A New Passivation Line, an Unvaried Trade Effluent Consent and Acid Stored Near a Surface-Water Drain
Halden Metal Finishing has plated zinc-nickel components since 2008 and added a trivalent chromium passivation line in January, using nitric acid and a chrome(III) bath. The environmental aspects register was last revised in November 2022 and lists eleven aspects covering the plating lines, the boiler house and site vehicles. Two entries refer to 'acid fume - scrubber, permit A1'. The trade effluent consent issued by the local water utility sets limits for zinc, nickel and total chromium at the boundary chamber; the new line's rinse water goes to that chamber, but the consent has not been varied and the utility has not been informed of the new process. Nitric acid is stored in 1,000-litre IBCs on a bunded pallet in the yard, 8 m from a surface-water drain discharging to a trout stream; the drainage plan marks the yard drain as 'surface water only'. The legal register lists national permitting and waste legislation but not the trade effluent consent or the utility's agreement. Your audit slot for this area is three hours and the site EHS manager joined four months ago.
1. Evaluate conformity with the requirements for environmental aspects (6.1.2) and compliance obligations (6.1.3). What evidence would you seek, and what would satisfy you that significance had been determined?
Read the worked answer
Start from what 6.1.2 demands: determine aspects and impacts within the defined scope, considering a life-cycle perspective, changes including new developments, and abnormal and emergency conditions; apply criteria to determine which are significant; communicate them; retain documented information. Clause 6.1.3 then requires the organisation to determine and have access to its compliance obligations.
Evidence to request: the aspects register and its review record; the change-management file for the new passivation line, including any environmental assessment and who approved the register update; the significance criteria and a worked example; whether acid storage is captured under abnormal or emergency conditions; whether upstream (supplier chemistry) and downstream (product end-of-life, customer disposal of passivated parts) are considered at all; the legal register and the process used to populate and update it.
Test significance rather than accept it. Ask the EHS manager to determine significance in front of you for 'release of chromium(III) rinse water to sewer' and for 'loss of containment of nitric acid to surface water'. If the answer is 'we would score that high, but it is not in the register', the process is not operating as described.
Expect a nonconformity: the register has not been maintained as a living process and does not address the new line or emergency conditions (6.1.2), and the compliance obligations determination is incomplete because the trade effluent consent is missing (6.1.3). Do not require a particular methodology - require evidence that the process is systematic and current.
2. How would you evaluate fulfilment of compliance obligations (9.1.2) given the consent has not been varied? Distinguish a compliance finding from a system finding, and state what you would do if you concluded a legal requirement was being breached at the time of the audit.
Read the worked answer
Clause 9.1.2 requires the organisation to evaluate fulfilment of its compliance obligations and to maintain knowledge and understanding of its compliance status. Compliance obligations include binding requirements the organisation has agreed to - a trade effluent consent is exactly that, whether or not it appears in the legal register.
Keep the two issues distinct:
- System finding (6.1.3): the legal register is incomplete. The consent and the utility's trade effluent agreement are absent, so the organisation cannot be said to have determined its compliance obligations.
- Compliance finding (9.1.2): the new line's rinse water is discharged to the consent chamber under a consent that does not authorise that effluent and sets no limits for it. That may be a breach of the consent as a matter of fact.
The auditor establishes facts - drainage plan, sampling point, the consent document, volumes, whether the utility was consulted - and evaluates them against the requirement. The auditor does not give a legal opinion.
If you conclude a legal requirement is being breached at the time of the audit, say so plainly as a nonconformity against 9.1.2, usually major. Tell the client's top management at the closing meeting so they can act immediately, note the requirement for corrective action under 10.2, and escalate to the certification body under its procedures. Do not wait for the report to be issued.
3. The site argues that because no spill has occurred, the acid storage location is low risk and needs no further control. How would you test whether risk-based thinking has actually driven operational control (8.1) and monitoring (9.1.1)?
Read the worked answer
Test the claim against the system, not against the absence of a spill.
Risk-based thinking (6.1.1) and the planning of action (6.1.4) exist to drive controls in 8.1. The chain you are testing is: identified risk → planned control → implemented control → monitoring → review. Break it at any link and you have a finding or at least an observation.
Identified? Ask for the risk assessment covering yard storage. If nitric acid storage beside a surface-water drain is not in it, the 'low risk' claim has no basis in the system - it is a post-hoc justification.
Planned? If it is in the risk assessment, ask what control was planned: secondary containment sized for the largest IBC, the drainage plan updated to show the area as contaminated, a spill kit suitable for nitric acid, an emergency plan (8.2) that names the stream and the regulator contact, and periodic inspection of the bund.
Implemented? Verify physically: is the bund intact and adequately sized, is there a drain shut-off valve and is it closed, does the spill kit contain acid-neutralising absorbent, do inspection records exist?
Reviewed? Check whether internal audit (9.2) and management review (9.3) considered the new line. A 'low risk' position that survives only because nothing has happened yet is not risk-based thinking; it is the absence of it. Record what you found and let the client draw its own conclusion from the evidence.