From time to time, a company decides to undertake an environmental self-audit to keep its business in compliance with environmental laws.  The company may intend to correct any problems found and to follow  federal and state guidelines and to avoid fines.  However, the guidelines are not clear.  Decisions regarding self-audits are difficult because there is a possibility that citizen lawsuits may result from disclosing self-audit results.

State and federal governments offer incentives to companies that undertake socially responsible actions by conducting self-audits.  The benefits are not clear.  However, in many cases, the best approach for companies undertaking self-audits is to rely on the traditional protection of the attorney-client privilege.

In particular, the federal Environmental Protection Agency and California audit policies are uncertain.  Even if a company's disclosures qualify under its policies, that does not prevent citizen suits or private attorney general actions (including injunctions, penalties and attorney fees awards for acting in the public interest) against a company for the violations disclosed in the self-audit.  This exposure exists even though corrective action is occurring in the manner and on the timetable that satisfies the regulatory agency.  Although state law provides privileges and immunities, exposure may exist because lawsuits can be filed under federal law.

Few corporations can afford to take that scope of risk.  However, invoking the attorney-client privilege provides the time to study the problem and determine the right course of action.

Audit-Privilege Laws
Environmentalists and citizens groups contend that audit-privilege laws threaten public health.  They argue that if companies keep the information in their environmental audits secret, then citizens will not discover actual or potential environmental threats in their communities.

Businesses state that they are unfairly harmed by lawsuits that have used information from self-audits.  The audits would not be available but for the companies' initiative to improve their environmental management.  They believe that their good-faith efforts should be rewarded by immunity and privilege.  Proponents of audit-privilege laws state that the laws encourage audits and disclosures of regulatory violations because of the reduced chances that audit findings will result in penalties.        

Oregon was the first state to pass an audit-privilege law in 1993, followed by Colorado.  During the 1980's, certain companies attempted to comply with environmental laws and regulations through environmental audits in order to preempt regulatory violations.  EPA encouraged companies to do audits and to correct violations.  Corporate attorneys took the position that a company's own self-generated audit information merits legal protection.  They argued that reputable companies that reported their problems should not be penalized when less reputable companies that failed to report were protected.  In the mid 1990's, various states passed audit-privilege bills.

Citizens groups and the EPA content that audit-privilege laws protect polluters.  Audit-privilege laws generally contain immunity from prosecution for violations discovered during an audit and for which the business shows its intention to remedy and privilege for the audit information.

The EPA argues that the privilege consents to secrecy about pollution.  Audit-privilege laws depart from EPA environmental regulations that require full disclosure of environmental compliance and from community right-to-know laws.          In order to manage environmental regulations, companies conducted their own audits.  In general, the audit privilege laws set out steps that auditors need to take to achieve immunity.  Essentially, the company must advise the EPA that an audit will be done, then perform the audit and discover any violations, make disclosure about violations for which immunity will be claimed and state the intended corrective action and its timetable.  Finally, when the corrective action is completed, the EPA reviews it and approves it and advises the company that it is immune from penalty for the violations.

The EPA has a policy of opposing audit-privilege laws.  The EPA encourages voluntary environmental auditing and other forms of self-policing through its own audit policy, which offers reduced or waived penalties for prompt disclosures and corrective actions.

The EPA states that one avenue for legal action against polluters in states with audit-privilege laws is to take Federal Court action.  In order to bring a court action, a plaintiff needs access to the information in an environmental audit.  Hence, audit-privilege laws protect businesses because plaintiffs are unable to get access to the information necessary to launch their suits.

EPA Self-Audits
On its face, the EPA's audit privilege theoretically protects companies that undertake self-audits and find and correct violations.  The polocies are intended to encourage compliance with environmental laws and promote self-policing. 

Environmental violations that are discovered, reported and corrected may qualify for penalty reductions.  However, the policy applies only to violations discovered during a formal audit or due diligence effort.  EPA disregards the concept that audits are privileged.  Although EPA provides incentives by stating that it will not use an audit to initiate an investigation, it reserves the right to initiate an investigation based on other information.  It may also initiate enforcement actions when the violation threatens human health and the environment.  In other words, EPA limits its audit incentives to minor problems.

To qualify for reduced penalties, a company must meet the several EPA policy conditions.  A business that complies with nine conditions may reduce a penalty to zero and compliance with conditions #2 through #9 may permit a 75 percent reduction.  However, EPA has discretion to calculate the economic benefit from allowing a violation to exist and later seek return of the benefit.

Policy benefits do not apply to repeat violations that constitute actual harm or an imminent and substantial danger when management has been involved or when management has a philosophy of concealing or condoning violations.  Even if EPA decides not to pursue criminal prosecution against the firm, it may pursue individual managers or employees.

This vague policy gives rise to subjective interpretation and prevents coverage for difficult cases in which public health priorities demand immediate remediation.  In other words, the policy appears to not cover major problems.

States' Actions
Cal-EPA, which is an environmental agency of the California, adopted most of EPA's policy.  The same nine conditions are followed.  However, Cal-EPA has criticized key elements and modified them.  Other states have taken action by treating self-audits as confidential and agreeing to not prosecute violations found.

However, EPA has threatened to withhold delegated authority to implement federal legislation such as the Clean Air Act, Clean Water Act and Resource Conservation and Recovery Act (RCRA).  As a consequence, a regulated community must deal with state authorities and EPA concurrently which increases the difficulty of obtaining permits.

EPA has threatened to over file which allows it to proceed with civil or criminal enforcement action under federal law even if state law prohibits prosecution.  The U.S. Court of Appeals for the 9th Circuit decided that over-filing is permitted.  Other federal courts are split on the question whether over-filing is permitted.

The Risks
In the event a company attempts compliance with EPA or Cal-EPA policies, significant problems exist.  First, the policies have broad exceptions so that protection for self-disclosure of violations is unclear.  State laws do not protect against federal action and states may transfer the information to support federal prosecution or enforcement actions.

Moreover, the policies do not resolve the continuing threat of citizen-suits under federal law.  Courts have held that entering into an agreement with a regulatory agency to correct a problem does not protect against citizen suits filed pursuant to federal law.

Citizen suits may be filed by a variety of potential plaintiffs. Although the American Constitution requires that a plaintiff suffer injury as a precondition to having standing to sue under Federal law , the standing requirement may be minimal.  For instance, some cases have held that standing may be found based upon a claim that defendant's activities interfere with the plaintiff's aesthetic view of a mountain or use of a river for recreational activities or from plaintiff's alleged emotional or psychological injury from observing the alleged harmful activity.

There are organizations that search for companies to sue.  So, even though a self-audit is performed to buy the peace, it may be subjected to a citizen suit.  In those claims, a company may encounter threatened injunctions, penalties and claims to pay the other party's legal fees.

Legal Privilege
Due to the various issues involving self-audits, the best protection for companies may be to invoke the attorney-client privilege.  This method avoids the uncertainty regarding EPA and state audit policies.

To assert the privilege, outside attorneys need to retain consultants directly through their law firms.  Consultants typically sign contracts stating that they understand the purpose of the employment and agree to keep the audit information confidential.  However, in some cases, when the consulting firm does work for governmental agencies, they may be reluctant to maintain the confidentiality.  Hence, the company needs to find another consultant who agrees with the confidentiality requirement.

Also, under the attorney-client privilege, the audit activities will not initiate an ongoing program for the company since the review will be customized for a single concern.  In addition, a review also may be utilized to check the condition of a property before it is listed for sale on the market. After the audit is finished, the company has the option to decide whether or not to market the property.

Some states have audit privilege laws, which, unlike California law, provide a complete immunity or privilege component such as rebuttable presumptions or burden-of-proof allocations.  For instance, states such as Alaska, Arkansas, Colorado, Idaho, Illinois, Indiana, Kansas offer these immunities.

Other states have self-disclosure policies, similar to California which do not provide outright privileges or immunities for self-audit disclosures.  These include Connecticut, Delaware, Florida, Maryland, North Carolina, Oklahoma, Pennsylvania, Tennessee, Vermont and Washington.

EPA Conditions for Penalty Reduction

1. the violation is discovered through an environmental audit or an objective, documented, systematic procedure or practice reflecting the company's due diligence;
2. the violation is identified voluntarily, and  not through a legally mandated monitoring or sampling requirement;
3. the violation is promptly disclosed after discovery;
4. the discovery and disclosure occur prior to and independently of government or third party action;
5. the violation is corrected as expeditiously as possible;
6. the company agrees in writing to take steps to prevent a recurrence;
7. the specific violation (or closely related violation) has not occurred previously within the past three years at the same facility, or is not part of a pattern of  violations at other facilities operated by the company;
8. no actual, serious harm has resulted from the violation, and it did not violate the specific terms of any judicial or administrative order, variance or consent agreement;  and
9. the company cooperates as requested by Cal/EPA. 

Cal/EPA's Self-Audit Policies
Cal/EPA offers to certify a company's  self-audit program before any inspections are undertaken or violations reported.  Cal/EPA offers a 90 percent reduction in penalties for companies without an audit or due diligence program that discover a violation and comply with EPA conditions 2 through 9 and agree to additional investments in pollution prevention programs.

Cal/EPA will not recommend criminal prosecution if the violation resulted from a decision not intended to violate the law;  EPA has a more strict liability approach.  Cal/EPA requires less documentation and recognizes a company's interests in maintaining the confidentiality of otherwise privileged information.

Attorney-Client Privilege Solution
Attorney-client privilege applies to all communications between client and attorney that are for the purpose of obtaining legal advice. For environmental assessments to be protected:

The communication must be primarily for a legal purpose; merely having a lawyer as part of a routine audit team is insufficient.

The audit should be directed by outside counsel and undertaken to develop information necessary for advice to be given to the client.  Provided these guidelines are followed, then such communications are protected and remain confidential under both state and federal law.