EHS Gap Assessment & Compliance Audit Services in California

Most facilities that call us start with some version of the same question: where do we actually stand on EHS compliance?

Maybe an inspector from your local CUPA (which may be a county environmental health department, fire department, or another local agency depending on jurisdiction) flagged something you didn’t expect. Maybe new management wants to take stock. Maybe the person who used to handle this left, and nobody’s sure what’s current and what isn’t. The specifics vary, but the need is the same: an outside evaluation of what’s in place, what’s missing, and what to do about it.

That’s what CDMS does for industrial and commercial facilities across California. We come to your site, review your environmental, health, and safety programs against the regulations that apply to your operations, and deliver a clear report of where things stand.

Why Facilities Call Us

Every facility’s situation is different, but the trigger usually falls into a familiar pattern:

• A CUPA inspector or Cal/OSHA inspector found issues you didn’t expect (what to expect from a CUPA inspection →)
• New ownership or management wants to understand the facility’s compliance posture
• The person who handled EHS left, and no one is sure what’s current
• Programs exist on paper but haven’t been updated or actively followed in years
• Your facility is expanding, adding processes, or handling new materials
• A customer, insurer, or corporate office is asking for proof of compliance
• Nobody on staff is dedicated to EHS, so it’s handled alongside everything else
• Management said “get an audit” but can’t describe what specifically needs auditing

If any of these sound familiar, you’re in the right place.

What We Actually Look At

The scope of a compliance review depends on what your facility does, what materials you handle, and what permits you hold. No two facilities are the same, and the regulations that apply to a precision machining shop are different from the ones that apply to a food distribution center or an auto body shop. Our job is to identify what applies to your specific operation, including requirements you may not know about, and check whether you’re meeting them.

Here are the major areas we evaluate. The specific programs within each area vary by facility.

Hazardous Materials and CERS

If your facility stores chemicals above threshold quantities, you’re required to have a Hazardous Materials Business Plan filed in CERS (California’s online Environmental Reporting System) and kept current. We check whether the plan has been submitted, whether it reflects what’s actually on site, and whether someone at the facility is responsible for maintaining it.

We’ve reviewed facilities where the HMBP was filed years ago under an old business name and has since lapsed. Others where sixteen chemicals were reported to CERS but the site map hadn’t been updated after renovations. Fire extinguisher locations were wrong, storage areas had moved, and the emergency contact listed was someone who no longer worked there. A deeper review checks whether inventory quantities match what’s physically on the shelves, whether threshold calculations for various additional programs are correct, and whether the plan’s contingency procedures reflect the building’s current layout.

Hazardous Waste

If your facility generates hazardous waste (and most industrial and commercial operations do), we review your handling, training, labeling, storage, and shipping practices. We check whether containers are properly labeled with accumulation start dates, whether satellite accumulation areas comply with quantity limits, whether waste is being shipped within required timeframes, and whether manifests are complete and retained.

The issues vary by facility type. At a manufacturing plant, we might find fine metal dust being disposed of as regular solid waste without ever testing whether it’s hazardous. At a food distribution center, the waste profile might be simpler (spent oil from equipment maintenance, expired cleaning chemicals), but manifests still need to be filed and, for paper or hybrid manifests, copies submitted to DTSC (the Department of Toxic Substances Control) within thirty days. A grocery operation might not realize that the cleaning supplies under the sink generate a hazardous waste stream when they expire.

We’ve seen facilities accumulating hundreds of gallons of spent machine oil with no disposition plan, and facilities where flammable storage cabinets were filled with non-flammable materials, defeating the purpose of the cabinet and creating a false sense of compliance. We’ve also found facilities where employees were pouring small quantities of used chemicals down a drain each month, not out of negligence, but because no one had told them what to do with the waste. Management didn’t know it was happening.

Safety Programs

Every California employer is required to have an Injury and Illness Prevention Program. We check not just whether the document exists, but whether it’s been tailored to your site, whether the people named in it still work there, and whether it reflects current operations.

Beyond the IIPP, we evaluate every safety program that applies to your specific activities. The list varies by facility, but commonly includes lockout/tagout procedures, confined space entry, respiratory protection, and hearing conservation. It may also include forklift and powered industrial truck safety, hot work permits, fall protection, PPE assessments, and workplace violence prevention. A precision machining shop might need documented lockout/tagout procedures for each piece of equipment, a hearing conservation program with annual audiometric testing, and respiratory protection with fit testing. A warehouse with forklifts needs a pre-shift inspection program with documented checklists and operator certification records. A facility with a spray booth needs explosion-rated lighting fixtures. Standard fixtures in a flammable environment are a fire hazard and a citation waiting to happen.

We check whether these programs exist, whether they’re written for your specific site and equipment, and whether they’re being followed on the floor, not just filed in a binder. We’ve walked into facilities where the PPE signage was posted but employees weren’t wearing the required protection. Where lockout/tagout was done informally but nothing was documented, which means as far as Cal/OSHA is concerned, it isn’t being done at all. Where binders full of safety plans existed, but nobody on the production line had ever seen them.

The specific programs your facility needs depend on your operations. Part of the review is identifying which ones apply, including requirements that may not be obvious from your industry code alone. See the programs California facilities get cited for most →

Environmental Permits and Programs

On the environmental side, we evaluate your facility’s standing across the programs that California regulators enforce. Depending on your operations, this can include stormwater, air quality, wastewater discharge, SPCC, and other permit requirements.

Stormwater. For a facility that’s never enrolled in the stormwater program, the finding might be that nobody on staff can confirm your enrollment status or no SWPPP exists. The first step is determining whether your operations trigger the Industrial General Permit and getting enrolled. A food distribution center with a diesel fueling station might not realize that the fueling operation alone can trigger stormwater permit requirements, even if the primary SIC code doesn’t. For a facility that already has a stormwater program running, a deeper review checks whether the SWPPP map shows drainage flow arrows correctly, whether the pollutants you’re sampling for match your actual site operations, and whether your annual report was filed in SMARTS on time. Some cities have also started requiring a stormwater permit number as a condition of business license renewal, which can create an immediate operational problem for facilities that aren’t enrolled.

Wastewater. Facilities that discharge to a sewer system may need an industrial wastewater discharge permit from their local sanitation district or regional water board. We check whether a permit is required, whether it’s current, and whether self-monitoring and annual reports are being submitted on schedule. We’ve seen facilities where a discharge permit existed but the monitoring requirements had changed since it was issued. The facility was sampling for the wrong parameters or at the wrong frequency without knowing it.

Air quality. Operations that generate emissions (paint booths, solvent use, grinding, welding, combustion equipment) may require permits to operate from the local Air District. We review whether required permits are in place, whether permit conditions are being met, and whether any operational changes have triggered new requirements. Some facilities don’t realize that adding a piece of equipment or changing a process chemical can require a permit modification.

SPCC. If your facility stores oil above federal threshold quantities, a Spill Prevention, Control, and Countermeasure plan is required. We’ve reviewed a distribution facility where a 2022 SPCC plan had been prepared but only the 2017 version was kept on site, technically out of compliance despite having done the work. Details like that are exactly what an inspector checks.

Environmental regulations in California are enforced by multiple agencies (CUPA, DTSC, the Air Districts, Regional Water Quality Control Boards, and local sanitation districts), each with their own requirements and timelines. Part of the review is identifying which agencies have jurisdiction over your facility and whether you’re current with each one. Read more about California environmental compliance requirements →

Training Records

California requires documented training for every EHS program that applies to your facility: hazard communication, chemical handling, emergency procedures, lockout/tagout, PPE, forklift operation, confined space, respiratory protection, hearing conservation, stormwater awareness, and others depending on your operations.

We check whether required trainings have been completed, whether records are current, and whether the content is specific to your site. We’ve found training binders full of generic “tailgate trainings” that checked a box but didn’t cover site-specific hazards. Facilities where employees listed on the safety plan had never actually seen the document. And the practical details matter too. If any of your workforce needs training in Spanish or another language, the program needs to account for that.

Training records are one of the first things an inspector asks for, and incomplete records are among the most common citations. See the signs that your EHS programs may have drifted →

At a Glance: What We Review and What We Commonly Find

Use the self-assessment checklist →

How the Review Works

The process starts before we arrive. We request key documents (your IIPP, HMBP, training records, permits, Safety Data Sheet (SDS) inventory, waste manifests) so we can review what exists before the site visit.

On site, we walk the entire facility with your team. We’re looking at operations, storage areas, signage, equipment, and employee practices, comparing what we see to what the documents say and what the regulations require. We check that fire extinguishers on the facility map match what’s actually mounted on the walls. We look at whether chemicals are stored compatibly. We observe whether procedures that exist on paper are being followed on the floor.

After the visit, we deliver a written report organized by regulatory program. Each section covers the regulatory requirement, what we observed, and a specific recommendation. The report includes a compliance summary table that shows status across all reviewed programs at a glance. Every finding comes paired with a solution, not just a list of problems.

What to expect from the assessment process →

Assessment vs. Audit: A Brief Note

CDMS offers both gap assessments and full compliance audits. A gap assessment is a big-picture review that identifies which programs are in place, which are missing, and where to focus first. An audit is a detailed, line-by-line review of programs that are already running, checking each requirement against current practice.

Most facilities that haven’t had an outside review start with a gap assessment. It costs less, covers the full picture, and gives you a prioritized path forward. Audits make sense once your programs are established and you want to verify the details.

Not sure which fits your situation? Read the full comparison →

What Happens After the Review

The review tells you where you stand. What happens next depends on what we find.

Program development. If programs are missing or need to be rebuilt, we scope and price the work to get them in place. This is typically fixed-fee, broken into phases based on risk. We start with the areas where a regulatory inspection would create the most exposure (the missing IIPP, the unfiled HMBP, the lapsed training) and work outward from there. For programs that are years out of date, it’s usually faster and more reliable to build fresh from a current regulatory baseline than to try to patch old documents.

Ongoing compliance management. Once programs are in place, they need to stay current. Regulations change, staff turns over, operations evolve. CDMS offers ongoing compliance services where we visit your facility on a monthly or bimonthly schedule, handle regulatory submissions, conduct training, and review programs throughout the year. We track upcoming regulatory changes before they happen. When a new Cal/OSHA standard takes effect or your CUPA updates its inspection checklist, we adjust your programs before the deadline arrives, not after. On a monthly schedule, every program gets reviewed within a year. On bimonthly, it’s a two-year cycle. Learn how ongoing compliance works → | Why mini-audits catch what annual audits miss →

California-Specific Expertise

California’s regulatory environment is more complex than federal requirements alone. Cal/OSHA enforces standards that meet or exceed federal OSHA, including California-only requirements like the IIPP. CUPAs (typically your local fire department) enforce hazardous materials and waste programs at the local level. DTSC, the Air Districts, and the Regional Water Quality Control Boards each have their own requirements and timelines.

For facilities with out-of-state corporate offices, this matters: compliance with federal OSHA or corporate EHS standards does not guarantee compliance in California. The state has its own rules, its own agencies, and its own enforcement priorities. Read more about Cal/OSHA vs federal OSHA →

CDMS works exclusively with California facilities. We know the agencies, the inspection patterns, and the regulatory calendar.

Who We Work With

CDMS serves industrial and commercial facilities throughout California, including manufacturing plants, food distribution and processing operations, aerospace suppliers, retail locations with back-of-house chemical storage, warehouses, laboratories, and automotive service facilities. Our clients range from single-facility operations to multi-site companies.

We work with EHS managers who need an outside firm for independent reviews, specialized projects, or additional bandwidth. We work with facility managers wearing multiple hats who need an experienced partner to handle compliance alongside everything else on their plate. We work with new ownership teams inheriting compliance obligations they didn’t create. And we work with companies that have operated for years without an outside review and want to get ahead of the next inspection.

For buyers and sellers evaluating facilities as part of a transaction, see our M&A due diligence guide.

Frequently Asked Questions

What is an EHS compliance audit?

An EHS compliance audit is a systematic review of a facility’s environmental, health, and safety programs against applicable regulations. In California, this includes Cal/OSHA safety requirements, environmental permits, hazardous materials and waste programs, and industry-specific regulations.

What does an environmental compliance audit cost?

Cost depends on facility size, the number of chemicals on site, which regulatory programs apply, and the scope of work needed. Call (925) 551-7300 and tell us about your facility, and we can give you a clear picture of what’s involved.

What is environmental compliance?

Environmental compliance means meeting all federal, state, and local environmental regulations that apply to your facility’s operations. In California, this typically includes hazardous materials management, hazardous waste handling, air quality permits, stormwater management, and wastewater discharge. Read more →

Do I need a compliance audit if I’ve never had an inspection?

The absence of an inspection makes it more important, not less. Inspections happen on the agency’s timeline. When they do come, the inspector expects your programs to be current and complete. A review now means you’re ready before that day, not scrambling after it.

Can CDMS be present during regulatory inspections?

Yes. For facilities on our ongoing compliance program, we can be on site during inspections to help answer questions and provide documentation. Having your compliance partner there means the conversation is more productive for everyone.

Take the First Step