BGC CPEA cheat sheet

Program scope defines which audits, sites, and intervals fall under the program; the program is the umbrella, an individual audit is one instance within it.

Risk-based scheduling rule: sites with higher environmental risk (permit exceedances, toxic releases, prior nonconformities) receive shorter audit intervals.

Auditor competence records must be maintained per auditor: qualifications, training, sector experience, and independence declarations.

Program performance indicators include audit completion rate against plan, nonconformity closure time, and recurrence rate of findings.

Resource planning formula: annual audit-days required = sum over planned audits of (audit duration in days x auditors per team).

Program review occurs at defined intervals (commonly annual) to reassess risk inputs, coverage gaps, and audit effectiveness.

Impartiality rule: the function managing the audit program should not report through the same line accountable for the audited environmental performance.

Audit criteria, scope, and objectives must be defined before scheduling; changes to criteria after scheduling require documented justification.

Audit scope states boundaries: sites, processes, time period, and organizational units; exclusions must be documented with rationale.

Audit criteria are the requirements against which evidence is compared: permits, regulations, EMS standard clauses, and internal procedures.

Document review precedes fieldwork: permits, monitoring reports, prior audit findings, corrective action logs, and management review minutes.

Sampling plan rule: sample size increases with population size and with risk; sampling rationale must be recorded, not arbitrary.

Audit plan content includes schedule, auditee contacts, team roles, working documents, and logistics; the plan is shared with the auditee in advance.

Checklist questions derive from audit criteria and identified risks; a checklist is a guide, not a limit on lines of inquiry.

Opening meeting agenda: confirm scope, criteria, schedule, confidentiality, safety rules, and nonconformity reporting method.

Evidence hierarchy: physical observation and records review generally outweigh interview statements alone; corroborate interviews with records.

Three evidence tests: evidence must be sufficient (adequate quantity), relevant (bears on the criterion), and verifiable (traceable to source).

Nonconformity components: the requirement, the evidence of the gap, and the objective evidence location or identifier.

Observation vs. nonconformity: a single isolated lapse may be an observation; a systemic or repeatable failure against a requirement is a nonconformity.

Interview technique: ask open questions, follow up with probing questions, and confirm understanding by restating the auditee's answer.

Trace sampling: follow a process end-to-end (input to output) rather than sampling isolated steps, to test linkage and control.

Working papers must record what was examined, what was found, and the source; undocumented findings cannot be relied on in the report.

Closing meeting presents findings, agrees factual accuracy, and sets expected corrective action timelines; disputes are logged, not resolved by audit team fiat.

Permit compliance test: compare actual emissions, discharges, and waste streams against permit limits, monitoring methods, and reporting deadlines.

Exceedance handling rule: a limit exceedance triggers notification duties, root cause analysis, and corrective action, independent of audit findings.

Recordkeeping obligations typically include monitoring data, calibration records, manifests, training records, and inspection logs retained for defined periods.

Waste determinations: hazardous waste classification drives storage time limits, labeling, manifesting, and disposal facility requirements.

Reporting calendar: permit reports, emissions inventories, and spill notifications each have distinct deadlines and recipients.

Regulatory change management: the auditee must have a process to identify new or amended requirements and assess applicability.

Compliance audit vs. management system audit: compliance audits test against legal requirements; EMS audits test the management system's ability to meet objectives, including compliance.

EMS audit tests conformance to the standard's clauses: context, leadership, planning, support, operation, performance evaluation, and improvement.

Aspect and impact identification: significant aspects drive operational controls, objectives, and monitoring; auditors verify the significance method is applied consistently.

Objectives must be measurable, monitored, and tracked; an objective without a metric or review cadence is a planning gap.

Operational control verification: check that documented controls exist, are communicated to relevant workers, and are actually followed in practice.

Emergency preparedness test: identify potential emergency scenarios, verify response procedures, and confirm drills were conducted and evaluated.

Management review inputs and outputs must be evidenced; missing outputs (decisions on resources or actions) indicate a weak review process.

Corrective action effectiveness: verify the root cause was addressed, not only the symptom, and check for recurrence.

Report structure: objectives, scope, criteria, audit dates and team, summary of findings, detailed nonconformities, and conclusions.

Nonconformity grading rule: grade by risk and systemic nature (e.g., major vs. minor) using a documented grading scheme applied consistently.

Finding statement formula: requirement + evidence + gap; avoid opinions, and cite the specific record, location, or observation.

Report accuracy rule: the auditee reviews findings for factual accuracy before final issue; disagreement is noted, not deleted.

Confidentiality: reports are distributed on a need-to-know basis; sensitive data handling is agreed at the opening meeting.

Report timeliness: issue the report within the timeframe defined by the audit program so corrective action can start promptly.

Conclusions distinguish conformity of the management system from compliance status with legal requirements; the two are reported separately.

Corrective action plan elements: containment, root cause, corrective action, responsible person, and target date.

Root cause tools include 5-whys, fishbone analysis, and fault tree analysis; the chosen tool and result should be documented.

Verification of implementation confirms the action was done; verification of effectiveness confirms the problem did not recur.

Closure rule: a finding closes only when objective evidence of effective action is reviewed and accepted by an authorized person.

Overdue tracking: open actions past target date are escalated per program rules; repeat findings indicate ineffective prior corrective action.

Effectiveness check timing: allow enough time after implementation for the control to operate and generate evidence before judging effectiveness.

Independence rule: an auditor must not audit work they performed or a process they are accountable for within a defined look-back period.

Objectivity threat types include self-review, familiarity, and intimidation; each threat requires a safeguard or recusal.

Confidentiality: audit information is not disclosed without authorization, and is not used for personal advantage.

Competence requirements: technical knowledge of environmental requirements, audit methods, and the sector being audited.

Evidence integrity: findings are based on verifiable evidence, not hearsay; uncertainty is disclosed rather than overstated.

Conflict of interest disclosure occurs before the audit; undisclosed conflicts invalidate the audit's credibility.

Professional conduct: auditors avoid accepting gifts or hospitality that could influence judgment, and behave courteously and truthfully with auditees.