EPA's New Enforcement Policy: At Last, a Reliable Roadmap to Civil Penalty Mitigation for Self-Disclosed Violations

James T. Banks

Editors' Summary: On December 22, 1995, EPA issued its Final Policy Statement on Incentives for Self-Policing, which sets forth the conditions under which EPA will reduce civil penalties assessed against regulated entities when they manage their own compliance responsibilities and disclose their own violations of environmental laws. This Article analyzes the Policy and evaluates its long-term prospects. The Article begins by describing the history behind the Policy. It discusses EPA's Interim Policy on Voluntary Environmental Self-Policing and Self-Disclosure, the defects that stakeholders identified in that Policy, and the ways in which EPA addressed those concerns in the Final Policy. The Article then analyzes the Final Policy itself. It examines the conditions that regulated entities must meet for civil-penalty mitigation and explores the limits of the guidance the Policy gives such entities. Finally, the Article discusses the prospects for the Policy's long-term success and suggests ways to ensure that success.

The author is a partner with the firm of Hogan & Hartson in Washington, D.C. He is a former General Counsel of Chemical Waste Management, Inc., and a former Senior Attorney for the Natural Resources Defense Council.

[26 ELR 10227]

On December 22, 1995, the U.S. Environmental Protection Agency (EPA) issued its long-awaited Final Policy Statement on Incentives for Self-Policing (Final Policy or Policy).¹ After 18 months of reviewing its enforcement policies and practices, participating in nine days of public meetings and stakeholder dialogues, and considering extensive public comments on an interim policy (Interim Policy), published last April,² the Agency established a clearer and far more sophisticated set of incentives to encourage self-policing by regulated entities than at any other time in the history of its enforcement program.

The hallmark of the Final Policy is EPA's articulation of the specific conditions and limitations under which regulated entities will be granted civil penalty mitigation when they effectively manage their compliance responsibilities and promptly disclose violations. The Policy also reiterates EPA's long-standing pledge not to seek audit reports to initiate investigations, and includes EPA's offer to refrain from criminal prosecution of entities under circumstances that almost everyone would agree do not warrant such action.³ But the Policy's most dramatic and important feature is its promise to eliminate or substantially mitigate civil penalties under defined circumstances that, for the first time, allow corporate managers and their counsel to design compliance and disclosure strategies that will produce tangible results when a violation occurs. In this regard, the Policy represents a significant departure from the vague, enforcement-discretion criteria EPA has employed for many years, and very likely will encourage a significant increase in corporate self-policing.

While the growing profile of EPA's criminal enforcement program provides obvious and important deterrence, civil enforcement is far more pervasive at both the federal and state levels, and has a much larger impact on the bottom line of corporate America. Civil actions far outstrip criminal prosecutions both in the numbers initiated and the fines levied for violations. In 1994, for example, EPA referred 220 criminal cases to the U.S. Department of Justice (DOJ), obtained convictions totaling 99 years of incarceration, and assessed $ 36.8 million in criminal penalties.⁴ By contrast, EPA referred 430 civil judicial cases to the DOJ, brought nearly 3,600 administrative enforcement actions, issued 1,596 administrative penalty orders, and assessed nearly $ 114 million in civil penalties for environmental violations.⁵ [26 ELR 10228] State agencies brought another 11,334 civil cases.⁶ The sheer magnitude of civil environmental enforcement provides unique leverage for EPA and the states to alter corporate compliance behavior through a new and innovative policy approach. At the federal level, the penalty-mitigation provisions of the Final Policy provide that approach.

The Final Policy emerges against an extensive background of state legislative activity, and the beginnings of serious congressional interest in these issues. Fourteen states have enacted environmental audit privilege and/or immunity statutes over the past three years,⁷ and many of the rest have similar bills under consideration. Sens. Mark Hatfield (R-Or.) and Hank Brown (R-Colo.) have introduced a bill that would provide a privilege against disclosure of environmental self-evaluation information, as well as immunity from penalties for voluntarily disclosed violations,⁸ and Rep. Joel Hefley (R-Colo.) has introduced a companion bill⁹ in the House. The Final Policy is as timely as it is important to addressing industry's concerns that EPA's enforcement zeal discourages, rather than rewards, responsible corporate behavior.

This Article first traces the evolution of EPA's civil enforcement and penalty policies leading to release of the Final Policy. The author then analyzes the penalty-mitigation features of the Policy itself, and highlights important questions that remain to be answered through case-by-case implementation, or perhaps through federal and state legislation. Finally, the author offers his own observations on the long-term viability of EPA's new approach, as well as recommendations for ensuring its effectiveness and durability in the years ahead.

Background

The concept of encouraging compliance efforts through penalty mitigation is not new in environmental law. Its roots may be seen in some of the nation's most venerable environmental statutes, whose enforcement provisions direct EPA to take into account a violator's "good faith efforts to comply" in assessing penalties.¹⁰ Over the years, EPA has implemented this concept in a number of statute-specific penalty policies, none of which ever promised a predictable or substantial amount of penalty mitigation for any particular type of self-policing activity.

The evolution began in 1984, when the EPA Office of Enforcement and Compliance Monitoring (later renamed the Office of Enforcement and Compliance Assurance (OECA)) issued general guidance for development of statute-specific penalty policies.¹¹ The guidance described a two-step process that starts by calculating a "preliminary deterrence amount" consisting of an economic "benefit component"¹² and a "gravity component,"¹³ and then applies "flexibility-adjustment factors"¹⁴ to increase or decrease the deterrence amount.

In very general fashion, the 1984 guidance identified several concepts related to a violator's "good faith efforts to comply." Under the adjustment factor for "degree of willfulness and/or negligence," the guidance calls for considering "whether the violator took reasonable precautions against the events constituting the violation."¹⁵ And under the adjustment factor for "degree of cooperation/noncooperation," the guidance mentions prompt reporting, as well as correction of the noncompliance and any resulting environmental problems.¹⁶ The guidance provides no assurance of penalty mitigation, however, and authorizes discretion for enforcement staff to make only modest downward adjustments of the gravity component.¹⁷

The EPA program offices then developed media-specific penalty policies that largely reflect this vague approach. The 1990 RCRA Civil Penalty Policy, for example, mentions the "adequacy of provisions for detecting and preventing a release" as one consideration in assessing "potential for harm," which in turn is but one factor in calculating the gravity component of the penalty.¹⁸ But in applying (as an adjustment factor) the explicit statutory directive to consider "good faith efforts to comply," the policy mentions only prompt identification of the violation, self-reporting to the Agency, and instituting corrective measures¹⁹ —all after-the-fact, responsive actions rather than systematic efforts to prevent the violation in the first place. Moreover, in ordinary circumstances, the RCRA Civil Penalty Policy allows for no more than a 25 percent adjustment of the gravity component even if these "good faith efforts" were exemplary.²⁰

A second example, the Clean Water Act Civil Penalty Policy, is even less direct in addressing these considerations. First issued in 1986,²¹ the policy was revised and [26 ELR 10229] superseded in March 1995.²² The 1995 revision acknowledges that neither it nor its predecessor contains any "explicit gravity adjustment factor for violators that conduct, or fail to conduct, environmental audits, disclose the results to the government, promptly correct the violations and remedy any harm," but observes that these types of actions should produce smaller penalty amounts because violators will have shorter histories of violations (a penalty aggravating factor).²³ The 1995 revision does not explain how regulated entities that search for violations and disclose them to EPA will have a better record of compliance than those who do not.

With the issuance of its Environmental Auditing Policy Statement (Auditing Policy) in 1986,²⁴ EPA began in earnest to focus on the nature and value of self-policing activities, and on their relationship to enforcement policy. Among other things, the Auditing Policy described EPA's view of what constitutes an effective audit program, and declared that "EPA encourages regulated entities to adopt sound environmental management practices … [and] to institute environmental auditing programs to help ensure the adequacy of internal systems …."²⁵

Regulated entities searched the Auditing Policy in vain, however, for concrete measures by which EPA's encouragement would be carried into action. Rebuffing the majority of commenters who sought assurance that EPA would not use audit reports to conduct compliance "witch hunts," the Agency reserved its authority to seek audit data "where the Agency determines it is needed."²⁶ Similarly, EPA declined to promise specific enforcement restraint for companies that adopt audit programs because such incentives "are fraught with legal and policy obstacles."²⁷ But the Agency foreshadowed some of the considerations now seen in its Final Policy by describing the factors that should guide the exercise of enforcement discretion:

In fashioning enforcement responses to violations, EPA policy is to take into account, on a case-by-case basis, the honest and genuine efforts of regulated entities to avoid and promptly correct violations and underlying environmental problems. When regulated entities take reasonable precautions to avoid noncompliance, expeditiously correct underlying environmental problems discovered through audits or other means, and implement measures to prevent their recurrence, EPA may exercise its discretion to consider such actions as honest and genuine efforts to assure compliance. Such consideration applies particularly when a regulated entity promptly reports violations or compliance data which otherwise were not required to be recorded or reported to EPA.²⁸

The Auditing Policy offers regulated entities scant guidance on which measures, other than auditing, will be considered "reasonable precautions to avoid noncompliance."

These considerations were later echoed by EPA and the DOJ in their policies on the exercise of investigative,²⁹ prosecutorial³⁰ and debarment³¹ discretion in the criminal arena. Like the 1986 Auditing Policy and EPA's various penalty policies, however, none of these policies offered specific or quantifiable enforcement restraint in return for any particular type of commitment to self-policing, reporting, and correction of violations.

Consequently, industry representatives sustained and intensified their quest for more certainty, both through continued dialogue with EPA³² and through legislative initiatives at the state level. By early 1994, four states had enacted audit privilege and/or penalty immunity statutes providing the desired certainty, and many more were considering similar bills. Alarm bells sounded at EPA. In May 1994, EPA Administrator Carol Browner asked the OECA to conduct a formal policy review and determine whether the Agency should provide a more structured federal system of incentives for self-policing and disclosure.

EPA commenced its review with a two-day public meeting in July 1994. Industry's interest was so "overwhelming"³³ that the meeting's location was changed several times, finally overflowing the ballroom of one of Washington, D.C.'s largest hotels. Witness after witness criticized EPA's opposition to state audit-privilege legislation and its heavy-handed treatment of entities who self-disclose harmless violations. The government's posture, they insisted, served to discourage self-policing practices that could bring about far greater environmental protection than could ever be achieved through traditional government inspection and enforcement. In the months that followed, an EPA/DOJ task force weighed public comments and internal data, and held focus-group meetings with interested stakeholders. EPA eventually issued its Interim Policy in April 1995, and invited still more public comment.

The Interim Policy recieved a lukewarm reception from many industry stakeholders because of its strong opposition to the audit-privilege concept and its promise of increased [26 ELR 10230] federal enforcement scrutiny in those states that had enacted such legislation.³⁴ It received praise and encouragement, however, for inaugurating the concept of substantial penalty mitigation in return for regulated entities' specific efforts at self-policing, disclosure and correction of violations.

The Interim Policy promised to mitigate civil penalties provided that a host of conditions and limitations were met.³⁵ Much of the ensuing public comment, as well as the five-day stakeholder dialogue hosted by the American Bar Association's Section of Natural Resources, Energy, and Environmental Law, focused in detail on whether the Interim Policy's particular formula was the most appropriate and effective approach. In particular, stakeholders were concerned that the Interim Policy excluded two categories of violations: those legally required to be reported, and those discovered by means other than audits. First, penalty mitigation was available only for violations "voluntarily" reported to the Agency,³⁶ an increasingly narrow universe under EPA's evolving regulatory system in which many types of violations are required to be reported.³⁷ Second, the Interim Policy applied only to violations detected through voluntary audits, as defined in the 1986 Auditing Policy,³⁸ or through a "self-evaluation," defined to mean an assessment that fails to meet the Auditing Policy's definition in some respect.³⁹ Regulated entities who implement comprehensive compliance management programs frequently find that they detect far more violations through those programs than through periodic audits or other internal assessments,⁴⁰ and yet the Interim Policy withheld its incentives in these circumstances.

The Final Policy addresses these and many other issues raised in the public comment and stakeholder dialogue processes. The discussion below outlines the penalty-mitigation provisions of the Final Policy, explains the most important changes from EPA's Interim Policy, and highlights open issues needing future resolution.

The Final Policy

As noted above, the feature that sets EPA's Final Policy apart from earlier Agency efforts is its concrete assurance of specific penalty mitigation under fairly precise conditions and limitations. Some ambiguities remain, to be sure, but the Final Policy gives regulated entities sufficient clarity and certainty to design compliance and self-policing programs with considerable confidence that self-disclosed violations will be met with a predictable enforcement response.

If the Final Policy encourages more careful and widespread self-policing, then EPA will have achieved its primary goal. The Agency's 18-month review process convinced OECA managers, DOJ officials, and participating state enforcement personnel that corporate self-policing is essential to better compliance and environmental protection. While maintaining its historically strong interest in deterrence through inspection and enforcement, EPA acknowledged that "achieving compliance also requires the cooperation of thousands of businesses and other regulated entities … ,"⁴¹ and that "because government resources are limited, maximum compliance cannot be achieved without active efforts by the regulated community to police themselves."⁴² This fundamental conclusion, coupled with compelling evidence that a different policy is necessary to encourage such behavior,⁴³ led EPA to offer more specific assurances in the Final Policy.

The Final Policy offers two categories of penalty mitigation: complete elimination of the gravity component, and reduction of the gravity component by 75 percent.⁴⁴ Nine conditions are attached to this incentive. The entity must meet all nine conditions to earn elimination of the gravity component; only eight must be satisfied to gain a 75 percent reduction.⁴⁵

Thus, the nine conditions are the essence of the Final Policy, and warrant the regulated community's most careful [26 ELR 10231] scrutiny.⁴⁶ Unlike the vague criteria in EPA's earlier policies, each of the nine conditions offers fairly specific guidance for entities wishing to formalize their "good faith efforts to comply."

Condition No. 1: Systematic Discovery

In its first condition, EPA implements the long-standing Agency policy of "encouraging" environmental audits and other forms of self-policing. This condition requires that the violation must have been discovered either through an environmental audit or through "an objective, documented, systematic procedure or practice reflecting the regulated entity's due diligence in preventing,detecting, and correcting violations."⁴⁷ The Policy further clarifies both of these "discovery options" by providing definitions of "environmental audit" and "due diligence."⁴⁸ This condition must be satisfied in order for an entity to receive full mitigation and to be eligible for the criminal referral incentive, but need not be met in order for an entity to receive 75 percent mitigation of the gravity component.

The Final Policy borrows its definition of "environmental audit" from the 1986 Auditing Policy: "a systematic, documented, periodic and objective review … of facility operations and practices related to meeting environmental requirements."⁴⁹ Two features of the definition are especially noteworthy. First, by "systematic" and "periodic," EPA appears to envision that the audit will be part of an overall auditing "system" or program containing the necessary policies, procedures and resources to ensure effectiveness.⁵⁰ While the Final Policy does not explicitly rule out a one-time audit of a particular facility or operation, the definition certainly casts doubt on the acceptability of such an approach. Second, the term "objective" is explained in the 1986 Auditing Policy to mean that the "auditing function" (i.e., the auditors and their management) should be independent of "audited activities" (e.g., facility operations).⁵¹ This would seem to rule out internal "self-audits" conducted by plant personnel who report to the facility manager, a fairly typical self-policing mechanism that probably would have qualified as a "self-evaluation" under the Interim Policy.⁵² Thus, the Final Policy is designed to encourage rigorous, independent auditing programs rather than occasional, less-formal "spot checks" for environmental compliance.

The Final Policy's definition of "due diligence" is an entirely new and innovative feature. It represents the most dramatic departure from EPA's Interim Policy. Whereas the Interim Policy authorized a less rigorous alternative to auditing programs (termed "self-evaluation"), the Final Policy's "due diligence" option envisions a much more rigorous compliance management program that includes auditing, but goes far beyond by requiring active management mechanisms to minimize violations in the first instance.

Built on features gleaned from the U.S. Sentencing Guidelines⁵³ and extensive discussions during the stakeholder dialogue, the definition of "due diligence" sets out six elements that capture the basic functions inherent in most compliance management systems in use today. Taken together, these functions describe a "regulated entity's systematic efforts, appropriate to the size and nature of its business, to prevent, detect and correct violations."⁵⁴ The Policy does not require advance submission or approval of due diligence programs, but does insist that entities seeking the Policy's benefits "must provide accurate and complete documentation" of how their programs satisfy all six elements.⁵⁵ In order for a violation to have been "discovered through" the operation of such a program, presumably this documentation must pre-date the violation. And EPA may require, as a condition of receiving the Final Policy's benefits, that a description of the entity's due diligence program be made publicly available.⁵⁶

The definition's six program elements describe how most organizations effectively manage their functions, whether they be production of goods, provision of services, or maintenance of compliance. These elements include: (1) establishing policies, standards, and procedures to guide the workforce; (2) assigning responsibility; (3) managing the work and checking for defects; (4) training; (5) providing incentives and ensuring accountability; and (6) correcting defects, both individually and programmatically.⁵⁷ EPA has used fairly general language to describe these concepts in order not to foreclose the variety of approaches that different types and sizes of organizations might employ.⁵⁸ Nonetheless, corporate managers must take care to design and document their due diligence programs to qualify under the Policy. A brief review of each element will illustrate this challenge.

The first element will require written "compliance policies, standards and procedures that identify how employees and agents are to meet the requirements of laws, regulations, permits and other sources of authority for environmental requirements."⁵⁹ It seems clear that these documents must go beyond exhorting workers to comply and reciting the terms and limitations of permits and their underlying regulations. They must translate applicable requirements into understandable directions for rank-and-file workers whose actions will affect compliance. In essence, the entity's task is to design the work process so that compliance is achieved as routinely and automatically as possible. This will be a daunting task for facilities that are regulated at several levels of government through numerous media-specific environmental programs. When mitigation is sought under the Policy, the entity should anticipate needing to satisfy EPA that its approach was comprehensive and that the violation in [26 ELR 10232] question was not caused by a breakdown in this standard-setting process.

The second element requires assignment of compliance responsibility at two levels within the organization: "Overall responsibility for overseeing compliance with policies, standards and procedures, and … specific responsibility for assuring compliance at each facility or operation."⁶⁰ This goes beyond some models, which require only the assignment of overall responsibility to "high-level personnel,"⁶¹ but stops short of others, which require that compliance authority be assigned to persons not reporting to production managers,⁶² or conversely, to the entity's "line managers" themselves.⁶³ While the Final Policy is quite flexible in this regard, as will be seen below, these assignments become important in the context of other program elements.

The third element of a due diligence program may be the most important. EPA's purpose appears to be encouragement of management systems designed to prevent violations, not merely encouragement of those designed to detect and correct violations. This element requires:

Mechanisms for systematically assuring that compliance policies, standards and procedures are being carried out, including monitoring and auditing systems reasonably designed to detect and correct violations, periodic evaluation of the overall performance of the compliance management system, and a means for employees or agents to report violations of environmental requirements without fear of retaliation.⁶⁴

The Final Policy's language does not make clear whether the several mechanisms specifically mentioned (monitoring, auditing, program evaluation, and employee reporting systems) will be merely necessary or also sufficient to satisfy this element. The more likely EPA interpretation is that, while a due diligence program must include the "look-back" approaches specifically mentioned, it also should have other systematic means of ensuring implementation on a real-time basis.

EPA emphasized the continuous, forward-looking nature of due diligence programs when it decided to broaden its penalty-mitigation incentive beyond the audit-detected violations included in the Interim Policy: "Compliance management programs which train and motivate production staff to prevent, detect and correct violations on a daily basis are a valuable complement to periodic auditing."⁶⁵ The general, introductory language of this third program element is the key ingredient in "continuous" compliance assurance. Unlike the specifically listed mechanisms, which are oriented toward detecting and reacting to compliance defects after-the-fact, the general introductory language requires systematic assurance that policies, standards, and procedures "are being" implemented. Since those policies, standards, and procedures must "identify how" employees are to meet compliance obligations, this element appears to require a management system that provides continuous oversight, from the compliance perspective, of the entity's work in progress.

Many different approaches are possible for providing this oversight, ranging from simple systems such as manual checklists to highly sophisticated, computer-based systems designed specifically for compliance assurance.⁶⁶ The Final Policy's language is intentionally broad and general in order to accommodate the variety of mechanisms that will be appropriate for various types and sizes of entities.

In designing their due diligence programs, regulated entities must pay special attention to integrating this element with the others. For example, policies, standards, and procedures required under the first element should be the object whose implementation is assured through continuous management oversight, and of course will be among the primary benchmarks for the monitoring and auditing systems. Likewise, the persons who are assigned compliance responsibility under the second element must have some authority over, if not outright command of, the management mechanisms that assure implementation of policies, standards, and procedures, as well as those used to monitor or audit compliance.⁶⁷

The fourth element—"efforts to communicate effectively the regulated entity's standards and procedures to all employees and other agents"—is the familiar training requirement common to many other policies.⁶⁸ The language is quite general, neither specifying a preferred type of training nor requiring that training efforts be evaluated through testing. At a minimum, EPA appears to contemplate that training materials will include an entity's policies, standards, and procedures, and that a large percentage of employees and agents will be trained, not merely a select group of supervisors or compliance personnel. In practice, one would expect EPA to accept training programs designed to reach a rationally selected portion of the workforce whose duties have the potential to affect compliance. The entity would be well advised to document the basis for those selections, and to maintain complete training records that demonstrate its "efforts to communicate."

The fifth program element requires "appropriate incentives to managers and employees to perform in accordance with the compliance policies, standards and procedures, including consistent enforcement through appropriate disciplinary mechanisms."⁶⁹ Again, it is not clear whether [26 ELR 10233] disciplinary mechanisms are merely necessary or also sufficient to satisfy this element. In most corporate cultures, positive incentives such as monetary rewards and recognition are more accepted and therefore more effective than the threat of discipline, but EPA is on familiar ground in singling out disciplinary processes for specific mention.⁷⁰

As with other program elements, several implementation issues must be confronted. Must the persons assigned compliance responsibility have control over incentives systems (e.g., bonus programs)? Does the Policy's documentation requirement compel entities to develop written disciplinary procedures? Does the need to demonstrate "consistent enforcement" mean that records must be kept describing incentive programs, including individual disciplinary actions? In particular cases, what will be EPA's attitude toward the disciplinary actions taken, or not taken, against employees causing the disclosed violation? These and, no doubt, many other issues will be answered incrementally as EPA implements the Final Policy.

The sixth and final program element requires that entities have "procedures for the prompt and appropriate correction of any violations, and any necessary modifications to the regulated entity's program to prevent future violations."⁷¹ As with several others, this element is "systems-oriented"; it requires that the entity's approach to correction of violations and to program modifications be embodied in procedures, and the documentation requirement would seem to necessitate written procedures. For smaller entities, satisfying this element should be relatively simple—essentially a complement to the assurance mechanisms required under the third element. For large, complex corporations with many facilities, more sophisticated, even computer-assisted tracking systems may be necessary. These systems enable the persons with overall compliance-program responsibility to manage the entity's responses to numerous violations or potential violations, keep senior management informed of progress on major problems and trends, and interpret the resulting data in ways that facilitate programmatic improvements (e.g., enhanced training, better procedures, stronger incentives, etc.) that respond to prevalent underlying causes of violations.

EPA's new "due diligence" program option is a pioneering attempt to describe, in less than 200 words, how regulated entities should go about systematically preventing and correcting violations. It requires the same commonsense management techniques that many businesses already employ to achieve quality control in a host of other endeavors. As with any new policy initiative, this option raises numerous implementation questions that will be answered only through experience. In addition to those noted in the discussion above, managers should focus especially on two overall challenges in designing their programs. First, with respect to every required element, the entity must decide how to document implementation without creating undue risk of legal exposure or burying their organizations in paper. This will require careful planning and sound legal advice. Second, managers and their counsel must anticipate the challenge of convincing EPA that a violation was "discovered through" the due diligence program, and not merely "stumbled upon" fortuitously. For violations detected through audits, monitoring activities, employee hotlines, and other familiar avenues, this will not be difficult. But a significant number of compliance issues will be detected simply by vigilant employees noticing something amiss and reporting it to a supervisor. For these violations, it will be essential to convince EPA that the problem could have gone undetected but for the entity's policies and standards, assignments of responsibility, systematic management procedures, employee training, and incentives to tackle compliance issues rather than ignore them. It will take only one serious violation with significant penalty exposure to justify the planning that will be necessary to meet this challenge.

Condition No. 2: Voluntary Discovery

In its Final Policy, EPA has dropped the Interim Policy's requirement that the disclosure be made voluntarily.⁷² Instead, the Policy requires that the violation be detected voluntarily: "The violation was identified voluntarily, and not through a legally mandated monitoring or sampling requirement prescribed by statute, regulation, permit, judicial or administrative order, or consent agreement."⁷³ EPA offers three examples of legally mandated discovery: emissions monitoring required by regulation, permit, or other authorities; similarly mandated discharge monitoring; and compliance audits required under a consent order or settlement.⁷⁴

At least two important issues will arise under this condition. First, regulated entities may collect and analyze emissions or discharge samples beyond the legally required frequency or number, and may conduct audits in addition to those required by an order or agreement. If violations are indicated by some sampling or audit results but not by others, it may not always be clear whether the violations were voluntarily discovered (e.g., which samples were the "required" ones). Second, entities routinely conduct legally required inspections of facilities that will not fit the language of this condition or any of the three examples. Daily inspections under the Resource Conservation and Recovery Act (RCRA),⁷⁵ for example, are neither "monitoring" nor "sampling," as those terms are commonly understood, and they certainly fall short of the Policy's rigorous definition of "auditing." At RCRA-permitted facilities, this issue could become fairly important, as these inspections can identify compliance defects with some frequency.

Condition No. 3: Prompt Disclosure

The Final Policy requires that "the regulated entity fully discloses a specific violation within 10 days (or such shorter period provided by law) after it has discovered that the violation has occurred, or may have occurred, in writing to [26 ELR 10234] EPA."⁷⁶ The Agency has dropped the Interim Policy's requirement for additional disclosures to state and local agencies,⁷⁷ and has made two other important changes.

First, somewhat more time is allowed before the disclosure should be made, but extensive delays will be scrutinized more carefully. Whereas the Interim Policy required virtually immediate disclosure, while allowing "a reasonable time to determine that a violation exists,"⁷⁸ the Final Policy allows 10 days to make the disclosure, but places several conditions on EPA's acceptance of disclosures beyond that time. The Agency explains that it "may accept" disclosures beyond the 10-day deadline if the entity meets its burden of showing that "the violation is complex and compliance cannot be determined within that period," and if the circumstances do not present a serious threat.⁷⁹ Large organizations with extensive reporting channels will have a significant challenge in meeting this 10-day deadline, even for straightforward violations. In factually or legally complex circumstances, the challenge will be far greater, and the entity will need to document itsdiligent investigatory efforts carefully if it expects to disclose beyond the deadline.

Second, EPA has added a duty to disclose within 10 days after the entity discovers that a violation "may have occurred." The Agency's purpose is to encourage disclosures that will "allow the regulatory authorities to make a definitive determination."⁸⁰ This may make good sense and perhaps even good policy, but it directly contradicts EPA's offer of flexibility when entities need more than 10 days because "compliance cannot be determined within that period." Situations where compliance cannot be determined promptly ordinarily are those triggered by discovery that a violation "may have occurred," and the entity will need a good crystal ball to guess which of the Policy's two scenarios will govern. One plausible explanation for this apparent contradiction is that EPA will insist on disclosure within 10 days where the uncertainty has to do with interpreting regulatory requirements (a realm within which "definitive determinations" often are made by regulatory authorities), while greater delays will be tolerated where the uncertainty has to do with factual circumstances requiring investigation by the entity.

Condition No. 4: Discovery and Disclosure Independent of Government or Third-Party Plaintiff

The entity must disclose the violation before any of five events that independently would bring it to the attention of a regulatory agency: (1) commencement of a federal, state, or local agency inspection or investigation, or issuance of an information request; (2) notice of a citizen suit; (3) filing of a complaint by a third party; (4) a "whistle-blower" report to EPA or another agency; or (5) "imminent discovery" of the violation by a regulatory agency.⁸¹ EPA's purpose is to reward entities that "have taken the initiative to find violations and promptly report them," but not those merely seeking a way out of liability for violations detected by others.⁸²

While this condition drew little comment during the development of EPA's Final Policy, it is easy to imagine confusion and serious disputes in implementing its language. Three of the listed events—citizen-suit notices, filing of complaints, and whistleblower reports—usually will be sufficiently discrete, both in time and scope, to allow straightforward determinations of the disclosure's timeliness. Two others—agency inspections and imminent discovery by an agency—are just the opposite. Where the physical evidence of a violation is easily observed (e.g., an unreported spill, waste-disposal manifest discrepancy, or equipment malfunction leading to unpermitted releases), EPA will be in a position to maintain that Agency officials were about to discover the violation on their own through upcoming inspections, routine records checks, ambient monitoring, or other means. Fortunately, the 10-day window for self-disclosure under Condition No. 3, discussed above, may narrow the opportunity for these disputes to arise.

Condition No. 5: Correction and Remediation

Two responsibilities are imposed by this condition. First, the entity must correct the violation within 60 days, and certify that it has been corrected.⁸³ The entity may take longer to correct violations that are more difficult or complex, provided that EPA is so notified within the 60-day period.⁸⁴ In "all cases," however, EPA will expect the entity to "return to compliance as expeditiously as possible."⁸⁵

Several important questions will arise under this language. Does the 60-day correction period run from discovery or from disclosure of the violation? Does EPA have to concur with extensions beyond 60 days? Does the certification of correction require EPA review or approval? If EPA disagrees with the adequacy of a corrective action performed in good faith, is penalty mitigation jeopardized? Will EPA insist on full, physical compliance (e.g., shutting down unpermitted units; exhuming improperly treated waste), or be willing to accommodate imperfect corrections while still providing penalty mitigation?

The entity's second responsibility is to take "appropriate measures as determined by EPA to remedy any environmental or human harm due to the violation."⁸⁶ EPA emphasizes that this will include spill responses and removal or remedial actions required by law.⁸⁷ Unlike the duty to correct the violation, this language clearly requires an EPA determination that the remedy is appropriate. Inasmuch as these disclosures will involve only relatively minor harm,⁸⁸ it is to be hoped that the entity's proposed remedy will prove acceptable to EPA in most instances. Nonetheless, disputes will arise, and penalty mitigation decisions will not be reached quickly for violations giving rise to harm [26 ELR 10235] that must be remedied. While the Final Policy does not explicitly envision trade offs between penalty mitigation and the extent or cost of remediation performed, it is not difficult to imagine some horse trading in practice.

Condition No. 6: Prevent Recurrence

Under this condition, "the regulated entity agrees in writing to take steps to prevent a recurrence of the violation, which may include improvements to its environmental auditing or due diligence efforts."⁸⁹ An important question lurks within the brief language of this condition. It involves EPA's 75 percent mitigation incentive which, as noted earlier, applies to disclosures meeting all conditions except the first—discovery through an audit or due diligence program. Why would an entity incur the expense and go to the trouble of creating such programs if it can count on avoiding three-fourths of any penalty without them? The answer probably is that it cannot. EPA appears to envision that the requirement to make "improvements" to auditing and due diligence programs will include creating such programs where they do not exist. In discussing the 75 percent solution, EPA emphasized that "this will encourage companies to come forward and work with the Agency to resolve environmental problems and begin to develop an effective compliance management program."⁹⁰ Condition No. 6 is the Final Policy's most obvious point of leverage to encourage such program development.

Condition No. 7: No Repeat Violations

The Interim Policy had required that the disclosed violation must "not indicate that the regulated entity has failed to take appropriate steps to avoid repeat or recurring violations."⁹¹ Industry stakeholders split on their reactions to this concept. Some supported EPA's approach of considering compliance history by analyzing the cause of the instant violation and withholding mitigation where it appeared the entity had failed to learn from prior mistakes. Others found the Interim Policy too vague, and agreed with state regulators, who urged EPA to utilize "bright lines" that would make it clearer and easier to factor in past performance.

The Final Policy moves in the direction of bright lines, driven there by EPA's understandable reluctance to delve into the alleged causes of violations that, for whatever reasons, continue to occur. Condition No. 7 completely removes eligibility for penalty mitigation where (1) "the specific violation (or closely related violation) … occurred previously within the past three years at the same facility," or (2) the disclosed violation is "part of a pattern of federal, state or local violations by the facility's parent organization … which have occurred within the past five years."⁹² The Policy defines "violation" very broadly, to include not only adjudicated violations, but also those alleged in a prior compliant or notice of violation, as well as "any act or omission for which the regulated entity has previously received penalty mitigation from EPA or a state or local agency."⁹³

These restrictions obviously present major difficulties for large or heavily regulated entities, but also offer opportunities to manage enforcement defense matters creatively to minimize future problems under the Policy. In particular, in negotiating settlements of alleged violations with state and local agencies, entities will want to seek careful wording, or even withdrawal of allegations, that will avoid triggering future bean counting under this condition.

Even with such careful lawyering, the Policy's language leaves some areas of uncertainty. EPA has not explained the circumstances under which disclosed violations will be considered "closely related" to prior infractions. And most important for large entities, the Policy does not make clear what it means by "a pattern of … violations by the facility's parent organization." While EPA is correct in concluding that "it would be unreasonable to provide unlimited amnesty for repeated violations," it is questionable whether the Policy will avoid being "unfair to regulated entities responsible for managing hundreds of facilities."⁹⁴ Such entities invariably will have numerous violations within any given five-year period, and those that aggressively self-police and report their violations will have the worst possible track record. If EPA considers sheer numbers in determining whether a "pattern" exists, then such entities will lose the principal incentive to self-police and disclose violations otherwise offered under the Policy. If the Agency instead looks for some causal connection among the entity's prior violations, then the conceptual approach of the Interim Policy will have been restored to some extent.

Condition No. 8: Other Violations Excluded

This condition eliminates from consideration under the Policy any violation that (1) "resulted in serious actual harm, or may have presented an imminent and substantial endangerment to human health or the environment" or (2) "violates the specific terms of any judicial or administrative order, or consent agreement."⁹⁵ Under the first category, EPA explains that violations causing serious harm or endangerment "indicate a serious failure (or absence) of a self-policing program, which should be designed to prevent such risks …."⁹⁶ This conclusion is debatable in particular cases, of course, since even the best compliance management systems cannot prevent all violations. Sometimes, the extent of any resulting harm or endangerment may be attributable far more to circumstances than to the severity of the violation itself.

The better course would be to examine whether the violation was serious and/or caused by a "serious failure (or absence) of a self-policing program," and then to deny or reduce penalty mitigation accordingly if serious harm or endangerment resulted. This would be a very fundamental shift indeed—away from a clear, "results-oriented" approach toward a "best efforts" test that rewards appropriate behavior even when that behavior fails to prevent serious harm. EPA's work load would increase, to be sure, but the [26 ELR 10236] resulting environmental benefits arguably would be worth the extra effort.

The Final Policy eschews that approach, however, preferring instead to create a bright line that excludes any violation leading to serious harm or endangerment. But is the Policy's line all that bright? There is no explanation for the distinction between "serious" harm that will disqualify a violation and ordinary harm which, if remedied pursuant to Condition No. 5, will earn the violator full penalty mitigation. Likewise, "imminent and substantial endangerment" can be an elastic concept, and is made more uncertain still by the exclusion of violations that "may have presented" such conditions. Future developments under this facet of the Policy will be among the most important for practitioners to follow.

Under the second category, it is important to note that violations are excluded only if they transgress "the specific terms" of prior orders or agreements. It is not uncommon for orders and agreements to contain a general commitment to comply with the law in the future. EPA appears to contemplate excluding only the more narrow and discrete obligations embodied in orders or agreements that are designed to respond to past violations.

Condition No. 9: Cooperation

Finally, EPA will insist that:

the regulated entity cooperates as requested by EPA and provides such information as is necessary and requested by EPA to determine applicability of this policy. Cooperation includes, at a minimum, providing all requested documents and access to employees and assistance in investigating the violation, any noncompliance problems related to the disclosure, and any environmental consequences related to the violations.⁹⁷

EPA has added to the Interim Policy a duty to provide information regarding other noncompliance "related to" the disclosure. The Agency does not appear to contemplate broad fishing expeditions, but will insist on cooperation to investigate possible violations "indicated by the disclosure" that were not specifically mentioned by the entity.⁹⁸

Cooperation is important for an entity seeking enforcement restraint under any circumstances, and yet raises familiar issues concerning the need to protect privileged documents and business-sensitive information, and to monitor employee interviews. The language of Condition No. 9 is very broad ("all requested documents") and limited only by EPA's determination of necessity. And of course EPA will seek information related not only to the disclosed (and related) violations, but also to the entity's due diligence and audit programs, perhaps companywide.

In one particular aspect, the Final Policy sets up a tension between its various "incentives." On the one hand, entities seeking full penalty mitigation or criminal-referral restraint very likely will be asked to disclose their audit reports, especially if violations were discovered through audits, but also perhaps to document the auditing feature of their due diligence programs. On the other hand, EPA pledges in the Final Policy that it "will not request or use an environmental audit report to initiate a civil or criminal investigation … ," but may do so if it "has independent reason to believe a violation has occurred …."⁹⁹ The Policy does not explain whether the entity's written disclosure constitutes a "reason to believe" that is "independent" of the underlying audit. If it does, then the cooperation requirement of Condition No. 9 trumps EPA's promise not to seek audit reports to initiate investigations.

Why is this important to an entity seeking penalty mitigation pursuant to a disclosure? First, audit reports may identify related, or even unrelated, potential problems that the entity is under no obligation to disclose. Second, the auditors may provide a whole menu of speculative causes, options for remedies, potential for recurrence at other facilities, and potential for harm that prove to be fertile ground for expensive investigation under the Policy's conditions, but that take EPA and the entity far afield. Finally, audit reports may inaccurately point to particular managers' responsibility for the violations, which could lead the government into the criminal arena, even under the Final Policy's new incentives.¹⁰⁰ EPA's statement that its docket does "not reveal a single criminal prosecution for violations discovered as a result of an audit self-disclosed to the government"¹⁰¹ will be small comfort to the first candidate.

The result of this tension within the Final Policy is that entities who audit and disclose may be more vulnerable to a probe into their self-evaluative process than will be entities who audit but do not disclose a violation. Consequently, the Policy may not only stifle the frank and complete evaluation that auditors might otherwise provide, but could discourage disclosure in some of the most serious circumstances EPA would wish to address. The answer to this dilemma might not necessarily be an audit privilege; EPA could improve conditions for disclosure simply by making clear that its promise not to seek audit reports is unaffected by the entity's duty to cooperate with the investigation of self-disclosed violations.

Observations and Recommendations

EPA's new Final Policy provides a framework for civil-penalty mitigation that should increase the regulated community's willingness to manage compliance responsibilities and work with EPA in the context of disclosure and cooperation. Many of the ambiguities and issues highlighted in the discussion above will be resolved through experience or supplemental guidance, and as they are, corporate managers and their counsel will be able to develop management and disclosure strategies that satisfy the Policy. In particular, regulated entities will need to learn from the due diligence program descriptions and penalty-mitigation decisions EPA has promised to disclose publicly.

At the same time, the ultimate success of EPA's initiative may depend on the resolution of four much more fundamental questions. The Agency is well aware of these issues and their importance to the stakeholders.

[26 ELR 10237]

What About the States and Third Parties?

No corporate counsel worth their stock options will recommend disclosures to EPA without first concluding that risks of enforcement actions by state agencies and litigation by third parties are fairly small. While EPA has deleted the Interim Policy's requirement of disclosure to state and local agencies, it has acknowledged its obligation to release disclosures if required by the Freedom of Information Act, and has underscored its long-standing policy of making publicly available any compliance agreements that are reached.¹⁰²

Entities' evaluation of state enforcement exposure may be relatively straightforward in the eight states that have enacted some form of immunity legislation¹⁰³ and in others added to the list over time, but will be difficult everywhere else. Since EPA has pledged to "work closely with the states in implementing the policy," there will be no secrets among the agencies.

The potential for citizen suits and other third-party litigation will depend on the circumstances of each violation. It is difficult to imagine environmental groups bringing successful citizen suits for violations meeting all of the Policy's nine conditions, but the entity often will have doubts about satisfying some of the conditions. Tort litigation cannot be ruled out where a release has occurred, even if only "ordinary" harm resulted.

In order to bring about increased disclosure and cooperation over the long term, EPA needs to articulate and follow an aggressive plan to encourage state adoption of penalty-mitigation schemes that are consistent with the Final Policy. The Agency has said it "will work closely with states to encourage their adoption of policies that reflect the incentives and conditions outlined in this policy."¹⁰⁴ EPA needs to do that quickly.¹⁰⁵

EPA probably is powerless to affect the potential for tort litigation against the disclosing entity, but does have the authority to declare its position on how final decisions under the Policy should affect citizen suits. In particular, EPA should state its position that favorable penalty-mitigation decisions reached under the Policy constitute "diligent prosecution" of the violation, as that phrase is used in several environmental statutes to foreclose citizen suits.¹⁰⁶ The Policy already provides for formalizing such decisions in judicial decrees.¹⁰⁷

Will the Policy Enjoy Long-Term Stability?

As demonstrated by the evolution of EPA's approach to penalty mitigation, agency policies are very easy to change. EPA has examined considerable data and made extraordinary efforts to solicit public input in developing the Interim and Final Policies, but it was not required to do so, and need not follow the same course in the future. These factors are among the most important considerations behind regulated entities' federal and state legislative initiatives.

EPA could, and should, provide the stability industry is seeking by promulgating the Final Policy as a regulation. Promulgation not only would make the Policy binding and enforceable against the Agency, but would materially decrease the possibility of precipitous change. EPA indicated that it will consider converting the Policy into a regulation if appropriate.¹⁰⁸

Will the Policy Be Implemented Consistently?

Regulated entities and their counsel are acutely aware of differences in enforcement attitudes and practices among the EPA regional offices, and there is concern that while the Policy may be endorsed and fully implemented by some, it could be grudgingly and only partially accepted by others.¹⁰⁹ If this occurs, the Policy's potential will be undermined considerably, and interest in legislation will be heightened.

In the long run, promulgation of the Policy as a regulation should address some of these concerns. Meanwhile, EPA needs to pay close attention to consistent implementation in the early going. This could be accomplished most efficiently by creating a review process at EPA headquarters through which regulated entities and regional EPA enforcement personnel can obtain clarifications and resolve differences in interpretation under the Policy. This might be what the Agency meant when it said "EPA is taking steps to ensure consistency and predictability."¹¹⁰

How Will EPA Demonstrate the Policy's Success?

Finally, EPA needs to translate its overall policy goals into measurable objectives that will demonstrate success in the years ahead. The Agency's enforcement program is captive to traditional measures that not only have little connection to the Policy's objectives, but will appear to demonstrate enforcement failures as the Policy succeeds. EPA relies primarily on deterrence-oriented statistics (numbers of actions brought, amount of fines collected, years of incarceration meted out) to evaluate its enforcement success and [26 ELR 10238] justify its resources. While the Agency is moving toward more qualitative measures, such as the "quality" of enforcement actions and the environmental results they achieve,¹¹¹ this evolution only modifies traditional "bean counting" and, to some critics, appears intended to rationalize EPA's declining enforcement presence. As the Policy succeeds in encouraging better compliance management by regulated entities, there will be fewer traditional beans to count. If EPA fails to dramatically change the way it measures success, and to articulate the importance of those changes, the enforcement program will appear to fail even as it succeeds.

What are the appropriate success measures? At a minimum, EPA needs to develop baseline data and then track progress annually in the following areas: numbers and quality of auditing and "due diligence" programs among the regulated community; numbers and types of violations detected, corrected, and disclosed under the Policy; programmatic improvements and startups agreed to in penalty-mitigation settlements; environmental and human harm remedied pursuant to the Policy; trends in repeat violations and patterns of violations; and of course audit-related information sought or used by the Agency to investigate or prosecute violations.

The Agency has promised to complete a study of the Policy's effectiveness within three years.¹¹² EPA should act much sooner in order to demonstrate to congressional appropriators, Agency personnel, and the regulated community that a reliable policy of penalty mitigation, under appropriate conditions and limitations, will significantly improve compliance management and environmental protection.

1. EPA, Final Policy Statement on Incentives for Self-Policing: Discovery, Disclosure, Correction and Prevention of Violation, 60 Fed. Reg. 66706 (Dec. 22, 1995), ELR ADMIN. MAT. I 35639 [hereinafter Final Policy].

2. EPA, Voluntary Environmental Self-Policing and Self-Disclosure Interim Policy Statement, 60 Fed. Reg. 16875 (Apr. 3, 1995) (available from the ELR Document Service, ELR Order No. AD-1200) [hereinafter Interim Policy].

3. The Final Policy promises that EPA will not refer criminal cases for prosecution against an entity where (1) all of the prerequisites for civil penalty mitigation are met; (2) there is no demonstration of a prevalent management philosophy or practice that concealed or condoned violations; and (3) there was no high-level corporate officials' or managers' conscious involvement in, or willful blindness to, the violations. Final Policy, supra note 1, at 66711. Few, if any, criminal prosecutions have been brought against entities under these circumstances, although small closely held entities will find somewhat less comfort in EPA's conditions than large corporations, and individuals are not covered by the Policy at all.

4. EPA, ENFORCEMENT AND COMPLIANCE ASSURANCE ACCOMPLISHMENTS REPORTS FY 1994 4-3 (May 1995) (available from the ELR Document Service, ELR Order No. AD-1236).

5. Id. at 4-4 to 4-5.

6. Id. at 2-3.

7. Eight states have enacted both penalty-immunity and environmental-privilege statutes (Colorado, Idaho, Kansas, Minnesota, Mississippi, Texas, Virginia, and Wyoming). Another six have enacted privilege statutes (Arkansas, Illinois, Indiana, Kentucky, Oregon, and Utah).

8. S. 582, 104th Cong., 1st Sess. (1995).

9. H.R. 1047, 104th Cong., 1st Sess. (1995).

10. See 42 U.S.C. § 7413(e), ELR STAT. CAA § 113(e); 33 U.S.C. § 1319(d), ELR STAT. FWPCA § 309(d); 42 U.S.C. § 6928(a), ELR STAT. RCRA § 3008(a).

11. EPA, A Framework for Statute-Specific Approaches to Penalty Assessments: Implementing EPA's Policy on Civil Penalties, #GM-22 EPA GENERAL ENFORCEMENT POLICY COMPENDIUM (Feb. 16, 1984), ELR ADMIN. MAT. I 35073 [hereinafter the Framework].

12. Id. at 6-12. In general, the benefit component consists of delaying expenditures (e.g., failure to install control equipment), avoiding costs altogether (e.g., operation and maintenance costs), and gaining a competitive advantage (e.g., selling banned products).

13. Id. at 13-15. The gravity component is quantified by evaluating several factors: actual or possible harm (including amount and toxicity of pollutants, sensitivity of the environment, and length of continuing violations), importance to the regulatory scheme, availability of data from other sources (for recordkeeping and reporting violations), and size of the violator.

14. Id. at 17-24. These factors include: degree of willfulness and/or negligence, degree of cooperation/noncooperation, history of noncompliance, and ability to pay.

15. Id. at 18.

16. Id. at 19.

17. The Framework suggests no more than a 20 percent reduction of the gravity component, absent unusual circumstances, for a low degree of willfulness and/or negligence. Id. at 18. Similarly, prompt reporting ordinarily would earn the violator no more than a 10 percent reduction, while prompt correction of environmental harm might be worth a 50 percent reduction. Id. at 19-20. This same consideration is relevant to making a downward adjustment based on the lack of willfulness and/or negligence. Id. at 34.

18. EPA, RCRA CIVIL PENALTY POLICY 13 (Oct. 1990), ELR ADMIN. MAT. I 35273.

19. Id. at 33.

20. Id. at 32.

21. EPA, CLEAN WATER ACT CIVIL PENALTY POLICY (Feb 11, 1986) (available from the ELR Document Service, ELR Order No. AD-1041).

22. EPA, INTERIM CLEAN WATER ACT SETTLEMENT PENALTY POLICY (Mar. 1, 1995), ELR ADMIN. MAT I 35618.

23. Id. at 13. EPA noted that it was about to issue the Interim Poicy, and authorized the regions, with advance approval from headquarters, to adjust the gravity component based on the presence or absence of auditing programs. Id.

24. 51 Fed. Reg. 25004 (July 9, 1986), ELR ADMIN. MAT. I 35001 [hereinafter Auditing Policy].

25. Id. at 25006.

26. Id. at 25005.

27. Id. at 25004.

28. Id. at 25007 (emphasis added).

29. OFFICE OF CRIMINAL ENFORCEMENT, EPA, GUIDANCE ON EPA'S EXERCISE OF INVESTIGATIVE DISCRETION (Jan. 12, 1994) (available from the ELR Document Service, ELR Order No. AD-151).

30. U.S. DOJ, FACTORS IN DECISIONS ON CRIMINAL PROSECUTIONS FOR ENVIRONMENTAL VIOLATIONS IN THE CONTEXT OF SIGNIFICANT VOLUNTARY COMPLIANCE OR DISCLOSURE EFFORTS BY THE VIOLATOR (July 1, 1991) (available from the ELR Document Service, ELR Order No. AD-505) [hereinafter DOJ FACTORS].

31. EPA, Policies Regarding the Role of Corporate Attitude, Policies, Practices and Procedures, in Determining Whether to Remove a Facility From the EPA List of Violating Facilities Following a Criminal Conviction, 56 Fed. Reg. 64785 (Dec. 12, 1991), ELR ADMIN. MAT. I 35411 [hereinafter Dec. 12, 1991, Policies].

32. See, e.g., Letter from Francis Blake, former EPA General Counsel, to William K. Reilly, EPAAdministrator (Sept. 13, 1990) (setting forth industry's Request for Amendment to RCRA and TSCA Enforcement Policies to Encourage Voluntary Reporting and Correction of Violations). The letter cites enforcement policies implemented successfully by the Federal Aviation Administration (concerning commercial airline safety) and the Nuclear Regulatory Commission (addressing reactor safety requirements) in support of civil-penalty policy recommendations very similar to those adopted by EPA in the Final Policy.

33. EPA, Restatement of Policies Related to Environmental Auditing, 59 Fed. Reg. 38455 (July 28, 1994).

34. Interim Policy, supra note 2, at 16878.

35. Id.at 16877.

36. Id.

37. Owners and operators of permitted hazardous waste facilities must report virtually all instances of noncompliance with RCRA. 40 C.F.R. § 270.30(1) (1995). Similarly, once applications are required to be submitted under the Clean Air Act federal operating permit program, applicants will be required to certify compliance and identify noncompliance. Id. § 70.5(c).

38. According to the 1986 Auditing Policy, environmental auditing is defined to mean "a systematic, documented, periodic and objective review by regulated entities of facility operations and practices related to meeting environmental requirements." Auditing Policy, supra note 24, at 25006. Among other limitations, EPA interprets the requirement that auditing be "objective" to mean that the auditing function must be independent of audited activities. Id. at 25009. Formal, independent auditing programs are by no means common throughout the universe of regulated entities.

39. Interim Policy, supra note 2, at 16877.

40. In its comments on the Interim Policy, for example, WMX Technologies, Inc. explained that through its internal compliance management program at least 80 percent of all environmental issues are self-identified by plant personnel, only 15 percent are detected by internal "independent" auditors, and only 5 percent by external sources such as agency inspectors and customers' auditors.

41. Final Policy, supra note 1, at 66706.

42. Id. at 66707.

43. In April 1995, shortly after the Interim Policy was published, Price WaterhouseLLP released its industry-sponsored Voluntary Environmental Audit Survey of U.S. Businesses (Mar. 1995). Price Waterhouse surveyed nearly 400 companies in 14 manufacturing and service sectors. Three-fourths of the responding companies reported that they had auditing programs in place, and nearly two-thirds of these said they would expand their programs if penalties were eliminated for problems that were self-identified, reported, and corrected.

44. Final Policy, supra note 1, at 66711. From the beginning of its Policy review, EPA has steadfastly refused to consider mitigating the economic-benefit component of civil penalties. The Final Policy preserves EPA's "full discretion to recover any economic benefit gained as a result of noncompliance to preserve a 'level playing field,'" but suggests that an "insignificant" amount of economic benefit may be forgiven if the entity satisfies all conditions for mitigating the gravity component. Id. at 66712.

45. The Interim Policy was much less explicit about which conditions must be met in order to achieve specific penalty-mitigation amounts. Full mitigation of the gravity component was available if seven conditions were met (detection, disclosure, correction, remediation of endangerment, remediation of harm and measures to prevent recurrence, no lack of preventive measures, and cooperation) and three exceptions did not apply (criminal conduct, imminent and substantial endangerment, and serious actual harm). But the Interim Policy provided that EPA "may" mitigate "up to" 75 percent of the gravity component where "most" of the seven conditions were met, or where imminent and substantial endangerment or criminal conduct were involved and all seven conditions were met. Interim Policy, supra note 2, at 16877. The Final Policy is much more clear-cut, but eliminates the prior flexibility to mitigate less than 75 percent of the gravity component. Such cases now must be addressed under the vague, discretion-laden criteria of statute-specific penalty policies, discussed earlier. Final Policy, supra note 1, at 66712.

46. It is also important to remember that these same nine conditions, among other things, must be satisfied in order for an entity to benefit from EPA's promise not to refer cases to the DOJ for criminal prosecution. Final Policy, supra note 1, at 66711.

47. Id.

48. Id. at 66710.

49. Id.

50. Auditing Policy, supra note 24, at 25009.

51. Id.

52. Interim Policy, supra note 2, at 16877.

53. Final Policy, supra note 1, at 66708.

54. Id. at 66710.

55. Id. at 66708.

56. Id.

57. Id. at 66710-11.

58. Id. at 66708.

59. Id. at 66710 (emphasis added).

60. Id.

61. See U.S. SENTENCING COMM'N, GUIDELINES MANUAL, § 8A1.2, cmt. n.3(k) (Nov. 1991) [hereinafter 1991 SENTENCING GUIDELINES].

62. See Dec. 12, 1991, Policies, supra note 31, at 64787.

63. See ADVISORY WORKING GROUP ON ENVTL. SANCTIONS, REPORT TO THE U.S. SENTENCING COMMISSION, § 9.C1.1(f) (Nov. 16, 1993) (proposing a new Chapter 9 to the U.S. Sentencing Guidelines) (available from the ELR Document Service, ELR Order No. AD-170).

64. Final Policy, supra note 1, at 66711.

65. Id. at 66708 (emphasis added).

66. In its testimony at EPA's July 1994 public meeting, its comments on the Interim Policy, and during the five-day stakeholder dialogue attended by state and federal regulators, WMX described a component of its compliance program, called the Compliance Management System (CMS), that performs many of these functions. CMS is a computer-based system, now operational at hundreds of WMX facilities, that translates permit and other requirements into tasks, issues task orders at the appropriate times, and tracks and documents completion of the tasks as workers perform them and inform the system.

67. The requirement that environmental audits be "objective," and therefore managed independently from activities being audited, presents obvious organizational difficulties for entities wishing to place compliance responsibility on the shoulders of facility managers.

68. Final Policy, supra note 1, at 66711.

69. Id.

70. Disciplinary procedures are mentioned specifically in other compliance-program models. See, e.g., 1991 SENTENCING GUIDELINES, supra note 61; DOJ FACTORS, supra note 30, § II.D.2; Dec. 12, 1991, Policies, supra note 31, at 64787.

71. Final Policy, supra note 1, at 66711.

72. Interim Policy, supra note 2, at 16877. The Agency became convinced through the public-comment process that legally required disclosures should be included in order to broaden the Policy's incentive for voluntary self-policing. Final Policy, supra note 1, at 66708.

73. Final Policy, supra note 1, at 66711.

74. Id.

75. 40 C.F.R. §§ 264.15, 265.15 (1995).

76. Final Policy, supra note 1, at 66711.

77. Interim Policy, supra note 2, at 16877.

78. Id.

79. Final Policy, supra note 1, at 66708.

80. Id. at 66709.

81. Id. at 66711.

82. Id. at 66709.

83. Id. at 66711.

84. Id.

85. Id. at 66709.

86. Id. at 66711.

87. Id. at 66709.

88. As noted in the discussion of Condition No. 8, the Policy totally excludes from its coverage any violation causing "serious actual harm." See infra note 95 and accompanying text.

89. Final Policy, supra note 1, at 66711.

90. Id. at 66707.

91. Interim Policy, supra note 2, at 16877.

92. Final Policy, supra note 1, at 66712.

93. Id.

94. Id. at 66709.

95. Id. at 66712.

96. Id. at 66709.

97. Id. at 66712.

98. Id. at 66710.

99. Id. at 66711.

100. Id. EPA excludes from its promise not to recommend criminal prosecutions those situations demonstrating "high-level corporate officials' or managers' conscious involvement in, or willful blindness to, the violations." In addition, the Agency remains free to pursue prosecution of individual employees even where the Policy would result in no referral against the entity. Id.

101. Id. at 66708.

102. Id. at 66709.

103. See supra note 7.

104. Final Policy, supra note 1, at 66712.

105. California has proposed a new policy that largely mirrors EPA's approach, but adds a few wrinkles of its own. On February 16, 1996, the California Environmental Protection Agency issued a proposal containing the same nine conditions included in EPA's Final Policy, but offering an additional 15 percent penalty mitigation for pollution prevention programs where the entity otherwise would be entitled to 75 percent mitigation, and a fee-for-service certification of due diligence programs that would provide entities some advance assurance that their programs are designed appropriately. See State Unveils Draft Audit Policy That Expands on U.S. EPA Approach, Daily Env't Rep. (BNA), Feb. 22, 1996, at A-7.

106. See, e.g., 33 U.S.C. § 1365(b)(1)(B), ELR STAT. FWPCA § 505(b)(1)(B).

107. Final Policy, supra note 1, at 66711.

108. Id. at 66710.

109. While the DOJ was involved closely in the development of EPA's Final Policy, there had been similar concern among regulated entities that the DOJ, and in particular the U.S. Attorneys Offices, would not feel compelled to follow the Policy and might even be hostile to it, especially with respect to restraint in pursuing criminal prosecutions. The department has moved to address those concerns, however, by explicitly supporting the Final Policy: "The approach taken in EPA's policy, endorsed by this Department, is sound." Letter from Lois J. Schiffer, Assistant Attorney General, Environment and Natural Resources Division, DOJ, to Steven Herman, Assistant Administrator for Enforcement and Compliance Assurance, EPA (Jan. 31, 1996).

110. Id.

111. See EPA Officials Attribute Drop in Enforcement to New Compliance Policies, INSIDE EPA WKLY. REP., Nov. 3, 1995, at 16.

112. Final Policy, supra note 1, at 66712.