John Barwise on whether third-party EMS audits of permitted sites can guarantee legal compliance
Environment management systems (EMS) are increasingly popular as a way of reducing an organisation’s environmental impacts and improving business performance. But does implementing an EMS help to ensure legal compliance? Environment regulators currently carry out onsite inspections and monitoring to ensure permitted operations are complying with the conditions of their permits. This is costly in terms of time and money.
The Environment Agency’s operator risk appraisal tool (OPRA) takes the presence of an EMS into account when assessing risk at the sites it regulates. Since 2011, the agency has been piloting an approach that goes a step further. Its environmental permitting regulations assurance scheme (EPRAS) consists of the operator confirming annually that the site has complied with its permits (or details of any breaches) and a third-party audit against a specially developed compliance management checking tool, called EMS+.
The approach is being piloted at several sites across five industry sectors. Evidence from the trials, along with feedback from participants, will be used to determine whether such a scheme should be more widely available, potentially from April 2015. EPRAS is the latest in a long line of projects exploring ways of aligning EMS implementation with regulatory compliance, with the aim of cutting administration costs and lowering inspection fees. But can it work?
Frame of reference
An EMS provides an effective mechanism for controlling environmental impacts, reducing risk, complying with regulations and improving environmental performance. The most widely used, certifiable EMS standard is ISO 14001. At the last count, in 2012, more than 285,000 14001 certificates had been issued worldwide, about 10,000 of which are in the UK. The EU standard, EMAS (eco-management and audit system), meanwhile has more than 4,500 registered organisations across 8,000 sites worldwide.
Both 14001 and EMAS require organisations to demonstrate continual improvement in environmental performance, but only EMAS requires full compliance with applicable legislation, as a condition of EMS registration. 14001 requires a commitment to comply with applicable legislation, but full compliance is not a certification requirement.
There have been numerous research studies to see whether a certified EMS can be used as a mechanism for improving regulatory compliance. In 2000, the agency introduced its EMS regulation project, in partnership with certification bodies and businesses. The aim was to assess whether regulators could rely on conformance with 14001 or EMAS as an indicator of regulatory compliance. While the study confirmed that environment management systems did bring benefits in terms of environmental improvements, it was inconclusive on whether certification improved compliance.
In 2002, a three-year study was launched examining the potential benefits of linking systems with regulation across a range of European businesses. The incentive was to find ways of reducing fees for participating organisations by establishing a partnership approach to inspection between regulators and certifiers. The results show strong evidence that an EMS certified by an accredited certification body improves environment management activities and results in higher detection rates of non-compliance. However, evidence of legal compliance from the sample groups showed mixed results across different regions.
An ENDS survey carried out jointly with IEMA and the UK’s accreditation body, UKAS, in 2006, discovered growing confidence in EMS as a useful tool for detecting non-compliance and reducing environmental risk, but evidence of improving compliance was again inconclusive. Interestingly, the results revealed an increased level of confidence in the credibility of certification bodies compared with an earlier survey.
These studies indicate that a certified EMS can lead to continual improvement in performance and raise awareness of statutory responsibilities, but that it does not guarantee legal compliance.
Third-party certification of 14001 in the UK is undertaken by certification bodies, many of which are accredited by UKAS. The auditor’s primary responsibility is to determine whether an organisation’s EMS is functioning properly and is capable of consistently achieving the organisation’s stated environment policy and objectives.
Guidance for accredited certification bodies on compliance auditing (EA-7/04) states that auditors are required to assess the conformity of an EMS to the requirements of 14001, but not to make a direct evaluation of legal compliance. The guidance states that it is the role of regulators and not auditors to conduct legal compliance audits and inspections. It adds: “It should be stressed that certification body auditors are not inspectors of the environmental regulator. They should not provide ‘statements’ or ‘declarations’ of legal compliance.” The guide acknowledges, however, that an organisation’s compliance with applicable legal requirements is of concern to regulators and other interested parties, and that while certification of an EMS is not a guarantee of legal compliance, it is an efficient tool to achieve and maintain compliance.
Sniffing out change
Against this background, the UK’s environment regulators have been exploring various ways of linking third-party EMS certification audits with inspection regimes that will benefit all parties.
EMS certification aligned to regulatory inspections opens up the possibility of compliance auditing by proxy. Certified organisations would benefit from having fewer inspections and lower compliance fees, and there would be more business opportunities for EMS certification bodies. Environment agencies would be able to focus their attention on those organisations whose activities pose the greatest risk to the environment and require more complex control. However, a convergence of auditing and inspection would require a major realignment of the auditing procedures used by UKAS-accredited certification bodies to match them with regulatory inspection regimes.
Sustainability analysts Sniffer recently led a research project on behalf of UK regulators to assess whether third-party EMS certification audits can provide assurance of legal compliance. The scope of the research was extensive, but the main objectives were to:
- assess existing auditing processes and the consistency of approach, and make recommendations for improvement;
- identify what opportunities there are for maximising synergies between regulators and certification bodies; and
- develop a position statement on environment management systems to help the regulators refine their approach to third-party certification bodies.
The research involved all the key players in EMS certification, including face-to-face interviews with representatives from certification bodies and regulators, discussions with UKAS, open debates on LinkedIn and online surveys of environment managers, auditors and other stakeholders. Most of the participants indicated a need for better communication and cooperation between certification bodies and agency inspectors. Issues were also raised about the significant differences between EMS auditing and regulatory inspection, and that environment agencies should provide clearer guidelines on legal requirements and inspection regimes.
The research indicated that certification bodies have differing views on compliance auditing, with some bodies keen to deliver assurance of legal compliance, while others were reluctant to take on this role – in part, because of legally binding confidentiality agreements with their clients. There was also some concern that, while certification bodies were responsive to the UKAS accreditation process, there is a lack of evidence regarding the quality or effectiveness of that process.
The final Sniffer report contains more than 30 recommendations that the researchers suggest are necessary to provide assurance that EMS certification audits can deliver consistent legal compliance. The report concludes that, at present, audits of legal requirements and compliance evaluation are generally not sufficiently consistent to be used as a proxy for regulatory inspection.
The findings will be used to establish closer cooperation between regulators, UKAS and certification bodies, and, ultimately, to strengthen alignment between UKAS-accredited certification and legal compliance. Ruth Wolstenholme, managing director at Sniffer, says: “The UK environment agencies intend to use the report’s findings in further work with UKAS, IEMA and other bodies to address the issues identified, implement the recommendations and improve correlation between accreditation and regulatory compliance.”
The Sniffer report and its recommendations are mainly based on the current version of 14001, but the authors suggest there may be further opportunities to strengthen the links between certification and legal compliance with the proposed revision of the standard, which is expected to be published in 2015. IEMA has been pushing for the revised standard to tighten requirements on demonstrating legal compliance and performance improvement.
Martin Baxter, executive director of policy at the Institute and the lead adviser to the UK delegation on the revision, comments: “The proposed changes to the standard emphasise the need for organisations, through their EMS, to be able to demonstrate that they are actively managing compliance and know their compliance status.”
He also says that the communication requirements related to compliance performance have been strengthened, so there is greater focus on internal assurance of performance data before it gets reported to regulators. “In combination, these changes would provide a stronger basis for regulators more explicitly recognising 14001 in their regulatory approach,” explains Baxter.
Cutting red tape
The Environment Agency certainly takes the view that an effective EMS has the potential to improve regulatory compliance and is exploring new ways of linking the environmental permitting regime with certified systems. OPRA already provides an EMS-type framework for managing and assessing environmental risks. It includes compliance rating attributes, which enable organisations to determine whether their operations fall within the high, medium or low risk profiles. And, working in partnership with Assured Food Standards, the organisation that manages the Red Tractor mark, certification bodies and others, the agency launched the pig and poultry assurance scheme (PPAS) in 2010.
The scheme aims to cut “red tape” and reduce costs for farmers, and focuses on pig and poultry producers who achieve a high standard of compliance under the Environmental Permitting Regulations 2010 (EPR). As part of the scheme, the agency trains auditors to carry out regulatory inspections, at the same time as undertaking certification audits.
The PPAS goes beyond regulatory compliance to cover the management of energy, water, waste and other resources, leading to greater business efficiencies and fewer environmental risks. The 800 firms that have joined the scheme complete fewer compliance audits than other producers, saving them £880 a year each in inspection fees, according to the agency.
The EPRAS aims to see whether a similar assurance scheme can work in other industries. The voluntary pilot scheme ran from October 2011 to June 2013 in 30 of the best performing sites in five key sectors – cement and minerals; waste; chemicals; metals; and food and drink. EPRAS is similar to the pig and poultry assurance scheme and can be used in conjunction with an auditor’s EMS certification work. It has two main components: an annual compliance statement (ACS), and an independent audit. The ACS, which is signed off and sent to the agency by a senior manager at the operator, confirms that the site has complied with its permit and identifies whether any conditions have been breached.
To support the businesses taking part, the agency has developed a compliance checking spreadsheet (EMS+), which contains background information on compliance auditing and a series of questions that the site operator must complete. The emphasis is on environment management and there are priority questions on “management and operations”, “resource efficiency” and “performance indicators”, as well as on legal compliance.
Once the internal audit is complete, an approved auditor carries out an independent permit compliance EMS audit. They assess the operator’s response to selected questions and ensure supporting evidence is in place. Auditors grade their assessment using an options feature in the EMS+ spreadsheet.
In practice
Lafarge Tarmac, a 14001-certified construction materials and services firm, took part in the trials at its Cauldon cement plant in Staffordshire. Those involved included the agency inspector, the company’s certification body, LRQA, and staff from Lafarge.
LRQA undertook a routine 14001 assessment as part of phase I of the project and reviewed the findings against assessment criteria set by the agency. Phase II of the project was conducted on themes agreed by the agency and LRQA, with the aim of improving self-assessment in line with the 14001-surveillance cycle. Audit reports were completed to the satisfaction of the Environment Agency for both phases, along with a declaration of compliance signed by the managing director of the cement and lime business.
Comments from Lafarge suggest that, although the pilot was compatible with its 14001 certified EMS, the process was lengthy, time consuming and not really appropriate for the firm’s extensive monitoring and regulatory regime. David Shenton, senior environment manager at Lafarge Tarmac, was, however, cautiously optimistic that EPRAS can work in some circumstances.
“Overall, the trial wasn’t entirely appropriate for the complex range of operations at Lafarge and did not achieve the desired outcome. It can work for some processes and industries, particularly those of a simpler nature,” he says. “However, for others to gain the best from this process, it is important that difficult questions are addressed, such as why does an operator have an EMS and what is their business ethic towards environmental performance? These aspects need to be fully understood.”
Wider rollout?
The EPRAS trials have now ended and the results are being reviewed by the Environment Agency to assess the suitability of an assurance scheme for industry. In its present form, the scheme may not be suitable for all businesses, but there is scope for improvement and many businesses could benefit from aligning EMS certification with regulatory compliance.
“The main driver for conducting a trial was to see how we could be a more effective regulator, using information gained through existing audits to assess compliance, and also testing to see where we could reduce the burdens on an operator,” says Stefan Robinson, compliance and enforcement manager at the agency.
There is a convergence of interests in finding ways of aligning EMS with regulatory compliance. Businesses would benefit from having less bureaucracy and fewer inspections, and certification bodies would see their auditing role enhanced, perhaps benefiting from increased business opportunities as more companies engage in EMS implementation. Meanwhile, regulators would be able to focus their resources on industries that pose the greatest risk to the environment.
All the evidence suggests, however, that more work is needed to improve communications and cooperation between regulators, UKAS and certification bodies if real benefits are to emerge from relying on third-party audits to attest to compliance.
