EHS compliance management is the work of keeping a facility’s environmental, health, and safety programs aligned with the regulations that apply to it. In California, that’s a longer list than most owners and managers expect. It involves written plans, posted inspection logs, training records, reporting deadlines, agency submittals, and periodic updates whenever operations, staffing, equipment, or regulations change.
If you searched for “what is EHS compliance,” you may have found short definitions that stop there. This guide goes further. It covers which agencies enforce which programs in California, the difference between achieving compliance once and maintaining it over time, and how facilities typically handle the work. For a full overview of how ongoing compliance management works as a service, see our ongoing EHS compliance management guide.
EHS Compliance Has Three Parts
The acronym carries three distinct regulatory domains that get bundled into one phrase for convenience. They’re enforced by different agencies, on different schedules, with different documentation requirements.
Environmental. Air quality permits, wastewater discharge, stormwater, hazardous materials inventory, hazardous waste generation and disposal, spill prevention.
Health. Worker exposure to chemicals, noise, ergonomic hazards, respiratory hazards, heat illness, bloodborne pathogens where applicable.
Safety. The written safety programs that Cal/OSHA expects every California employer to maintain: the Injury and Illness Prevention Program (IIPP), the Workplace Violence Prevention Plan (WVPP), lockout/tagout, confined space, forklift, and others triggered by specific operations.
A facility may have requirements across all three domains. Most California industrial and commercial facilities have obligations in at least two. EHS compliance management is the practice of running all of them as one coordinated program rather than five disconnected ones.
Who Enforces What in California
The first thing facilities new to EHS compliance ask is “who do we actually report to?” The short answer is more than one agency. California layers state and local oversight on top of federal baselines, and each program has its own enforcer.
| Program Area | Enforcing Agency | What They Require |
|---|---|---|
| Hazardous materials inventory, hazardous waste generation, tank storage, tiered permitting | Your local CUPA (Certified Unified Program Agency, which may be a county environmental health department, fire department, or another local agency depending on jurisdiction) | HMBP filed and updated in CERS (the state’s online environmental reporting portal), waste manifests, accumulation logs, tank registrations |
| Hazardous waste classification, generator status, biennial reporting, waste minimization (SB14) | DTSC (Department of Toxic Substances Control) | EPA ID number, classification of waste streams, generator-status compliance, biennial report every other year |
| Workplace safety programs and training | Cal/OSHA (Title 8 of the California Code of Regulations) | IIPP, WVPP, heat illness prevention, LOTO, confined space, respiratory protection, hazard communication, training records |
| Stormwater (industrial general permit) | Regional Water Quality Control Board, via SMARTS | SWPPP, BMP inspections, sampling, annual report |
| Wastewater discharge to sewer | Regional Water Quality Control Board or local sewer authority | Discharge permit, monitoring, slug plans where required |
| Air quality permits and emissions | Your local air district (AQMD, BAAQMD, SCAQMD, etc.) | Permits to operate, AER and AB 2588 toxic emissions reporting, permit renewals |
When we walk a facility for the first time, this is the matrix we map their operations against. Most facilities know about one or two of these and are surprised by the rest. The order they typically appear in conversations is: the fire department showed up (CUPA), an employee complaint triggered Cal/OSHA, a stormwater inspector wrote them up, then the air district reminded them that the permit on the boiler in the back has been expired since 2019.
Achieving Compliance vs. Maintaining It
This is the distinction most “what is EHS compliance” articles miss. The two are different problems with different solutions.
Achieving compliance is a project. You don’t have an IIPP. We write one. You haven’t filed an HMBP in CERS. We submit it. Your SWPPP references a layout that doesn’t match the facility anymore. We rebuild it. There’s a start point, a deliverable, and an end point. A gap assessment is usually how facilities figure out what projects they need. For more on that step, see our EHS gap assessment and compliance audit guide.
Maintaining compliance is a state. Once the plans are written and the submittals are current, the question becomes how to keep them that way as operations change, staff turn over, regulations update, and inspection cycles come around. This is where most facilities drift. The IIPP names a safety coordinator who left two years ago. The CERS inventory lists chemicals that aren’t on site anymore. The training records show completions from people no longer on the payroll. The plan is technically in place, but it’s not current.
The most common pattern we see is a facility that paid for written programs once, filed them, and then went years without anyone reviewing whether the documents still matched reality. The first time the gap surfaces is usually during an inspection, which is the most expensive time to find out.
Not sure whether your facility has achieved compliance, is maintaining it, or has drifted? Call (925) 551-7300 or request a consultation. We can walk through what’s in place, what’s expired, and what an honest baseline looks like.
Three Ways Facilities Handle EHS Compliance
Once a facility decides EHS compliance needs to be managed rather than reacted to, there are three practical approaches. Most facilities use some combination.
In-house staff. A dedicated EHS manager or coordinator on payroll. Works well at larger facilities with daily on-site needs and the budget for a full-time hire who can cover all five regulatory domains. The tradeoff is breadth: one person rarely has deep expertise across haz waste, stormwater, air permitting, Cal/OSHA training, and CUPA reporting at the same time.
Software platforms. EHS compliance management software stores documents, tracks deadlines, and sends reminders. Useful as a tool. It doesn’t walk your facility, doesn’t update your HMBP when CERS changes its data fields, and doesn’t stand in front of a Cal/OSHA inspector. Software supports the work; it doesn’t do the work. We cover this distinction in EHS compliance software vs. EHS compliance services.
Outsourced compliance management. A consulting firm handles the programs on a regular cadence: plans reviewed and updated, training delivered, reports filed, inspection logs maintained, and a consultant walking the facility on a recurring schedule to catch drift before an inspector does. The cost is typically a fraction of an in-house hire because one team covers many facilities, with senior oversight on every deliverable.
There’s no single right answer. A larger manufacturer with multiple California sites usually needs an in-house EHS lead plus outside support. A smaller warehouse or distributor with a handful of permits is often better served by an outsourced engagement.
What’s Different About California
A few things make California EHS compliance distinct from federal-only compliance.
The CUPA structure. California’s Unified Program consolidates oversight of six environmental programs under one local agency, the CUPA (which may be a county environmental health department, fire department, or another local agency depending on jurisdiction): HMBP, haz waste generators, USTs, ASTs/SPCC, CalARP, and tiered permitting for treatment activities. Facilities deal with one local agency rather than half a dozen.
CERS. All of the CUPA-administered programs are reported through CERS, the state’s online portal. CERS is not just a filing system. Inspectors increasingly use it as their checklist when they arrive. A current, accurate CERS submittal makes inspections move faster. A stale one writes its own list of findings.
Title 8 and Cal/OSHA. California’s workplace safety standards in Title 8 of the California Code of Regulations are generally stricter than the federal OSHA equivalents. Heat illness prevention rules and the Workplace Violence Prevention Plan requirement (SB553, in effect for most employers since 2024) are California-specific.
SMARTS for stormwater. Industrial facilities subject to the general stormwater permit file and report through SMARTS, the state’s online stormwater portal. Annual reports, sampling results, and No Exposure Certifications all live there.
If a facility’s compliance program was built against federal standards, it almost certainly has gaps under California requirements. This is the most common finding when we audit acquired facilities or facilities that brought in their programs from out of state.
Where to Start
If you’re new to EHS compliance and trying to figure out what applies to your operation, the practical order is:
- Identify which agencies regulate you. What’s on site, how many employees, what permits already exist?
- Inventory what’s in place. Pull every plan, permit, log, and training record. Note what’s missing.
- Compare against current requirements. An honest comparison shows where the gaps are.
- Decide how to manage the work going forward. In-house, outsourced, software-supported, or some combination.
A structured gap assessment covers steps one through three on a single engagement.
Ready to figure out what EHS compliance means for your specific facility? Call (925) 551-7300 or request a consultation. We’ll talk through your operation, identify which programs apply, and outline the options for getting current and staying current.
