Land use and institutional controls are usually linked, and should be considered together during the investigation phase of cleanup, according to EPA guidance. As a site moves through the early stages of the cleanup process, site managers should develop assumptions about reasonably anticipated future land uses and consider whether institutional controls will be needed to maintain these uses over time. EPA guidance states that, if remediation leaves waste in place that would not permit “unrestricted use” of the site and “unlimited exposure” to residual contamination, use of institutional controls should be considered to ensure protection against unacceptable exposure to the contamination left in place. Even sites that are appropriate for residential use after the cleanup process is complete may require institutional controls if they do not allow for unlimited use and unrestricted exposure. For example, residential properties may be located over a contaminated groundwater plume where the properties are not the source of contamination. In such a situation, well drilling restrictions put in place to limit the use of groundwater may serve as appropriate institutional controls. EPA recognizes four types of institutional controls—governmental controls, proprietary controls, enforcement and permit tools with institutional control components, and informational devices: Governmental controls use the regulatory authority of a government entity to impose restrictions. Generally, EPA must depend on state or local governments to establish these controls. Examples of governmental controls include zoning restrictions, local ordinances, and groundwater use restrictions. Proprietary controls involve legal instruments placed in the chain of title of the site or property, such as easements and covenants. Enforcement and permit tools with institutional control components are issued or negotiated to compel the site owner to limit certain site activities. These controls, which can be enforced by EPA under Superfund and RCRA legislation, include administrative orders and consent decrees. Informational devices warn the public of risks associated with using contaminated property. Examples of informational devices are deed notices, state registries of hazardous waste sites, and health advisories. Approximately 3,800 RCRA facilities have corrective action under way or will require corrective action. EPA refers to these facilities as its “corrective action workload.” Under the Government Performance and Results Act of 1993 (GPRA), which requires agencies to assess progress toward achieving the results expected from their major functions, EPA developed short-term goals for 1,714 of these facilities, referred to as the “GPRA baseline.” According to EPA’s GPRA goals, by 2005, EPA and the states will verify and document that 95 percent of the baseline facilities have “current human exposures under control” and 70 percent have “migration of contaminated groundwater under control.” According to EPA, over the last 10 years, the agency has focused increased attention on understanding and overcoming the complexities and challenges associated with using institutional controls. In recent years, this experience has led EPA to improve its approach to these controls. For example, the agency has hosted numerous meetings and workshops to identify institutional control issues and develop solutions; developed and administered national training programs for federal, state, tribal, and local agencies; developed a national strategy to help ensure that controls are successfully implemented; and established a national management advisory group to work on high-priority policy issues. Furthermore, in addition to issuing guidance in 2000 on evaluating and selecting institutional controls, the agency is currently developing four additional guidance documents covering specific implementation, monitoring, and enforcement issues. These improvements have been targeted at the full life- cycle of institutional controls from identification, evaluation, and selection to implementation, monitoring, and enforcement. In reviewing selected Superfund and RCRA sites in three different time periods or stages of cleanup, we found an apparent increase in the use of institutional controls over time. Two of the 4 older Superfund sites and 6 of the 8 older RCRA facilities we reviewed where cleanup was completed but residual contamination remained had no institutional controls in place. In contrast, of the 32 Superfund and 4 RCRA sites we reviewed where cleanup was completed during fiscal years 2001 through 2003 but residual contamination remained, 28 and 4, respectively, had one or more institutional controls in place. However, because EPA’s guidance is vague and does not specify in which cases controls are necessary, it is unclear whether any of the sites we reviewed were inconsistent with the agency’s policy. When considering recent remedy decisions in both programs, we found that, of the 112 Superfund and 23 RCRA remedy decision document sets we reviewed that were issued during fiscal years 2001 through 2003, most documents called for some type of institutional control to prevent or limit exposure to residual contamination. Moreover, although EPA guidance directs staff to include four specific factors in documenting the institutional controls to be implemented at a site, the documents we reviewed frequently included no more than two of these factors, and the language was often vague. In reviewing selected Superfund and RCRA sites in three different time periods or stages of cleanup, we found an apparent increase in the use of institutional controls over time. The proportion of Superfund sites with institutional controls in place increased from 10 percent for those deleted during fiscal years 1991 through 1993 to 53 percent for those deleted during fiscal years 2001 through 2003. The proportion of RCRA facilities with institutional controls in place increased from 5 percent for those sites we examined where corrective action was terminated prior to fiscal year 2001 to 13 percent for those sites where corrective action was terminated during fiscal years 2001 through 2003. Moreover, 83 percent of the Superfund and 65 percent of the RCRA remedy decision documents finalized during fiscal years 2001 through 2003 indicated the need for some sort of institutional controls, an increase over the proportion of completed sites with controls. (See tables 1 and 2.) While EPA recognizes that the use of institutional controls is becoming increasingly common, the agency points out that this should not be interpreted to mean that sites are being less thoroughly cleaned up. The EPA project manager for 1 Superfund site deleted with residual contamination and no institutional controls told us that if the site were being remediated today, EPA might consider institutional controls to restrict groundwater use. In addition, EPA is now considering institutional controls for a site that was cleaned up to a level allowing for unrestricted use and unlimited exposure at the time of remediation. The levels of acceptable lead contamination have decreased since completion of this remedy, so the levels of contamination at the site may now exceed the new standards. Four of the 12 older Superfund and RCRA sites we reviewed where residual contamination remained had institutional controls in place. Waste was left in place after cleanup at 4 of the 20 Superfund sites that were deleted during fiscal years 1991 through 1993; as figure 1 shows, one-half of these sites had institutional controls in place. Similarly, of the 40 RCRA facilities we reviewed where corrective action was terminated before fiscal year 2001, 8 had residual waste after cleanup; institutional controls appeared to be in place at 2 of these facilities (see fig. 2). The most common type of institutional control in place at these older Superfund and RCRA sites was a covenant; there was also a consent order and a conservation easement, as shown in figure 3. A covenant, as used in the institutional controls context, is a promise by a landowner to use or refrain from using the property in a certain manner. A consent order contains elements of both an administrative order (an order issued and enforced by EPA or states directly restricting the use of property) and a consent decree (in this context, a court order that implements the settlement of an enforcement case, which may restrict the use of the land by the settling party, such as prohibiting well drilling). A conservation easement, allowed by statutes adopted by some states, is established to preserve and protect property and natural resources. EPA guidance encourages the use of multiple controls—referred to as “layering”—stating that it is more effective than using only one institutional control. Controls were layered at only 1 of these 4 older sites. Conservation easement (1) Covenant (3) In contrast to sites where cleanup was completed in earlier years, 32 of the 36 Superfund and RCRA sites we reviewed where residual contamination remained after cleanup had one or more institutional controls in place. At most of the 53 Superfund sites deleted from the NPL during fiscal years 2001 through 2003, institutional controls were implemented if waste was left in place (see fig. 4). Furthermore, future controls were being considered at 2 of the sites where institutional controls were not originally planned. Of the 31 RCRA facilities we reviewed where corrective action was terminated during fiscal years 2001 through 2003, most corrective actions did not result in waste being left in place and, therefore, the facilities likely did not require institutional controls. As figure 5 shows, only 4 facilities had waste remaining, and all of these had institutional controls in place. The most common types of institutional controls in place at these Superfund and RCRA sites were covenants and consent decrees, followed by deed notices and easements (see fig. 6). Deed notices are informational documents filed in public land records, and these notices alert anyone searching the records to important information about the property. Easements are property rights conveyed by landowners to other parties, giving them rights with regard to the owner’s land. Of the 28 Superfund sites with institutional controls, 17 included multiple controls, or layering, as encouraged by EPA guidance. One of the 4 RCRA facilities had multiple institutional controls. In total, there were 66 controls in place at the 32 sites. Deed notice (8) Consent decree (12) Covenant (19) For both recently completed and older sites we reviewed, 6 of 36 Superfund sites and 6 of 12 RCRA sites with waste remaining did not have institutional controls in place. EPA site managers told us that the potentially responsible parties or property owners of several sites we reviewed had agreed to file a proprietary or informational control, such as a covenant or deed notice, to limit the use of the contaminated land or water. However, following our request for documents, EPA staff discovered that the controls had not been implemented. EPA is now working to implement institutional controls for some of these sites to ensure the protection of human health and the environment. Finally, at several sites we reviewed where contamination was left in place, the remedy decision documents did not call for institutional controls. Some of these sites were delegated to states for monitoring and possible future action. For example, in one case, groundwater contamination was contained as long as wells at a nearby plant continued to operate—the wells, which pump approximately 10 million gallons a day, provide protection by capturing contaminants from a former landfill on site before they migrate into the off-site groundwater. EPA asked the state to assume responsibility for monitoring the continued operation of the wells and to conduct an examination of groundwater contamination if well operation ceased. Finally, deleting Superfund sites and terminating corrective action at RCRA facilities where waste remains without implementing institutional controls may be contrary to EPA guidance. Guidance issued in 2000 states that an institutional control is generally required if the site cannot accommodate unrestricted use and unlimited exposure. However, the guidance does not specify under what circumstances controls are necessary. Instead, it uses language like “generally required” and “likely appropriate.” Four of the sites deleted during fiscal years 2001 to 2003, after the guidance was issued, had residual contamination but no institutional controls in place. However, because EPA’s guidance is vague and does not specify in which cases controls are necessary, it is unclear whether any of the sites we reviewed were inconsistent with the agency’s policy. EPA’s institutional controls project manager believed that some of these deviations from EPA’s guidance may have occurred because, during the period between the completion of the cleanup and site deletion, site managers may have inadvertently overlooked the need to implement the institutional controls. In reviewing files for 135 Superfund and RCRA remedy decisions that were issued during fiscal years 2001 through 2003, we found that most of the documents we reviewed called for some type of institutional control to prevent or limit exposure to residual contamination. As previously mentioned, we reviewed the principal remedy decision documents issued during this time period; however, other remedy decision documents may also include information about institutional controls. Of the 112 Superfund remedy decisions, 85 called for institutional controls. In 8 additional cases, remedy decision documents called for institutional controls under certain circumstances but not others. For example, one Superfund remedy decision document outlined the need for institutional controls if excavated contaminated soil were to be disposed of on-site, rather than at another facility. Finally, some of the Superfund documents we examined were interim remedy decision documents; while some of those documents did not call for institutional controls, future documents may include provisions for such controls if waste is left on-site after remedy construction is completed. Of the 23 RCRA remedy decisions issued between fiscal years 2001 and 2003, 15 called for institutional controls. Many remedy decision documents did not identify the specific institutional control mechanism, or type of control, to be used. Of the 93 sets of Superfund remedy decision documents we examined that called for institutional controls under all or certain circumstances, 81 discussed the mechanism to some degree. Almost all of the 15 sets of RCRA remedy decision documents we examined that called for institutional controls discussed the mechanism to a certain extent. However, in both sets of documents, these discussions were often vague, gave a list of options, or discussed mechanisms for one planned control but not another (e.g., a document only specified an institutional control mechanism for restricting the use of groundwater and did not specify a control for contaminated soil). For those documents that discussed specific institutional controls— including those that listed options rather than a selected control or controls—deed notices and groundwater use restrictions, followed by covenants and zoning, were most commonly mentioned, as shown in figure 7. Twelve of the documents were vague in describing a mechanism, and, in 13 cases, the documents did not mention a mechanism at all. Covenant (25) Deed notice (29) Groundwater use restriction (32) Other types of institutional controls (55) Thorough planning is critical to ensuring that institutional controls are implemented, monitored, and enforced properly. EPA guidance specifies that staff should evaluate institutional controls in the same level of detail as other remedy components. Furthermore, it advises staff to make several determinations regarding a number of key factors (see table 3) and to describe them in the remedy decision documents. As EPA’s draft guidance on institutional controls points out, without specific information on the institutional controls—such as their objectives; the mechanisms (or kinds of controls) envisioned; the timing of their implementation and duration; and who will be responsible for implementing, monitoring, and enforcing them—the site manager and site attorney may be unable to interpret the intent of the remedy selection document. For example, managers currently responsible for some sites we reviewed were not involved with the remedial investigation or preparation of the ROD for the sites and, therefore, may not fully understand what types of controls were envisioned when the document was written. In addition, without specific information on the proposed institutional controls for a site, the public may not fully understand the restrictions on site use necessary to prevent exposure to residual contamination. Vague language may also result in creating unintended rights and/or obligations. As shown in figures 8 and 9, the remedy decision documents we examined generally discussed the objective of the institutional controls. Eighty-six of the 93 sets of Superfund documents we reviewed that addressed institutional controls (whether under all or certain conditions), and all of the document sets for the 15 RCRA sites, discussed the objective, at least in general terms. For both programs, however, the level of detail in the discussion of the objective varied greatly. For example, one Superfund ROD called for “the use of institutional controls to help prevent human exposure to any residual contaminants at the site following the completion of remedy construction,” which is a general purpose of institutional controls rather than a specific objective. Other decision documents included more detailed discussions of objectives; for example, one document discusses institutional controls “for future development that would prevent inappropriate disturbance of remediated mine sites and potential remobilization of contaminants” and “to prevent the use of new drinking water wells where contaminated aquifers exist.” Of the 93 sets of Superfund documents and 15 sets of RCRA documents we examined, 81 and 14, respectively, discussed the mechanism to be used, at least generally. However, the specific mechanism for each institutional control was identified in only 35 of the sets of Superfund documents and in 5 of the sets of RCRA documents. Most discussions were vague, gave a list of options, or discussed mechanisms for one planned control but not another. For example, 24 documents mentioned “deed restrictions” without detailing how the deed would be restricted. EPA guidance points out that the term “deed restriction” is not a traditional property law term, but rather a shorthand way of referring to types of institutional controls. Furthermore, it states that site managers should avoid the generality of “deed restriction” and instead be specific about the types of controls under consideration. Other remedy decision documents were incomplete, suggesting mechanisms for one medium, such as soil, but not another, such as groundwater. In 30 of the Superfund cases and 4 of the RCRA cases, the remedy decision documents gave several options for control mechanisms rather than identifying those that were most appropriate. In contrast, some documents do include a detailed discussion of the institutional control mechanism. For example, one document suggested implementing and monitoring deed notices to ensure that land use is consistent with the cleanup levels selected for the site. If the land is used for residential purposes, additional institutional controls, such as a restrictive covenant, may be needed to limit access to soils. Because some institutional controls—such as informational devices—cannot be enforced, or may not transfer if the property is sold, careful consideration of the institutional control mechanism is generally necessary. EPA guidance points out that since parties other than EPA often implement institutional controls, site managers should consider the time required to put a control in place. However, as shown in figures 8 and 9, less than one- third of the Superfund remedy decision documents and only 1 of the RCRA documents we examined specified the timing of institutional control implementation. Twenty-five Superfund documents and 1 RCRA document specified when the institutional controls should be implemented—for example, “before the RA is final”—although some of the documents were vague or only indicated timing for one out of several controls. Moreover, for 14 of the Superfund sites, the institutional controls referred to in remedy decision documents had already been implemented. Documents for 45 Superfund and 4 RCRA sites specified how long the institutional controls should remain in place—which was, in most cases, until the contamination was no longer present or cleanup levels were achieved. However, some of the documents indicated the duration of only one of several planned controls. In the remedy decision documents we examined, many of the Superfund and RCRA documents did not discuss any of the parties responsible for implementing, monitoring, and enforcing institutional controls. To the extent that responsibility was addressed, most of the discussion centered only on the implementing party, rather than those responsible for monitoring and enforcing institutional controls. Only 11 Superfund and 3 RCRA document sets discussed parties responsible for monitoring institutional controls, and only 13 Superfund and 4 RCRA document sets discussed parties responsible for enforcing institutional controls (see figs. 8 and 9). According to the EPA draft guidance issued in December 2002, early cooperation and coordination between federal, state, and local governments in the selection, implementation, and monitoring of institutional controls is critical to their implementation, long-term reliability, durability, and effectiveness. Where EPA is implementing a remedy, states often play a major role in implementing and enforcing institutional controls. In addition, under the RCRA program, the state typically imposes and oversees the remedial action. Some governmental controls may be established under state jurisdiction. Furthermore, a local government may be the only entity that has the legal authority to implement, monitor, and enforce certain types of institutional controls, such as zoning changes. EPA guidance states that while EPA and the states take the lead on response activities, local governments have an important role to play in the implementation, long-term monitoring, and enforcement of institutional controls. Without the cooperation of these other parties, the successful implementation of institutional controls may not be ensured. In many cases, remedy documents we examined contained no evidence that planning of institutional controls included consideration of all aspects of the four key elements in the remedy selection process. In total, 34 of the 93 sets of Superfund and 5 of the 15 sets of RCRA remedy decision documents discussed all four elements, at least in part. For example, the documents may have discussed the duration of the institutional controls but not when they will be implemented, or the documents may have discussed who will implement only one of the controls required. EPA’s institutional controls project manager stated that discussion in the ROD may be intentionally vague because key decisions on such issues as who may implement the remedy and institutional controls have not yet been made. He also speculated that site managers may not have given adequate consideration to all relevant aspects of institutional controls at the remedy decision stage. Without careful consideration of all four factors, an institutional control put in place at a site may not provide long-term protection of human health and the environment. Furthermore, EPA’s 2002 draft guidance recommends planning of the full institutional control life cycle early in the remedy stage—including implementation, monitoring, reporting, enforcement, modification, and termination—to ensure the long- term durability, reliability, and effectiveness of institutional controls. The guidance states that, critically evaluating and thoroughly planning for the entire life cycle early in the remedy selection process could have eliminated many of the problems identified to date. In addition, according to the EPA guidance, calculating the full life-cycle cost is an essential part of the institutional control planning process. This estimate is important to compare the cost-effectiveness of institutional controls with that of other remedy elements and to ensure that parties responsible for implementing, monitoring, and enforcing institutional controls understand their financial liability for these activities. Relying on institutional controls as a major component of a selected remedy without carefully considering all of the applicable factors—including whether they can be implemented in a reliable and enforceable manner—could jeopardize the effectiveness of the entire site remedy. At the Superfund sites we reviewed, institutional controls often were not implemented before site deletion, as EPA requires. Moreover, efforts to monitor institutional controls after they are implemented may also be insufficient. Finally, EPA may have difficulties ensuring that the terms of certain types of institutional controls in place at some Superfund and RCRA sites can be enforced, and state laws may limit EPA’s ability to implement and enforce needed controls. Institutional controls were often not implemented before site deletion, as required, at the Superfund sites we reviewed. Under EPA guidance, a site may not generally be deleted from the NPL until all appropriate response actions, including institutional controls, have been implemented. Timely implementation of institutional controls is important because, until the controls are in place at a site, there is a greater potential for the public to become exposed to any residual contamination. At 32 of the 53 Superfund sites deleted during fiscal years 2001 through 2003, institutional controls were likely appropriate, according to EPA guidance, because waste remained in place at these sites above levels that allowed for unrestricted use and unlimited exposure. Our discussions with cleanup officials and our review of supporting documentation, however, indicate that all institutional controls were implemented before site deletion at only 24 of these 32 sites. In the case of 4 of the remaining 8 sites, even though EPA site managers believed certain of the institutional controls had been implemented at the site, our subsequent requests for documentation revealed that these controls had not been implemented. At 2 of these sites, there were no institutional controls in place at all. In another 2 cases, institutional controls were implemented, but only after deletion of the site. In 2 other cases, remedy decision documents did not call for institutional controls, but because EPA guidance does not specify in which cases controls are necessary, it is unclear whether these 2 sites were inconsistent with this guidance. Furthermore, institutional controls were implemented before site deletion at only 2 of the 4 Superfund sites deleted during fiscal years 1991 through 1993 that had residual contamination above levels that would allow for unrestricted use of the site. The 2 other sites were deleted without institutional controls, even though the site manager for 1 of these sites believed there were institutional controls in place. EPA’s institutional controls project manager believed that sites with residual contamination may have been deleted without institutional controls at least in part because site managers lost track of the need to implement the institutional controls between the time that active remediation of the site ended and the site’s deletion. Implementation of institutional controls at the RCRA facilities we examined generally occurred by the time the corrective action was terminated. RCRA program guidance does not address the timing of implementation of institutional controls relative to termination of corrective actions. Rather, owners and operators of RCRA facilities that treated, stored, or disposed of hazardous waste must submit documentation indicating the location and dimensions of a closed hazardous waste facility before its closure. Facility closure in the RCRA program occurs after all RCRA-related activities at a site, including corrective action, end and after the facility undergoes a closure process. Among the 6 state RCRA corrective action programs we reviewed, state officials for 3 of the programs stated that if institutional controls are required, they must be in place before the RCRA corrective action is terminated. Of the 4 RCRA facilities where corrective action was terminated during fiscal years 2001 through 2003 that likely required institutional controls, only 2 had all controls in place by the time the corrective action was terminated. At 1 of the remaining facilities, the sole institutional control was implemented about 1 year after the corrective action was terminated; at the last facility, at least one of several controls was implemented after the corrective action was terminated. Monitoring of institutional controls at Superfund sites after they have been implemented may be inadequate to ensure their continued protectiveness. At sites where contamination is left in place above levels that allow for unlimited use of the site and unrestricted exposure to site contaminants, CERCLA requires reviews once every 5 years of the continued protectiveness of the remedy, including any institutional controls in place. According to EPA’s guidance, these 5-year reviews usually consist of community involvement and notification, document review, data review and analysis, site inspection, interviews, and a determination of remedy protectiveness. As a part of these reviews, EPA’s guidance calls for a determination of whether institutional controls successfully prevent exposure to site contaminants and a specific check on whether they are still in place. EPA officials acknowledged, however, that reviews that only occur every 5 years may be too infrequent to ensure the continued protectiveness of the institutional controls. At some of the sites we examined, 5-year reviews uncovered institutional control violations that could have been discovered and stopped earlier with more frequent monitoring. For example, an institutional control at 1 Superfund site we examined prohibited any use of groundwater without prior written approval from EPA. When EPA conducted its 5-year review in April 2003, agency officials discovered that over 25 million gallons of groundwater from the site had been pumped for use as drinking water during 2002. Moreover, the agency official who conducted the 5-year review did not know how long groundwater had been pumped without EPA’s approval. While many Superfund sites are no longer active, sites that are being reused may be especially vulnerable to activities occurring on-site that may violate an institutional control during the time period between 5-year reviews. At 1 Superfund site we visited, for example, the institutional control for the site requires monitoring for worker safety precautions during digging on the site. At the time of our site visit, however, active digging was occurring at the site about which the EPA official charged with supervising the site was not aware (see fig. 10). The EPA official had not visited the site since the previous 5-year review, which had occurred 4 years earlier. Five-year reviews, even when they do eventually occur, may not ensure that institutional controls are in place. EPA’s guidance on conducting 5-year reviews instructs officials conducting the review to verify that (1) institutional controls are successful in preventing exposure to site contaminants and (2) institutional controls are in place. We interviewed officials at the 32 Superfund sites deleted during fiscal years 2001 through 2003 and the 4 Superfund sites deleted during fiscal years 1991 through 1993 with residual contamination. Most of these officials stated that, during 5-year reviews, they confirmed that the site remedy—including institutional controls—continued to protect the public from exposure to site contaminants. However, while they usually confirmed the protectiveness of the remedy, 8 did not also verify that site institutional controls were in place. For example, EPA site managers in charge of 3 sites told us they generally did not check whether institutional controls were in place during 5-year reviews. Managers of 4 other sites stated that they generally verified that institutional controls were in place during 5-year reviews; our subsequent requests for documentation, however, revealed that the institutional controls these site managers believed to be in place were never actually implemented. One additional site manager was unsure whether the 5-year review process even included a check on the continued presence of institutional controls. A determination that institutional controls successfully prevent exposure to contaminants at a site is meaningless if the controls that are supposed to be at the site are, in fact, not in place, or their presence is unknown. Unless EPA verifies that institutional controls remain in place during its 5-year reviews, the agency cannot ensure the continued protectiveness of site remedies. Monitoring of Superfund sites by parties other than EPA may occur more often than every 5 years, but this monitoring may not significantly contribute to ensuring the protectiveness of institutional controls at sites. Thirty-two Superfund sites were deleted during fiscal years 2001 through 2003 with contamination left in place. At 26 of these sites, parties responsible for contamination, site owners, or state or local government entities were responsible for conducting some form of site monitoring in addition to the 5-year reviews. In principle, this additional monitoring could help to ensure that site institutional controls remain protective. Often, however, this monitoring is unrelated to the institutional controls on the site. At fewer than half of these 26 sites, for example, do the additional monitoring activities specifically include a review of the sites’ compliance with institutional controls; at the other sites, monitoring either focused on analyzing site groundwater or on other activities. Moreover, at none of the 26 sites did monitoring include a specific check on whether site institutional controls were in place, as 5-year reviews do. In fact, at 4 of these sites, monitoring that checked whether institutional controls were in place would have found that controls that had supposedly been implemented were not. In addition, some parties responsible for site monitoring sometimes do not meet their monitoring requirements. In 4 cases, site managers indicated that monitoring parties had either not performed the required monitoring or they were unable to provide documentation of this monitoring. In 1 case, for example, an official in a town with a Superfund site refused to perform monitoring of the site, even though there was significant evidence of trespassing at the site, according to the responsible EPA site manager. In contrast with the Superfund program, the RCRA corrective action program does not include any national requirement to review facilities with residual contamination that have been closed. As a result, EPA has no way of knowing whether institutional controls implemented at such facilities remain in place, or whether they remain protective of human health and the environment. At least some states, however, conduct their own monitoring of closed RCRA corrective action facilities, including determining whether institutional controls remain in place and have not been violated. This practice may be in recognition of the necessity to track the status of RCRA facilities that have waste in place after the corrective action process is terminated and they are closed. Officials that we interviewed in 4 of 6 states reported some form of postclosure monitoring of RCRA corrective action facilities in their states; an official in 1 additional state stated that her agency is working to implement such monitoring. Two of these states specifically require that facility owners self-certify the continued presence of institutional controls. One state program, for example, requires facility owners to submit a form every 2 years certifying that facility institutional controls are still in place. In addition, this state’s officials conduct inspections of the closed sites every 5 years, during which they verify the self-certifications and ensure that institutional controls remain in place. As of 2001, according to a 50-state survey that an independent research group prepared using funding from EPA, 17 states had established schedules for auditing sites where institutional controls have been implemented, including 7 states that review such sites at least annually. In addition to potentially inadequate monitoring, EPA may have difficulties enforcing the terms of certain institutional controls currently in place, or planned, for some Superfund and RCRA sites. Some institutional controls selected for sites are purely informational and do not limit or restrict use of the property. Informational institutional controls, according to EPA’s guidance, include deed notices, state hazardous waste registries, and advisories to the public. For example, while a deed notice—which is required by the RCRA corrective action program for certain closed facilities—alerts anyone searching land records to the continuing presence of contamination at the site, such a notice does not provide a legal basis for regulators to prevent a property owner from disturbing or exposing that contamination. Seven of the 32 Superfund sites deleted during fiscal years 2001 through 2003 with waste remaining had some form of informational institutional control in place. Furthermore, EPA recognizes that another mechanism used often at sites to impose institutional controls, a consent decree, is not by itself binding on subsequent property owners or occupants. We found consent decrees in place at 12 of the 32 Superfund sites with residual contamination deleted during fiscal years 2001 through 2003. The use of multiple institutional controls at the same site could alleviate concerns about the use of nonenforceable mechanisms, as long as one of the additional controls is enforceable. In some cases, however, informational, nonenforceable institutional controls were the only controls in place at sites. This was the case at 1 of the Superfund and 2 of the RCRA corrective action sites that we examined that had reached the end of the cleanup process. Moreover, among the sets of remedy decision documents finalized during fiscal years 2001 through 2003 that we examined, 56 of 112 Superfund and 6 of 23 RCRA corrective action sets of documents specified at least one institutional control mechanism; among these, 6 of the Superfund and 3 of the RCRA sets of documents specified only an informational device as the sites’ institutional control. State property laws, which traditionally disfavor restrictions attached to deeds and other land use restraints in order to encourage the free transferability of property, can hinder EPA’s ability to implement and enforce institutional controls. EPA’s guidance warns that state property laws should be researched to ensure that certain types of institutional control mechanisms can be enforced. For example, one state only allows use restrictions attached to a deed to be enforced for 21 years from the recording of the deed. As an EPA official charged with managing a site with such restrictions in this state recognized, the issue of following up on this site after 21 years presents a planning problem for EPA. In several cases, EPA or state officials stated that property owners had to agree before certain proprietary controls, including covenants, could be put in place. Therefore, EPA officials are forced to negotiate aspects of the institutional control with the property owner. This process has the potential to compromise or dilute the enforceability of the proprietary control that is ultimately negotiated. Because RCRA generally does not authorize EPA to acquire any interests in property, many proprietary controls require that third parties such as states be willing to be involved. RCRA officials must thus rely on states, localities, or sometimes even adjacent property owners to hold an easement over a facility property. At least one EPA regional official we interviewed was aware of a state that refuses to serve as a third party in such cases, limiting EPA’s ability to put in place such institutional controls. States have legislative options available to help ensure that institutional controls can be enforced. Certain states have enacted statutes that provide the state with the legal authority to restrict land use at contaminated properties. Colorado, for example, passed legislation in 2001 that allows the state’s Department of Public Health and Environment to hold and enforce environmental covenants. Colorado’s agreements are binding upon current and future owners of the property, thus allowing the state to enforce these agreements should they be violated. These covenants had been used at 11 state sites, including 1 RCRA corrective action facility, as of August 2004. In addition, several states have adopted statutes providing for conservation easements, which override certain common law barriers to enforcement. A recent effort by the National Conference of Commissioners on Uniform State Laws sought a way to allow states to implement enforceable institutional controls. In 2003, this group finalized a Uniform Environmental Covenants Act that is available for state legislative adoption. According to the group, this legislation provides clear rules for state agencies to create, enforce, and modify a valid real estate document— an environmental covenant—to restrict the use of contaminated real estate. The act creates this new type of institutional control and, according to the group, ensures that it can be enforced. Several states have shown interest in adopting the legislation, according to the chairman of the group that drafted it. Institutional controls help to ensure the protectiveness of remedies at Superfund and RCRA sites where waste remains in place after cleanup. If institutional controls are not properly functioning or cease to apply to the site, the administrative and legal barriers between the residual contamination and potential human exposure to site contaminants disappear. Because of the potential danger of losing these barriers, EPA has recognized the importance of monitoring whether institutional controls are still in place and whether they continue to prevent exposure to residual contamination during its 5-year reviews. Current efforts to monitor institutional controls, however, may not occur with sufficient frequency to identify problems in a timely manner and may not always include checks on controls. Institutional controls are often key components of selected cleanup remedies and, as such, need to be monitored, enforced, and kept in place as long as the danger of exposure to residual contamination remains. Residual contamination can remain at a site long after EPA’s involvement is completed, and an entity other than EPA may assume responsibility for long-term monitoring and enforcement of the controls. However, historically, EPA had no system in place to readily identify which sites had institutional controls in place or whether the controls were being monitored and enforced. To improve its ability to ensure the long-term effectiveness of these controls, EPA has recently begun implementing tracking systems for its Superfund and RCRA corrective action programs. These systems currently track only minimal information on the institutional controls—as currently configured, they do not include information on long-term monitoring or enforcement of the controls. In addition, initial reports of tracking system data show that there are potential problems in implementing the systems. Regulators must track institutional controls at hazardous waste sites in order to ensure that they remain effective over the long term. Such controls are often intended to remain in place long after cleanup work has been completed to ensure that a site’s future use is compatible with the level of cleanup at the site and to limit exposure to residual contamination. EPA maintains that an institutional control tracking system should include information about the selection and implementation of the controls as well as their monitoring, reporting, enforcement, modification, and termination. According to EPA, several unique characteristics of institutional controls make tracking them particularly challenging. First, the life-span of institutional controls may begin as early as site discovery and can continue for as long as residual contamination remains above levels that would allow for unrestricted use or unlimited exposure. Therefore, institutional controls may remain necessary at a site indefinitely. Second, the long-term effectiveness of institutional controls depends on diligent monitoring, reporting, and enforcement. Third, institutional controls are often implemented, monitored, and enforced by an entity other than the one responsible for designing, performing, and/or approving the remedy. As a result, an entity other than EPA may be responsible for ensuring that one of the remedy’s critical components—the institutional control—is both effective and reliable in the long term. Historically, EPA has had no way to (1) readily identify which hazardous waste sites relied on institutional controls to protect the public from residual contamination or (2) monitor how the controls were working over the long term. According to EPA’s institutional controls project manager, the need for institutional control tracking systems has been discussed since at least the early 1990s, and environmental groups have long advocated the development of such systems. While several existing EPA information systems track basic information on hazardous waste sites, such as cleanup status and selected remedies, these systems were not designed to capture information on institutional controls at the level of detail necessary to allow for effective tracking and monitoring of the use of these controls. As previously discussed, our analysis of EPA’s use of institutional controls at Superfund and RCRA sites showed that the agency has generally not ensured that institutional controls are adequately implemented, monitored, and enforced. In some cases, for example, we found that controls had not been implemented on a timely basis, and, in at least 4 cases, controls that agency staff thought were in place had never been implemented. An effective institutional control tracking system may alert EPA management to such situations. EPA has recently begun implementing institutional control tracking systems for the Superfund and RCRA corrective action programs. The Institutional Controls Tracking System (ICTS) was designed with the capability to track controls used in a variety of hazardous waste cleanup programs. However, at least initially, ICTS will only include data for Superfund “construction complete” sites. For RCRA corrective action sites, EPA is utilizing its existing RCRA information database to identify sites where institutional controls have been established. In both instances, the EPA tracking systems include only limited, basic information. EPA has not yet decided the extent to which ICTS may be expanded in the future to include more detailed information. The RCRA program currently has no plans to track more detailed information regarding institutional controls at its facilities. EPA began developing ICTS in 2001. According to EPA, ICTS is a state-of- the-art tracking system that is Web-based, is scalable, and will serve as the cornerstone for future programmatic and trend evaluations. The system is built around a cross-program, cross-agency, consensus-based institutional control data registry developed by the agency. The ICTS draft project management plan notes that EPA envisioned an integrated tracking system that would be developed collaboratively using a work group approach that relied on existing data sources for its information. The primary sources of the data to be entered in ICTS include RODs and any amendments; explanations of significant differences; notices of intent to delete; and actual institutional control instruments, such as consent decrees, easements, ordinances, and advisories. The objectives of ICTS are to make institutional controls more effective by creating links across all levels of government through a tracking network; improve EPA program management responsibilities; establish relationships with coregulators (other federal agencies, along with state and local regulatory agencies); improve information exchange with individuals interested in the productive use of a site after cleanup; and improve existing processes allowing for notification to excavators of areas that are restricted or need protection prior to digging. EPA designed ICTS to be implemented in three separate phases, or “tiers,” of data collection activities. The initial data gathering effort was focused on collecting Tier 1 data for all sites on the Superfund construction complete list, which includes all deleted sites. Data collected during Tier 1 can be used by EPA management to generate reports with basic status information about institutional controls at sites. Tier 1 data consist of information on whether site decision documents report the presence of residual contamination at the site above a level that prohibits unlimited use and unrestricted exposure, and if present, whether the documents call for controls; the objectives of the institutional control; the specific control instruments, including the administrative or legal mechanism that establishes a specific set of use restrictions; any person and/or organization that may be directly or indirectly involved with institutional controls at the site; and the source of the information that is entered into the data entry form. The initial version of ICTS was designed to provide some baseline information on institutional controls and a step toward a more comprehensive system. EPA envisions that Tier 2 would (1) identify which institutional controls are in place to prevent use of which media (e.g., soil or groundwater); (2) identify parties responsible for implementing, monitoring, and enforcing the controls; and (3) provide for attaching the latest inspection report. Tier 3 information would include detailed site location information, such as the actual boundaries of the institutional controls. According to the draft ICTS quality assurance project plan, EPA plans to make information from ICTS accessible to EPA and other federal agencies, state and local governments, tribes, and industry groups. Some information may also be made available to the public via the Internet about site-specific institutional controls near and within local communities. Initially, only data for those Superfund sites where construction of remedies has been completed will be entered into ICTS. Although no decision has been made to date, future data collection efforts may include additional sites in EPA’s other cleanup programs (RCRA and Underground Storage Tanks). According to ICTS plans, the tracking system also has the flexibility to include data for sites in other programs, such as Brownfields and State Voluntary Cleanup Programs. Between April and July 2004, EPA regions entered data into ICTS for most of the 899 Superfund construction complete sites, including data on about 280 sites that had been deleted from the NPL. Reports on these data indicate that 154 of the deleted sites had residual contamination; institutional controls were reported for 106 of these sites. Site decision documents did not report institutional controls for the other 48 sites, or about one-third of the deleted sites with residual contamination. EPA’s institutional controls project manager cautioned, however, that the data reported may be inaccurate and need to be verified. The official was concerned, for example, that (1) the standard for what constitutes residual contamination was not consistently applied across all regions, (2) some data may have come from interim decision documents rather than final documents, and (3) some staff entering data into ICTS may have confused whether institutional controls were implemented or only planned. In addition, the EPA official stated that the EPA regions were asked to enter the data into ICTS in 8 weeks, using the best available information and/or their best professional judgment. Because of the expedited data entry, additional research into the status of institutional controls at the site- specific level and significant data quality assurance efforts are necessary to ensure the accuracy of the data. Upon completing the ICTS Tier 1 data entry, EPA plans to assess the data to evaluate the current status of institutional controls at all construction complete sites for data gaps and site-specific control issues. According to the ICTS strategy, once the agency has determined where data gaps and site-specific institutional control problems may exist, the agency will prioritize the work to address these issues on the basis of a variety of factors, including resources and the number of sites with potential issues. EPA’s goal is to identify and review institutional control problems at all construction complete sites over approximately the next 5 years, relying on a combination of special evaluations and scheduled 5-year reviews, focusing on deleted sites as the highest priority. The sites identified as priorities will likely be addressed through a special evaluation, unless a routine 5-year review is scheduled within 12 months of problem identification. Priority evaluations will focus on whether institutional controls were required and properly implemented for all media not cleaned up to levels that allow for unlimited use and unrestricted exposure. EPA does not yet know the scope of these priority evaluations, but expects that these evaluations will be conducted over the next 2 years, resources permitting. After 2 years, the remaining sites will be evaluated in conjunction with or as a component of the normal 5-year review process. To track institutional controls at RCRA corrective action sites, EPA modified RCRAInfo—the agency’s database of information on individual RCRA sites—to identify sites where institutional controls have been established as part of, or to augment, an interim or final corrective action. Details to be entered into RCRAInfo for pertinent sites include the type of institutional controls (governmental control, proprietary control, enforcement or permit tool, or informational device); the scheduled and actual dates that the controls were fully implemented and effective; and the responsible agency (state or EPA). While EPA currently has no plans to track more detailed information regarding institutional controls at its facilities, the RCRA database requires identifying a location where additional information concerning the specific control can be accessed (e.g., responsible agency contact information). In April 2004, EPA officials asked the regions and/or states to enter the requested information into RCRAInfo by September 30, 2004, for the 1,714 GPRA baseline facilities, and by the end of fiscal year 2005 for the remainder of the 3,800 RCRA facilities in the corrective action workload universe. Analysis of the RCRA institutional control tracking system information showed that, by November 22, 2004, only 4 EPA regions, and 7 states in those regions, had identified a total of 87 facilities where institutional controls had been established. Moreover, according to the head of EPA’s RCRA corrective action program, because the agency asked the regions and states to identify and report on only those facilities with institutional controls, rather than asking for reports on all sites indicating whether or not controls were established, the agency does not know the extent to which the data reported by this minority of regions and states are complete. Additionally, the official stated that the agency does not know whether the institutional controls that were reported were actually verified to be in place and operating as intended. In December 2004, the RCRA corrective action program official reminded officials in all 10 EPA regions of the importance of entering these data. Unlike the Superfund ICTS, the agency has no plans to verify that the institutional control information reported for RCRA corrective action facilities accurately reflects actual conditions. Information on institutional controls in the new Superfund and RCRA tracking systems was primarily derived from reviews of decision documents contained in the individual site files. As such, these data reflect the planned use of institutional controls, which may or may not reflect the controls as actually implemented. As previously noted, our review of the use of institutional controls at Superfund sites disclosed four cases where the planned controls had never been implemented. These cases illustrate the need for EPA to determine not only whether institutional controls were required at a site but also whether they were implemented. While EPA currently plans to review the actual use of controls at all Superfund sites with residual waste, such reviews may take up to 5 years to complete. The RCRA program, on the other hand, has no current plans to determine whether (1) institutional controls have been required in all appropriate situations or (2) all required controls were actually implemented. Information necessary to determine whether institutional controls are being monitored and enforced is not currently included in either the Superfund or RCRA tracking systems. As previously noted, monitoring of institutional controls at Superfund sites after they have been implemented may be inadequate to ensure their continued protectiveness. Failure to monitor or enforce institutional controls can lead to compromising the protectiveness of remedies put into place and, consequently, potential exposure of the public to residual hazardous waste. While EPA plans to include information on monitoring and enforcing institutional controls at Superfund sites in the Tier 2 data for ICTS, EPA’s institutional controls project manager stated that it is uncertain whether ICTS will ever be expanded to include Tiers 2 or 3 data. Further, there is no plan to include such information in the RCRA tracking system, since EPA regulations do not require any review of terminated RCRA corrective action sites. Currently both tracking systems only identify where an interested party may go to obtain more information on a particular site. As previously noted, the objectives of ICTS include improving information exchange with individuals interested in the productive use of a site after cleanup, and the existing processes allowing for notification to excavators of areas that are restricted or need protection prior to digging. EPA acknowledges that there is an immediate need for disseminating readily available information about institutional controls at contaminated sites. This need will only increase in the future as sites’ remediation advances and as more contaminated land and water resources are identified for potential reuse. Without knowledge of the controls at a site, excavators might unknowingly contact or otherwise disturb residual contaminated media. At this time, to obtain information about possible institutional controls at the site of interest, excavators would need to search many different databases and sources of information before operations could begin. While information on institutional controls at RCRA corrective action sites is planned to be available to the public by April 2005 and this capability is planned for ICTS in the future, EPA has not yet determined what information on institutional controls at Superfund sites will be made available to the public. Additionally, EPA currently has no assurance that the institutional control information on RCRA sites that will be made available to the public accurately reflects actual conditions. The Superfund ICTS and RCRA tracking systems, together, currently cover a universe of more than 2,600 hazardous waste sites. Expanding the existing tracking system information to reflect the institutional controls as actually implemented and to include long-term monitoring and enforcement information will likely be a resource-intensive task. Nevertheless, without such additional data, EPA has no assurance that the institutional controls actually implemented are continuing to provide the level of protectiveness intended. In this regard, EPA currently has established a task force that will decide what will be done with regard to any expansion of the institutional control tracking systems. Many of the sites that have been cleaned up under EPA’s Superfund and RCRA corrective action programs rely on institutional controls to ensure that the public is not exposed to sites’ residual contamination, and it is likely that a growing number of sites remediated in the future will rely on such controls. However, the long-term effectiveness of these institutional controls depends on EPA resolving several issues. First, EPA’s guidance does not specify under what circumstances a site with residual contamination should have institutional controls. Rather, the guidance states that an institutional control is “generally required,” or “likely appropriate,” if the site cannot accommodate unrestricted use and unlimited exposure. In addition, EPA has identified four factors in its guidance that should be considered during the remedy decision stage—the objective of the institutional control; the mechanism, or type of control, used to achieve that objective; the timing of the implementation of the control and its duration; and the party who will bear the responsibility for implementing, monitoring, and enforcing the institutional controls. Adequately addressing these factors is intended to help ensure that the control will effectively protect human health. But without documentation that these four factors are considered at the remedy decision stage, there is no assurance that sufficient thought has gone into designing the institutional controls and ensuring that they can be successfully implemented, monitored, and enforced. Once the controls are implemented, monitoring is necessary to determine their continued effectiveness and to check that they remain in place. Current efforts to monitor institutional controls, however, may not occur with sufficient frequency to identify problems in a timely manner and may not always include checks on controls. Finally, EPA’s current efforts to begin tracking institutional controls could be a positive step toward achieving successful implementation, monitoring, and enforcement of institutional controls at Superfund and RCRA sites. As presently configured, however, these tracking systems may not significantly contribute to improving the long- term effectiveness of institutional controls. Although EPA has recognized many of these problems and is developing draft guidance documents that may address many of them, until these documents are finalized, the extent to which they will resolve the problems we have identified is unclear. In order to ensure the long-term effectiveness of institutional controls, we recommend that the Administrator, EPA: clarify agency guidance on institutional controls to help EPA site managers and other decision makers understand in what cases institutional controls are or are not necessary at sites where contamination remains in place after cleanup; ensure that, in selecting institutional controls, adequate consideration is given to their objectives; the specific control mechanisms to be used; the timing of implementation and duration; and the parties responsible for implementing, monitoring, and enforcing them; ensure that the frequency and scope of monitoring at deleted Superfund sites and closed RCRA facilities where contamination has been left in place are sufficient to maintain the protectiveness of any institutional controls at these sites; and ensure that the information on institutional controls reported in the Superfund and RCRA corrective action tracking systems accurately reflects actual conditions and not just what is called for in site decision documents. We provided EPA with a draft of this report for its review and comment. EPA agreed with the findings and recommendations in the report and provided information on the agency’s plans and activities to address them. Regarding our recommendation that EPA clarify in its guidance when controls are needed, EPA stated that the agency will continue to develop cross-program guidance to clarify the role of institutional controls in cleanups and has a number of such guidance documents in draft form, under development, or planned. Regarding our recommendation that EPA demonstrate sufficient consideration of all key factors in selecting controls, EPA stated that the agency agrees that sufficient consideration of all key factors should be completed at remedy selection, but does not agree that this information should be included in the remedy decision document. However, our report does not suggest that the information should be included in the remedy decision document, but should be included in some cleanup-related documentation. Regarding our recommendation that EPA ensure that the frequency and scope of monitoring efforts are sufficient to maintain the effectiveness of the controls, EPA noted that it is revising guidance to address this issue. For example, according to EPA, the agency’s draft implementation, monitoring, and enforcement guidance will require periodic evaluation and certification from a responsible entity at the site stating that the controls both are in place and remain effective, and the draft implementation and assurance plan guidance will include specific roles and responsibilities for monitoring efforts. Finally, regarding our recommendation that EPA ensure that the information on controls reported in new tracking systems accurately reflects actual conditions, EPA stated that, among other actions, regions are currently undertaking a quality assurance effort to ensure that the information in the system reflects actual conditions. EPA’s completion of its ongoing and planned activities should, if implemented successfully, effectively address the concerns we raised in this report. In addition to comments directly relating to our recommendations, EPA also offered a number of general comments on the draft report. EPA pointed out that a “missing institutional control” does not, by itself, necessarily represent an unacceptable human exposure or environmental risk or suggest a breach of remedy. We agree that the mere presence of residual contamination at a site does not necessarily indicate the need for institutional controls, and we acknowledge that EPA generally—although not always—requires that institutional controls be put in place at sites where total cleanup is not practical or feasible. We believe, however, that in cases where EPA’s selected remedy for a particular site includes institutional controls as an integral component of the remedy, the agency has determined that such controls are necessary and, as such, the controls should be effectively implemented, monitored, and enforced. In addition, EPA noted that an evaluation of a small universe of sites may overestimate the number of sites with potential institutional control problems. However, we are not making any population estimates, but are describing only the results for those specific cases we reviewed. This report specifically acknowledges that the results from the nonprobability samples for our analysis cannot be used to make inferences about a population because some elements of the populations being studied have no chance or an unknown chance of being selected as part of the sample(s). Finally, EPA commented that an increased use of institutional controls does not mean that the agency advocates less treatment; we do not believe that this report implies that this is the case. The full text of EPA’s comments is included in appendix II. As agreed with your offices, unless you publicly announce the contents of this report earlier, we plan no further distribution until 30 days from the date of this letter. At that time, we will send copies of this report to the appropriate congressional committees; the Administrator, EPA; and other interested parties. We will also make copies available to others upon request. In addition, the report will be available at no charge on the GAO Web site at http://www.gao.gov. If you or your staff have any questions, please call me at (202) 512-3841. Key contributors to this report are listed in appendix III. The primary objective of this review was to examine the long-term effectiveness of institutional controls at nonfederal sites in the Environmental Protection Agency’s (EPA) hazardous waste cleanup programs. Specifically, we reviewed (1) the extent to which institutional controls are used at sites addressed by EPA’s Superfund and Resource Conservation and Recovery Act (RCRA) corrective action programs; (2) the extent to which EPA ensures that institutional controls at these sites are implemented, monitored, and enforced; and (3) EPA’s challenges in implementing systems to track these controls. Although both the Superfund and RCRA programs address federal and nonfederal sites, our review did not address federal sites because federal agencies are generally responsible for cleaning up their own sites and EPA involvement is limited. Furthermore, our review focused on institutional controls that remain in place after site deletion or termination to determine whether these controls are effective in the long run. We also focused our review of RCRA facilities on those whose cleanup was led by EPA. To examine the extent of the planned use of institutional controls, we examined all 112 Superfund records of decision (ROD)—involving 101 Superfund sites—finalized during fiscal years 2001 through 2003, and statements of basis or other final decision documents for all 23 RCRA corrective action facilities that reached the remedy decision stage during that period. In this regard, we examined only the principal remedy decision documents for the sites in our universe, rather than all remedy decision documents. Institutional controls may be called for in a number of EPA documents. In the Superfund program, at least two types of documents, in addition to RODs, may sometimes include information about institutional controls at the site—ROD amendments and explanations of significant differences. In the RCRA program, a variety of documents may include information about institutional controls, including permits, permit modifications, statements of basis, and other documents. Because of the number of potential sources of information regarding the planned use of institutional controls, we asked regional officials responsible for the sites to provide us with documentation relevant to the remedy decision at the site. In most cases, regional officials provided us with either a statement of basis, a final decision document, or both. Because we did not look at all remedy decision documents for these sites, we may not have captured all institutional controls at the sites we examined. To address the extent of institutional control use at Superfund sites and RCRA corrective action facilities, we examined EPA’s use of institutional controls at a nonprobability sample of nonfederal sites and facilities where (1) the cleanup process was completed in earlier periods, for historical perspective; (2) cleanup had recently ended; and (3) the remedy had only recently been selected, for insight into the future use of these controls. To gain a broader view of past use of institutional controls, we reviewed files for all 20 Superfund sites deleted from the National Priorities List (NPL) during fiscal years 1991 through 1993; in addition, in the two EPA regions with the most such facilities—Region III in Philadelphia and Region V in Chicago—we reviewed files for all 40 RCRA facilities at which, according to EPA’s database, a preliminary investigation was conducted and corrective action was terminated before fiscal year 2001. Regarding sites where the cleanup was recently completed, we examined site documentation for all 53 Superfund sites deleted from the NPL during fiscal years 2001 through 2003 and at all 31 RCRA facilities where corrective action was terminated during the same period. With the exception of the historical RCRA facilities we examined in two regions, for those deleted sites or terminated facilities whose documentation indicated the use, or potential use, of institutional controls, we conducted follow-up interviews with EPA or state officials knowledgeable about the site to obtain detailed information and additional documentation and to determine what institutional controls were actually in place. To identify the universe of Superfund sites deleted from the NPL during fiscal years 1991 through 1993 and 2001 through 2003, as well as those sites where a remedy decision was reached during fiscal years 2001 through 2003, we obtained data from EPA’s Comprehensive Environmental Response, Compensation, and Liability Information System (CERCLIS)—a computerized inventory of potential hazardous waste sites that contains national site assessment, removal, remedial, enforcement, and financial information for over 44,000 sites. CERCLIS is a relational database system that uses client-server architecture (i.e., each computer or process on the network is either a client or server), installed on separate local area networks at EPA headquarters and all 10 regional Superfund program offices, and is used by more than 1,900 EPA staff. A September 30, 2002, report issued by EPA’s Inspector General found that over 40 percent of CERCLIS data they reviewed were inaccurate or not adequately supported. The Inspector General’s review focused on site actions, which it defined as activities that have taken place at a site—such as site inspections, removals, studies, potentially responsible parties searches, RODs, and remedial actions. As a result of its review, the Inspector General concluded that CERCLIS could not be relied upon to provide error-free data to system users. For our review, we verified CERCLIS data related to the NPL sites in our universe, but we did not verify detailed site action data for all sites in CERCLIS. To address the reliability of CERCLIS data, we met with the Inspector General’s staff to discuss the nature of the errors disclosed in their report. According to the Inspector General’s staff, the reliability of CERCLIS data was more of a concern at the action level rather than the site level. They indicated that confirming the data with EPA regions would decrease concerns about data reliability. As a result, we confirmed all relevant CERCLIS data fields for all 53 NPL sites deleted during fiscal years 2001 through 2003 and all 23 NPL sites deleted during fiscal years 1991 through 1993; in addition, we verified information regarding all 232 remedy decisions, including 117 RODs, finalized during fiscal years 2001 through 2003. We verified all relevant CERCLIS data fields with staff in the relevant region, as appropriate, including confirming that sites were nonfederal and had been deleted or had a remedy decision during the time frames of interest. Regional staff found no errors with any of the deleted NPL sites in our universe. Regional staff identified errors regarding 2 of the 232 remedy decisions in our universe, including a change to information regarding 1 ROD, and added 1 remedy decision document to our universe, resulting in a 1 percent error rate. We corrected the CERCLIS site-level data that we used for our analysis to reflect regions’ changes. In addition, we obtained remedy documentation, Federal Register notices of deletion, and other documents from regional staff that corroborated the accuracy of our data. We also conducted interviews with officials knowledgeable about deleted sites where it appeared there were institutional controls or where it was unclear. As a result of these interviews and further analysis, we amended the number of records of decision finalized during fiscal years 2001 through 2003 to 112 and the relevant number of sites deleted during fiscal years 1991 through 1993 to 20. After taking these additional steps, we determined that the CERCLIS data we used were sufficiently reliable for the purposes of this report. In addition, we visited 5 Superfund sites that had been deleted from the NPL. For the site visits, we went to EPA Region III, headquartered in Philadelphia, which had (1) the most Superfund sites deleted during fiscal years 1991 through 1993 and fiscal years 2001 through 2003 and (2) the most RCRA facilities reaching corrective action termination during the latter time period. Over the course of 5 days in July 2004, we visited the 5 sites that had institutional controls in place in EPA Region III. We conducted a physical inspection of each site to verify compliance with the terms of the institutional controls in place, accompanied by either the EPA site manager or a representative of the responsible party, or both. We also visited the relevant county recorder’s office to verify that relevant institutional controls for each site had been recorded and to assess the process for accessing these documents. We also met with local officials responsible for informal monitoring of 1 site. In addition, we met with state officials to learn about a statewide system of groundwater management zones, an institutional control in place at 2 of the sites we visited. To identify the universe of RCRA facilities that reached the corrective action termination or remedy decision stage throughout the life of the program, and specifically during fiscal years 2001 through 2003, we obtained data from the RCRAInfo system—the EPA Office of Solid Waste’s national, mission-critical, major application consisting of data entry, data management, and data reporting functions used to support the implementation and oversight of the RCRA Subtitle C Hazardous Waste Program as administered by EPA and State/Tribal partners. RCRAInfo is a relational database management system (Oracle) that is centralized and Web-enabled, stored on a central Unix server at EPA’s Research Triangle Park, North Carolina, facility. Access to RCRAInfo is restricted to authorized EPA Headquarters, EPA Regional, and State staff with RCRA program oversight or implementation responsibilities. During our review, we also spoke with officials in each of the 10 EPA regions regarding their use of the code in the RCRAInfo system used to indicate the termination of corrective action. Specifically, we asked them whether a site coded in this way could include an institutional control, as had been indicated by an official in EPA headquarters early in our review. Officials in 6 EPA regions indicated that regional policy dictated that a site coded in this manner should not include institutional controls, while officials in the other 4 regions stated that it could. In addition, officials in 5 of the regions expressed doubts or uncertainty about whether use of the code had been consistent over time, whether personnel within their region used the code consistently, or whether states in the region interpreted the code in a uniform manner. While EPA’s Inspector General has not examined the reliability of the RCRAInfo database, at least one previous report about its predecessor system—the Resource Conservation and Recovery Information System—raised additional significant questions about data reliability. For our review, we verified the data obtained from RCRAInfo with knowledgeable staff in each EPA region. We asked regional officials to verify that (1) the facilities in our universe belonged there and (2) there were no facilities that should be present in our universe but were not. Verifying the facilities in our universe entailed verifying information about each facility, such as whether it was a federal or nonfederal facility, whether corrective action activities at the facility were led by the state or by EPA, and whether the site had reached the relevant milestone within the prescribed time frame. As a result, we checked all relevant RCRAInfo data fields for the 30 EPA-led RCRA facilities where corrective action was terminated during fiscal years 2001 through 2003 and 21 EPA-led RCRA facilities where a remedy decision was finalized during that period, according to data provided by RCRA officials in EPA headquarters. We verified all relevant RCRAInfo data fields with staff in the relevant region, as appropriate, including confirming that facilities were nonfederal and had had corrective action terminated or had a remedy decision during the time frames of interest. From our universe of RCRA facilities where corrective action was terminated, regional officials deleted 1 facility, added 3 more, and edited the data for 1 additional facility, for a total of 32 facilities. Subsequent follow-up work and interviews with site managers brought the relevant universe of RCRA facilities to 31. Similarly, from our universe of RCRA facilities where a remedy decision was finalized, regional officials deleted 1 facility, added 3 more, and edited the data for 1 additional facility, for a total of 23 facilities. We corrected the RCRAInfo data for facilities in our universe to reflect regions’ changes. In addition, we obtained documentation of remedy selection and corrective action termination from regional staff that corroborated the accuracy of our data. We also conducted interviews with knowledgeable site officials at terminated facilities where it appeared there were institutional controls or where it was unclear. After taking these additional steps, we determined that the RCRAInfo data we used were sufficiently reliable for the purposes of this report. To learn the extent to which EPA ensures that institutional controls at Superfund sites and RCRA corrective action facilities are implemented, monitored, and enforced, we interviewed EPA or state officials knowledgeable about particular sites. To identify sites of interest, we examined documentation related to all 20 Superfund sites deleted from the NPL during fiscal years 1991 through 1993, as well as all 53 Superfund sites deleted from the NPL and all 31 RCRA facilities where corrective action was terminated during fiscal years 2001 through 2003. For those deleted sites or terminated facilities among these whose documentation indicated the use, or potential use, of institutional controls, we conducted follow-up interviews with EPA or state officials knowledgeable about the site to obtain detailed information and documentation regarding the implementation, monitoring, and enforcement of any institutional controls in place. To understand the extent to which states implement, monitor, and enforce institutional controls in the RCRA corrective action program, we interviewed RCRA program managers in the 2 states with the most corrective action remedy decisions and terminations at state-led facilities during fiscal years 2001 through 2003—Colorado and New Jersey. We also interviewed officials in 4 additional states that were selected at random from the 37 states that, in addition to Colorado, were authorized by EPA to conduct RCRA corrective action activities as of March 2002—California, Nevada, South Dakota, and Texas. In addition, we reviewed An Analysis of State Superfund Programs: 50-State Study, 2001 Update, a 2002 report by the Environmental Law Institute, an independent environmental research organization, and interviewed the report’s main author. To inform their study, the Environmental Law Institute collected documents from states, requested program information from them, and conducted telephone interviews to clarify responses and reconcile any discrepancies. While a few states declined to participate, the study achieved a 92 percent response rate. As a result of our review, we determined that this study was sufficiently methodologically sound for the purposes of our review. To identify the challenges of developing a system to track institutional controls, we interviewed the EPA officials in charge of developing tracking systems for the Superfund and RCRA corrective action programs. We also analyzed documentation related to these efforts and initial data drawn from these systems. In addition, we discussed systems to track institutional controls with officials we interviewed in 6 states, including how the states tracked institutional controls, if at all, and whether the states had any concerns about such national tracking systems. In addition, we collected information about the Superfund program’s Institutional Controls Tracking System (ICTS) to inform a data reliability review of this new database. ICTS is an Oracle database accessed through a user interface consisting of HTML Web pages with JavaScript. The current version of ICTS was designed to provide some baseline information on institutional controls but was planned as a step toward a more comprehensive system. The current ICTS has been used to gather baseline information on institutional controls at approximately 900 EPA Superfund construction completion sites. Officials in all 10 EPA regions were asked to populate the system in 8 weeks using the best available information and/or their best professional judgment. Because of the expedited data entry, EPA plans additional research into the status of institutional controls at the site- specific level and significant data quality assurance activities. In light of the uncertain quality of the data, in this report we present data from ICTS with appropriate caveats. We conducted our work from October 2003 to January 2005 in accordance with generally accepted government auditing standards, including an assessment of the data reliability and internal controls. John B. Stephenson, (202) 512-3841 (stephensonj@gao.gov) Vincent P. Price, (202) 512-6529 (pricev@gao.gov) In addition to the individuals named above, Nancy Crothers, Shirley Hwang, Justin Jaynes, Richard Johnson, Jerry Laudermilk, Judy Pagano, Nico Sloss, and Amy Sweet made key contributions to this report.

Summary: The Environmental Protection Agency's (EPA) Superfund and Resource Conservation and Recovery Act (RCRA) programs were established to clean up hazardous waste sites. Because some sites cannot be cleaned up to allow unrestricted use, institutional controls--legal or administrative restrictions on land or resource use to protect against exposure to the residual contamination--are placed on them. GAO was asked to review the extent to which (1) institutional controls are used at Superfund and RCRA sites and (2) EPA ensures that these controls are implemented, monitored, and enforced. GAO also reviewed EPA's challenges in implementing control tracking systems. To address these issues, GAO examined the use, implementation, monitoring, and enforcement of controls at a sample of 268 sites. Institutional controls were applied at most of the Superfund and RCRA sites GAO examined where waste was left in place after cleanup, but documentation of remedy decisions often did not discuss key factors called for in EPA's guidance. For example, while documents usually discussed the controls' objectives, in many cases, they did not adequately address when the controls should be implemented, how long they would be needed, or who would be responsible for monitoring or enforcing them. According to EPA, the documents' incomplete discussion of the key factors suggests that site managers may not have given them adequate consideration. Relying on institutional controls as a major component of a site's remedy without carefully considering all of the key factors--particularly whether they can be implemented in a reliable and enforceable manner--could jeopardize the effectiveness of the remedy. EPA faces challenges in ensuring that institutional controls are adequately implemented, monitored, and enforced. Institutional controls at the Superfund sites GAO reviewed, for example, were often not implemented before the cleanup was completed, as EPA requires. EPA officials indicated that this may have occurred because, over time, site managers may have inadvertently overlooked the need to implement the controls. EPA's monitoring of Superfund sites where cleanup has been completed but residual contamination remains often does not include verification that institutional controls are in place. Moreover, the RCRA corrective action program does not include a requirement to monitor sites after cleanups have been completed. In addition, EPA may have difficulties ensuring that the terms of institutional controls can be enforced at some Superfund and RCRA sites: that is, some controls are informational in nature and do not legally limit or restrict use of the property, and, in some cases, state laws may limit the options available to enforce institutional controls. To improve its ability to ensure the long-term effectiveness of institutional controls, EPA has recently begun implementing institutional control tracking systems for its Superfund and RCRA corrective action programs. The agency, however, faces significant obstacles in implementing such systems. The institutional control tracking systems being implemented track only minimal information on the institutional controls. Moreover, as currently configured, the systems do not include information on long-term monitoring or enforcement of the controls. In addition, the tracking systems include data essentially derived from file reviews, which may or may not reflect institutional controls as actually implemented. While EPA has plans to improve the data quality for the Superfund tracking system--ensuring that the data accurately reflects institutional controls as implemented and adding information on monitoring and enforcement--the first step, data verification, could take 5 years to complete. Regarding the RCRA tracking system, the agency has no current plans to verify the accuracy of the data or expand on the data being tracked.