How OECA’s “Compliance First” Policy Affects Audit Policy Disclosures

Executive Summary  

“Compliance First” does not amend EPA’s Audit Policy or relax its eligibility conditions. However, it makes voluntary auditing, prompt disclosure, rapid correction, and prevention of recurrence more consistent with the EPA Office of Enforcement and Compliance Assurance (OECA)’s broader civil-enforcement philosophy. In practical terms, the approach can make a well-supported disclosure under the Audit Policy more attractive for companies to use, but it does not make the Audit Policy procedurally easier to satisfy.

******************************************

In December 2025, OECA published its “Compliance First” Memorandum, marking a shift in its longstanding enforcement policy towards a swift, economical, and cooperative compliance orientation rather than pursuing aggressive litigation and punitive penalties. The memorandum emphasized the importance of self-auditing and using voluntary self-disclosure as a mechanism toward compliance. While these principles are consistent with EPA’s Audit Policy, companies can expect the “Compliance First” orientation to have practical implications for voluntary disclosure and penalty mitigation.  

1. “Compliance First” strengthens the policy case for disclosure

EPA’s Audit Policy already provides defined incentives for qualifying voluntary disclosures:

• A 100% reduction of gravity-based civil penalties if all nine Audit Policy conditions are satisfied
• A 75% reduction of gravity-based penalties if the entity satisfies all conditions other than systematic discovery
• EPA retains discretion to recover any economic benefit realized from noncompliance.

“Compliance First” adds an enforcement-policy overlay because the memorandum directs EPA personnel to emphasize compliance assistance, voluntary compliance, and support companies to “find and fix” self-audits.  

That “Compliance First” Memorandum supports the following sequence of voluntary disclosure:

SELF-AUDIT →  IDENTIFY  →  DISCLOSE  →  CORRECT  →  PREVENT RECURRENCE

2. “Compliance First” does not expand Audit Policy eligibility

The Audit Policy’s conditions and deadlines still remain, and a company should not treat “Compliance First” as a substitute for satisfying those requirements. EPA’s current enforcement orientation continues to require voluntary discovery, prompt disclosure, expeditious correction, and measures to prevent recurrence.

• Disclosure deadline: EPA’s current Audit Policy provides a company 21 days from discovery to submit a written disclosure through the eDisclosure Portal.
• Practice Tip: Do not rely on “Compliance First” to excuse a late disclosure or cure the failure to meet an Audit Policy condition. Document the date of discovery and calculate the disclosure deadline immediately.

3. “Compliance First” may support a “correct promptly, preserve defenses” approach

“Compliance First” couples two themes: (1) prompt achievement of compliance; and (2) enforcement based on clear, defensible interpretations of the governing statute and regulation. Where the existence of a violation turns on a debatable interpretation, a company may consider separating:

1. Risk management: promptly disclose and correct the potentially noncompliant condition; and
2. Liability position: preserve the company’s argument that the conduct was not prohibited under the best reading of the statute or regulation.

Any voluntary disclosure should be forthright enough to meet the Policy while avoiding unnecessary concessions on disputed legal questions. The feasibility of reserving defenses will depend on the facts, the statutory program, and the wording of the disclosure.

4. Economic benefit remains a separate consideration in penalty considerations

“Compliance First” does not eliminate the Audit Policy’s distinction between the gravity component and economic benefit: 

5. Systematic compliance auditing becomes more valuable

Systematic discovery through an environmental audit or compliance-management system is the first Audit Policy condition. If that condition alone is absent, the entity may still qualify for the 75% gravity reduction rather than the 100% reduction. The emphasis of “find and fix” self-audits reinforce the value of an institutionalized audit process, including defined scope, findings logs, discovery-date controls, corrective-action tracking, and recurrence-prevention measures.

6. Not every discovered issue should automatically be disclosed

Before submitting a disclosure, consider the following questions:

• Is there actually a violation? Confirm that the obligation follows from the best reading of the applicable statute, regulation, permit, or order.
• Was discovery voluntary? Determine whether the issue was found through legally required monitoring, sampling, or auditing, which may affect eligibility.
• Can the 21-day deadline be satisfied? Identify and document the discovery date; avoid delaying the filing while every factual detail is investigated.
• Can correction occur within the applicable period? Develop a credible correction plan and preserve support for any extension request that may be needed.
• Are repeat-violation, serious-harm, or criminal issues present? Assess provisions that may limit civil-policy relief or require separate treatment.
• What economic benefit may EPA seek? Quantify avoided and delayed costs separately from the gravity component.
• Should legal positions be reserved? Draft carefully where liability depends on an unsettled or disputed interpretation.

7. Recommended disclosure workflow under “Compliance First”

• Open a privileged rapid-response review. Record when the issue was first recognized, by whom, and what facts were known at that time.
• Evaluate Audit Policy eligibility immediately. Map the facts to each Audit Policy condition and identify any uncertainty.
• Stabilize and correct the condition. Implement interim controls where final correction cannot be completed immediately.
• Submit within the applicable disclosure window. Use EPA’s eDisclosure process for eligible civil violations.
• Frame the disclosure around compliance. Describe discovery, immediate response, corrective action, and recurrence prevention while preserving any legitimate interpretive defenses.
• Document completion and prevention. Maintain evidence of correction, training, controls, and follow-up verification.
• Analyze residual exposure. Separately assess economic benefit, non-qualifying violations, state-law considerations, and potential collateral consequences.

Final Takeaways

“Compliance First” makes the Audit Policy more strategically attractive, but not procedurally easier to satisfy. A company that identifies a genuine violation through a compliance audit has an additional policy basis for disclosing quickly, correcting aggressively, documenting prevention measures, and presenting the matter as voluntary “find and fix” conduct. Counsel should nevertheless preserve liability defenses where appropriate, meet every Audit Policy deadline and condition independently, and analyze economic-benefit exposure separately.