administrative 

official in cases of a tribe or local government) covers this component of the 

authorized programs’ CROMERR applications. 

These inconsistencies exist because there are no documented policies or standards 

that outline what constitutes sufficient evidence for AG certifications signed by a 

designee. OGC lawyers review AG certifications on a case-by-case basis using 

their experience and legal interpretation. Without a valid AG certification, a key 

evidentiary piece of the EPA’s case against fraudulent electronic reporting may be 

lost. This potentially weakens cases brought against significant violators with 

fraudulent reports. 

Subsequent to issuing our findings, the EPA provided written comments to the 

OIG. The agency stated it had updated documented CROMERR business 

practices. However, the agency had not provided the OIG with the documentation. 

Also, while AG certifications appear valid based on the totality of the documents 

14-P-0143 6 
 

and authority conveyed by the designees, the lack of documented standards for 

OGC review remains an issue. 

Recommendations 

We recommend that the Director, Office of Information Collection, within the 

Office of Environmental Information: 

1.	 Update written CROMERR business practices and remove references to 

the Exchange Network Policy and Planning Workgroup and Quality 

Information Counsel-Exchange Network Subcommittee since they no 

longer participate in the CROMERR program. Those written practices 

should include: 

a) EPA Procedure for Approval of State, Tribal, or Local 

Government Authorized or Delegated Program Applications for 

Implementing CROMERR; 

b)	 EPA Procedure for Implementation of CROMERR for EPA 

Systems; 

c)	 Technical Review Committee Charter; and 

d) CROMERR authorized program review for approval flowchart. 

2.	 Update CROMERR procedures to state where CROMERR applications 

and modifications to applications are sent. 

3.	 Develop and implement an oversight process to regularly notify regions 

and program offices when TRC representative roles need to be filled. 

We recommend that the Associate General Counsel of the General Law Office 

within the Office of General Counsel: 

4.	 Create and implement an internal guidance the staff will use to determine 

acceptable support for a designation from the State AG (or chief 

administrative official) to the designee who signs the AG certification. 

Agency Response and OIG Evaluation 

OEI and OGC provided a joint response to the draft report (appendix C), which 

was signed by the acting Assistant Administrator for OEI. OEI concurred with 

recommendations 1, 2 and 3, and provided a corrective action plan. We consider 

these recommendations resolved with corrective actions pending. 

OGC did not agree with recommendation 4 to document how attorneys verify the 

validity of AG certifications. The agency states that 40 CFR Part 3 Subpart D 

§3.1000(b)(1)(i) clearly articulates the standards for AG certification. However, 

we found this section of the CFR to be vague regarding what constitutes a valid 

State AG designee. Our audit showed that there is no consistency in the 

14-P-0143 7 
 

documentation the EPA received for AG designees. As such, this contributed to 

the discrepancies noted in this audit. 

Subsequent to the issuance of our draft report, we met with representatives from 

both OEI and OGC. Upon discussions with OGC, we reworded the 

recommendation to more clearly describe the corrective action needed. In an 

electronic email response from OGC, its management concurred with the 

reworded recommendation and provided a corrective action plan. We consider 

this recommendation resolved with corrective action pending. 

14-P-0143 8 
 

Chapter 3

Improvements Needed in the Monitoring and 

Reviewing of CROMERR Applications 

The EPA lacks monitoring activities to verify CROMERR systems’ functionality 

prior to approval or follow-up with states to ensure that the systems continue to 

meet CROMERR requirements. Furthermore, the EPA lacks processes monitoring 

internal controls to ensure that completeness reviews are completed within 

required time frames. Federal guidance requires management to have internal 

controls related to monitoring activities. The EPA neither implemented processes 

to enforce CROMERR system compliance nor created a formal documented 

completeness review process for reviewing CROMERR applications. This audit 

disclosed that one state changed its CROMERR process without notifying the 

EPA. Another state implemented its CROMERR application differently than the 

EPA approved. Additionally, the agency did not review all CROMERR 

applications in a timely manner. As a result of not having these key processes in 

place, the EPA could be receiving electronic documents which are not enforceable 

in court. 

EPA Lacks Internal Controls to Monitor Systems With 

CROMERR Applications 

The EPA had not implemented internal controls related to continuous monitoring 

to verify that the applicants’ electronic reporting systems comply with 

CROMERR requirements. 

During state site visits, we found the following: 

	 A system with an approved CROMERR application that did not notify the 

EPA of a change in their process as required by 40 CFR Part 3 Subpart D 

§3.1000(a)(4). 

	 A system with an approved CROMERR application that had one out of the 

20 application checklist items not functioning as stated. While the state 

had other controls in place for the checklist item, the state did not notify 

the EPA of the change as required by 40 CFR Part 3. 

OMB A-123 requires management to develop and maintain internal control 

activities, including monitoring. 

The EPA lacks a process to enforce CROMERR compliance or to conduct 

monitoring activities, prior to or after approving CROMERR applications, to 

ensure that the system and business practices are CROMERR compliant. The 

agency trusts the information on the CROMERR application to be accurate and 

requires applicants to notify the EPA of any modifications. 

14-P-0143 9 
 

 

 

OIC is responsible for implementing the CROMERR program but lacks the 

required internal controls. These internal controls would determine that the 

CROMERR applications submitted include accurate information and monitor 

CROMERR-compliant systems. While OIC delegates management responsibility 

to regional and program personnel, OIC still needs processes in place to review 

the regional and program monitoring activities for sufficiency. According to the 

EPA representatives, the CROMERR program would benefit from a policy in 

place requiring a review of the information in the CROMERR application from 

states, tribes and local governments prior to approval. However, the EPA has not 

taken steps to develop such policy. 

By not having internal controls for monitoring application information, the EPA 

may be approving CROMERR applications for systems that do not function as 

stated in their application. It is important for applicants to receive electronic 

reports that are CROMERR compliant to ensure that the EPA and its authorized 

programs have documentary evidence for court cases. If approved systems are not 

CROMERR compliant, then the electronic reports from these systems may not be 

legally dependable and enforceable in court. 

EPA Does Not Adhere to Required Completeness Review 

Time Frames for CROMERR Applications 

The EPA does not review CROMERR applications for completeness in a timely 

manner. The EPA did not send written completeness reviews to two out of the 

five states we reviewed. The EPA also did not finish the completeness reviews of 

CROMERR applications within required time frames for three of the five states 

tested. 

Table 1: Summary of results of completeness review testing 

Completeness 

notice written 

Completeness 

review timely 

Days that the 

EPA missed the 

deadline 

Massachusetts NO YES 0 

West Virginia NO NO 175 

Florida YES NO 389 

Delaware YES NO 280 

Oklahoma YES YES 0 

Source: OIG analysis. 

Title 40 CFR Part 3 Subpart D §3.1000(b)(3)(i), requires the EPA to respond in 

writing to applicants notifying them that their application is complete or 

incomplete. This written response should occur within 75 calendar days for 

original application submissions and 30 calendar days for amendments to existing 

applications. If the application is incomplete, the EPA should identify deficiencies 

in the application that renders it incomplete and inform the applicant in writing of 

the deficiencies. 

14-P-0143 10 
 

The EPA does have a formal documented completeness review process for 

reviewing CROMERR applications. However, according to OIC personnel, the 

EPA sometimes uses an informal process for reviewing CROMERR applications 

for completeness. Based on OIG interviews, the undocumented informal 

completeness review process includes the EPA and the applicant discussing the 

CROMERR application via telephone and email. According to OIC personnel and 

employees from the states that we visited, the informal completeness review 

process does not include written incompleteness notices or timeframes for the 

EPA to share the results with CROMERR applicants. 

Without a response from the EPA about the status of their CROMERR 

application, applicants with operational systems may violate the CROMERR 

requirements by moving forward in receiving electronic reports without an 

approval. Delay in the EPA completeness review for applicants, may cause delays 

in the development of the system(s) and additional costs. Additionally, since the 

EPA’s approval process begins once a CROMERR application is complete, the 

use of an informal review without deadlines can delay the EPA’s approval of 

CROMERR applications. 

Subsequent to issuing our findings, the agency stated it updated its documented 

CROMERR business practices to incorporate the informal review process. 

However, the agency had not provided the OIG with information for review. 

Recommendations 

We recommend that the Director, Office of Information Collection, within the 

Office of Environmental Information: 

5.	 Create a process to determine if the information included in the 

CROMERR application is reliable and accurate prior to the CROMERR 

application being approved. 

6.	 Create a process to regularly follow up with applicants with approved 

CROMERR applications in order to confirm that no changes were made to 

the approved CROMERR application. 

7.	 Develop and implement a completeness review process with states, tribes 

and local governments that is consistent with the CROMERR program. 

Agency Response and OIG Evaluation 

In its response to our draft report, the agency agreed with our recommendations 

and provided a corrective action plan for two of the three recommendations. 

Management did not agree with a portion of our recommendation to create 

enforcement policy and procedures that include implementing a process for 

verifying system functionality prior to the approval of the CROMERR 

application. OEI stated that the CROMERR program does not authorize the EPA 

14-P-0143 11 
 

to verify system functionality prior to application approval. During our audit, we 

noted that the EPA relies on the information the applicant provides to be accurate. 

As such, prior to approving applications, the EPA should determine which 

attributes in the CROMERR application are implemented and which attributes are 

not yet implemented. 

Subsequent to the issuance of our draft report, we met with agency officials to 

discuss their concerns with the draft report recommendations. While management 

did not concur that the agency needed an enforcement policy, management 

subsequently agreed that the responsible office should have documented policies 

and procedures for conducting this activity. Where appropriate, we modified the 

report recommendations to address management concerns. Appendix C provides 

the agency’s original response to the draft report. Appendix D contains the 

agency’s subsequent response to the recommendations. 

14-P-0143 12 
 

 

 

 

 

 

 

 

 

Status of Recommendations and 

Potential Monetary Benefits 

POTENTIAL MONETARY 

RECOMMENDATIONS BENEFITS (in $000s) 

Planned 

Rec. 

No. 

Page 

No. Subject Status1 Action Official 

Completion 

Date 

Claimed 

Amount 

Agreed-To 

Amount 

1 7 Update written CROMERR business practices and 

remove references to the Exchange Network Policy 

and Planning Workgroup and Quality Information 

Counsel-Exchange Network Subcommittee since 

they no longer participate in the CROMERR 

program. Those written practices should include: 

O Director, Office of Information 

Collection, Office of 

Environmental Information 

4th Quarter 

FY 2014 

a) EPA Procedure for Approval of State, Tribal, 

or Local Government Authorized or 

Delegated Program Applications for 

Implementing CROMERR; 

b) EPA Procedure for Implementation of 

CROMERR for EPA Systems; 

c) Technical Review Committee Charter; and 

d) CROMERR authorized program review for 

approval flowchart. 

2 7 Update CROMERR procedures to state where 

CROMERR applications and modifications to 

applications are sent. 

O Director, Office of Information 

Collection, Office of 

Environmental Information 

2nd Quarter 

FY 2014 

3 7 Develop and implement an oversight process to 

regularly notify regions and program offices when 

TRC representative roles need to be filled. 

O Director, Office of Information 

Collection, Office of 

Environmental Information 

2nd Quarter 

FY 2014 

4 7 Create and implement an internal guidance the 

staff will use to determine acceptable support for a 

designation from the State AG (or chief 

administrative official) to the designee who signs 

the AG certification. 

O Associate General Counsel 

of the General Law Office, 

Office of General Counsel 

2nd Quarter 

FY 2014 

5 11 Create a process to determine if the information 

included in the CROMERR application is reliable 

and accurate prior to the CROMERR application 

being approved. 

O Director, Office of Information 

Collection, Office of 

Environmental Information 

3rd Quarter 

FY 2014 

6 11 Create a process to regularly follow up with 

applicants with approved CROMERR applications 

in order to confirm that no changes were made to 

the approved CROMERR application. 

O Director, Office of Information 

Collection, Office of 

Environmental Information 

1st Quarter 

FY 2015 

7 11 Develop and implement a completeness review 

process with states, tribes and local governments 

that is consistent with CROMERR. 

O Director, Office of Information 

Collection, Office of 

Environmental Information 

3rd Quarter 

FY 2014 

O = recommendation is open with agreed-to corrective actions pending 

C = recommendation is closed with all agreed-to actions completed 

U = recommendation is unresolved with resolution efforts in progress 

14-P-0143 13 

1 
 

 

 

 

Appendix A 

CROMERR System Checklist 

CROMERR System Checklist 

Item 

Registration (e-signature cases only) 

1. Identity-proofing of registrant 

Business Practices: 

System Functions: 

Supporting Documentation (list attachments): 

1a. (priority reports only) Identity-proofing before accepting e-signatures 

Business Practices: 

System Functions: 

Supporting Documentation (list attachments): 

1b. (priority reports only) Identity-proofing method (See 1bi, 1bii, and 1b-alt) 

1bi. (priority reports only) Verification by attestation of disinterested individuals 

Business Practices: 

System Functions: 

Supporting Documentation (list attachments): 

14-P-0143 14 
 

 

 

 

 

1bii. (priority reports only) Information or objects of independent origin 

Business Practices: 

System Functions: 

Supporting Documentation (list attachments): 

1b-alt. (priority reports only) Subscriber agreement alternative 

Business Practices: 

System Functions: 

Supporting Documentation (list attachments): 

2. Determination of registrant's signing authority 

Business Practices: 

System Functions: 

Supporting Documentation (list attachments): 

14-P-0143 15 
 

 

 

 

3. Issuance (or registration) of a signing credential in a way that protects it from compromise 

Business Practices: 

System Functions: 

Supporting Documentation (list attachments): 

4. Electronic signature agreement 

Business Practices: 

System Functions: 

Supporting Documentation (list attachments): 

Signature Process (e-signature cases only) 

5. Binding of signatures to document content 

Business Practices: 

System Functions: 

Supporting Documentation (list attachments): 

14-P-0143 16 
 

 

 

 

6. Opportunity to review document content 

Business Practices: 

System Functions: 

Supporting Documentation (list attachments): 

7. Opportunity to review certification statements and warnings 

Business Practices: 

System Functions: 

Supporting Documentation (list attachments): 

Submission Process 

8. Transmission error checking and documentation 

Business Practices: 

System Functions: 

Supporting Documentation (list attachments): 

14-P-0143 17 
 

 

 

 

9. Opportunity to review copy of record (See 9a through 9c) 

9a. Notification that copy of record is available 

Business Practices: 

System Functions: 

Supporting Documentation (list attachments): 

9b. Creation of copy of record in a human-readable format 

Business Practices: 

System Functions: 

Supporting Documentation (list attachments): 

9c. Providing the copy of record 

Business Practices: 

System Functions: 

Supporting Documentation (list attachments): 

14-P-0143 18 
 

 

 

 

10. Procedures to address submitter/signatory repudiation of a copy of record 

Business Practices: 

System Functions: 

Supporting Documentation (list attachments): 

11. Procedures to flag accidental submissions 

Business Practices: 

System Functions: 

Supporting Documentation (list attachments): 

12. (e-signature cases only) Automatic acknowledgment of submission 

Business Practices: 

System Functions: 

Supporting Documentation (list attachments): 

Signature Validation (e-signature cases only) 

14-P-0143 19 
 

 

 

 

13. Credential validation (See 13a through 13c) 

13a. Determination that credential is authentic 

Business Practices: 

System Functions: 

Supporting Documentation (list attachments): 

13b. Determination of credential ownership 

Business Practices: 

System Functions: 

Supporting Documentation (list attachments): 

13c. Determination that credential is not compromised 

Business Practices: 

System Functions: 

Supporting Documentation (list attachments): 

14-P-0143 20 
 

 

 

 

14. Signatory authorization 

Business Practices: 

System Functions: 

Supporting Documentation (list attachments): 

15. Procedures to flag spurious credential use 

Business Practices: 

System Functions: 

Supporting Documentation (list attachments): 

16. Procedures to revoke/reject compromised credentials 

Business Practices: 

System Functions: 

Supporting Documentation (list attachments): 

14-P-0143 21 
 

 

 

 

17. Confirmation of signature binding to document content 

Business Practices: 

System Functions: 

Supporting Documentation (list attachments): 

Copy of Record 

18. Creation of copy of record (See 18a through 18e) 

18a. True and correct copy of document received 

Business Practices: 

System Functions: 

Supporting Documentation (list attachments): 

18b. Inclusion of electronic signatures 

Business Practices: 

System Functions: 

Supporting Documentation (list attachments): 

14-P-0143 22 
 

 

 

 

18c. Inclusion of date and time of receipt 

Business Practices: 

System Functions: 

Supporting Documentation (list attachments): 

18d. Inclusion of other information necessary to record meaning of document 

Business Practices: 

System Functions: 

Supporting Documentation (list attachments): 

18e. Ability to be viewed in human-readable format 

Business Practices: 

System Functions: 

Supporting Documentation (list attachments): 

14-P-0143 23 
 

 

 

 

19. Timely availability of copy of record as needed 

Business Practices: 

System Functions: 

Supporting Documentation (list attachments): 

20. Maintenance of copy of record 

Business Practices: 

System Functions: 

Supporting Documentation (list attachments): 

14-P-0143 24 
 

Appendix B 

Summary of States’ Input on 

CROMERR Implementation 

Suggestion States agreeing with suggestion 

More CROMERR information technology (IT) guidance to the states. 

(Includes proving states’ IT security personnel with training about 

CROMERR IT requirements). 

5 

Timelier response to application submissions and inquiries. 4 

Provide current list of states with CROMERR-compliant systems 

(with point of contacts), and list of third party solutions/vendors. 

4 

More outreach from the EPA (including face-to-face and direct 

communication). 

3 

CROMERR website updated with current communication. 3 

Staffing OEI CROMERR personnel for the size of the workload they 

are handling. 

3 

More EPA-created systems for states to use/customize. 3 

Provide states with models of CROMERR-compliant systems. 3 

More involvement from regional TRC representative in the 

CROMERR process. 

3 

Provide definitive technical answers to states’ questions. 3 

CROMERR application reviews should consider new IT solutions as 

opposed to tailoring systems to previously approved IT solutions. 

2 

Provide expected timeframe for response during informal process. 

Also, determine when formal process should be used. 

2 

Provide regions and states with “question and answer” sessions to 

assist with the application process. 

2 

Avoid delays in implementing e-reporting system (caused by the 

CROMERR application process affecting production and operations 

costs). 

2 

Assistance from the EPA with marketing states’ e-report systems to 

its intended users. 

1 

Provide source code and other CROMERR-compliant operational 

technology in a vendor-neutral format. 

1 

Provide information regarding how facilities and other third parties 

submit electronic reports directly to the EPA in a CROMERRcompliant format. 

1 

Source: OIG analysis. 

14-P-0143 25 
 

 

 

Appendix C 

Agency Response to Draft Report 

MEMORANDUM 

SUBJECT:	 Response to Office of Inspector General Draft Report No. OMS-FY12

0004: EPA Needs to Improve Management of the Cross-Media 

Electronic Reporting Regulation Program, dated August 28, 2013 

FROM:	 Renee P. Wynn 

Acting Assistant Administrator and Chief Information Officer 

TO: Richard Eyermann, Acting Assistant Inspector General 

Office of Audit 

Office of Inspector General 

Thank you for the opportunity to respond to the issues and recommendations in the subject 

audit report. This memorandum provides a summary of the position on each of the report’s 

six recommendations. For those report recommendations with which the agency agrees, I 

have provided high-level intended corrective actions and estimated completion dates. For 

those report recommendations with which the agency does not agree, I have explained 

EPA’s position and provided the legal basis when relevant. 

AGENCY’S POSITION 

Of the six recommendations in the draft audit report, EPA agrees with recommendations 1, 

2, 3, 

5b and 6 and describes corrective actions in the provided Agreements table. EPA disagrees 

with recommendations 4 and 5a. 

SUMMARY OF DISAGREEMENTS 

With respect to OIG recommendation 4, EPA disagrees because the regulation 

governing the program clearly articulates the standards by which that agency is to
 

evaluate state Attorney General certifications. 

With respect to OIG recommendation 5a, EPA disagrees because it does not have the legal 

authority within CROMERR to inspect authorized programs’ electronic reporting systems 

prior to application approval. 

14-P-0143 26 
 

If you have any questions regarding this response, please contact Jonathan Jacobson, subject 

audit primary contact, Office of Information Collection, Information Exchange and Services 

Division, Information Exchange Partnership Branch at (202) 566-1984, 

jacobson.jonathan@epa.gov or Scott Dockum, OEI Audit Follow-Up Manager, Office of 

Program Management, Policy, Outreach and Communications Staff at (202) 566-1914, 

dockum.scott@epa.gov. 

Attachments 

cc: Rudy Brevard 

Connie Dwyer 

Warren Brooks 

Jonathan Jacobson 

Evi Huffer 

Karen Seeh 

Christina Nelson 

Scott Dockum 

14-P-0143 27 
 

Attachment 1 

AGENCY’S RESPONSE TO REPORT RECOMMENDATIONS 

Agreements 

No. Recommendation High-Level Intended Corrective Action(s) Estimated 

Completion by 

Quarter and 

FY 

1 Update 

CROMERR 

procedures to 

remove references 

to the Exchange 

Network Policy 

and Planning 

Workgroup 

(ENPPW) and 

Quality 

Information 

Counsel – 

Exchange 

Network 

Subcommittee 

(QIC-ENS) 

because they no 

longer participate 

in the CROMERR 

program, 

including: 

a). EPA Procedure 

for Approval of 

State, Tribal, or 

Local 

Government 

Authorized or 

Delegated 

Program 

Applications for 

Implementing 

CROMERR; and 

b). EPA 

Procedure for 

Implementation of 

CROMERR for 

EPA Systems. 

Update the 

following 

1.1 a and b – Update procedures 1st Quarter 

FY 2014 

1.1 c – Update Technical Review Committee 

Charter 

1st Quarter 

FY 2013 

(complete) 

1.1 d – Update flow chart 1st Quarter 

FY 2013 

(complete) 

1.2 a and b – Submit updated Procedure 

Documents to CIO for review and approval 

1st Quarter 

FY 2014 

1.3 a and b – Obtain CIO approval of updated 

Procedure Documents 

4th Quarter FY 

2014 

1.3 EPA will review CROMERR documents 

every three years to ensure that the content 

reflects current practices 

2nd Quarter FY 

2017 

14-P-0143 28 
 

documents to 

reflect current 

business practices: 

c). Technical 

Review 

Committee 

Charter; and 

d). CROMERR 

authorized 

program review 

for approval 

flowchart. 

2 Update 

CROMERR 

procedures to state 

where 

CROMERR 

applications and 

modifications to 

applications are 

sent. 

The step-by-step guide for authorized programs 

found on the CROMERR website 

(http://epa.gov/cromerr/documents/cromerr_ste 

p_by_step_guide.pdf) provides the correct 

address for submitting applications. 

OEI will inventory all CROMERR websites 

and will update all website documentation to 

direct applicants to the step-by-step guide or 

remove information that is not consistent with 

the step-by-step guide. 

2nd Quarter 

FY 2014 

3 Develop and 

implement an 

oversight process 

to regularly notify 

Regions and 

Program Offices 

when TRC 

representative 

roles need to be 

filled. 

Over the past 18 months OEI has implemented 

procedures to ensure that all program offices 

and Regions are represented on the TRC as part 

of its overall effort to improve program 

administration and communication. OEI will 

codify these activities in a Standard Operating 

Procedure (SOP) that OEI will post on its 

internal OEI SOP intranet website. 

2nd Quarter FY 

2014 

5 Take the lead to 

create an 

enforcement 

policy and 

procedures that 

include 

implementing a 

process for: 

b). Following up 

with applicants 

that have 

approved 

CROMERR 

applications, 

noting any 

changes made to 

the approved 

b). With respect to post-approval changes, 

EPA’s approval letter informs applicants of 

their obligation to notify EPA of any changes 

(e.g., technology, business practices, statutory, 

regulatory) that would affect the system and 

includes, as an attachment, the procedure for 

notifying the agency and modifying the 

applicant’s program authorization if the change 

merits such modification. To date, EPA is not 

aware of any cases of non-compliance. 

1st Quarter 

FY 2013 

(complete) 

14-P-0143 29 
 

 

 

 

CROMERR 

application. 

6 Develop and 

implement a 

completeness 

review process 

with states, tribes, 

and local 

governments that 

is consistent with 

CROMERR. 

EPA will conduct completeness reviews on 

new applications that are consistent with 

CROMERR’s requirements. 

3rd Quarter FY 

2014 

Disagreements 

No. Recommendation Agency Explanation/Response 

4 Document how 

attorneys verify the 

validity of an AG 

certification, including 

how to determine an 

authorized AG designee. 

While AG certifications vary in content, OGC finds that 

agency regulations at 40 C.F.R. section 3.1000(b)(1)(i) 

clearly articulates the standards by which to evaluate the 

AG certifications. 

5 Take the lead to create 

an enforcement policy 

and procedures that 

include implementing a 

process for: 

a). Verifying system 

functionality prior to the 

TRC approval of 

CROMERR 

Applications. 

a). CROMERR’s requirements to review and approve 

applications for authorized program 

modifications/revisions are modeled on EPA’s primacy 

regulations, which rely on the accuracy of the information 

provided by authorized programs. The regulation does not 

authorize the agency to verify system functionality prior to 

application approval. 

14-P-0143 30 
 

 

Appendix D 

Subsequent Agency Response to Draft Report (OEI) 

AGENCY’S RESPONSE TO REPORT RECOMMENDATIONS 

Agreements 

No. Recommendation High-Level Intended Corrective Action(s) Estimated 

Completion by 

Quarter and 

FY 

1 Update 

CROMERR 

procedures to 

remove references 

to the Exchange 

Network Policy 

and Planning 

Workgroup 

(ENPPW) and 

Quality 

Information 

Council – 

Exchange 

Network 

Subcommittee 

(QIC-ENS) 

because they no 

longer participate 

in the CROMERR 

program, 

including: 

a). EPA Procedure 

for Approval of 

State, Tribal, or 

Local 

Government 

Authorized or 

Delegated 

Program 

Applications for 

Implementing 

CROMERR; and 

b). EPA 

Procedure for 

1.1 a and b – Submit updated Procedure 

Documents to CIO for review and approval 

1st Quarter 

FY 2014 

1.1 c – Update Technical Review Committee 

Charter 

1st Quarter 

FY 2013 

(complete) 

1.1 d – Update flow chart 1st Quarter 

FY 2013 

(complete) 

1.2 a and b – Submit updated Procedure 

Documents to CIO for review and approval 

1st Quarter 

FY 2014 

1.3 a and b – Obtain CIO approval of updated 

Procedure Documents 

4th Quarter FY 

2014 

1.3 EPA will review CROMERR documents 

every three years to ensure that the content 

reflects current practices 

2nd Quarter FY 

2017 

14-P-0143 31 
 

 

 

Implementation of 

CROMERR for 

EPA Systems. 

Update the 

following 

documents to 

reflect current 

business practices: 

c). Technical 

Review 

Committee 

Charter; and 

d). CROMERR 

authorized 

program review 

for approval 

flowchart. 

2 Update 

CROMERR 

procedures to state 

where 

CROMERR 

applications and 

modifications to 

applications are 

sent. 

The step-by-step guide for authorized programs 

found on the CROMERR website 

(http://epa.gov/cromerr/documents/cromerr_ste 

p_by_step_guide.pdf) provides the correct 

address for submitting applications. 

OEI will inventory all CROMERR websites 

and will update all website documentation to 

direct applicants to the step-by-step guide or 

remove information that is not consistent with 

the step-by-step guide. 

2nd Quarter 

FY 2014 

3 Develop and 

implement an 

oversight process 

to regularly notify 

Regions and 

Program Offices 

when TRC 

representative 

roles need to be 

filled. 

Over the past 18 months OEI has implemented 

procedures to ensure that all program offices 

and Regions are represented on the TRC as part 

of its overall effort to improve program 

administration and communication. OEI will 

codify these activities in a Standard Operating 

Procedure (SOP) that OEI will post on its 

internal OEI SOP intranet website. 

2nd Quarter FY 

2014 

4 Create and 

implement an 

internal guidance 

the staff will use 

to determine 

acceptable 

evidence for an 

authorized AG 

designee. 

14-P-0143 32 
 

 

5 Create a process 

to determine if the 

information 

included in the 

CROMERR 

application is 

reliable and 

accurate prior to 

the CROMERR 

application being 

approved. 

As part of OEI’s internal completeness review 

process for an application, OEI prepares 

detailed comments identifying all areas of an 

application where additional information is 

needed in order to determine if an application 

can be approved. OEI sends these comments to 

the applicant with the completeness 

determination letter and follows up with a 

conference call to review the comments and 

obtain the information required to determine 

the application to be complete. 

Ongoing 

6 Create a process 

to regularly follow 

up with applicants 

with approved 

CROMERR 

applications in 

order to confirm 

that no changes 

were made to the 

approved 

CROMERR 

application. 

OEI will utilize the CROMER Program 

Management System automated email 

capabilities to send all applicants with 

approved applications an annual reminder to 

inform OEI of any changes to their CROMERR 

applications. 

1st Quarter 

FY 2015 

14-P-0143 33 
 

 

Appendix E 

Distribution 

Office of the Administrator 

Assistant Administrator for Environmental Information and Chief Information Officer 

General Counsel 

Agency Follow-Up Official (the CFO) 

Agency Follow-Up Coordinator 

Associate Administrator for Congressional and Intergovernmental Relations 

Associate Administrator for External Affairs and Environmental Education 

Principal Deputy Assistant Administrator, Office of Environmental Information 

Principal Deputy General Counsel, Office of General Counsel 

Director, Office of Information Collection, Office of Environmental Information 

Division Director, Information Exchange and Services Division, Office of Environmental 

 Information 

Chief, Information Exchange Partnership Branch, Office of Environmental Information 

Associate General Counsel, General Law Office, Office of General Counsel 

Audit Follow-Up Coordinator, Office of Environmental Information 

Audit Follow-Up Coordinator, Office of General Counsel 

14-P-0143 34