Insider's Perspective: Avoiding Legal Pitfalls on the Path to ISO 14001 Implementation
 
January 26, 2005
 

Implementing an environmental management system (EMS) can be a worthwhile endeavor. An EMS helps an organization stop “fighting fires” – reacting to issues only when they reach a crisis level – and start managing environmental issues as part of its overall business strategy. A number of benefits have been identified by organizations that have put an EMS in place. These reported benefits include improved environmental performance, a boost in public image, increased business opportunities and saving money.

You need to be prepared for the trip, however. Just as a trek along a hiking trail can have biting insects, poisonous plants and slippery rocks, the path to ISO 14001 registration has its own hazards. The purpose of this series of articles is to help you prepare by identifying actions you can take to avoid the legal pitfalls you may encounter along the way.

Avoiding Pitfall #1: Not Understanding the Lay of the Land

Before you start down the path to ISO 14001 registration, it is important to clarify where you are headed. Just as you would study a map before starting out on a wilderness hike, you should understand the basics about ISO 14001 before you begin.

Get a copy of the ISO 14001 standard. Read it. Talk to other companies who are already ISO 14001 registered. Explore the wealth of information available on the Internet or attend a training seminar. Make sure you understand the terrain you are likely to encounter before you begin.

The first legal pitfall to avoid is the erroneous assumption that an ISO 14001 EMS has nothing to do with environmental compliance. Compliance with legal requirements is an integral part of ISO 14001. Your existing compliance programs will become a major part of your EMS.

ISO 14001 Is a Compliance Assurance Tool

ISO 14001 is a different approach to environmental management. It focuses on establishing internal controls rather than just achieving results. It is based on the management principle, popularized by Deming, which states that you can achieve the outcome you desire by controlling the processes that create that outcome. For example, in quality, you control the quality of the parts you produce by controlling the processes that create those parts.

The same principle applies in ISO 14001. Achieving and maintaining legal compliance is an important goal (output) of most environmental programs. In an EMS, you achieve the output desired (in this case, legal compliance) by focusing on establishing a system of internal controls to achieve the compliance you seek.

ISO 14001 contains several requirements that focus on assuring legal compliance. They include:

• creating a written environmental policy, defined by the organization’s top management, which includes a commitment to compliance

• establishing and implementing a procedure to identify the organization’s legal requirements

• establishing and implementing a documented procedure for periodically evaluating the organization’s compliance with relevant laws and regulations

Although ISO 14001 does not require a company to be in 100 percent compliance with its legal requirements 100 percent of the time, you must have the necessary processes (internal controls) in place to achieve environmental compliance. For example, one unlabelled drum of hazardous waste may not prevent you from achieving registration, whereas, the presence of unlabeled drums in combination with the lack of internal controls (e.g., procedures) to ensure proper labeling of hazardous waste drums probably would.

Companies going through third-party registration discover that compliance assurance is an integral part of the registration process. IAF Guide 66 requires that registrars confirm that the organization seeking ISO 14001 registration has fully implemented “a system capable of achieving the required compliance.”¹ As a result, registration auditors scrutinize an organization’s implementation of its compliance assurance procedures. They seek verifiable evidence that demonstrates the organization has implemented procedures to identify its legal requirements and evaluate its compliance status.

Identification of Legal Requirements Is Not Simply a List of Laws

A common pitfall many organizations encounter when implementing an EMS is failing to adequately identify their particular legal requirements, as required by Section 4.3.2 of ISO 14001. They assume that simply creating a list of potentially applicable laws and regulations satisfies this ISO 14001 requirement. It does not.

Such a “list of laws” usually lacks sufficient detail. As demonstrated in Table 1, two organizations can have the same list of applicable laws, yet their legal requirements may be vastly different. The overall purpose of the procedure specified in 4.3.2 of ISO 14001 is for the organization to identify its compliance requirements in sufficient detail so that internal controls can be established to meet them. In other words, an identification of legal requirements needs to include an identification of the actions that must be taken to be in compliance.

When they begin implementing an ISO 14001 management system, some organizations discover legal requirements that were not previously identified. Perhaps operating permits should have been obtained or reports should have been filed with an environmental agency. In some cases, a company also discovers that it is out of compliance with these newly identified requirements. This can have serious legal ramifications.

Legal Implications of Initiating a “Compliance Evaluation” Procedure

In addition to putting controls in place to achieve compliance, organizations must also develop a documented procedure for evaluating whether these controls have worked. In accordance with Section 4.5.1 of ISO 14001, the organization must “establish and maintain a documented procedure for periodically evaluating compliance with relevant environmental legislation and regulations.” There are a number of legal issues associated with environmental compliance evaluations, particularly when noncompliance is discovered.

First, there can be substantial civil and criminal penalties associated with failing to comply with environmental regulations. In fiscal year 2003, the Environmental Protection Agency initiated 471 criminal cases. In total, 247 defendants were charged with environmental crimes, resulting in sentences of 146 years imprisonment and criminal fines totaling $71 million.² Noncompliance can also result in state or local agency enforcement actions, citizen suits or serve as evidence in a toxic tort case.

Some mitigation of potential penalties can be obtained by self-reporting environmental violations; however, this has its own legal risks. Fines can still be imposed and public disclosure may have other negative business impacts. In addition, unless the potential violation is reported shortly after it is discovered, no benefit may be achieved even if self-reporting is done. It is prudent to develop and institute written procedures for dealing with compliance audit results prior to performing the first compliance evaluation.

For publicly-traded companies, there are also potential Securities and Exchange Commission (SEC) reporting requirements. Companies are required to disclose environmental compliance and noncompliance issues that could be financially significant.³

Tips for Avoiding Pitfall #1

Given the breadth of environmental regulation and the complexity of many regulatory requirements, some organizations need help identifying their legal obligations. Environmental agency and industry trade association Web sites have an abundance of self-help information.⁴ Environmental consultants and environmental attorneys can also help. Remember, the goal is to identify what you are required to do, so be sure to seek information tailored to your specific operations.

If you have not had a system in place in your organization to routinely and systematically evaluate your compliance status, you should consider retaining an experienced environmental attorney to assist you in conducting an initial compliance review. If conducted under the direction of an attorney, nonconformance issues can be identified and addressed in a manner that minimizes legal risks to the company and its management personnel. One word of caution: if the compliance evaluation is conducted without involving an attorney first, virtually nothing can be done to protect the results from discovery in a future lawsuit.

Table 1: Different Legal Requirements

List of Laws	Company A's Requirements	Company B's Requirements
Clean Water Act (Stormwater Management), 40 CFR 122	Required to develop a stormwater management plan, sample discharge points monthly and report results to environmental agency quarterly	Required to file a certification of "no exposure" every three years
Clean Air Act, 40 CFR 70	Required to inspect filters in an emission control device quarterly; must file for a new permit if equipment is modified or replaced	Required to install continuous emission monitoring equipment, calibrate monthly, track results and submit report to environmental agency quarterly
RCRA (Hazardous Waste), 40 CFR Part 260 to 265	Required to send waste to a permitted landfill using a licensed transporter (conditionally exempt small-quantity generator)	Required to inspect hazardous waste storage areas weekly, label hazardous waste containers properly, send waste to permitted landfill using a licensed transporter, file biennial waste report, train hazardous waste handlers and develop emergency procedures (large quantity generator)

For more information, e-mail Thea Dunmire, President, ENLAR Compliance Services, Inc., at enlar@compuserve.com or call toll free, 1-888-688-8500.

This article was previously published in the July/August 2004 edition of Environmental Systems Update.

¹ Section G.4.1.6 of IAF Guidance on the Application of ISO/IEC Guide 66, Issued 4 December 2001.

² Environmental Crimes and Enforcement, 2003 Annual Report, p. 37 of Environmental, Energy and Resources Law, The Year in Review 2003, American Bar Association.

³ See section on SEC Environmental Disclosure Obligations on Sarbanes-Oxley page at www.enlar.com.

⁴ Several resources to assist you in identifying legal requirements can be accessed at www.enlar.com/resources.html.

Related Practices

• Environment