USEPA finalizes changes to its Risk Management Program rule

What are the key changes?

- Hazard reviews for PL2 facilities and process hazard analyses (PHA) for PL3 facilities must now identify:

• Natural hazards that could cause or exacerbate accidental releases.
• Stationary source siting.¹
• Recognized and generally accepted good engineering practices (RAGAGEP) gap analysis [applicable to PL3 facilities only].
• Standby or emergency power system safeguards as applicable (PL2 and PL3), and appropriate application of detection methodologies for early release warning (PL3 only). Such monitoring safeguards must have backup power.

- Technical clarifications include maintaining up-to-date PSI and ensuring and documenting process design is in compliance with RAGAGEP.

- Expanded operating procedure requirements for PL2 and PL3 facilities include addressing documentation when monitoring equipment associated with prevention and detection of accidental releases from covered processes is removed due to safety concerns from imminent natural hazards.

- Expanded hot work requirement for PL3 facilities includes retention of permits for three years after completion of hot work operations.

- STAA required for North American Industry Classification System (NAICS) codes 324 and 325² that meet one or more of the following criteria: (1) are located within one mile of another stationary source having a covered process in NAICS code 324 or 325; (2) have had one RMP reportable accident³ since the most recent process hazard analysis under this section; and/or (3) NAICS code 324 with hydrofluoric acid alkylation covered processes.

- STAA must be performed by a qualified team with members who have expertise in the process being evaluated, including a member who works in the process.

- STAA must consider and document inherently safer technology/design, passive measures, active measures, and procedural measures as well as practicability:

• At least one passive measure must be implemented from the STAA; however, alternatives described by the rule are allowed if they are greater than the risk reduction of a passive measure. If no passive measures are identified or all are not practicable, and no inherently safer technology or design is implemented, at least one active measure must be implemented. If no active measures are identified or all are not practicable, at least one procedural measure must be implemented.
• If a safer technology/design is implemented from the STAA, a description of the technology/design must be submitted to USEPA.
• For passive and active measures not implemented, sufficient evidence to demonstrate that implementation is not practicable and the reasons for this conclusion must be documented. Impracticability cannot be based solely on evidence of reduced profits or increased costs.

- Incident investigation reports must be completed within 12 months of an incident, unless the implementing agency approves, in writing, an extension of time.

- Report shall include factors contributing to the incident including initiating event, direct and indirect contributing factors, and root causes. Root causes must be determined by conducting an analysis for each incident using a recognized method.

- Next required compliance audit must be conducted by a third-party when one or more of the following conditions apply:

• An RMP reportable accident has occurred.
• Implementing agency requires it⁵ or previous third-party audit failed to meet competency or independence criteria.

- For third-party audits, the owner/operator must either:

• Engage third-party auditor meeting all competency and independence criteria defined by the rule, or
• Assemble an audit team led by a third-party auditor meeting all the competency and independence criteria defined by the rule.

- Third-party auditors:

• Must meet defined competency and independence criteria, including but not limited to knowledge of requirements of prevention program elements, experience with the type of stationary source being audited and applicable RAGAGEP, and adherence to conflict-of-interest policies. See rule for further details.

- Third-party audit report must:

• Identify all persons participating and their qualifications. For third-party auditors, demonstrate competency requirements are met.
• Describe or incorporate by reference the policies and procedures the auditor has for ensuring all personnel comply with competency and independence criteria.
• Document evaluation of compliance with prevention program requirements and findings.
• Summarize significant revisions between draft and final versions of the report, if any.
• Include certification statement (as provided in 40 CFR 68.59(e)(6) and 68.80(e)(6)).

- Response to third-party audit report is required:

• Within 90 days after receiving the final audit report, the owner/operator must develop a response report addressing each finding, along with a schedule for rectifying deficiencies, and this response must be certified by a senior corporate officer.

- Management of third-party audit reports and findings by owner/operator requires the following:

• Implement a schedule to address identified audit deficiencies and document action taken, along with the date completed.
• Immediately provide a copy of the certified, final report and implementation schedule to the owner/operators audit committee of the board of directors, or other comparable committee or individual, if applicable.
• Maintain two most recent final third-party audit reports, finding response reports, documentation of actions taken to address deficiencies, and related records (does not apply to any document more than five years old).

- Requires written plan of action for the implementation of employee participation requirements, including annual notice to employees and their representatives on accessing the plan and training for employees and management on the details of the plan.

- A process must be developed and implemented by the owner/operator for employees and their representatives to report unaddressed hazards that could lead to a catastrophic release, RMP reportable accidents, and other noncompliance with RMP. The process must allow for employees to report hazards anonymously, and employee involvement in findings resolution is mandated.

- New authorities given to employees knowledgeable in the process and their representatives for recommending shutdowns based on the potential for catastrophic release.

- Findings resolution involvement by consulting employees knowledgeable in the process and their representatives on results of PHAs, audits, and incident investigations.

- Non-responding stationary sources:

• Mandated to establish mechanisms ensuring the timely dissemination of accurate data and information regarding accidental releases. This can be achieved through notification systems meeting federal, state, or local requirements provided notification requirements from the rule are met.
• Must also maintain and implement, as necessary, procedures for notifying the public and relevant emergency response agencies about accidental releases, collaborating with these agencies to establish a community notification system for public warnings. Documentation of this partnership must be maintained as per 68.93(c) requirements.

- Responding stationary sources:

• Must integrate procedures into emergency response plans for collaborating with response agencies to establish a community notification system for accidental releases. Documentation of this partnership must be maintained as per 68.93(c) requirements.
• Required to promptly provide data and information about an accidental release to local emergency response officials. This can be achieved through notification systems meeting federal, state, or local requirements provided notification requirements from the rule are met.
• If the local emergency planning committees (LEPC) or emergency response officials request information for developing and implementing the community emergency response plan, the owner/operator must promptly provide it.

- Field exercises must be conducted by March 15, 2027, and subsequently every 10 years, unless local emergency response agencies mutually agree in writing that this frequency is not feasible. In such cases, a suitable frequency must be determined through collaboration between local emergency response officials and the owner/operator.

- Evaluation reports for each field and tabletop exercise must be prepared within 90 days. Reports must include:

• Description of the exercise scenario.
• Names and organizations of each participant.
• An evaluation of the exercise results including lessons learned, recommendations for improvement or revisions to the emergency response exercise program and emergency response program, and a schedule to promptly address and resolve recommendations.

- The public can request RMP information if they reside, work, or spend significant time within six miles of the fence line of a stationary source. Requests can include data on regulated substances held in a process, accident history, emergency response programs, and declined recommendations/justifications (see further details in 40 CFR 68).

• Requests must be fulfilled within 45 days
• Owner/operators must record the members of the public requesting chemical hazard information and maintain the records for 5 years.

- The owner/operator must provide ongoing notification on a company website, social media platforms, or through other publicly accessible means that address the information request process.

- Facilities with PL2 and PL3 processes must now report the following in their RMP submittals:

• Recommendations declined from natural hazard, power loss, and siting hazard evaluations and justifications.
• Identification if the most recent compliance audit was a third-party audit.
• Findings declined from third-party compliance audits and justifications.
• Inherently safer technology or design measures implemented since the last PHA, if any, and the technology category (substitution, minimization, simplification, and/or moderation). Applicable to PL3, NAICS 324, or 325 only.
• Recommendations declined from safety gaps between codes, standards, or practices to which the process was designed and constructed and the most current version of applicable codes, standards, or practices. Applicable to PL3 only.