Environmental, health, and safety (EHS) audits are an effective compliance assurance tool for many organizations. They are designed to verify whether sites, facilities, and operations are meeting the expectations of applicable regulatory requirements, corporate policies and standards, and good risk management practices. As such, EHS audits are an important part of corporate governance.

The audit function can take a variety of forms depending on the nature and history of the organization and on available resources. These forms can include

• A corporate audit function with full-time corporate auditors
• A corporate audit function with part-time auditors selected from business units, divisions, plants, and third-party organizations
• A small corporate oversight group with delegation of the program to the business units or divisions
• A small corporate oversight group and the use of external, independent auditors

In the past few years, substantial debate has occurred over whether it makes sense to outsource the audit function entirely. In fact, many organizations have done just that. The decision to outsource is typically not an easy one, and many factors come into play in making it. This paper discusses both the advantages and the challenges of outsourcing the corporate EHS audit program.

Advantages of Outsourcing EHS Audits

Outsourcing can achieve any number of important objectives for an EHS audit program. Among the advantages of outsourcing are readily available functional expertise, local knowledge, greater independence, a fresh set of eyes, and less disruption of routine EHS functions.

Readily Available Functional Expertise

In utilizing third parties to conduct the audits, one can typically draw from a large pool of available functional experts and experienced auditors. This situation is often not the case when internal staff members are used and the same functional experts are routinely relied on to conduct the audits. These are staff members who, because of their knowledge and expertise, have other organizational responsibilities and can ill afford to allocate too much of their time to auditing. Often substantial tension exists between the needs of the audit program to staff the audits adequately and the needs of the functional EHS managers, who must develop and implement compliance programs. The internal staff is often spread too thin, and staff members find themselves in a no-win situation. The use of third-party experts can help to relax this tension.

Local Knowledge

Multinational companies have the challenge of operating in multiple, if not numerous, jurisdictions. Although English-language international audit protocols are available for purchase, use of these protocols by corporate auditors is sometimes not enough to ensure that applicable regulatory requirements are evaluated comprehensively. Further, in countries where English is not the official language, it is advantageous to utilize local third-party auditors, who speak and read the language fluently and who know the customs and mores of the country. When local auditors are not used, the audit team is often required to hire a translator or to have site staff translate the contents of permits, plans, and other documents during the course of the on-site visit. Neither of these two options results in a very efficient or illuminating process. As the story goes, there once was an auditor who was interviewing a site environmental coordinator through an interpreter. The auditor asked a fairly direct, short question, which was then translated. The response from the coordinator took about five minutes. At the conclusion of the coordinator’s rather extended monologue, the auditor asked eagerly of the translator, “What did he say?” “Yes,” replied the translator. Maybe something was lost in the translation.

Greater Independence

Because of a number of events (e.g., the Enron and Arthur Andersen scandals) and the regulatory responses to these events (the Sarbanes-Oxley Act of 2002), the financial auditing profession is under increased scrutiny. In the EHS auditing field, too, there is now a greater expectation that auditors be truly independent and objective. While the use of third parties does not meet a full test of independence (e.g., the company can discontinue the use of the third party or refuse payment if the results of an audit are not considered “acceptable”), this approach is generally considered more independent than the use of internal auditors. It can also eliminate conflict-of-interest situations where internal, corporate auditors are asked to audit programs or procedures that they helped to develop.

Fresh Set of Eyes

Many times, simply having a fresh set of eyes on an audit team can help to identify issues and instances of noncompliance that have been “in the background” for years. Moreover, to use an analogy, the Sarbanes-Oxley Act makes it unlawful for lead third-party financial auditors to provide that service for more than five consecutive years. They are required to sit out an audit at least once every five years. There is a sense in the audit community that auditors can become stale or all too familiar with the operations they are reviewing.

A wonderful example of the need for a fresh set of eyes is depicted in the accompanying photograph, which was taken at a site in Australia. A maintenance technician at the site had arrived at a unique solution for the disposal of small quantities of waste solvent. He welded a pipe with a funnel onto the roof drain of the building, which discharged to a nearby creek. This practice had not been identified on any previous audits, until one year a new auditor asked, “What is this thing?” It became the “finding of the audit.”

Less Disruption of Routine EHS Functions

In most cases in which internal staff members are used as auditors, these assignments are only temporary. These staff members typically have other responsibilities that must be managed almost as an afterthought during the audit week. If a crisis at home distracts the auditor, then the audit suffers. Either way, this can be disruptive to the EHS function. The use of third parties eliminates this issue. The third-party auditor is assigned full time to the audit during the course of the audit.

Challenges of Outsourcing

To be fair, outsourcing of an EHS audit program is not without its challenges. Some of the more significant challenges are highlighted below, with thoughts on how best to address them.

Reduced Retention of Knowledge

A legitimate concern with outsourcing an EHS audit program is that the knowledge gained by the auditors may be lost to the organization if third auditors are used. Each audit is a true learning experience in which both noncompliance trends and best management practices are identified. If third parties are used, a formal mechanism should be put in place to ensure that strategic observations, which go beyond what is included in the audit reports, are communicated periodically to corporate EHS management. This might involve a semiannual or annual meeting with senior management where the following topics are discussed:

• Highlights of liabilities most affecting the corporation
• Analysis of trends in the types of noncompliance findings, to identify potential corporate-wide issues
• Trends in the number of repeat and Level I (high priority) findings
• Identification of best practices worthy of incorporation by all sites

As an added benefit, this reporting to senior management is very consistent with the expectations of the U.S. Federal Sentencing Commission’s November 2004 guidance on mitigating factors. The guidance states that for a compliance and ethics program to be effective, a company’s “governing authority” (i.e., board of directors) must be informed, no less than annually, about the status of the company’s compliance.

Cost

There is no denying that the using a third party to conduct audits will result in costs for both auditor labor and travel expenses. However, the use of internal staff results in comparable charges, although the labor costs are often not directly visible to management. That is, these internal auditors often don’t bill their time directly to the audit; the time is incorrectly viewed as a “free good.” In fact, were true cost accounting to be used, an argument could be made that an outsourced program might actually be cheaper. The third party will be expected to maintain trained auditors, updated protocols, and other program tools at its expense. Further, use of a third party can minimize travel expenses, as the intent is to utilize third-party staff in the country or state in which the site is located. This practice eliminates the need to send corporate EHS staff halfway around the world to conduct audits.

Need to Communicate Organizational Nuances

Every organization is unique, and there is no doubt that internal auditors understand the uniqueness of their company better than third parties do. With a certain amount of effort, however, organizational nuances can be communicated to third-party auditors. Some of the issues that need to be communicated for an EHS audit program include the following:

• What is the history of EHS auditing in the company? Does the program have the organizational clout and top management support it needs?
• Are there corporate EHS standards and guidelines that must be evaluated on the audits? Which are considered mandatory?
• How will the legal department be involved?
• What can be left behind with the site at the end of the audit? Nothing, a summary of the findings, a draft report?
• How will repeat findings be handled?
• Will findings be classified by significance or priority?
• Will sites be scored? If so, how? Is there a pass-fail threshold?
• If there is a disagreement on a finding between the site and the audit team, who will arbitrate?
• What are the records retention and destruction policies for audit working papers and reports?

Attention to these details up front will ensure a better program and a more informed and savvy third-party auditor.

Lack of Auditor Familiarity with Operations

One of the principal concerns with the use of third-party auditors is that these auditors are not always sufficiently familiar with the operations of a given company or industry to understand the subtleties involved in achieving compliance. Mining is different from power production, which is different from pharmaceutical manufacturing, and so forth. To some extent, there is a certain amount of truth to this concern. On the other hand, quite often a lack of full familiarity results in an auditor’s asking that one “naïve” question (e.g., “Why exactly is that sump not considered a confined space?”) that strikes at the heart of an issue not previously identified. In any event, there are two solutions to this challenge. One, third-party auditors can be taught about the unique aspects of a business. It is something that can be learned. Two, the pool of third-party auditors is very large; people with knowledge of a particular business can almost always be identified.

Why Not a Blend?

One solution used by numerous organizations is to design and implement a program that utilizes a blend of internal and external resources. That is, internal auditors are used where feasible, and they are supplemented by third-party auditors when local knowledge and presence or a particular expertise (e.g., process safety management) is needed. This approach has some very distinct technical and cost advantages. It also adds a layer of independence that would not exist if only internal resources were utilized.

About the Author

Lawrence B. Cahill, CPEA, is a Technical Director at Environmental Resources Management in Exton, Pennsylvania, U.S.A. He has over 30 years of professional EHS experience with industry and consulting. He is the editor and principal author of the widely used text, Environmental, Health and Safety Audits, published by Government Institutes, Inc. and now in its 8th Edition. (The ninth edition will be released in the Fall of 2010.) He contributed four chapters in the 1995 book Auditing for Environmental Quality Leadership, published by John Wiley & Sons, Inc. Mr. Cahill has published over 50 articles and has been quoted in numerous publications including the New York Times and the Wall Street Journal.

Other Articles by Lawrence Cahill in the EHS Journal

Measuring the Success of an EHS Audit Program

EHS Audits – Have We Lost Our Way?

Statistically Representative Sampling on EH&S Audits: Expectations Established by Third Parties

Images:

Balloon 5 by Doug Paul, Reno, Nevada, U.S.A.

The Finding of the Audit provided by Lawrence Cahill.

Return to the EHS Journal Home Page