The Auditor’s Conundrum in Reporting EHS Violations

Aug 28th, 2011 | By | Category: Environmental Management

This article discusses the conundrum faced by an environmental auditor who is retained by his client to perform an audit. During the audit, the consultant uncovers certain serious environmental violations that clearly pose imminent harm to the public and the environment. What are this auditor’s duties to report?

Case Study

Consider this likely scenario. An environmental auditor performs an in-depth assessment of his client’s operations under a contract that contains a confidentiality clause. The confidentiality clause specifically forbids the auditor from disclosing any information he finds during the course of the audit unless the disclosure is required by law.

During the audit, the consultant determines that his client is storing numerous drums of highly toxic wastes in a warehouse. The storage time of the drums has far exceeded the allowable 90/180/270-day accumulation time that would exempt the client from having to obtain a Resource Conservation and Recover Act (RCRA) Part B permit as a hazardous waste treatment, storage, and disposal facility. This is potentially a criminal act under RCRA Section 3008(d). To make matters worse, the auditor finds out that the client has ordered his staff to dispose of the wastes gradually by pouring a couple of drums a day into a ditch just outside the warehouse. A public drinking water well is located 30 feet down-gradient from the ditch.

What should the consultant do?

He now has personal knowledge that several illegal acts are taking place at the direction of his client. Everything in the auditor’s training tells him that it will be a matter of days before the drinking water supply will be contaminated with his client’s toxic waste.

Should the auditor report the findings to a regulatory agency in order to stop the illegal release? What about the auditor’s confidentiality agreement with his client? Should he tell the client to cease and desist? What if the client refuses to heed his advice?


There are two schools of thought on this matter. The conventional wisdom is that the auditor should report his findings only to his client because the confidentiality clause in his contract forbids him from disclosing his findings to anyone else unless required by law. There is no specific language in any environmental statute or regulation that legally requires the auditor to report to the agency since he is neither the owner nor the operator of the facility. Therefore, the only way the auditor is required to disclose his findings is in response to a subpoena or court order. According to this school of thought, once the auditor has advised his client to stop the illegal act, the auditor’s obligations are fulfilled.

The other school of thought is that the auditor should tell his client to stop the illegal dumping immediately, and the auditor should report it to the agency if the client refuses to stop or report the release. The auditor would be violating the terms of his confidentiality clause in the contract and might be subject to legal action from his client, but he will have stopped the commission of a crime and the imminent harm to the users of the drinking well who could have been affected by the release.

If the auditor complies with the confidentiality clause, he may be exposing himself to another form of personal liability. What will the people who consume the contaminated drinking water think of his failure to take affirmative action to stop the imminent harm? Bear in mind that the auditor is not just an innocent bystander who happens to witness the commission of a crime. He is a trained professional with knowledge of the harm that the discharge will cause. Although the auditor is neither the owner nor the operator of the facility, he has a relationship as an expert with the person who is committing the crime.  The auditor has inside knowledge. He has more persuasive power and sway than a bystander in terms of influencing the decision of the owner or operator. The question is this: If he turns a blind eye to the ongoing criminal act, is he actually abetting the crime?

What about the auditor’s fiduciary duty to his client? Doesn’t the auditor have a duty to act in the “best interest” of his client?


In terms of best interest, there are two possible outcomes when the client refuses to stop the illegal act and ignores the auditor’s advice to report:

  1. The auditor walks away after informing the client of the illegal act, the discharge continues, and the drinking water supply is contaminated. The agency finds out a few months later and launches a criminal investigation. The client is prosecuted and convicted of environmental crimes and sent to prison for five years. The client’s company pays a million dollar fine, and the company faces a multi–million dollar lawsuit from the people who have been harmed by the illegal dumping.
  2. The auditor reports his findings to the agency when his client refuses to act. The agency moves in, stops the discharge in time, and fines the owner a US$ 100,000 civil fine. There is no contamination of the drinking well.

Which of these two possible outcomes is better for the client from a fiduciary duty standpoint? Is the client’s interest better served when the auditor discloses to the agency in spite of the confidentiality agreement? Or does the auditor’s fiduciary duty end after he informs his client of the illegal act?

What if the auditor is an attorney? Does he not have a duty as an officer of the courts to disclose the illegal act?

There have been two conflicting court decisions on this subject. The Supreme Court of New Jersey ruled in May 1996 in the case of Carvalho v Toll Brothers that

an engineer has a legal duty to exercise reasonable care for the safety of workers on a construction site when the engineer has a contractual responsibility for the progress of the work, but not for safety conditions, yet is aware of working conditions on the construction site that create a risk of serious injury to workers.

Even though the engineer was not hired to monitor safety conditions, the court ruled that he had a duty to report a known unsafe condition.

Yet a case in 2011 in the Superior Court of Pennsylvania ruled that

an engineering firm retained by its client to monitor toxic emissions from a beryllium plant had no duty to report findings that beryllium particulate emissions belching from the plant “significantly exceeded” EPA limits to either the EPA or to members of the public.

This ruling flies in the face of the New Jersey Supreme Court ruling. Note that the Superior Court in Pennsylvania is often the last arbiter of legal dispute since the Supreme Court of Pennsylvania rarely rules on its findings.

We therefore, on this subject, have a state Supreme Court decision in conflict with a state Superior Court ruling.

Clearly, there are no black and white answers to this dilemma.

About the Author

Norman Wei is the founder of Environmental Management and Training, LLC, a training firm based in Cape Coral, Florida, USA. He performs environmental audits for companies and also conducts training on environmental compliance throughout the country. More than 2,000 environmental professionals have attended his seminars. He maintains a blog at

Photograph: A View of the Ruin by Bev Lloyd-Roberts, Denmark.

Return to the EHS Journal Home Page

Tags: , , , , , ,

One Comment to “The Auditor’s Conundrum in Reporting EHS Violations”

  1. […] entire article can be view here. Share this:EmailDiggStumbleUponPrintRedditTwitterFacebookLike this:LikeBe the first to like this […]

Leave a Comment