The Clock Started Before You Read the Report: What a Compliance Audit Finding Obligates You to Do
← Back to Blog Compliance

The Clock Started Before You Read the Report: What a Compliance Audit Finding Obligates You to Do

A compliance audit finding starts two clocks: 21 days to disclose to EPA, 60 days from discovery to correct. What self-disclosure protects and what it does not.

by iSi Environmental

The compliance audit report is on your desk. It is dated, it names a condition and a location, and it probably names a standard. Your first instinct is to confirm the finding is real before telling anyone. That is the most expensive instinct in this area, because the disclosure clock did not wait for you to read it.

EPA’s 21-day window does not begin when you confirm a violation. It begins when any officer, director, employee or agent of the facility has “an objectively reasonable basis for believing that a violation has, or may have, occurred,” measured “against what a prudent person, having the same information, would have believed” (65 FR 19618, Part II.D(3)). Contract personnel on site can start it. The 60-day correction window starts at discovery too, not when you file.

A plant that spends three weeks confirming a finding before deciding whether to disclose has burned the disclosure window and has 39 days left on the other. Nothing about the audit created that exposure. The audit changed what is provable, and when.

What Happens After a Compliance Audit Finds a Violation?

Two clocks start. If it is an environmental violation found voluntarily, EPA’s Audit Policy gives you 21 calendar days to disclose in writing and 60 days from discovery to correct (65 FR 19618). If it is a safety finding, OSHA’s self-audit policy shelters you from a willfulness finding only while you are correcting promptly with interim employee protection (65 FR 46498). Neither protection survives an unclosed loop.

The two regimes run on opposite logics, which is why practitioners routinely apply the wrong one. EPA gives you a disclosure obligation with a hard deadline and no privilege. OSHA gives you a correction obligation with no deadline and a conditional safe harbor. One consultant report can sit inside both.

The most common overstatement here is worth killing early: the audit does not create the legal duty. The duty to abate comes from the OSH Act and the applicable standard, or from the general duty clause (29 U.S.C. 654). What the finding changes is the evidentiary posture on knowledge.

The EPA Side: Two Deadlines, and Only One Runs From the Day You File

How Many Days Do You Have to Report an Environmental Violation to EPA After You Discover It?

Twenty-one calendar days, extended to the next business day if day 21 falls on a weekend or federal holiday (65 FR 19618, Part II.D(3)). The clock starts when any officer, director, employee or agent has “an objectively reasonable basis for believing” a violation may have occurred, not when you confirm it. EPA’s stated advice if unsure: disclose anyway.

The policy says so directly: “if an entity has some doubt as to the existence of a violation, the recommended course is for the entity to proceed with the disclosure.” Submission runs through the eDisclosure portal at CDX, except for criminal matters and new-owner disclosures, which route to a Regional Audit Policy contact. New owners get different math: if you closed within the last nine months and the violation predates closing, the window is 21 days from discovery or 45 days from closing, whichever is later (73 FR 44991).

Does the 60-Day Correction Deadline Run From Discovery or From Disclosure?

From discovery. EPA states it on its eDisclosure page: “the deadline for correcting violations runs from the date of discovery, not the date of disclosure.” A facility that uses all 21 days to investigate has 39 days left, not 60. If more time is needed, you must notify EPA in writing before the 60 days expire (65 FR 19618, Part II.D(5)).

The mechanics of both windows are covered in our earlier post on EPA’s Compliance First policy: disclose in 21 days, correct in 60 from discovery, then file the Compliance Certification within 60 days of submitting the disclosure. One correction to how that memo is often read: it does not amend the Audit Policy. Its only reference to self-disclosure across seven pages is one sentence promoting “self-reporting and voluntary audits.”

What Are the Nine Conditions for EPA Audit Policy Penalty Relief?

Systematic discovery; voluntary discovery; disclosure within 21 days; discovery and disclosure independent of government or third-party action; correction within 60 days; written agreement to prevent recurrence; no repeat of the same violation in 3 years at the site or 5 years across the entity; no serious actual harm or imminent endangerment; and cooperation (65 FR 19618, Part II.D). Missing only the first drops relief from 100 percent to 75 percent.

Condition 2 is where most facilities fall out. EPA excludes anything found through “a legally mandated monitoring or sampling requirement,” naming CEMS excursions, NPDES sampling results, and consent-order audits. If your continuous emissions monitor caught it, the policy does not apply.

What You Get in Return, and What You Give Up to Get It

Does Self-Disclosing to EPA Waive 100 Percent of the Penalty?

No. It waives up to 100 percent of the gravity-based portion only. EPA “retains its full discretion to recover any economic benefit gained as a result of noncompliance” (65 FR 19618, Part II.E). For a deferred capital expenditure such as a control device or a tank upgrade, the economic-benefit component can exceed the gravity component that gets waived.

That asymmetry is the part most summaries skip, and EPA publishes no de minimis threshold for economic-benefit recovery. You are trading a permanent, signed, written admission for relief on one of two penalty components, and the component that scales with how long you deferred the spend is not the one being waived.

What Do You Actually Get Back After Filing Through EPA’s eDisclosure Portal?

It depends entirely on category. Category 1, EPCRA violations meeting all conditions, gets an automatic electronic Notice of Determination resolving the violations with no penalty. Category 2, every non-EPCRA violation, gets only an Acknowledgement Letter; EPA “will make a determination as to eligibility for penalty mitigation if and when it considers taking enforcement action” (EPA eDisclosure).

Read that again with a Category 2 filing in mind. You submit an admission and receive an automated receipt and an unresolved contingency. EPA’s own Inspector General found the screening behind that process inadequate: Report 22-E-0051 (June 30, 2022) concluded the system “does not have adequate internal controls,” with “no formal, written national guidance or eDisclosure-specific training” for screening. A disclosure that sits unreviewed is not the same as one that has been resolved. Scale reinforces the point: 538 disclosures nationwide in FY2025 against a regulated universe in the millions.

The Privilege Question: Three of Your Four States Have a Statute, and It Does Not Reach EPA

Is an Environmental Audit Report Privileged Under Federal Law?

No. EPA has opposed a federal audit privilege for 30 years and states in the Audit Policy itself that “federal courts have unanimously refused to recognize a privilege for environmental audits in the context of government investigations” (65 FR 19618, Part I.F). What exists is a forbearance policy, which lapses once EPA “has independent reason to believe that a violation has occurred.” Attorney-client privilege and work product remain the only durable protections.

That forbearance sits at Part II.C(4): EPA “will neither request nor use an environmental audit report to initiate a civil or criminal investigation.” It is enforcement discretion binding EPA’s own staff. It binds no citizen-suit plaintiff, no tort plaintiff, no grand jury and no state agency.

Which States in Kansas, Missouri, Oklahoma and Nebraska Have Environmental Audit Privilege Statutes?

Three of the four. Kansas has both privilege and immunity (K.S.A. 60-3332 to 60-3339). Oklahoma has had both since November 1, 2019 (27A O.S. 1-4-110 to 1-4-121), a fact EPA’s own published list still omits. Nebraska has a partial protection that bars admissibility but not discovery (Neb. Rev. Stat. 25-21,254 to 25-21,264). Missouri has none; eight bills between 1995 and 2004 all died.

The Oklahoma error is easy to make from a good-faith source: EPA’s list was last updated September 16, 2020 and carries EPA’s own caveat that it “may not have a formal view with respect to the statutory provisions enacted since 2012.” Oklahoma’s postdates that cutoff and covers occupational health and safety too.

Each carries a condition that quietly decides whether the protection exists at all. Kansas excludes anything “developed or maintained in the course of regularly conducted business activity or regular practice” (K.S.A. 60-3336), so a disciplined monthly EHS routine is arguably outside the privilege because it is routine. Oklahoma makes an Advance Notice of Audit a precondition to immunity (1-4-119(H)). Nebraska imposes three formalities with no cure provision (25-21,255(1)): dated, labeled “confidential environmental audit,” issued under a specific written directive. Miss one and it was never an audit.

Does a State Audit Privilege Statute Protect an Audit Report From EPA or in Federal Court?

No. Federal Rule of Evidence 501 applies federal privilege law in federal-question cases, which every EPA enforcement action and every Clean Water Act, Clean Air Act or RCRA citizen suit is. In Sierra Club v. Woodville Pellets, 553 F. Supp. 3d 378 (E.D. Tex. 2021), a court ordered production over the Texas privilege. Oklahoma DEQ states that disclosure to EPA “will result in the waiver of the privilege” entirely.

Be precise about that holding: the court applied a comity balancing test and found the conditions unmet, so a state privilege is discretionary at best in federal court rather than void.

A second-order point matters for multi-site operators, because the circuit map inverts the statute map. Harmon Industries v. Browner, 191 F.3d 894 (8th Cir. 1999), limited EPA’s overfiling after state enforcement; United States v. Power Engineering Co., 303 F.3d 1232 (10th Cir. 2002), went the other way. Kansas, Oklahoma and Colorado sit in the Tenth Circuit, where EPA may overfile freely. Missouri and Nebraska sit in the Eighth, where it is limited. So Kansas and Oklahoma have the strong statutes and the weak overfiling posture, while Missouri has no statute and the stronger one. Texas’s statute sits at Tex. Health & Safety Code ch. 1101; Colorado’s covers environmental matters only.

The OSHA Side: A Safe Harbor That Runs Only While You Are Correcting

Can OSHA Use a Safety Audit Report as Evidence of a Willful Violation?

Only in defined circumstances, but the exceptions are broad. OSHA’s Field Operations Manual Chapter 4 says self-audits “shall not normally be used as a basis of a willful violation,” then adds that once one identifies a hazard “the employer must promptly take appropriate measures to correct.” The same chapter lists “safety committee or other internal reports” and “insurance company reports” among the sources establishing the knowledge willfulness needs.

Note what that is and is not. It is a presumption against use, not a switch. Willfulness still requires proof of intentional disregard or plain indifference, and the objective good-faith-belief defense remains available. What a written finding does is speak to the knowledge element of a serious violation under OSH Act section 17(k), 29 U.S.C. 666(k), which exists “unless the employer did not, and could not with the exercise of reasonable diligence, know” of it.

Scope matters too. Section V.B includes “health and safety audits conducted for an employer by a third party,” so a consultant’s report is inside the policy, while Section IV excludes “ad hoc observations” made “during the ordinary course of business.” A walkthrough email is not a self-audit; a planned, documented review is.

What Is the Penalty for a Willful OSHA Violation in 2026?

$11,823 minimum and $165,514 maximum per violation, unchanged from 2025 (29 CFR 1903.15(d); OSHA memorandum of May 21, 2026). The annual inflation adjustment was cancelled because the government shutdown prevented BLS from producing October 2025 CPI-U data (OMB M-26-11, April 17, 2026). The 2025 levels remain in effect until the next annual adjustment, which is due no later than January 15, 2027.

Serious violations run $1,085 to $16,550, repeats carry the same $165,514 ceiling as a willful, and failure to abate runs $16,550 per day, generally capped at 30 days for $496,500. We covered the freeze in our post on the 2026 penalty schedule. If you are checking these figures, 1903.15(d) still reads “after January 15, 2025,” which is correct rather than stale; the absence of a 2026 amendment is the proof the adjustment was cancelled.

Capacity is genuinely down on the OSHA side: federal inspections fell from 34,625 in FY2024 to 30,273 in FY2025, and DOL’s FY2027 budget justification plans 20,855 for FY2026. That relief does not reach an uncorrected finding, because the same document targets employers “with a history of willful and repeat violations,” and Field Operations Manual Chapter 6 bars any good-faith reduction once a willful violation is documented. EPA moved the other way and the two should not be conflated: over 14,000 compliance monitoring activities in FY2025 against 12,497 the year before, and 2,127 civil cases concluded, its highest in nine years. What fell there was penalty dollars, $1.7 billion down to just over $650 million.

Does OSHA’s Self-Audit Policy Protect You From a Repeat Violation?

No. Section V.C.4 of the policy states it in one sentence: “This policy does not apply to repeat violations.” A repeat carries the same $165,514 ceiling as a willful, is measured against a five-year look-back from the prior final order or abatement date, and per the Field Operations Manual carries “no requirement that the previous and current violations occur at the same workplace or under the same supervisor.”

For a multi-site operator, a finding closed at one plant and left open at another is not two independent events in OSHA’s arithmetic. And if a citation follows, abatement certification is due within 10 calendar days after the abatement date (29 CFR 1903.19(c)(1)).

A Closed Loop Is a Defense. An Open Loop Is an Exhibit.

Most advice on this subject amounts to “be careful what you put in writing.” The OSHRC record says the opposite, and it says it in both directions.

A.P. O’Horo Company, OSHRC Docket 85-0369 (Jan. 31, 1991), is the strongest example of documents proving willfulness. The Commission relied on the employer’s own safety plan, which quoted the standard verbatim, a written warning from an outside safety consultant, and a prior citation, and affirmed the violations as willful. Note the shape of that record: a third-party warning plus a plan plus a prior citation, not a self-audit report alone. Beverly Enterprises, OSHRC Docket 91-3144 (Oct. 27, 2000), used internal “Human Resource Audits” as hazard-recognition evidence and ranked that above “purely voluntary safety precautions.”

Now the other direction. In Century Steel Erectors, OSHRC Docket 87-1348, a Liberty Mutual loss-control report and an internal safety director’s field report were both in evidence and the willful citation was vacated: they came in as the employer’s own exhibits, proof of a live, working program. In Otis Elevator, OSHRC Docket 03-1344, the employer’s own work rules established hazard recognition and it still won, because those rules were communicated, monitored and enforced. In Americold Logistics, an ALJ decision at OSHRC Docket 22-1400 (Aug. 22, 2023) reported through secondary sources, daily safety observations defeated OSHA’s constructive-knowledge case.

The same class of document produced opposite outcomes, and what separated them was not whether the hazard was written down. It was whether the record showed the loop closing. The Field Operations Manual makes the mechanism explicit: “an employer’s own corrective actions may serve as the basis for establishing employer recognition of the hazard, if the employer did not adequately continue or maintain the corrective action.” That last clause is the whole test.

So the finding is not the liability. The unclosed loop is. The work after any audit is narrower and more boring than most people expect: date the finding, document the interim protection, the corrective action and the verification, then keep the record showing the fix stayed fixed. That file is either your best exhibit or theirs, and which one it becomes is decided in the 60 days after the report lands.

What To Do This Week

Pull every written finding from the last 90 days: internal walkthroughs, consultant reports, insurance carrier loss-control reports, corporate EHS audits, safety committee minutes. For each, answer four questions. When did someone first have an objectively reasonable basis to believe there was a problem? Is it in the EPA lane, the OSHA lane, or both? Has the correction been documented and verified, or only performed? And is anything open at one site already closed at another, the fact pattern that turns an isolated issue into a repeat.

If that turns up more open loops than you expected, or you run a one-person program with no second set of eyes on the file, that is the point where outside help pays for itself rather than the point after a citation arrives. iSi’s environmental compliance consulting team works this problem for manufacturing and industrial clients across Wichita, Kansas City and the surrounding four-state region, including the disclosure decision and the documentation that makes a correction provable a year later.

Sources

EPA Audit Policy and self-disclosure

EPA enforcement data and oversight

OSHA policy, standards and penalties

OSHRC and federal case law

State audit privilege statutes

Tags: