The great majority of environmental, health, and safety (EH&S) professionals come from a background that is either primarily environmental in focus or primarily health and safety based. As the EH&S auditing profession has evolved, companies have integrated environmental topics with health and safety topics (and sometimes with others such as management systems or sustainability) on site audits, and many auditors must work outside their traditional comfort zones, whether in terms of education or experience. For example, at smaller sites, companies often expect one auditor to be able to cover all EH&S topics. Even at larger sites, where there is a team of auditors, the expectation is that each auditor should be able to contribute on topics that might be more involved than anticipated. This situation holds true for both internal and external auditors.

Aside from the obvious variations in the content of regulations and requirements, environmental audits and health and safety audits differ to varying degrees in other ways. These differences must be recognized and understood in order for auditors to conduct audits effectively and efficiently. This article discusses 12 of these differences, with the goal of helping auditors, especially new auditors, understand the subtle and not-so-subtle differences between the two types of audits and making them comfortable working on topics for which they are not subject-matter experts.

 

Volume of Federal Regulations

First and foremost, the United States currently has about nine times as many pages of federal environmental regulations as it does pages of health and safety regulations (see Figure 1). However, many environmental regulations will not apply to a particular audit. For example, 64 percent of the environmental regulations are related to air emissions, and many of these apply only to particular sources. This disparity in volume does not necessarily mean auditors can more easily understand health and safety requirements than environmental requirements. It does, however, mean that the body of knowledge is much larger for environmental audits, and environmental auditors must understand which regulations apply to a specific audit and which do not.

Volume of State Regulations

A striking difference in environmental regulations versus health and safety regulations is also found at the state level, where regulatory agencies must adopt federal requirements as a regulatory minimum and can, at their discretion, promulgate only state requirements that are more stringent than the federal requirements. Most states were delegated the authority to implement federal environmental programs and often have developed even more stringent environmental requirements. Some states have developed environmental programs in parallel with federal programs, which requires auditors to audit against both the federal and the state requirements for a specific program (e.g., New Jersey developed discharge prevention regulations parallel to the federal spill prevention rules). A common environmental auditor pitfall is failing to audit against state-specific environmental requirements. Conversely, except for California and a few other states, more stringent state health and safety regulations are rare, so the focus is more typically on the federal requirements.

One way to evaluate the relative differences in regulation proliferation at the state level is to review state audit protocols offered by commercial providers. For instance, Specialty Technical Publishers (STP) offers a complete set of federal and state EH&S audit protocols that include state regulatory difference summaries for all 50 states. These summaries include only those requirements that are particular to the given state. Interestingly, the average number of pages for the environmental difference summaries is 66, whereas that for the health and safety summaries is only 17, despite California’s high number (see Figure 2). This reinforces the assumption that state-initiated environmental regulations are much more common and voluminous than their health and safety counterparts.

 

Completeness of Regulations

Differences between environmental and health and safety regulations also exist with respect to regulation completeness. On the environmental side of the ledger, the regulations are more likely to be self-contained, although on occasion auditors need to review the preamble to the regulation, published questions and answers, guidance documents, and so forth to better interpret the meaning of the requirement. On the health and safety side, many letters of interpretation help to define the requirements. As a measure of how many letters there are, a search for “letters of interpretation” on the U.S. Occupational Safety and Health Administration (OSHA) website resulted in 55,000 hits. If OSHA issues a letter of interpretation, the regulated entity is expected to know its contents, especially if there is some ambiguity in the regulation. Companies have been cited because they did not know the rigor of the expectation defined in letters of interpretation, especially in the Control of Hazardous Energy standard. Thus, identifying individual letters of interpretation is not a straightforward exercise but is nonetheless necessary.

Regulatory Approach

Many environmental regulations include descriptions of not only what to do but how to do it. For example, the U.S. Environmental Protection Agency (EPA) requires not only that containers of hazardous waste be labeled but also that they meet the following requirements:

1. The initial date of waste accumulation must be clearly marked and visible on each container.
2. Each container or tank must be labeled or marked clearly with the words “Hazardous Waste.”
3. No waste may be stored for more than 90 days unless an extension has been granted by the EPA.
4. Containers must be closed except when wastes are added or removed.

 

Conversely, health and safety regulations often include only the “what to do.” For example, OSHA requires that a written confined space permit program must, among many other requirements, do the following:

1. Specify acceptable entry conditions appropriate for the types of permit spaces present at the facility.
2. Develop procedures for isolating the space and, as appropriate, purging, inerting, flushing, or ventilating the permit space to eliminate or control atmospheric hazards.
3. Develop effective methods to restrict pedestrian and vehicular access to the entry areas to protect entrants from external hazards.

 

For an auditor, the task of verifying compliance would typically be much more straightforward with the more prescriptive EPA regulations.

Number of Audit Topics

Although there are nine times as many pages of federal environmental regulations as there are health and safety regulations, a health and safety audit typically covers twice as many audit topics (see Table 1). As a result, the health and safety auditor often needs to cover more topics than the environmental auditor on a given audit.

The topics shown in italics in Table 1 tend to be easier for auditors who are not subject-matter experts to audit. Often, these topics are easier because they emphasize written programs, training, and inspection records, rather than detailed knowledge of the intent of the regulation or knowledge of whether an answer to an audit question is credible. These topics are good ones to start with for auditors who want to broaden their capabilities and cross over to the other side—but they are always to be approached with caution.

Table 1: Typical Audit Topics¹

Health and Safety Topics (24)	Environmental Topics (12)
Blood-borne pathogens	Air emissions
Confined space entry	Community Right-to-Know
Control of hazardous energy	Drinking water
Electrical safety	Hazardous wastes
Emergency response	Medical wastes
Ergonomics	Pesticides
Fall protection	Solid wastes
Fire protection	Spill containment
Flammable storage	Storm water
Hazard communication	Toxic substances
Hearing conservation	Wastewater
Hot work	Universal wastes
Industrial hygiene
Lifting devices, cranes, and hoists
Machine guarding
Means of egress
Medical and first aid
Personal protective equipment
Portable hand tools
Powered industrial trucks
Record keeping
Respiratory protection
Ventilation
Walking and working surfaces

 

¹Topics in italics are more suitable for crossover auditors.

Overall Focus and Principal Means of Verification

The three core evidence-gathering activities on EH&S audits are records review, interviews, and physical inspections. On environmental audits, written records are critically important and, as a result, receive considerable attention from environmental auditors. These records can include regulatory permits and plans (e.g., wastewater permits, air permits, spill response and contingency plans), written procedures, inspections, data reports, and the like. Conversely, on health and safety audits, although the review of records (e.g., permits, training, written programs, and inspection logs) is certainly important, observation of workforce behaviors and interviews, in particular, are relatively more important in verifying health and safety compliance.

Availability of Records

All environmental records are typically available to auditors; however, not all health and safety records are. Certain personnel records are considered confidential (e.g., audiograms conducted as part of a hearing conservation program, pulmonary function tests conducted as part of a respiratory protection program), and they cannot be released to auditors without employees’ written approval. This situation can make conducting the occupational health portion of a health and safety audit challenging. It may be necessary to have a plant nurse or other professional review the records and answer the auditor’s questions while reviewing the records instead of allowing the auditor direct access to the records.

Approach to Permits

An intriguing difference in the approach to permits exists between environmental and health and safety topics. There are, of course, numerous agency-issued environmental permits and reviewing these permits is vital to the verification process. In contrast, there are literally no agency-issued health and safety permits, but there are health and safety permits nonetheless. These permits are internal to the organization and typically must be issued when a particular activity takes place (e.g., confined space entry, hot work). Evaluating whether these permits contain all the appropriate elements and have been completed correctly is an important part of the verification process.

Governing Programs and Procedures

Records review on EH&S audits can be an intimidating exercise. However, certain key documents can provide a road map for verification. On the environmental side, these documents include both agency-issued permits and written plans (e.g., storm water pollution prevention plan, spill plan, hazardous waste contingency plan) that have been prepared by the facility. In many cases the key, strategic documents for health and safety include actual written programs that define the particular approach for meeting the requirements of the standard. For example, confined space entry, hazard communication, respiratory protection, and control of hazardous energy require a written program that governs the activity. These written programs, when required and available, are perfect documents for quickly understanding a program and for developing a verification strategy.

Agency Regulatory Databases

It has become standard audit practice for auditors to access U.S. government databases before the site visit in order to gather regulatory and compliance information about the site. Presently, three databases provide this type of information: two are managed by the EPA, and one is managed by OSHA. They are as follows:

• EPA Envirofacts. Envirofacts is a single point of access to selected EPA environmental data. This website provides access to several EPA databases that contain information about environmental facilities that may affect air, water, and land anywhere in the United States (www.epa.gov/enviro).
• EPA ECHO. ECHO provides searches of EPA and state data for more than 800,000 regulated facilities. ECHO integrates inspection, violation, and enforcement information for the Clean Water Act, the Clean Air Act, and hazardous waste laws. ECHO also includes data on the Safe Drinking Water Act, the Toxics Release Inventory, the National Emissions Inventory, and water quality (www.epa-echo.gov).
• OSHA IMIS. The “establishment search” function enables auditors to search the OSHA Integrated Management Information System (IMIS) enforcement database by establishment name. This database contains information on more than 3 million inspections conducted since 1972. The database is updated daily from more than 120 OSHA area and state 18b plan offices (http://osha.gov/oshstats).

 

Auditors need to become familiar with these databases and use them as a resource on every audit conducted in the United States. Otherwise, the audit will not meet “generally accepted practice” expectations currently in play.

Classification of Audit Findings

Many audit programs require auditors to classify each finding by the level of risk it poses to the organization. Some schemes use the terms significant, major, and minor. Others classify findings as high, medium, or low risk, and still others designate findings as level I, II, or III. Definitions are provided for each risk category, but all schemes require judgment on the part of the auditor. For environmental findings, these classification systems work relatively well. For safety findings, however, they can sometimes prove problematic. For certain issues (e.g., a machine guard missing from a high-speed belt in a remote location), auditors are more likely to envision a maximum worst-case scenario that would result in an injury or fatality, even though the likelihood of the event is extremely low. This can make assigning a risk level more challenging.

Financial Consequences of Noncompliance

It seems rather odd that, historically, the financial consequences for environmental incidents have dwarfed those for health and safety incidents, although some people would say this is changing. For example, the BP Texas City refinery explosion in 2005, which killed 15 contractors, resulted in the largest fines ever assessed by OSHA, a total of more than US$ 100 million in two separate enforcement actions (2005 and 2009). However, the financial consequences for BP of the 2010 Deepwater Horizon release, as opposed to the explosion, have been in the tens of billions of dollars.

One reason for this disparity in financial consequences might be found in the relative budgets of the EPA and OSHA. The EPA’s 2012 budget is 15 times that of OSHA (see Figure 3). In fact, the EPA’s enforcement budget alone is larger than OSHA’s entire budget!

 

 

Conclusion

In most ways, conducting environmental audits is quite similar to conducting health and safety audits. However, the differences between the two types of audits should be understood and incorporated into an audit strategy. For environmental auditors who are being asked to audit health and safety topics, the most important differences are the following:

• Interviews and observation of behaviors are key to verifying compliance.
• Twice as many topics must be covered in the same period of time.
• Becoming adept at identifying key “letters of interpretation” is important.

 

Conversely, health and safety auditors who are asked to audit environmental topics should note the following important differences:

• Understanding what regulations apply must be done as part of the scope definition.
• Assessing state requirements is key to evaluating compliance.
• A detailed review of records is necessary.

As the EH&S audit practice continues to mature, auditors will be expected to be more facile across a broader range of topics and will need to recognize both the similarities in and differences between environmental audits and health and safety audits. However, auditors should always be cautious about attempting to audit potentially high risk areas without having the knowledge and experience necessary to conduct a thorough and insightful audit.

 

Related Articles by Lawrence Cahill in the EHS Journal

• Using Risk Factors to Determine EHS Audit Frequency
• Measuring the Success of an EHS Audit Program
• EHS Audits – Have We Lost Our Way?
• Statistically Representative Sampling on EH&S Audits: Expectations Established by Third Parties
• Outsourcing EHS Audits: Does it Make Sense?
• EHS Audits – Have We Lost Our Way? A Sequel (Lawrence Cahill and Robert Costello)

 

About the Authors

Lawrence B. Cahill, CPEA (Master Certification), is a Technical Director at Environmental Resources Management in Exton, Pennsylvania, U.S.A. He has more than 30 years of professional EH&S experience with industry and consulting. He is the editor and principal author of the widely used text Environmental, Health and Safety Audits, which is published by Government Institutes, Inc. and is now in its ninth edition. He has published more than 60 articles and has been quoted in numerous publications, including The New York Times and The Wall Street Journal. Mr. Cahill has worked in more than 25 countries during his career. He holds a B.S. in Mechanical Engineering from Northeastern University, an M.S. in Environmental Health Engineering from Northwestern University, and an M.B.A. from the Wharton School of the University of Pennsylvania.

Robert J. Costello, PE, Esq., CPEA, is a Principal Consultant at Environmental Resources Management in Exton, Pennsylvania, U.S.A. He has more than 17 years of professional environmental resource management and consulting experience. Mr. Costello manages global regulatory compliance, management systems, and sustainability assurance programs and typically participates on-site in 30 or more audits and assessments per year. He holds a B.S. in Environmental Engineering fromWilkesUniversity, an M.S. in Environmental Engineering fromSyracuseUniversity, and a J.D. fromSyracuseUniversity. Mr. Costello is admitted to the bar inPennsylvania, is a licensed professional engineer inPennsylvania andDelaware, and is a Certified Professional Environmental Auditor.

This article was peer reviewed by Joseph B. Baker, CIH, CSP, CPEA, who is a senior consultant with Environmental Resources Management and previously served as the company’s Global Safety Director for five years. The authors wish to thank Joe for his contributions.

Photograph: Deep Pink Dahlias by David Ritter, Phoenix, Arizona, U.S.A.

 

Return to the EHS Journal Home Page