EMS and Regulatory Compliance Internal Auditing

1. EMS and Regulatory ComplianceInternal Auditing Bet Zimmerman, CEP, EMS-A PNNL, ESH&Q EFCOG Conference March 9, 2005

2. Outline • Why: Purpose and Requirement • Who: Team Selection • When: Planning & Scheduling • How: • Logistics, Tools, Approaches • Reporting • Delighting auditors • Keys to success • Questions 2

3. Purpose of EMS Audit • Test whether system has been implemented and maintained • Should be a hard internal look • Gain real understanding of strengths and weaknesses • Goal is NOT to dupe auditors 3

4. Requirement • ISO 14001 requires procedure for periodic EMS audits • Auditors trained and competent – See ISO 19011 • Auditors and process objective, impartial • If you don’t have ISO 14001 EMS, should still periodically evaluate system 4

5. Team Lead • Point of contact • Develop audit plan • Keep on schedule and on track • Summarize at end of each day, discuss categorization of findings • Prepare closing meeting presentation • Ensure report is delivered on schedule • Compile and finalize 5

6. Team Mix • ISO 14001 auditor training • Members: 1-3 max in addition to lead • Mix • One with environmental background • One with quality background • One from inside organization • Good interpersonal skills • Objective and inquisitive 6

7. Shared Resources ORNL BNL BCO PNNL Private Sector 7

8. Planning • Allow time to correct problems before ISO 14001 registration audits • All 17 elements don’t have to be audited every year – should hit all in 3 year period • Frequency based on results of previous audits, environmental importance of activities • Selection criteria: • Not assessed in previous 2 years • Identified for follow-up/review during previous audit • Don’t have good handle on whether it’s working • Problem areas • New requirement being implemented • If engine isn’t working, don’t focus on the muffler 8

9. Out to Lunch Scheduling Meetings • Schedule key interviews • Mix it up • Leave time • in between • for follow up • to review information • Schedule caucus • Schedule daily outbrief • Invite interviewees, ECRs/EMS Reps and key managers to opening and closing meetings 9

10. Scheduling Interviews • Develop e-schedule that shows • Daily • All auditors on one page • Time slots • Interviewee name, location, phone number, title, organization • Topics 10

11. Use of Checklist • Reminder of standard, prompts with questions • Divides up responsibility among auditors • Organizes information by element • Tips: • Use standard form, maintain online • Update to capture 14001:2004 requirements • With teams, use Sharepoint to complete • Appropriate level of detail • Track recommendations on what to cover in next audit 11

12. Logistics • Administrative point of contact • Meeting room • Access to Internet, phone, copier, printer, whiteboard • For daily debriefings • Place to leave materials 12

13. Notification • Avoid “Who the #*%$ are you?” • What, why, when, how, where, who • Reason and Scope • Dates • Auditors • Who they are interacting with • Time, place and location of opening and closing meetings • Who to contact with questions 13

14. OBJECTIVE EVIDENCE Interviewing • Be on time • Introduce self, explain purpose • Ask to briefly describe responsibilities • Request objective evidence! • Make note of any documents requested • Obtain while onsite • Summarize at end to validate and provide preliminary feedback 14

15. Comportment ISO RCRA P2EMS NCR SBMS R2A2QMS BLYPXK 15

16. Just the facts, ma’am Reporting • Provide daily report on findings • Start writing up report during audit • Document findings – relative to element • “Actionable” • Clear • Separate recommendations from nonconformities • Avoid opinions • Executive summary • Allow 2 weeks for factual accuracy review and comment 16

17. Closing Meeting • No surprises at closeout! • Review findings • Nonconformities • Noteworthy practices and progress • Put in perspective • Review next steps • Review lessons learned • Ask for: • questions/reactions • input on how to further improve process 17

18. Compliance Assessment Methods • Select several compliance areas: • Problem and not a problem – e.g., air compliance • Line and corporate-level • How are EMS elements implemented (or not) relative to that issue, e.g.: • Applicable legal requirements understood? • Goals established to address problems? • Practices consistent with documented operational control procedures? • Monitoring? • Adequate measures taken to prevent recurrence? 18

19. Use of results • Consider whether it’s an isolated incident or larger issue • Prioritize • Don’t chop heads off • Assign to real owner • Track to closure 19

20. On the Receiving End: Delight Auditors • Orientation • EMS manual with pointers • Computer access/hard copies • Scheduled interviewees prepared with materials, examples • Prompt and helpful follow-up • Okay to seek clarification/correction of findings 20

21. Keys to Success • Plan well • Assemble competent team • Auditee cooperates • Report results in a meaningful way • USE results to improve 21

22. Questions 22