(a) The owner or operator shall compile and maintain the following up-to-date safety information related to the regulated substances, processes, and equipment:

(1) Safety Data Sheets (SDS) that meet the requirements of 29 CFR 1910.1200(g);

(2) Maximum intended inventory of equipment in which the regulated substances are stored or processed;

(3) Safe upper and lower temperatures, pressures, flows, and compositions;

(4) Equipment specifications; and

(5) Codes and standards used to design, build, and operate the process.

(b) The owner or operator shall ensure and document that the process is designed in compliance with recognized and generally accepted good engineering practices.

(c) The owner or operator shall update the safety information if a major change occurs that makes the information inaccurate.

(a) The owner or operator shall conduct a review of the hazards associated with the regulated substances, process, and procedures. The review shall identify the following:

(1) The hazards associated with the process and regulated substances;

(2) Opportunities for equipment malfunctions or human errors that could cause an accidental release;

(3) The safeguards used or needed to control the hazards or prevent equipment malfunction or human error including standby or emergency power systems; the owner or operator shall ensure monitoring equipment associated with prevention and detection of accidental releases from covered processes has standby or backup power to provide continuous operation;

(4) Any steps used or needed to detect or monitor releases;

(5) Natural hazards that could cause or exacerbate an accidental release; and

(6) Stationary source siting, including the placement of processes, equipment, and buildings within the facility, and hazards posed by proximate stationary sources, and accidental release consequences posed by proximity to the public and public receptors.

(b) The owner or operator may use checklists developed by persons or organizations knowledgeable about the process and equipment as a guide to conducting the review. For processes designed to meet industry standards or Federal or state design rules, the hazard review shall, by inspecting all equipment, determine whether the process is designed, fabricated, and operated in accordance with the applicable standards or rules.

(c) The owner or operator shall document the results of the review and ensure that problems identified are resolved in a timely manner.

(d) The review shall be updated at least once every five years. The owner or operator shall also conduct reviews whenever a major change in the process occurs; all issues identified in the review shall be resolved before startup of the changed process.

(a) The owner or operator shall prepare written operating procedures that provide clear instructions or steps for safely conducting activities associated with each covered process consistent with the safety information for that process. Operating procedures or instructions provided by equipment manufacturers or developed by persons or organizations knowledgeable about the process and equipment may be used as a basis for a stationary source's operating procedures.

(b) The procedures shall address the following:

(1) Initial startup;

(2) Normal operations;

(3) Temporary operations;

(4) Emergency shutdown and operations;

(5) Normal shutdown;

(6) Startup following a normal or emergency shutdown or a major change that requires a hazard review;

(7) Consequences of deviations and steps required to correct or avoid deviations;

(8) Equipment inspections; and

(9) Documentation when monitoring equipment associated with prevention and detection of accidental releases from covered processes is removed due to safety concerns from imminent natural hazards.

(c) The owner or operator shall ensure that the operating procedures are updated, if necessary, whenever a major change occurs and prior to startup of the changed process.

(a) The owner or operator shall ensure that each employee presently operating a process, and each employee newly assigned to a covered process have been trained or tested competent in the operating procedures provided in § 68.52 that pertain to their duties. For those employees already operating a process on June 21, 1999, the owner or operator may certify in writing that the employee has the required knowledge, skills, and abilities to safely carry out the duties and responsibilities as provided in the operating procedures.

(b) Refresher training shall be provided at least every three years, and more often if necessary, to each employee operating a process to ensure that the employee understands and adheres to the current operating procedures of the process. The owner or operator, in consultation with the employees operating the process, shall determine the appropriate frequency of refresher training.

(c) The owner or operator may use training conducted under Federal or state regulations or under industry-specific standards or codes or training conducted by covered process equipment vendors to demonstrate compliance with this section to the extent that the training meets the requirements of this section.

(d) The owner or operator shall ensure that operators are trained in any updated or new procedures prior to startup of a process after a major change.

(a) The owner or operator shall prepare and implement procedures to maintain the on-going mechanical integrity of the process equipment. The owner or operator may use procedures or instructions provided by covered process equipment vendors or procedures in Federal or state regulations or industry codes as the basis for stationary source maintenance procedures.

(b) The owner or operator shall train or cause to be trained each employee involved in maintaining the on-going mechanical integrity of the process. To ensure that the employee can perform the job tasks in a safe manner, each such employee shall be trained in the hazards of the process, in how to avoid or correct unsafe conditions, and in the procedures applicable to the employee's job tasks.

(c) Any maintenance contractor shall ensure that each contract maintenance employee is trained to perform the maintenance procedures developed under paragraph (a) of this section.

(d) The owner or operator shall perform or cause to be performed inspections and tests on process equipment. Inspection and testing procedures shall follow recognized and generally accepted good engineering practices. The frequency of inspections and tests of process equipment shall be consistent with applicable manufacturers' recommendations, industry standards or codes, good engineering practices, and prior operating experience.

(a) The owner or operator shall certify that they have evaluated compliance with the provisions of this subpart, at least every three years to verify that the procedures and practices developed under this subpart are adequate and are being followed. When required as set forth in paragraph (f) of this section, the compliance audit shall be a third-party audit.

(b) The compliance audit shall be conducted by at least one person knowledgeable in the process.

(c) The owner or operator shall develop a report of the audit findings.

(d) The owner or operator shall promptly determine and document an appropriate response to each of the findings of the compliance audit and document that deficiencies have been corrected.

(e) The owner or operator shall retain the two (2) most recent compliance audit reports. This requirement does not apply to any compliance audit report that is more than five years old.

(f) The next required compliance audit shall be a third-party audit when one or more of the following conditions applies:

(1) An accidental release meeting the criteria in § 68.42(a) from a covered process at a stationary source has occurred; or

(2) An implementing agency requires a third-party audit due to conditions at the stationary source that could lead to an accidental release of a regulated substance, or when a previous third-party audit failed to meet the competency or independence criteria of § 68.59(c).

(g)(1) If an implementing agency makes a preliminary determination that a third-party audit is necessary pursuant to paragraph (f)(2) of this section, the implementing agency will provide written notice to the owner or operator that describes the basis for this determination.

(2) Within 30 days of receipt of such written notice, the owner or operator may provide information and data to, and may consult with, the implementing agency on the determination. Thereafter, the implementing agency will provide a final determination to the owner or operator.

(3) If the final determination requires a third-party audit, the owner or operator shall comply with the requirements of § 68.59, pursuant to the schedule in paragraph (h) of this section.

(4) The owner or operator may appeal a final determination made by an implementing agency under paragraph (g)(3) of this section within 30 days of receipt of the final determination. The appeal shall be made to the EPA Regional Administrator or, for determinations made by other implementing agencies, the administrator or director of such implementing agency. The appeal shall contain a clear and concise statement of the issues, facts in the case, and any relevant additional information. In reviewing the appeal, the implementing agency may request additional information from the owner or operator. The implementing agency will provide a written, final decision on the appeal to the owner or operator.

(h) The audit and audit report shall be completed as in paragraph (a) of this section, unless a different timeframe is specified by the implementing agency.

(a) Applicability. The owner or operator shall engage a third party to conduct an audit that evaluates compliance with the provisions of this subpart in accordance with the requirements of this section when any criterion of § 68.58(f) is met.

(b) Third-party auditors and auditing teams. The owner or operator shall either:

(1) Engage a third-party auditor meeting all of the competency and independence criteria in paragraph (c) of this section; or

(2) Assemble an auditing team, led by a third-party auditor meeting all of the competency and independence criteria in paragraph (c) of this section. The team may include:

(i) Other employees of the third-party auditor firm meeting the independence criteria of paragraph (c)(2) of this section; and

(ii) Other personnel not employed by the third-party auditor firm, including facility personnel.

(c) Third-party auditor qualifications. The owner or operator shall determine and document that the third-party auditor(s) meet the following competency and independence requirements:

(1) The third-party auditor(s) shall be:

(i) Knowledgeable with the requirements of this part;

(ii) Experienced with the stationary source type and processes being audited and applicable recognized and generally accepted good engineering practices; and

(iii) Trained and/or certified in proper auditing techniques.

(2) The third-party auditor(s) shall:

(i) Act impartially when performing all activities under this section;

(ii) Receive no financial benefit from the outcome of the audit, apart from payment for auditing services. For purposes of this paragraph (c)(2)(ii), retired employees who otherwise satisfy the third-party auditor independence criteria in this section may qualify as independent if their sole continuing financial attachments to the owner or operator are employer-financed or managed retirement and/or health plans;

(iii) Ensure that all third-party personnel involved in the audit sign and date a conflict of interest statement documenting that they meet the independence criteria of this paragraph (c)(2); and

(iv) Ensure that all third-party personnel involved in the audit do not accept future employment with the owner or operator of the stationary source for a period of at least two years following submission of the final audit report. For purposes of the requirement in this paragraph (c)(2)(iv), employment does not include performing or participating in third-party audits pursuant to § 68.80 or this section.

(3) The auditor shall have written policies and procedures to ensure that all personnel comply with the competency and independence requirements of this section.

(d) Third-party auditor responsibilities. The owner or operator shall ensure that the third-party auditor:

(1) Manages the audit and participates in audit initiation, design, implementation, and reporting;

(2) Determines appropriate roles and responsibilities for the audit team members based on the qualifications of each team member;

(3) Prepares the audit report and, where there is a team, documents the full audit team's views in the final audit report;

(4) Certifies the final audit report and its contents as meeting the requirements of this section; and

(5) Provides a copy of the audit report to the owner or operator.

(e) Audit report. The audit report shall:

(1) Identify all persons participating on the audit team, including names, titles, employers and/or affiliations, and summaries of qualifications. For third-party auditors, include information demonstrating that the competency requirements in paragraph (c)(1) of this section are met;

(2) Describe or incorporate by reference the policies and procedures required under paragraph (c)(3) of this section;

(3) Document the auditor's evaluation of the owner or operator's compliance with the provisions of this subpart to determine whether the procedures and practices developed by the owner or operator under this subpart are adequate and being followed;

(4) Document the findings of the audit, including any identified compliance or performance deficiencies;

(5) Summarize any significant revisions (if any) between draft and final versions of the report; and

(6) Include the following certification, signed and dated by the third-party auditor or third-party audit team member leading the audit:

(f) Third-party audit findings—(1) Findings response report. As soon as possible, but no later than 90 days after receiving the final audit report, the owner or operator shall determine an appropriate response to each of the findings in the audit report, and develop a findings response report that includes:

(i) A copy of the final audit report;

(ii) An appropriate response to each of the audit report findings;

(iii) A schedule for promptly addressing deficiencies; and

(iv) A certification, signed and dated by a senior corporate officer, or an official in an equivalent position, of the owner or operator of the stationary source, stating:

(2) Schedule implementation. The owner or operator shall implement the schedule to address deficiencies identified in the audit findings response report in paragraph (f)(1)(iii) of this section and document the action taken to address each deficiency, along with the date completed.

(3) Submission to Board of Directors. The owner or operator shall immediately provide a copy of each document required under paragraphs (f)(1) and (2) of this section, when completed, to the owner or operator's audit committee of the Board of Directors, or other comparable committee or individual, if applicable.

(g) Recordkeeping. The owner or operator shall retain at the stationary source, the two most recent final third-party audit reports, related findings response reports, documentation of actions taken to address deficiencies, and related records. The requirement in this paragraph (g) does not apply to any document that is more than five years old.

(a) The owner or operator shall investigate each incident which resulted in, or could reasonably have resulted in a catastrophic release.

(b) An incident investigation shall be initiated as promptly as possible, but not later than 48 hours following the incident.

(c) An incident investigation team shall be established and consist of at least one person knowledgeable in the process involved and other persons with appropriate knowledge and experience to thoroughly investigate and analyze the incident.

(d) A report shall be prepared at the conclusion of the investigation which includes at a minimum:

(1) Date of incident;

(2) Date investigation began;

(3) A description of the incident;

(4) The factors that contributed to the incident; and,

(5) Any recommendations resulting from the investigation.

(e) The owner or operator shall promptly address and resolve the investigation findings and recommendations. Resolutions and corrective actions shall be documented.

(f) The findings shall be reviewed with all affected personnel whose job tasks are affected by the findings.

(g) Incident investigation reports shall be retained for five years.

(h) The owner or operator shall ensure the following are addressed when the incident in paragraph (a) of this section meets the accident history reporting requirements under § 68.42:

(1) The report shall be completed within 12 months of the incident, unless the implementing agency approves, in writing, to an extension of time; and

(2) The report in paragraph (d) of this section shall include factors that contributed to the incident including the initiating event, direct and indirect contributing factors, and root causes. Root causes shall be determined by conducting an analysis for each incident using a recognized method.

(a) The owner or operator shall develop a written plan of action regarding the implementation of the employee participation requirements required by this section.

(1) An annual written or electronic notice shall be distributed to employees and their representatives indicating that the plan is readily available to view, and how to access the information.

(2) Training shall be provided as often as necessary to ensure employees and their representatives, and management involved in the process, are informed of the details of the plan.

(b)(1) The owner or operator shall develop and implement a process to allow employees and their representatives to report to either or both the owner or operator and EPA unaddressed hazards that could lead to a catastrophic release, accidents covered by § 68.42(a) but not reported under § 68.195(a), and any other noncompliance with this part.

(2) The employee and their representatives may choose to report either anonymously or with attribution.

(3) When a report is made to the owner or operator, a record of the report shall be maintained for three years.

(c) The owner or operator shall provide to employees and their representatives access to hazard reviews and to all other information required to be developed under this subpart.