CalARP Compliance Audits: What to Expect During Agency Review
“Compliance audit” gets used two ways in CalARP, and they tend to trip up clients who have never been through one.
“Compliance audit” gets used two ways in CalARP, and they tend to trip up clients who have never been through one. There is the periodic self-audit your facility owes the regulation. And there is the agency review your local administering agency runs on the plan you submitted and the facility behind it. Both feel high-stakes when they show up on your calendar. They are not the same thing.
This piece walks through both, what reviewers look at, and what tends to result in a notice of deficiency. For a broader overview of the program, see our CalARP and Risk Management Plan compliance in California guide.
Two Audits, Both Called “Compliance”
The self-audit is something the regulation requires of your facility. Under federal RMP and California’s CalARP program (Title 19 CCR Chapter 4.5), Program 2 and Program 3 facilities must certify at least every three years that the prevention program described in the plan is being followed. The requirement traces to Clean Air Act Section 112(r) and 40 CFR Part 68. The facility documents the audit, signs it, and keeps it on file. It is not submitted to the agency, but the agency can ask for it during an inspection and routinely does if anything else looks off.
The agency review is what your local administering agency conducts on the plan itself. Most California facilities deal with their CUPA (Certified Unified Program Agency), which depending on the jurisdiction may be a fire department hazardous materials division, a county environmental health department, or another designated agency. The agency reviews the plan at initial submittal, at the five-year update, and any time an inspection or release event reopens a previous finding. The review follows a structured completeness checklist rooted in Title 19 CCR §2745 and the parallel sections that follow.
Most calls we get on this topic are post-review: “the CUPA reviewed our plan and failed it” or “we got a notice of deficiency, can you read the plan and tell us what to fix.” The piece is written for that situation, and for the facilities trying to avoid being in it.
What the Agency Checks During Plan Review
When a CalARP submittal lands at the administering agency, the reviewer works through the plan element by element against the completeness checklist. The Sacramento County and Long Beach CUPA checklists we work from both mirror the regulation’s structure. Here is what they walk through:
| Plan element | What the reviewer is looking for |
|---|---|
| Registration | Facility identifiers, regulated substances, quantities, EPA facility ID, contact info |
| Executive Summary | Plain-language description of release prevention, scenarios, accident history, prevention program, emergency response |
| Facility Description | Process boundaries, covered substances, site map, P&IDs (piping and instrumentation diagrams) current to the facility today |
| Offsite Consequence Analysis | Worst-case and alternative scenarios, dispersion modeling, end-point distances, population estimates |
| 5-Year Accident History | All accidental releases of covered substances within the last five years, with required data points |
| Prevention Program (Program 2/3) | Safety information, PHA (process hazard analysis), operating procedures, training, mechanical integrity, MOC (management of change), pre-startup review, contractor and hot work programs |
| Emergency Response Program | Written plan, notification procedures, emergency healthcare information |
| Seismic Analysis | Required by many California administering agencies; documentation of external-event analysis |
| Certification | Signed certification by the owner/operator or responsible facility official; separate preparer signature block if required by the administering agency |
The reviewer is not just confirming each element exists. They are cross-checking that the OCA scenarios match the chemicals and quantities on site, that the PHA covers every covered process, that the accident history aligns with the agency’s own records and any prior spill or release reports, and that the prevention-program documentation references the procedures actually in use at the facility today. When the plan and the facility disagree, the agency writes it up.
What an On-Site Compliance Audit Looks Like
If your facility is Program 2 or Program 3, the self-audit is a documented walkthrough of the prevention program against your written plan. CDMS conducts these for facilities that prefer not to handle them in-house, or that have received a deficiency notice tied to the prior audit.
When our team walks a Program 3 audit, the room is usually the same. A representative from the local administering agency is on site for the day. The plant manager is on site for the day. Our consultants work through the plan element by element with the facility EHS contact.
We start with the documentation-heavy elements: PHA revalidation dates, operating-procedure review cycles, training records, management-of-change packages, mechanical-integrity inspection records, prior compliance-audit corrective actions. Then we move to the floor and verify that what the binder says matches what is actually happening. The two findings we see most often are operating procedures that drifted from current practice without a documented MOC, and mechanical-integrity records that exist for some equipment but not all covered equipment.
The deliverable is an audit report kept at the facility, with findings, corrective actions, and target completion dates. That report is the document a regulator will ask for if they ever want to confirm you are running the prevention program your plan describes.
Findings That Most Often Trigger a Notice of Deficiency
Most of the patterns we see are documentation patterns, not facility patterns. The plan and the records have drifted away from operations. Reviewers flag the following most often:
- OCA (offsite consequence analysis) scenarios that no longer match the chemical inventory. Quantities have changed, a regulated substance was added, or the worst-case process is no longer the largest one. The dispersion modeling has to be re-run.
- PHA past its revalidation date. Program 3 PHAs must be revalidated at least every five years. Reviewers check the date on the study cover.
- Operating procedures missing recent process changes. A procedure that describes an old tank or piping configuration after an MOC change is a documented gap.
- Training records that do not match the procedure list. Each operating procedure needs evidence that affected personnel were trained on it on the cycle the plan commits to.
- 5-year accident history that does not square with agency records. If the CUPA has spill or release reports the plan does not reference, that is an immediate flag.
- Mechanical-integrity records incomplete for covered equipment. Pressure vessels, relief systems, piping, controls, and pumps all need inspection records on the schedule the plan describes.
- Seismic study missing or stale where the administering agency requires one.
- Prior compliance-audit corrective actions not closed out. If the previous self-audit identified items and the plan does not show them resolved, the next reviewer treats them as open.
The voice on this list is “be ready,” not “be scared.” Most of these are routine to clean up if they are caught at the right time. For a deeper look at how completeness reviews break down, see our piece on common CalARP plan deficiencies and how CUPAs review submittals.
After the Review
If the review comes back clean, the plan is accepted and the next milestone is the five-year update. Plans and audit scopes should be checked against current Part 68 requirements, including the 2024 EPA RMP amendments and any current EPA reconsideration status. If it comes back with deficiencies, the agency typically issues a written notice with corrective actions and a response deadline. The deadline varies by agency. Some give thirty days, some ninety, some longer when the correction requires new dispersion modeling or a full PHA revalidation. The amendment goes back to the same reviewer who issued the notice.
For broader EHS audit context outside the CalARP/RMP framework, see our EHS gap assessment and compliance audit services.
Trusted throughout California
BSY started working with CDMS last year after our in-house EHS person departed the company. CDMS reviewed our existing operational permits as well as any additional Federal, State and Local regulations that could apply and helped us to create a comprehensive compliance calendar to track regulatory deadlines and submittal due dates. The CDMS team does an excellent job of tracking everything and can be relied upon to complete the forms accurately and assist with submittals, allowing me to focus on our business.
Speak with a CDMS EHS expert
Tell us about your facility and your deadline. You’ll get a clear read on what applies and a scoped plan to handle it.