Audit of environmental protection, 2019

The Audit of Environmental Protection was conducted as part of the Correctional Service Canada (CSC) Internal Audit Sector's 2017-2020 Risk-Based Audit Plan.

The overall objectives of this audit were to provide reasonable assurance that:

• The management framework in place supports the effective and efficient management of CSC's environmental protection; and
• CSC is compliant with relevant policy and procedures related to environmental protection.

The audit was national in scope and assessed the overall management framework along with assessing compliance with key policy requirements related to halocarbon systems, petroleum storage tanks and the management of both drinking and wastewater.

Environmental management is increasingly becoming an area garnering public attention. Given the broad scope of CSC's operations and the large environmental footprint that it has, CSC is required to comply with a number of regulations governing various areas including the management of petroleum storage tanks, the management of halocarbons and the management of both wastewater and drinking water.

Overall, the audit team found that some elements of a management framework were in place. Namely, the governance structure adequately supported CSC staff in carrying out their environmental roles and responsibilities. In addition, a Commissioner's Directive and related policy documents existed and clearly identified the key roles and responsibilities of some of those involved in environmental management at the site level.

The audit found that the management framework requires further improvements. More specifically:

• The roles and responsibilities of environmental officers were not clearly defined;
• CSC did not have a process in place to ensure that its environmental policy continually aligned with relevant legislation; and
• CSC did not have a structured approach in place to monitor, report and take action on compliance issues with environmental policy requirements.

With respect to compliance, the audit found that overall, CSC was not compliant with relevant policy and procedures related to environmental protection. More specifically:

• Staff had generally not completed training and certification requirements;
• Operating plans and procedures were not always documented; and
• Monitoring requirements for water treatment and halocarbon systems were not always respected.

Management agrees with the audit findings and recommendations as presented in the audit report. Management has prepared a detailed Management Action Plan to address the issues raised in the audit and associated recommendations. The Management Action Plan is scheduled for full implementation by July 31, 2020.

The overall objectives of this audit were to provide reasonable assurance that:

1. The management framework in place supports the effective and efficient management of CSC's environmental protection responsibilities; and
2. CSC is compliant with relevant policy and procedures related to environmental protection.

Specific audit criteria are included in Annex A.

The audit was national in scope and assessed applicable practices and procedures in place at institutions and National Headquarters (NHQ). The focus of this audit was on institutions rather than on community sites, given that institutional operations are generally larger and therefore entail a more significant environmental footprint. In terms of assessing compliance with specific CSC policy areas, the audit focussed on drinking water, wastewater, petroleum storage tanks and halocarbon systems requirements. The audit team chose these areas because they are regulated at the federal level and these regulations apply to CSC's operations nationwide.

The audit did not assess compliance with policy requirements pertaining to energy and water conservation, waste management and the environmental assessment of projects. While some legislation exists to govern conservation efforts and waste management, this legislation either does not apply to CSC or does not apply to CSC operations nationally, as the requirements are provincially based and can vary geographically. In addition, while CSC is required to comply with legislation pertaining to the environmental assessment of projects, this was scoped out as NHQ plays a major role in the environmental assessment process for major construction projects. The audit instead focussed on those areas where accountability fell more significantly to the institutions.

In accordance with the five-year documentation retention requirement in CSC policy, the audit scope period was calendar years 2013 to 2018. This scope period was reduced on a case-by-case basis to account for matters such as system installation dates.

The first audit objective was to determine whether the management framework in place supported the effective and efficient management of CSC's environmental protection responsibilities.

The following sections highlight those areas where expectations were met and those where management attention is required. Annex A provides the overall assessment for all audit criteria.

The audit expected to find that the governance structure in place adequately supported CSC staff in carrying out their environmental roles and responsibilities.

This criterion was assessed as being met. The findings are discussed below.

The governance structure adequately supported CSC staff in carrying out their environmental roles and responsibilities.

The audit found that there was an adequate governance structure in place to ensure that the institutional head, who is ultimately accountable for ensuring compliance with CSC policy, was adequately supported in fulfilling his or her duties.

The CFM plays a key role in ensuring that compliance with CSC policy is achieved, as it is the CFM who has direct responsibility for ensuring that compliance-related activities, such as ongoing maintenance, testing and inspections have been completed in a timely manner. In the past, the CFM reported through the institutional chain of command to the Institutional Head. However, in 2014 the reporting relationship was changed and the CFM now reports to regional management. Institutional heads and CFMs did not identify any significant concerns with the sites' ability to meet environmental policy requirements under the new reporting structure. Several institutional heads indicated that the working relationship with their respective CFMs continued to function well under the new structure.

The audit expected to find that roles and responsibilities were clear, communicated and well understood.

This criterion was assessed as being partially met. The findings are discussed below.

Duties of regional EPP staff were not always consistent with the roles and responsibilities outlined in the policy suite.

In addition to the CFMs and relevant institutional staff, each region has a team of environmental officers who report to NHQ, with a role of ensuring compliance with the environmental policy suite.

The audit found that CSC policy identified roles and responsibilities pertaining to environmental management. Institutional Heads, CFMs and other relevant institutional staff understood their respective roles and responsibilities.

However, the audit found that the duties completed by the Environmental Protection Programs (EPP) staff located within the regions varied from one region to another and were not always aligned with the roles and responsibilities outlined in the policy suite. While it was generally understood that their primary role was to provide oversight and guidance to the sites on how to achieve compliance with environmental requirements, the level of support provided by the environmental protection officers varied from one region to another. For example, one team played strictly a compliance and oversight role by determining the extent to which institutions within their region were respecting CSC policy. However, another team was significantly involved in completing tasks identified in CSC policy as being an institutional responsibility, such as conducting monthly petroleum storage tank inspections. Whereas a third team played a role which is best described as falling somewhere in between the two aforementioned. As a result, EPP was providing the institutions visited with a notably inconsistent level of support, impacting the degree to which institutional management felt that they were in a position to achieve environmental compliance.

The audit expected to find that CSC policy was clear, up-to-date and aligned with relevant legislation.

This criterion was assessed as being partially met. The findings are discussed below.

While the audit found that CSC policy was clear, there was no systematic mechanism in place to ensure that it was up-to-date and aligned with relevant legislation.

The audit found that CSC policy expectations were generally clear to the institutional staff responsible for carrying out policy requirements. The policy suite was well understood by institutional staff, however, the audit found significant challenges with overall compliance, as discussed in Objective Two.

In terms of ensuring that policy was up-to-date and aligned with legislation, the audit expected to find that EPP had a formal process in place to: a) Map out CSC's scope of operations and identify potential areas that could be subject to legislative or regulatory requirements; and b) Periodically scan the legislative environment in order to identify any new or amended legislation or regulations that could impact CSC's operations. The audit found that EPP relied primarily on an informal process for identifying legislative or regulatory changes, such as e-mail communications from the federal departments responsible for managing a particular piece of legislation. However, EPP did not have a systematic process in place to identify aspects of CSC's operations that could be impacted by changes in environmental law and to ensure that CSC policy was up-to-date and aligned with relevant legislation and regulations.

CSC operates in an era of increasing expectations and enforcement action pertaining to environmental management. EPP staff regularly liaise with Environment Canada by providing input to legislation changes, participating on interdepartmental committees and workshops and by receiving regular communiques. However, the audit found that there was no systematic process in place to identify the impact of changes to environmental law and to provide assurance to management that CSC has conducted the due diligence necessary to ensure that it meets all relevant legislated requirements.

The audit noted one additional exception in terms of ensuring that CSC policy was up-to-date. EPP had not updated the policy to reflect the rollout of a national database used to record and monitor drinking water and wastewater sampling test results. To elaborate, institutional staff submit water quality samples to laboratories for analysis, who, in the past, provided test results in paper or e-mail format to the requesting institution. This changed in 2014, when CSC implemented a national water quality database. Laboratories now upload the test results directly into the database, which is accessible by several stakeholders including NHQ, RHQ and institutional staff. However, the responsibilities listed in CSC policy had yet to be updated to reflect the existence of this national database. For instance, while the audit team was told during interviews that NHQ played a key role in monitoring water quality test results, this responsibility was not documented in CSC policy documents. This is further discussed in Section 3.2.3.

If the policy suite is not up-to-date, there is an increased likelihood that CSC will not meet its environmental obligations on important matters such as the provision of safe drinking water.

The audit expected to find that CSC had a systematic, disciplined approach in place to monitor environmental performance; and that relevant information was being used to inform decision-making.

This criterion was assessed as being not met. The findings are discussed below.

CSC did not have a structured approach in place to assess and monitor compliance with environmental requirements.

As previously noted, EPP has environmental officers located within the regions who are responsible for assessing institutional compliance with CSC policy. The audit expected to find that these officers were following a documented periodic compliance plan, using a structured approach to assess compliance against policy requirements.

The audit found that CSC did not have a documented work plan in place to guide the activities of the environmental officers. Each regional team was generally using its own set of tools to periodically assess compliance. However, these tools did not cover all of the policy areas, typically focussing on halocarbon systems and petroleum storage tanks. In addition, EPP was not tracking the compliance with the training requirements by institutional staff. The audit also noted that EPP was not consolidating the results of compliance work conducted by its environmental officers for any trend analysis or presentation to senior management for decision-making. While EPP periodically presented updates to the Executive Committee (EXCOM) on elements of policy that CSC had no legal obligation to follow (such as conservation efforts), EXCOM did not receive or request information on the status of CSC's compliance with mandatory environmental legislation and regulations. This lack of oversight allowed for institutions to be in non-compliance for multiple years, thus putting the organization at risk. For example, not respecting the sampling frequency of drinking water could impede CSCs ability to manage a situation where the water is unsafe for consumption, possibly putting at risk the health of both staff and inmates.

With respect to the first objective, the audit team found that some elements of a management framework were in place. Namely, the governance structure adequately supported CSC staff in carrying out their environmental roles and responsibilities. In addition, a Commissioner's Directive and related policy documents existed and clearly identified the key roles and responsibilities of some of those involved in environmental management at the site level.

As noted, the management framework requires further improvements. More specifically, the audit found that:

• The roles and responsibilities of environmental officers were not clearly defined;
• CSC did not have a process in place to ensure that its environmental policy continually aligned with relevant legislation; and
• CSC did not have a structured approach in place to monitor, report and take action on compliance issues with environmental policy requirements.

The second audit objective was to determine whether CSC was compliant with relevant policy and procedures related to environmental protection. As previously discussed under the Scope section of this audit report, in terms of assessing compliance with specific CSC policy areas, the audit team focussed on the management of drinking water, wastewater, petroleum storage tanks and halocarbon systems.

Annex A provides the overall assessment for all audit criteria.

The audit expected to find that relevant staff had completed mandatory training and certification relating to environmental protection, as required by CSC policy.

This criterion was assessed as being not met. The findings are discussed below.

Staff with environmental management responsibilities did not always complete required training.

CSC policy identifies the training and certification required by relevant institutional staff. It is the responsibility of the regions to ensure that the relevant individuals receive the required training. More specifically, in accordance with policy, the audit expected to find that staff responsible for drinking water treatment and wastewater treatment were certified in accordance with provincial requirements; and that staff responsible for managing and overseeing halocarbon systems had completed environmental awareness training offered by Environment Canada. The audit found that, at sites visited, staff had not completed the aforementioned requirements.

In terms of drinking water, the audit found that staff at four of the six institutions visited did not have the required certifications. In terms of wastewater, four of the five wastewater facilities visited were not staffed by appropriately certified personnel. Staff at one of the four non-compliant sites indicated that their provincial regulatory authority did not involve itself in federal operations, making it impossible for them to become provincially certified.

In terms of halocarbon systems, the audit found that none of the CFMs had completed the required environmental awareness training. EPP staff informed the audit team that this training was not always available, especially outside of the Ottawa area making it difficult for institutional staff to comply with this policy requirement.

If staff are not appropriately trained, this may affect institutional capacity to comply with the requirements of CSC policy, thereby increasing the likelihood of an environmental or health and safety incident, such as a spill or leak resulting in environmental contamination. This could ultimately open CSC to significant liabilities.

The audit expected to find that the sites visited had documented operating plans and procedures in place, as required by CSC policy.

This criterion was assessed as being partially met. The findings are discussed below.

Operating plans and procedures were not always documented.

CSC policy clearly outlines documentation requirements for the environmental areas scoped into this audit. For halocarbon systems, policy requires that institutions prepare an inventory of systems; and that information pertaining to the most recent leak test is placed on the halocarbon system itself. As it relates to petroleum storage tanks, institutions are required to maintain a tank inventory, risk assessments and emergency plans. In terms of drinking water, policy requires that institutions have Drinking Water Management Plans (DWMPs) in place, which describe the drinking water quality monitoring program; potential problems with the water supply; system maintenance requirements; training requirements; and emergency procedures. In terms of wastewater treatment, policy requires that each facility have a documented capital plan, operating procedures and emergency plans in place.

With regards to halocarbon systems, the audit found that all institutions visited had a documented systems inventory and were keeping leak test records in a central location (such as the CFMs office). However, policy requires that institutions place leak test information on each respective system and the audit found that one site was not complying with this requirement. Halocarbon leak testing is important as it will determine whether a leak exists, so that repairs can be initiated on a timely basis to prevent further release into the atmosphere.

For petroleum storage tanks, the audit found that all institutions had an inventory of their tanks and all had emergency plans in place. In addition, the audit found that four of the six institutions visited had risk assessments in place for all of the tanks sampled as part of the audit. That said, concerns were noted that many plans included the requirement to complete annual spill response simulation exercises. However the audit found that these were not regularly occurring.

In terms of drinking water, while the audit found that all of the institutions visited had DWMPs in place, these plans were not sufficiently customized or detailed to suit the individual circumstances of each institution visited; and the emergency contact information was often outdated. In addition, the audit noted that the institutions either did not record and track maintenance conducted on drinking water infrastructure or did record some maintenance, but the records provided were insufficient to demonstrate that the maintenance requirements outlined in their respective DWMPs had been achieved.

In terms of wastewater, the audit found that, contrary to policy requirements, the facilities visited generally did not have documented capital plans, standard operating procedures and emergency plans in place. While all of the facilities visited had some level of scheduled maintenance, it was unclear to the audit team whether this maintenance would be considered adequate or otherwise acceptable, given the lack of formal planning documentation to demonstrate that all maintenance requirements had been adequately identified and considered.

As previously mentioned, while CSC had environmental officers on staff who were responsible for assessing compliance with policy, CSC did not have a documented work plan to guide these activities, and the limited set of compliance tools that existed typically focussed on halocarbon systems and petroleum storage tanks. This resulted in a significant lack of oversight in the other policy areas, such as drinking water and wastewater, which may explain the non-compliance found by the audit team.

Without operating plans and procedures, there is an increased likelihood of system malfunction or failure, which can lead to an environmental or health and safety incident, such as a sewage spill or degradation of drinking water quality.

The audit expected to find that the sites visited were monitoring relevant systems, including drinking water and wastewater treatment systems as well as halocarbon and petroleum storage tank systems, to ensure that they continually met policy expectations.

This criterion was assessed as being not met. The findings are discussed below.

Opportunities exist to improve the frequency of water quality sampling and the timeliness of both halocarbon leak testing and petroleum storage tank inspections.

CSC policy outlines requirements for sampling drinking water and wastewater to ensure that treatment systems meet pre-established standards and are operating as intended.

In terms of drinking water, the frequency of sampling depends largely on the parameter being tested. For example, sampling for E. coli and total coliforms is required on a weekly basis whereas sampling for lead is to be conducted semi-annually.

In terms of wastewater, the frequency of sampling depends largely on the treatment system in place at each respective institution. CSC has two general types of systems in place (continuous systems, meaning that treated wastewater is ‘continually' discharged into the environment; and intermittent systems, where wastewater is stored in lagoons and periodically discharged). Monthly sampling of influent (i.e. the wastewater entering treatment) and effluent (i.e. post-treatment wastewater being discharged into the environment) is a key requirement for monitoring CSC's systems.

Based on a national analysis of water quality, the audit found that CSC's institutions were not always sampling drinking water and wastewater at the required frequencies. In addition, while CSC policy required CFMs to submit periodic status reports on the performance of their respective wastewater systems to NHQ, the audit found that this was not occurring.

In addition, CSC policy also requires institutions to conduct leak tests of halocarbon systems at least once every 12 months and to conduct monthly visual inspections of petroleum storage tanks. The audit found that all institutions visited completed the required leak tests for 2017; however these leaks were not always conducted within 365 days of the previous test, as required by CSC policy. For petroleum storage tanks, the audit found that all sites had been conducting the visual inspections of the tanks; however, they were not always conduct monthly as required.

The audit team also noted that CSC's halocarbon leak test form did not include instructions on who should complete the form or include a specific field to identify whether a leak had been detected. As a result, the audit team found that several leak test documents were completed by an individual who did not actually perform the test. Several forms also did not identify whether or not a leak had been detected. This was a key piece of information that was missing from the documentation, given that the entire purpose of the test is to determine whether a leak exists.

Confirming the effectiveness of systems in place for the treatment of both wastewater and drinking water as well as halocarbon systems on a regular and timely basis provides assurance that these systems are operating as intended, and reduces the likelihood of undetected contamination and leaks.

With respect to the second objective, the audit found that overall, CSC was not compliant with relevant policy and procedures related to environmental protection. More specifically:

• Staff had generally not completed training and certification requirements;
• Operating plans and procedures were not always documented; and
• Monitoring requirements for halocarbon systems as well as the systems related to the treatment of both wastewater and drinking water were not always respected.

The Assistant Commissioner, Corporate Services should strengthen the management framework. Specifically by;

• Ensuring the current environmental policy suite is up-to-date and in line with relevant legislation and regulations;
• Ensuring that the Environmental Protection Officers clearly understand their roles and are performing them as required; and
• Monitoring compliance and provide updates to EXCOM for information and decision-making.

The Assistant Commissioner, Corporate Services agrees with the recommendation. By June 30, 2020, Corporate Services will:

• update the Internal Services Directives on Drinking Water Quality Management, Management of Wastewater and Wastewater Treatment Systems, Environmental Management of petroleum Storage Tank Systems and Environmental Management of Halocarbons will be updated;
• prepare and provide a presentation on the roles of the Environmental Protection Officers to applicable environmental staff for each of the aspects and follow up actions; and
• develop and implement tools to monitor compliance and provide updates to EXCOM, as required.

The Regional Deputy Commissioners should ensure that institutions are complying with the Environmental Protection Policy Suite. Specifically;

• Ensuring all staff complete all required training;
• Ensuring individual operating plans and procedures are created and implemented as required; and
• Given the concerns identified in the audit, ensure that samples for wastewater and drinking water are taken and analyzed as required by policy, and any exceedances are investigated and managed.

The Regional Deputy Commissioners agree with the recommendation.

By March 31, 2020, staff responsible for drinking and wastewater treatment, as well as halocarbon systems will have completed required and applicable training. By September 30, 2019, formal operating plans and procedures will be created and implemented for wastewater systems. By July 31, 2020, various sampling schedules will be created and matching work orders added to a Computerized Maintenance Management System. Additionally, the regular sampling completed will be more readily auditable through various means.

Overall, the audit team found that some elements of a management framework were in place. Namely, the governance structure adequately supported CSC staff in carrying out their environmental roles and responsibilities. In addition, a Commissioner's Directive and related policy documents existed and clearly identified the key roles and responsibilities of some of those involved in environmental management at the site level.

The audit found that the management framework requires further improvements. More specifically:

• The roles and responsibilities of environmental officers were not clearly defined;
• CSC did not have a process in place to ensure that its environmental policy continually aligned with relevant legislation; and
• CSC did not have a structured approach in place to monitor, report and take action on compliance issues with environmental policy requirements.

With respect to compliance, the audit found that overall, CSC was not compliant with relevant policy and procedures related to environmental protection. More specifically:

• Staff had generally not completed training and certification requirements;
• Operating plans and procedures were not always documented; and
• Monitoring requirements for halocarbon systems as well as the systems related to the treatment of both wastewater and drinking water were not always respected.

Management agrees with the audit findings and recommendations as presented in the audit report. Management has prepared a detailed Management Action Plan to address the issues raised in the audit and associated recommendations. The Management Action Plan is scheduled for full implementation by July 31, 2020.

Audit evidence was gathered through a number of methods:

Interviews were conducted with senior management and staff primarily at the national and at the institutional level. At the national level, interviews were conducted with senior management and staff working in the Environmental Protection Programs (EPP) group, including EPP's environmental officers located within the regions. At the institutional level, interviews were conducted with institutional heads, CFMs and other staff relevant to the environmental management portfolio of the specific institution visited.

Relevant documentation including policies, procedural documentation, plans, performance reporting and other relevant corporate documentation was reviewed.

At each institution visited, the audit included a sampling and review of documentation pertaining to petroleum storage tank inspections and fuel transfers; and halocarbon leak inspections to determine whether inspection frequency requirements were respected. In terms of drinking water and wastewater, the audit team used data extracted from CSC's water quality database as well as information provided by EPP to determine whether at the national level, required sampling frequencies were being met.

While on-site at each institution, the audit team inspected a sample of halocarbon systems to determine whether leak test documentation was affixed to each system, as required by CSC policy. In addition, the audit team inspected a sample of petroleum storage tanks to determine whether each tank was labelled with its Environmental Canada registration number; and to confirm whether emergency response instructions and spill kits were readily available.

The audit team focussed on selecting sites that were responsible for treating their own wastewater, as this was seen as a higher risk activity when compared to sites that relied on municipal wastewater services. The audit therefore included a visit to one institution per region which was responsible for treating its own wastewater. Three of these sites were responsible for producing their own drinking water while the two remaining sites relied on municipal drinking water services. Annex B identifies the sites visited.

Past CSC internal audits and external assurance work were used to assist in scoping the audit work, including the following.

CSC Performance Assurance Sector - Audit of the Environmental Management System (May 2006)

The audit recommended that all sites establish an environmental emergency plan; prepare an inventory of halocarbon systems and ensure that it is kept up to date; and implement a system for measuring solid waste. The audit also recommended that CSC ensure that required processes are put into place to monitor the level of compliance with CSC environmental policies.

Report of the Commissioner of the Environment and Sustainable Development

Chapter 1: Safety of Drinking Water (March 2009)

The audit found that contrary to recommendations in Health Canada's central guidance document, CSC's internal guidance did not require testing for lead or other chemical and physical contaminants at sites that were supplied by municipal systems. Laboratory analysis confirmed that at most of the institutions visited between one third and one half of the samples contained lead at levels higher than recommended in Health Canada's Guidelines for Drinking Water Quality. The cause was lead from the facilities' aging water distribution systems and not the municipal water supply to which they were connected.

In my professional judgment as Chief Audit Executive, sufficient and appropriate audit procedures have been conducted and evidence gathered to support the accuracy of the opinion provided and contained in this report. The opinion is based on a comparison of the conditions, as they existed at the time, against pre-established audit criteria that were agreed on with management. The opinion is applicable only to the area examined.

The audit conforms to the Internal Auditing Standards for Government of Canada, as supported by the results of the quality assurance and improvement program. The evidence gathered was sufficient to provide senior management with proof of the opinion derived from the internal audit.

Sylvie Soucy, CIA
Chief Audit Executive

The following table outlines the audit criteria developed to meet the stated audit objective and audit scope:

To provide assurance that the management framework in place supports the effective and efficient management of CSC's environmental protection responsibilities.

1. The governance structure in place adequately supports CSC staff in carrying out their environmental roles and responsibilities.
2. Roles and responsibilities are clear, communicated and well understood.

Rating (met/met with exceptions/partially met/not met)

Partially met

CSC policy is clear, up-to-date and aligns with relevant legislation.

Rating (met/met with exceptions/partially met/not met)

Partially met

1. CSC has a systematic, disciplined approach in place to monitor environmental performance.
2. Relevant information is being used to inform decision-making at all levels.

Rating (met/met with exceptions/partially met/not met)

Not met

To provide assurance that CSC is compliant with relevant policy and procedures related to environmental protection.

Staff have completed mandatory training and certification relating to environmental protection.

Rating (met/met with exceptions/partially met/not met)

Not met

Operating plans and procedures are documented and implemented.

Rating (met/met with exceptions/partially met/not met)

Partially met

CSC conducts ongoing testing, monitoring and reporting of relevant systems to ensure that they are operating as intended.

Rating (met/met with exceptions/partially met/not met)

Not met