My experience on this topic regarding not only EHS audits but also other important risk assessment and compliance initiatives in Europe is the following:

1) Most companies have these policies linked to their Annual Reports with board member level responsibles

2) Most companies have well structured and well thought policies to classify the different risks that the different stakeholders can pose to them (as suppliers, ie)

3) There is a vast majority of these companies that fail in the compliance of these policies, because of the distance between the middle and regional management and the top board level members, that impacts in how and when these policies and audits are put in place

4) In the cases that these audits and policies are followed there is, in most of the cases, a lack in following up how the risk profiles of the different stakeholders change over time, being these audits a “one-off” event in the life of a supplier, for example.

There is a huge breach due to the hardness of implantation and the amount of transactional work that these imply for middle managament across the enterprise and the following steps should be taken in the direction to cope with this problem.

Sergio Mateo

http://tinyurl.com/CyberRegs-May-eNews

For anyone interested, I sponsored a survey on LinkedIn to find out what trend may exist relative to EHS audit performance/risk reduction measures. Results were interesting (202 responses in less than 24 hours) and can be viewed by LinkedIn members at http://polls.linkedin.com/poll-results/44274/mulee. If you are not a LinkedIn Member, you can view a summary of the poll results at http://elmconsultinggroup.wordpress.com/2009/06/26/do-you-measure-the-economic-value-of-ehs-risk-reductionauditing-programs/.

I have another poll on LinkedIn that is currently still open asking opinions on what you consider to be the “perfect” EHS risk reduction measurement. Please feel free to vote.

1) A little less worry about a strictly independent audit team as manifested by a desire to have the team provide a measure of mentoring and coaching to facility staff on compliance issues; or
2) A tendency toward management system-type reviews instead of regulatory compliance audits – but increasingly trying to couple these reviews with a more formal root cause analysis approach to corrective and preventive actions.

I do believe if the Obama administration’s USEPA (and the states) ratchet up their compliance enforcement activities again that we’ll see organizations return to a traditional EHS regulatory audit approach – but hopefully still in concert with management system reviews.

I think the next level in the development of EHS auditing will be for the auditing activity to embrace the concept of the “learning organization.” This would entail a collaborative approach to auditing where the auditor and the entity being audited work in partnership; where best practices are identified and implemented to correct findings; and where lessons learned from the audit are shared across the entire enterprise. There are a number of tactics that can be employed to promote the “learning organization” concept. One example would be for working-level EHS SME’s serving as part of the audit teams so that they are both auditors and auditees at various times.

My comment builds on those of Alex and Dean. My observation has been that, in practice, organizations with mutiple operating units and locations that scale-back their traditional corporate-level compliance auditing activities and, instead, rely more on the facility-level ISO 14001-type EMS for compliance assurance are vulnerable to fundamental non-compliance at the facility level that may go undetected by corporate and, over time, result in bad outcomes for the entire enterprise (i.e., fines, penalties, lawsuits, serious injuries, fatalities). I agree with Dean that an organization with a well-crafted EMS that is executed with high fidelity should be able to reduce traditional auditing, but I think this must be done with delibration and great care. Traditional audit programs aren’t glamorous, cutting edge, or exciting, but they remain a proven and cost effective compliance assurance tool.

Dean M. Calhoun, CIH
Affygility Solutions