James E. Plumhoff - Establishing an Environmental Audit Privilege to Promote Implementation of the ISO 14000 Standards

In recent years, environmental audits⁽¹⁾ have become an integral part of corporate management.⁽²⁾ Environmental audits allow companies⁽³⁾ to evaluate the impacts corporate activities have on the environment. These audits often reveal problems or potential problems, which can then be addressed, to reduce a companies' environmental impact. There are several reasons for the increase in companies' use of environmental audits. First, environmental disasters such as the one in Bophal, India have raised the level of environmental consciousness worldwide, both from a corporate standpoint and within the world population as a whole.⁽⁴⁾ Second, the proliferation of environmental regulations over the last two decades has made it necessary for companies to evaluate their ability to meet these regulations. Finally, companies are in business to make money and audits enable companies to save money by planning and averting environmental degradation before it occurs, rather than facing the consequences after it occurs.

Forces such as these have led to the development of standards such as the International Organization for Standardization (ISO)⁽⁵⁾ 14000⁽⁶⁾ series of standards, which utilize environmental audits. These standards are designed to assist companies with the development and implementation of, environmental management systems (EMS).⁽⁷⁾ The EMS standards are contained in ISO 14001 and 14004."⁽⁸⁾ These EMS's will allow businesses to establish strategies for managing the impacts that their activities have on the environment.⁽⁹⁾ Businesses now realize that they cannot simply focus on compliance requirements, but must manage their environmental programs as well as their environmental image if they are to enjoy long term viability.⁽¹⁰⁾ As we move more towards an international economic community, the ISO 14000 standards may prove to be a "global passport" for international business.⁽¹¹⁾

Implementing these standards, however, will not be without challenges. First, the cost of implementation, particularly for smaller companies or lesser developed countries, may cause difficulties. If this proves to be true, the ISO 14000 standards could actually create trade barriers for these companies or countries.⁽¹²⁾ Second, because ISO 14000 focuses on process rather than performance, it remains to be seen if the standards will actually lead to better environmental performance.⁽¹³⁾ Finally, ISO 14000 is based upon EMS's which require periodic auditing. This proliferation of environmental auditing will create vast amounts of information. This raises concerns about requiring companies to disclose information. If this audit information can be used against companies by regulators or private citizens, U.S. participation in the ISO standards could be undermined. To avoid this result, it will be necessary for countries such as the U.S. to adopt an ISO audit privilege in order to encourage ISO 14000 implementation.

This comment will attempt to address some of the issues surrounding the ISO 14000 standards and also the Eco-Management and Audit Scheme or EMAS standards.⁽¹⁴⁾ Part II of the comment will discuss the evolution and need for international standards such as ISO 14000 and EMAS. Part III will analyze the challenges to successful implementation of ISO and EMAS, particularly concentrating on the problems which may arise from the proliferation of information due to increased EMS audits. Part IV suggests that ISO audit privilege legislation be adopted by the U.S. Congress and that an ISO audit policy be adopted by the U.S. Environmental Protection Agency (EPA). Finally, part V will provide concluding thoughts.

Over the last few decades, international companies have been faced with an enormous increase in the number of environmental regulations, laws, and treaties.⁽¹⁵⁾ Standardization attempts to harmonize different requirements and level the playing field for companies and industries doing business world-wide. Many feel that without standardization, the proliferation of non-harmonized standards for similar industries in different countries could contribute to, "technical barriers to trade."⁽¹⁶⁾ Standardization is not a new concept. Although they deal specifically with quality management, one of the first sets of standards developed to address these barriers was the ISO 9000.⁽¹⁷⁾ Following standardization for quality management, the need for standardization in the area of environmental management became apparent.⁽¹⁸⁾ Nations participating in the 1992 Rio Conference particularly saw a need for international standards addressing environmental issues.⁽¹⁹⁾ For this reason, following the Conference there was a proliferation of national and regional environmental management, and auditing schemes."⁽²⁰⁾

Environmental standardization got off to an early start in Europe, partly due to the differing environmental standards found among members of the European Economic Community (EEC).⁽²¹⁾ ⁽²²⁾ This led to the 1993 adoption of EMAS.⁽²³⁾ EMAS is an environmental management program implemented by the European standards-setting body or the Comite Europeen de Normalisation (CEN).⁽²⁴⁾ EMAS is a site-based, voluntary, registration program which recognizes environmental management systems within companies. ⁽²⁵⁾ It allows participants to establish an EMS both at the corporate level and at the subject sites.⁽²⁶⁾ This EMS incorporates past, present, and future activities and tries to address environmental concerns through the corporate management plan.⁽²⁷⁾

The EMS under EMAS is subject to periodic audits for completeness and effectiveness, usually every three years.⁽²⁸⁾ EMAS also requires companies to produce annual reports outlining environmental performance. But one of the unique features of EMAS is that external accredited verifiers review and validate a company's policy statements, environmental programs, management systems, and audits.⁽²⁹⁾ Companies who meet the requirements of EMAS may then publicize their participation in the program.⁽³⁰⁾ Although the program is voluntary, it is the hope of the EU that market forces will dictate the eventual participation of all EU industries in the EMAS program. The EU's Environmental Commission plans to review the program's effectiveness in 1998 and decide whether to make participation mandatory.⁽³¹⁾

EMAS has enjoyed a certain degree of success. As of February 3, 1999 there were 2,489 industrial sites under EMAS.⁽³²⁾ Germany is by far the leader in the area of EMAS registrations; with 1,876 as of 1999, Germany achieved well over twice as many registrations as all other member states combined.⁽³³⁾ The success of EMAS in the EU has allowed Europe to assume the lead in the area of industrial environmental standardization.

Partly in response to the proliferation of differing environmental standards, such as EMAS worldwide, the ISO formed a Strategic Action Group on the Environment (SAGE) in 1991.⁽³⁴⁾ The purpose of SAGE was to investigate the usefulness of drafting international standards for environmental management.⁽³⁵⁾ SAGE focused its attention in the following three areas: (1)promoting a common worldwide approach to environmental management in business and industry; (2)increasing the ability of and incentives for organizations to measure and attain improvements in environmental performance; and (3) facilitating world trade and removing potential environmental trade barriers.⁽³⁶⁾ As a result of the findings of SAGE, the ISO formed Technical Committee 207 (TC 207) in June of 1993.⁽³⁷⁾

TC 207 became responsible for drafting the ISO 14000 series of standards. At early meetings of TC 207, more than thirty countries and 200 representatives expressed a desire to develop new EMS standards.⁽³⁸⁾ TC 207 itself had members representing some sixty-nine countries and was divided into six subcommittees.⁽³⁹⁾ These members included representatives from various industries, standards organizations, governments, environmental organizations, and other interest groups.⁽⁴⁰⁾

For some involved in this process, motivation for the development of these standards was due to the fear that the increased number of inconsistent national and regional EMS standards would create trade barriers.⁽⁴¹⁾ As a result, U.S. companies and others persuaded their national ISO organizations to begin to formulate international standards for EMS's.⁽⁴²⁾

For other companies, the fear seemed to be that because Europe was established with the EMAS program, there would be attempts to influence the ISO 14000 standards to make them comparable to EMAS. This led to criticism about Europe having an unfair advantage in the development and adoption of ISO 14000 which standards were intended to be world-wide.⁽⁴³⁾ This concern was in part fueled by the fact that the ISO 14000 standards were being developed in conjunction with CEN, the European standards-setting body.⁽⁴⁴⁾ In fact, the ISO set the standards drafting timetable at 30 months, in part because CEN had agreed to accept ISO 14000 if they were finalized quickly enough.⁽⁴⁵⁾ There were also fears that the standards were a reflection of European not American technology.⁽⁴⁶⁾ Nevertheless, the standards were developed with each participating member having equal say in the process.

The ISO 14000 standards represent a paradigm shift away from command and control regulations which set levels for pollutants.⁽⁴⁷⁾ Instead, ISO 14000 focuses on management practices which help companies assess how successful and efficient they are at meeting their environmental responsibilities.⁽⁴⁸⁾ The standards are process oriented, not performance oriented. Companies will still need to comply with all local and national environmental laws and regulations.

Of the current ISO standards,⁽⁴⁹⁾ five have been finalized.⁽⁵⁰⁾ The first two address the EMS and the last three deal with environmental auditing. ISO 14001 provides EMS system specifications and establishes specific requirements which companies must meet in order to become ISO 14000 certified.⁽⁵¹⁾ ISO 14004 contains general EMS guidelines, providing advice and an outline of the elements of an EMS.⁽⁵²⁾ The auditing standards are: ISO 14010 which lays out the general principles of environmental audits; 14011 which deals with auditing of the EMS's; and, 14012 which sets the criteria for qualified environmental auditors. In addition to the standards for EMS's and auditing, ISO 14020-14025 deal with environmental labeling and ISO 14040-14043 deal with life cycle analysis. To actually implement ISO 14000 standards, it will take a commitment as well as guidance from senior management to develop a company's environmental policy.⁽⁵³⁾

Standard	Title/Description
14000	Guide to Environmental Management Principles, Systems and Supporting Techniques
14001	Environmental Management Systems -- Specifications with Guidance for Use
14004	Environmental Management Systems -- General Guidelines on Principles, Systems, and Supporting Techniques
14010	Guidelines for Environmental Auditing -- General Principles on Environmental Auditing
14011	Guidelines for Environmental Auditing -- Audit Procedures -- Auditing Environmental Management Systems
14012	Guidelines for Environmental Auditing -- Qualifications Criteria for Environmental Auditors
14015	Environmental Site Assessment
14020	Goals and Principles of All Environmental Labeling
14021	Environmental Labels and Declarations -- Self Declaration Environmental Claims -- Terms and Definitions
14022	Environmental Labels and Declarations -- Self Declaration Environmental Claims -- Symbols
14023	Environmental Labels and Declarations -- Self Declaration Environmental Claims -- Testing and Verification
14024	Environmental Labels and Declarations -- Environmental Labeling Type 1 -- Guiding Principles and Procedures
14025	Environmental Labels and Declarations -- Environmental Information Profiles -- Type III Guiding Principles and Procedures
14031	Evaluation of Environmental Performance
14040	Environmental Management -- Life Cycle Analysis -- Principles and Framework
14041	Environmental Management -- Life Cycle Analysis -- Life Cycle Inventory Analysis
14042	Environmental Management -- Life Cycle Analysis -- Impact Assessment
14043	Environmental Management -- Life Cycle Analysis -- Interpretation
14050	Terms and Definitions -- Guide on the Principles for ISO/TC 207/SC6 Terminology Work
14060	Guide for Inclusion of Environmental Aspects in Product Standards

Under the ISO 14000 standards, this policy statement must include a commitment to continuous environmental improvement, pollution prevention, and legislative and regulatory compliance.⁽⁵⁵⁾ Once the policy is established, it must be communicated within the company and be made available to the public.⁽⁵⁶⁾ With the environmental policy statement complete, the company will conduct an initial review or audit of existing environmental programs and develop an implementation plan for an EMS.⁽⁵⁷⁾ Following identification of the environmental impacts, the company, not the ISO 14000 standards, sets objectives and targets.⁽⁵⁸⁾ These objectives and targets are integrated into the EMS.⁽⁵⁹⁾

Effective monitoring of the EMS will entail periodic auditing.⁽⁶⁰⁾ These periodic EMS audits only address effectiveness, they do not specifically address compliance, site assessment or emissions.⁽⁶¹⁾ To accomplish these objectives, issue-specific audits will need to be performed externally by regulators, consultants, or internally within the company by environmental engineers.⁽⁶²⁾ The organization's EMS should continually evolve in relation to audit results, corrective actions, legislation or even complaints.⁽⁶³⁾ This holistic approach to environmental management taken by ISO 14000 will be helpful to companies in the long term. However, despite the industry-friendly appearance of the ISO 14000 standards, there will be challenges.

One of the major concerns with ISO 14000 standards is the cost of implementation. Implementation costs can more easily be internalized by larger companies, particularly in developed countries, yet difficulties may arise for smaller companies or developing countries. Costs may also be felt by smaller companies or countries in the form of "non-tariff trade barriers."⁽⁶⁴⁾ These trade barriers could be perpetuated if companies or countries cannot implement ISO 14000 efficiently or if the standards are applied in a discriminatory manner.⁽⁶⁵⁾

Depending on the definition of a small company, 75-90% of the world's industry is performed by small businesses.⁽⁶⁶⁾ One estimate places the cost of completing ISO 14000 certification at $10,000 to $50,000 for small to medium sized facilities.⁽⁶⁷⁾ Furthermore, the costs to the company in people hours could be five or ten times greater than these external costs.⁽⁶⁸⁾

This amounts to a substantial capital outlay, which smaller businesses may not have, in order to implement the ISO 14000 standards quickly and efficiently.⁽⁶⁹⁾ In addition, smaller companies would still undertake environmental audits to demonstrate compliance with the standards. Environmental compliance audits alone can be very costly, ranging from $300,000 to $3 million annually for some companies.⁽⁷⁰⁾ Under the current ISO 14001 system, it is expected that all companies will undergo a similar process when auditing and there will be "just as much preparation" in small and medium sized companies.⁽⁷¹⁾

Furthermore, if ISO 14000 does become the "global passport" for international business, countries who are unable to implement it or decide not to implement it will find themselves excluded from international markets through non-tariff barriers. This could prove to be particularly true when considering EU states. It is likely that the EU will make ISO 14000 adherence a requirement of doing business there in the future.⁽⁷²⁾ Currently under ISO 9000, participation is a prerequisite for certain industries if they are to enter markets in the EU.⁽⁷³⁾

Nevertheless, the drafters of the ISO standards kept these potential problems in mind when developing the standards. The standards are a gradual, baseline approach to managing environmental systems.⁽⁷⁴⁾ They do not need to be implemented all at once, but allow companies to implement less sophisticated processes at startup, rather than the most sophisticated.⁽⁷⁵⁾ The system can be tailored to the specific needs of the company.⁽⁷⁶⁾ Larger companies, for example, may want to target as many as 1,000 objectives in their EMS while a smaller company may only target as few as fifty.⁽⁷⁷⁾ In addition, a management review for large companies may last as long as a week while for small companies it may take as little as four hours.⁽⁷⁸⁾ This will help smaller companies keep their initial costs down.

Adherence to ISO 14000 will also make companies more efficient in terms of environmental compliance. This will save money in the long term and allow businesses to make up costs because it is likely that less will be spent after environmental problems have already occurred. If businesses are adhering to ISO 14000, they will experience fewer environmental incidents.⁽⁷⁹⁾ This will translate into lower costs in areas such as emergency responses, cleanups, and fines.⁽⁸⁰⁾ In developing countries, ISO 14000 compliance could equate to cost-savings as considered by regulators, "in lieu of imposing 'command and control' regulations."⁽⁸¹⁾

Furthermore, companies should be able to increase their market share by highlighting their "environmentally friendly" corporate policies. Companies can use ISO certification status in their marketing and advertising materials in order to demonstrate that they are environmentally conscious.⁽⁸²⁾ Because many consumers and investors are compelled to associate themselves with "green" companies, companies can bolster the bottom line by participating in environmental standardization. This could be done through the use of standards 14020-14025 which deal with environmental labeling or eco-labels, as they are sometimes called.⁽⁸³⁾

Even if ISO 14000 becomes the universal EMS standard, questions still remain as to whether this system will, in fact, improve corporate environmental performance. These questions remain for several reasons. First, the ISO standards deal with the environmental management process and do not set environmental performance standards. Second, companies must only adhere to the environmental laws and regulations of the country in which they are doing business. Finally, because developing countries will be participating and because many of these countries lack resources, there is a fear that their participation may jeopardize the integrity of the entire set of standards.

Some have voiced concern over the fact that the ISO 14000 standards do not require companies to meet minimum performance levels. As a recent ISO 14000 guide stated, "the 'process can equally enshrine mediocre or ambitious environmental performance objectives . . . and still satisfy certification requirements.'"⁽⁸⁴⁾ Although businesses must commit to complying with the laws surrounding the EMS as well as its continued improvement, certification does not depend upon a particular level of environmental performance.⁽⁸⁵⁾ Companies are free to accomplish whatever they want to accomplish through their EMS.⁽⁸⁶⁾ They do not need to operate at the best environmental performance level.⁽⁸⁷⁾

Even though ISO 14000 does require a commitment to comply with applicable laws and regulations, a great deal of disparity exists from country to country.⁽⁸⁸⁾ Because actual standards are not delineated within the ISO standards, some feel that this will result in an uneven playing field.⁽⁸⁹⁾ Developed countries, such as the U.S., have much higher environmental standards than lesser developed countries. This disparity may jeopardize the integrity of the ISO standards if certification in some countries is dependent upon the management system meeting lower performance goals than would be required in other countries.⁽⁹⁰⁾ This may create a situation in which companies choose a nation with weak environmental regulations, locate a damaging operation there, and still become certified under the ISO 14000 standards⁽⁹¹⁾

In addition, the lack of registration and accreditation resources in developing countries may make it difficult for these countries to meet requirements.⁽⁹²⁾ Certain companies and industries may find themselves at a competitive disadvantage because of the increased costs associated with seeking registration from foreign registrars.⁽⁹³⁾ It has been argued that the long term effects of participation of developing countries in the ISO 14000 standards process may be, "downward harmonization,"⁽⁹⁴⁾, similar to the "race of laxity"⁽⁹⁵⁾ in environmental protection. Downward harmonization suggests that the standards as a whole will have less credibility because they, "will be reduced to the 'lowest common denominator,' that is, the level of the lowest-standard country."⁽⁹⁶⁾

While it is important not to loose sight of the above-mentioned concerns, it is also important to look at the bigger picture. The ISO 14000 standards are more of a foundation or template for environmental performance than a strict gauge. They allow companies to put systems in place to address environmental concerns on many levels, not just "end-of-pipe". EMS's motivate companies, "to go beyond compliance" and manage pollutants in unison, rather than individually.⁽⁹⁷⁾ The actual performance levels and enforcement should be left to the individual countries because they are in a better position to determine what their particular needs are. Additionally, if performance specifications were included in the ISO 14000 standards and adopted by nations as national standards, it is likely that they would run contrary to the General Agreement on Tariffs and Trade (GATT) and World Trade Organization (WTO) rules.⁽⁹⁸⁾ Furthermore, with respect to developing countries, by keeping performance levels out of the standards, these countries will be encouraged to implement the ISO 14000 standards. Developing countries can use the standards as a benchmark for environmental performance toward which they develop their laws and regulations. They can incorporate the standards into their national environmental policy. Keeping performance levels out of the standards gives developing countries a goal to strive towards.

Companies seeking to utilize ISO 14000 will likely need to undergo an initial environmental review.⁽⁹⁹⁾ Then, once a company has put an EMS in place, it must conduct periodic audits as required by ISO 14004 to be certain that the EMS is meeting the goals and requirements of ISO 14001.⁽¹⁰⁰⁾ This EMS audit is a systems audit, which does not necessarily identify pollution problems or areas where pollution prevention can be improved.⁽¹⁰¹⁾ In order to identify whether pollution levels are being met, companies should include pollution prevention audits as well.⁽¹⁰²⁾ Finally, once a company has an EMS in place it may want to seek ISO certification. This can be done in one of two ways: self-declaration or a third party audit.⁽¹⁰³⁾

As ISO 14000 gains acceptance internationally, it is likely that the quantity of environmental audits will increase tremendously. With this increase in audits, comes the possibility of information overload. Much of this information is of a delicate nature, from the standpoint of future regulatory actions, private legal actions, and competition. The success of ISO 14000 will in part be dependent upon how companies are allowed to handle this audit information and what kinds of disclosure each nation requires.

The acceptance of disclosure will differ from country to country. Once again, this is in part due to the difference in the level of environmental regulation in any given nation. If the level of environmental regulation is somewhat low, then companies are likely to have less difficulty meeting those regulatory levels. In countries of lower environmental regulation, companies will be more likely to achieve the regulatory levels because such achievement will require less resources and cost the company less to meet the lower level of compliance. In addition, they have less to lose by releasing the results of their audits because it is unlikely that the country in which they are located will have the resources to bring a regulatory action or that the citizens will bring a private action. Furthermore, when EMS information is released to the public, comparing information from different companies will not give the public a true picture of an individual company's environmental success without more information.⁽¹⁰⁴⁾ For these reasons, acceptance of disclosure laws is likely to be different when comparing Europe and the U.S.

In the U.S., companies view the release of audit information with some skepticism. This may be due to the greater threat of environmental enforcement found in the U.S.⁽¹⁰⁵⁾ As Denis Boyle of Arco Chemical has put it, "'[d]oes this give regulators a shopping list to send you notice of violations? And how do you put this information in perspective for the public who may not have intimate knowledge of chemical manufacturing plants?'"⁽¹⁰⁶⁾ Companies may be apprehensive about acquiring ISO certification because the information found during the initial review or audit stage may be subject to discovery.⁽¹⁰⁷⁾ In addition, it is unclear whether third-party auditors could be compelled to disclose information gathered during an EMS audit.⁽¹⁰⁸⁾

Whether audit information will need to be disclosed will be due in part to how EPA policy in the U.S. proceeds with respect to audits.⁽¹⁰⁹⁾ Currently, the EPA plans, "to refrain from routine requests for audits."⁽¹¹⁰⁾ Although the EPA does not plan to use audit information to initiate an enforcement action, if it has independent evidence of violation, "it may seek information needed to establish the extent and nature of the problem and the degree of culpability."⁽¹¹¹⁾ In other cases, disclosure will depend upon the courts. Exemptions from disclosure may take place under, attorney-client privilege, immunity for attorney work product, the federal common law doctrine of self-evaluation privilege or a state statute on environmental audit privilege.⁽¹¹²⁾

In Europe, it is likely that the disclosure of audit information will be accepted with less apprehension on the part of companies. There are two reasons for this. First, the EU has had more experience with environmental disclosure, primarily because it has been implementing EMAS for the last five years.⁽¹¹³⁾ Companies doing business in Europe understand that a certain level of public disclosure is required. An EMAS registration requires companies to conduct an initial audit and to prepare an environmental statement.⁽¹¹⁴⁾ In addition, companies are required to conduct internal audits, and simplified environmental statements must be prepared annually.⁽¹¹⁵⁾ These environmental statements are then made available to the public.⁽¹¹⁶⁾ The environmental disclosure requirements for EMAS registration have served to indoctrinate companies doing business in Europe.

The second reason that disclosure is likely to enjoy a greater degree of acceptance in Europe is the lack of enforcement. While Europe has been moving towards a single market, environmental enforcement has not kept pace. When environmental information is released, it is questionable whether an enforcement action will ensue. One of the functions of the European Commission under the Treaty of Rome is to "ensure that the provisions of this Treaty and the measures taken by the institutions pursuant thereof are applied; . . ."⁽¹¹⁷⁾ This is largely done through the European Court of Justice. Nevertheless, the level of environmental enforcement in Europe does not match that of the U.S.⁽¹¹⁸⁾ In 1990, a regulation was adopted by the Council of Ministers, forming the European Environmental Agency (EEA).⁽¹¹⁹⁾ The purpose of the EEA is to supply information to its member states to enable them to take the necessary steps to protect their environment.⁽¹²⁰⁾ However, the actual enforcement is still left up to the individual member states and once again, the level of enforcement differs greatly among European countries.⁽¹²¹⁾

Private party actions are also less of a threat in European countries.⁽¹²²⁾ Because of differing provisions among EU Member States with respect to standing, the Commission's ability to enforce environmental laws is challenged.⁽¹²³⁾ In addition, because environmental issues do not always lend themselves to the conventional concepts of property rights, enforcement actions by private citizens are often difficult.⁽¹²⁴⁾ They simply lack the standing to bring suit.⁽¹²⁵⁾ It is not clear whether individuals who are indirectly involved have a right to bring complaints before the Commission.⁽¹²⁶⁾ This stifling of third-party suits serves to give companies operating in Europe a degree of comfort. They are less likely to be sued because of information disclosed in an audit or environmental assessment.

Although the ISO 14000 standards were intended to level the international business playing field, they may not achieve this goal without concerted efforts on behalf of nations. Companies still have liability concerns when it comes to disclosure of environmental audit information. Because of this, certain policy considerations will need to be made to enhance the success of ISO 14000 over the long term. Primarily, the U.S. will need to adopt a federal ISO audit privilege to shield from liability those companies who comply with the ISO 14000 standards. Along with this audit privilege, it will be necessary for regulators, both state and federal, to make certain concessions with respect to disclosure and enforcement in order to encourage the use of ISO 14000.

Disclosure of environmental audit information may be the single largest drawback that many companies foresee with ISO 14000 acceptance. This is particularly true with respect to companies in the U.S. To offset these fears, it will be necessary for regulators to meet industry halfway and provide certain guarantees that the audit information will not be used against them either in enforcement actions, or by third parties. The U.S. EPA has taken certain steps in this direction with its recent release of the "Incentives for Self-Policing: Discovery, Disclosure, Correction and Prevention of Violations,"⁽¹²⁷⁾ however, this policy does not go far enough. The fact that the EPA will reduce gravity-based penalties, and will not recommend criminal prosecution for violations discovered during an environmental audit really only amount to soft guarantees. It provides no bright line informing companies of when they are definitely safe and when sanctions are likely. Because of this, it will be necessary for Congress and states to take action to provide further safeguards for audit information.

Currently, eighteen states have adopted some form of environmental audit privilege and penalty immunity statutes.⁽¹²⁸⁾ These statutes vary widely,⁽¹²⁹⁾ but most of these state privilege statutes deal with compliance audits which may be intended to provide legal advice.⁽¹³⁰⁾ Although this information is protected under attorneys' activities in most of these statute, it is unclear whether EMS audits called for under ISO 14000 will meet this standard.⁽¹³¹⁾ The protections that states are providing should continue, but it should be expanded to specifically mention ISO 14000 standards and to include a privilege for EMS audits conducted in conjunction with the ISO 14000 standards. Because these state statutes only apply at the state level, Congressional legislation will also be necessary.

If the true spirit of standardization is consistency and uniformity, then Congress should adopt ISO self-audit privilege⁽¹³²⁾ legislation. This legislation should be designed to ensure that companies that comply with the ISO 14000 standards and meet specific criteria will not have environmental audit information used against them by either the EPA, the states, or private citizens. Much as the ISO 14000 standards represent a paradigm shift away from command-and-control, the EPA should adopt a policy stating that the environmental audit policy depends on voluntary compliance rather than enforcement.⁽¹³³⁾

The centerpiece of this ISO audit privilege legislation and the EPA audit policy would be a trading system whereby companies could receive certain concessions for disclosure of audit information. Companies that are willing to make certain types of information publically available would be given greater regulatory flexibility in terms of permitting and reporting.⁽¹³⁴⁾ Companies who only comply with the ISO 14000 standards, but do not disclose information, would not be granted this flexibility. Regulatory flexibility would include expediting permits, or only requiring general permits for certain operations, as well as reduced reporting or record keeping requirements.

There are currently examples in the U.S. and in Europe of regulatory relief and flexibility. In the U.S., both the EPA and some states are already providing regulatory flexibility to those willing to utilize the ISO 14000 standards for managing environmental concerns.⁽¹³⁵⁾ These regulatory concessions can help streamline, simplify, or eliminate certain regulatory requirements.⁽¹³⁶⁾ This sets up a sort of quid-pro-quo whereby companies have incentives to implement ISO 14000 because they can save money in other areas of regulatory compliance through reduced transaction costs.

Similar steps have been taken in Europe under the EMAS system. The Dutch government adopted a policy whereby they grant special environmental permits to corporations who establish an EMS consistent with EMAS.⁽¹³⁷⁾ The company must establish an environmental plan and produce a "reliable" annual report.⁽¹³⁸⁾ These special permits are considerably less detailed than ordinary permits.⁽¹³⁹⁾ It is anticipated that this program may be expanded to include EMS's produced in conjunction with ISO 14000.⁽¹⁴⁰⁾ This kind of regulatory relief and flexibility will provide an incentive and motivate companies to undertake the potentially high capital outlay needed to have ISO 14000 conformance formally certified.⁽¹⁴¹⁾

In addition to regulatory flexibility, companies would also receive leniency during enforcement actions under the ISO audit legislation. This program would allow companies to determine the level of public disclosure to which they wish to adhere. The incentive for companies comes from the fact that their disclosure of information will be directly proportional to the amount of enforcement that the company would be subject to, including the level of civil and criminal penalties in enforcement actions.

For a policy such as this to work, it will be necessary for the EPA to specifically outline the requirements for participation in the program. First, it will be necessary to draft a policy statement which references the ISO 14000 standards and states what types of information qualify as audit information under the EMS. Second, the EPA will need to establish a scale identifying the different types of information to be made public. This information might include certain environmental audit information, safety records, policies for handling environmental mishaps, etc. Third, tied directly to the level of information to be made public, the EPA will need to determine what kinds of regulatory concessions will be made in conjunction with the companies' release of information. These concessions may include regulatory flexibility for lower levels of information-sharing all the way up to a complete exemption from certain regulatory requirements. Finally, it will be necessary for the EPA to decide how enforcement actions against companies will be handled depending on the level of participation in the information disclosure program and how much of the information will be privileged. For this, the EPA might look to state programs dealing with environmental assessment privileges⁽¹⁴²⁾ or to some existing environmental statutes.⁽¹⁴³⁾

This program should allow for all interested parties to achieve their goals. The companies would have a bright line policy which would give them certainty in the area of ISO environmental audit disclosure as well as regulatory flexibility. The EPA would have a program which would be easier to administer because information will flow more freely. In addition, the EPA will not need to spend as much time and money inspecting and searching for hidden information; they will merely need to verify the information disclosed by the companies. Finally, the public and non-governmental organizations will be getting what they want: access to information which will allow them to assess how well companies are meeting their environmental responsibilities. This should be a win-win situation for all involved.

The ISO 14000 standards for EMS's hold a great deal of promise for companies world-wide which are likely to enjoy success.⁽¹⁴⁴⁾ They will assist companies in managing environmental concerns as well as meeting international environmental laws and regulations. However, the standards alone are not enough. Countries must reassess the way they look at environmental compliance. Command-and-control has worked fairly well, but it has fallen short in many areas. The ISO 14000 standards are a perfect solution to the problems of command-and-control. They will allow companies to look at the bigger picture when it comes to compliance and integrate environmental issues into all levels of management.

In the U.S., in order for the standards to work, companies need assurances that the audit information will not be used against them. Federal ISO 14000 audit privilege legislation will accomplish this goal. Legislation, along with a policy change at the U.S. E.PA. will provide companies liability guarantees they need to ensure successful ISO 14000 implementation. It is imperative that Congress and the EPA act quickly to prevent other countries from gaining a competitive advantage over U.S. companies. Adoption of the ISO 14000 audit privilege will insure that companies and U.S. regulatory agencies are able to utilize the ISO 14000 standards as the valuable management tool it is capable of being.

*James E. Plumhoff graduated of Virginia Tech in 1988. He has an undergraduate degree in agriculture and prior to coming to law school he served as Director of Government Affairs (lobbyist) for an agricultural and forestry industry trade group. Jim lobbied in the Va General Assembly for 6 years. He will be graduating from University of Richmond, T.C. Williams School of law in May of this year.

1. See Environmental Auditing Policy Statement, 51 Fed. Reg. 25,004 (1986) (The United States Environmental Protection Agency (EPA) defines an environmental audit as, "a systematic, documented, periodic and objective review by regulated entities of facilities operations and practices related to meeting environmental requirements."); see also Eric W. Orts & Paula C. Murry, Environmental Disclosure and Evidentiary Privilege, 1997 U. Ill. L. Rev. 1, 8 (1997) (Environmental audits are not a new concept, "[b]usinesses have used environmental audits since the late 1970's as a tool to identify, remediate, and minimize environmental risk.").

2. See Ann M. Thayer, Chemical Companies Take Wait-And-See Stance Toward ISO 14000 Standards, Chemical & Engineering News, April 1, 1996, at 14 (A survey conducted in late 1995 by the firm of Arthur D. Little Inc. showed that about half of 115 North American companies were already assessing environmental management systems against ISO 14000 draft documents. The survey also found that 84 leading European companies were participating in some type of "environmental management initiative", such as Eco-Management & Audit Scheme (EMAS) which entails periodic environmental audits.); see also Ridgway M. Hall, Keeping Track of the Environment, 5 Bus. L. Today 39, 42 (1996) (A 500 company survey conducted by the Manufacturer's Alliance For Productivity and Innovation in February 1995 showed that of the 150 companies who responded, 129 had formal environmental audit programs in place.).

3. The terms "company," "business," and "corporation" will be used interchangeably throughout this comment and refer to all legal business entities.

4. Robert Anthony Reiley, The New Paradigm: ISO 14000 and Its Place in Regulatory Reform, 22 J. Corp. L. 536 (1997)(discussing the Union Carbide disaster in Bophal and how corporations began using words like "environmental management," "proactive strategies," and "pollution prevention" following this disaster. ).

5. See Introduction to ISO (visited April 4, 1998) <http://www.iso.ch/infoe/intro.html> (ISO stands for the International Organization for Standardization and is a non-governmental organization whose Central Secretariat is based in Geneva, Switzerland. The mission of the ISO is to promote the development of standardization to assist in the international exchange of goods and services and to foster the exchange of "intellectual, scientific, technological, and economic activity."); see also EPA Standards Network Fact Sheet, ISO 14000: International Environmental Management Standards, EPA/625/F-97/004 (April 1998)(There are more than 120 ISO Participating countries with several other countries as Observer members. The ISO has promulgated more than 8,000 internationally accepted standards dealing with such things as film speed and paper sizes, as well as environmental auditing.).

6. See MGMT Alliances Inc: The Utility of Risk Assessment and Risk Management in the ISO 14001 Environmental System Framework (visited March 31, 1998) <http://www.mgmt14k.com/awma96.htm> (The ISO 14000 series is a voluntary set of international standards that provide guidelines for creating an environmental management system (EMS); see also EPA Standards Network Fact Sheet, ISO 14000: International Environmental Management Standards,EPA/625/F-97/004 (April 1998)(The standards provide guidelines for "EMS, eco-labeling, environmental auditing, life cycle assessment, environmental performance evaluation, and environmental aspects in product standards.").

7. Id (Under the ISO 14001 standard, an EMS requires that certain information be gathered and utilized in corporate policy and decision making. It should take into account "objectives and targets" for activities which effect the environment and should include monitoring on an ongoing basis to assess environmental performance.).

8. Christina C. Benson, Comment, The ISO 14000 International Standards: Moving Beyond Environmental Compliance, 22 N.C. J. Int'l L. & Com. Reg. 307, 319 (1996).

9. Elizabeth Pinckard, Comment, ISO 14000, 8 Colo. J. Int'l L. & Pol'y 423 (1997).

12. Global Network of Environment & Technology: Introduction to ISO 14000, Compliance Online (February 1996) <http://www.ieti.com/taylor/feb96/compliance.html#iso>.

14. See Pinchard, supra note 9 at 428 (EMAS is a site based environmental management system which recognizes EMS's. It is based in Europe and calls for periodic auditing.).

15. See Edith Brown Weiss, Strengthening National Compliance with International Environmental Agreements, Environmental Policy and Law, 27/4 (1997) (There are more than 900 international legal instruments which either mention the environment or focus on it.); see also Pinckard, supra note 9 at 423; see generally Edith Brown Weiss et al., International Environmental Law: Basic Instruments and References (1992).

16. See Intro to ISO, supra note 5 (discussing the need for standardization and the potential effects of multiple standards for similar technologies.).

17. See generally, Reiley, supra note 4 at 547 ( Although they deal with quality assurance, the ISO 9000 standards came about in large part from the EEC's move to develop a single internal market, and because of there were differing standards in the U.S., U.K., and Japan. The ISO 9000 standards provide quality guidance but are not industry specific. They help companies identify basic quality system elements which will assure quality.); see also Pinckard, supra note 9 at 426 (The ISO 9000 standards do not focus on the products themselves, but rather on the processes used in producing products and systems. The standards require companies to meet certain management guidelines in order for quality and conformity to be met when producing, inspecting, installing, and servicing of its goods. Periodic audits must then be conducted by independent third parties to insure that a company is meeting the goals of its quality management and assurance programs.); Reiley supra note 4 at 548 (To demonstrate compliance with these quality standards, the ISO has set up a registration system for companies.); Pinckard, supra note 9 at 427 (Although participation is voluntary many companies have found that they need to adopt these standards to remain competitive in the market place. In fact some industry sectors have found the ISO 9000 standards to be a condition for doing business.); See also, supra note 12 (These market forces have manifest themselves in the fact that, some multinational firms, non-governmental organizations, and governmental agencies are requiring suppliers to achieve ISO 9000 certification.); Reiley supra note 4 at 548 (The ISO 9000 standards have given stakeholders what they wanted, consistency in quality management.); Pinckard, supra note 9 at 427 (The ISO 9000 standards have been fairly well received by industry. As of the summer of 1997, some 127,000 companies had been awarded ISO 9000 certifications in ninety-nine countries.).

18. See generally Weiss supra note 15 (The proliferation of international environmental laws and regulations has been a big contributor to the need for international environmental management standardization.); see also Reiley supra note 4 at 548 (The author discusses public opinion and how it effects environmental decision making. Disasters such as the one in Bophal, India have raised the level of consciousness within international corporations.).

21. The terms European Economic Community (EEC) and European Union (EU) are used interchangeably throughout this comment.

22. See generally Pinckard, supra note 9 at 427 (In an effort to establish a singe market in the EU, the Single European Act (SEA) was adopted in 1986. The goal of the SEA was to achieve a single internal market and economic integration in the EU by 1992. Because of the limited power of the EU legislative system with respect to the enforcement of environmental protection among member states, implementing the SEA was challenging. For this reason, the EU went beyond the normal command and control approach to environmental enforcement and began looking at performance-based environmental regulations. This led to the adoption of EMAS.).

24. Stephen Barlas, ISO 14000: Friend or Foe?, Quality Progress, November 1996, at 23.

25. Europe's EMAS Program (visited March 31, 1998) <http://www.cris.com/~Isogroup/emas.asc>.

32. ISO World, The Number of ISO 14001/EMAS Registrations of the World (visited March 22,1999). <http://www.ecology.or.jp/isoworld/english/analy14k.htm>.

41. Roger Strelow & Norman A. Varney, Jr., A Radically Different Environmental Standard, 14 No. 3 ACCA Docket 12, 14 (July/August 1996).

43. See Naomi Roht-Arriaza, Developing Countries, Regional Organizations, and the ISO 14001 Environmental Management Standards, 9 Geo. Int'l Envtl. L. Rev. 583, 585 (1997) (Author states that many companies outside of Europe were concerned that EMAS might give Europe and unfair advantage and thus there was a push for international standards for environmental management.).

50. See Pinckard supra note 9 at 431 (discussing the ISO standards and explaining what each of the five finalized standards; 14001, 14004, 14010, 14011, and 14012 requires.).

53. See MGMT Alliances Inc: International Standards for Environmental Management Systems: ISO 14000 (visited March 31, 1998) <http://www.mgmt14k.com/ems.htm>.

54. See David Hunter et al., International Environmental Law and Policy 1398 (1998); see also EPA Standards Network Fact Sheet, ISO 14000: International Environmental Management Standards, EPA/625/F-97/004 (April 1998)(visited April 9, 1999)<http://www.epa.gov/cgi-bin/claritgw?op-Display&Document=clserv;epa-cin9:0485;&rank=4&template=epa>

57. 57.Id (It is during this initial review that the company will assess how its activities, products, and services impact the environment. It will take into account such issues as, "noise, emissions, environmental impact, waste reduction and energy use.").

58. Id (These objectives must take into account such considerations as, "legal and regulatory requirements, financial, operational and business requirements and the views of interested parties." Interested parties may include neighbors or interest groups.).

62. Id (EMS audits do not replace the issue specific audits, but rather supplement them. They are designed to look at the corporations overall environmental management.).

67. See Benson, supra note 8 at 360 (This cost is expected to range from $100,000 to $1 million per plant for large multinational companies.).

68. See Joe's Corner, Globnet (visited March 31, 1998) <http://www.iso14000.net/empire/?SubSystemID=1&ComponentID=16643> (Joseph Cascio, Chairman of the U.S. Technical Advisory Group developing the standards has an internet site and responds to questions.).

69. See Pinckard, supra note 9 at 446 (Companies may need from twelve to eighteen months for ISO 14001 implementation of environmental management systems. However, actual time will depend on the organization and its current systems.).

71. See supra note 69 (Information comes from an October 24, 1996 satellite conference on ISO 14000. Joseph Cascio, was a member of the satellite conference and responded to questions.).

72. See Pinckard, supra note 9 at 440 (This is likely because the EU will probably adopt the ISO 14000 standards in accord with the environmental management directive.).

73. See Pinckard, supra note 9 at 440 n.121 (explaining that ISO 9000 is a legal prerequisite for entry into the medical device industry.).

86. Burt Hamner, Pollution Prevention: The Cost-Effective Approach Towards ISO 14000 Compliance , INFOTERRA (March 1996) <http://www.ee/lists/infoterra/1996/03/0058.html> (discussing the fact that even though these decisions are left up to the company, because stakeholders are concerned about actual environmental performance, companies must take this into account.).

89. See Thayer, supra note 2 at 12 (This uneven playing field will result because of differing environmental regulations and laws in different countries.).

90. See supra note 69. (Question number 42 asks about the design of regulations from country to country and whether it will cause problems or prejudices?).

95. Zygmunt J. B. Plater et al., Environmental Law and Policy: Nature, Law and Society 727 (1992)(discussing how states may compromise environmental laws and regulations to attract business and industry.).

99. Id. at 347; see also Pinckard, supra note 9 at 434 ("Both during the planning stage and on an ongoing basis, the organization's activities, products, and services are evaluated to determine their interaction with, and impact on, the environment.").

103. See generally Thayer, supra note 2 at 12 (Article discusses the fact that chemical companies may not seek third party certification but instead will go the self-declaration route. This is in part due to the fear the public might not understand the information which may be disclosed and that regulators will use the information in enforcement actions.), see also Pinckard supra note 9 at 435.

104. See Hamner, supra note 87 (The author argues that for outsiders to determine if a company is being environmentally responsible, "the observer needs to know exactly what the company's EMS is trying to accomplish.").

105. See Sevine Ercmann, Enforcement of Environmental Law in United States and European Law: Realities and Expectations, 26 Envtl. L. 1213, 1236 (1996) (The author claims that despite the advantages of environmental audits in the U.S., companies there are at a disadvantage. "[E]nvironmental audits are subject to the threat of civil or criminal liability due to the shortcomings in the current privileges system caused by possible disclosure and adverse use of environmental audits.").

109. See Incentives for Self-Policing: Discovery, Disclosure, Correction and Prevention of Violations 60 Fed. Reg. 66,706 (Dec. 22, 1995).

110. Id at 66,708 (EPA reaffirms its longstanding policy of not initiating enforcement actions through the use of audit information.); see also Strelow & Varney, supra note 51 at 20 (discussing the EPA's continuing opposition to a statutory evidentiary privilege for audit information and the EPA's promise not to use audit information to begin and enforcement action.).

112. See Strelow & Varney, supra note 41 at 20 (discussing several possibilities for maintaining the confidentiality of EMS audit information. The attorney-client privilege and attorney work product are of limited usefulness because the courts usually require that the information have some connection to litigation, or be prepared in anticipation of litigation.).

114. Gaia Consulting: A Summary Comparison of Environmental Management Systems Standards and Regulations. (visited March 31, 1998) <http://indigo.ie/~gaia/standard/compare.html>.

118. See generally Springer, Beverly, The European Union and Its Citizens 105 (Greenwood Press 1994) (Author argues that environmental policy in the EC has taken a backseat to establishing a single market. "If the internal market continues to be the number-one priority of the EC . . . then the development of the environmental policy will be thwarted and its contribution to the growth of the European Union lessened."); see Richard Macrory, The Enforcement of Community Environmental Laws: Some Critical Issues, 29 Common. Mrkt. L. Rev. 355-356 (1992) (Author discusses Article 169 of the EEC which deal with enforcement procedures by the European Commission. The author then provides examples of non-implementation of European Commission environmental Directives by Member States. Examples deal with failure of drinking water supplies to meet Community standards, failure of a waste disposal licence to meet Groundwater Directives, failure to carry out mandatory Environmental Assessments and failure of authorities to provide the public with information required under Access to Environmental Information Directive.); see also Johnson, Stanley P. & Guy Corcelle, The Environmental Policy of the European Communities 338-341(Graham & Trotman, 1989) (Author asserts that "numerous weaknesses and gaps" exist in the implementation of environmental directives in Europe.).

119. See Macrory, supra note 119 at 335-336 (1992) (The EEA was established by Council Regulation (EEC) No. 1210/90.); see also About EEA (visited April 9, 1998) <http://www.eea.dk/about/default.htm> (The EEA is based in Copenhagen, Denmark and has a current membership of all 15 EU states as well as three other nations. The fifteen EU states which are members of the EEA are: Austria, Belgium, Denmark, Finland, France, Germany, Greece, Ireland, Italy, Luxembourg, The Netherlands, Portugal, Spain, Sweden, and the United Kingdom. The three additional nations are: Iceland, Liechtenstein, and Norway.).

121. See Johnson & Corcelle, supra note 119 at 338 (Under the Treaty of Rome the Commission issues directives and then must, "pay particular attention to the correct integration of the directives into national law." The directives bind the Member State, however, decisions regarding the "form and means to be used" are left to national authorities.).

122. See generally, Lopez Ostra v. Spain, 20 Eur. H.R. Rep 277, (Eur. Ct. H.R. ser. A, No. 303-C, 1995)(Although citizen suits in Europe are not as common as they are in the U.S. for example under the Clean Air Act or Clean Water Act, the Lopez Ostra case was unique in that it allowed a plaintiff to bring and environmental cause of action before the European Court of Human Rights. The case dealt with a waste-treatment plant for the leather industry which was operating without a licence and releasing fumes which caused health problems for local residents. The plaintiff alleged breaches of Articles 8 and 3 of the Convention and sought damages as well as costs and expenses under Article 50. The suit was in the nature of a nuisance and the court found in favor of the plaintiff for a breach of Article 8 and awarded damages of 4,000,000 Ptas and costs and expenses of 1,500,000 Ptas. It remains to be seen, however, whether the Lopez Ostra case establishes the benchmark for European environmental citizens actions or simply proves to be an anomaly.).

123. 123.See Sevine Ercmann, supra note 106 at 1222 ("The divergent provisions of certain EU Member States concerning the right of interested individuals and associations to bring actions before the national courts for noncompliance with EU environmental legislation affect the ability of the Commission to monitor the effective implementation of environmental legislation.").

125. Id. (Author discusses the fact that environmental groups who would lay claim to having an interest in environmental protection, "lack the necessary locus to commence legal proceedings . . . ").

126. Id. at 367 ("The Court of Justice has continued to confirm that the decision to commence Article 169 procedures is a matter of discretion for the Commission, and that a third party, whether the complainant or, one must presume, another party directly effected by this decision, has no locus before the Court in such cases to question the legality of its action.").

127. See supra note 110 (Under this policy, the EPA will not seek gravity-based penalties (those which are non-economic based) and will not recommend criminal prosecution against a company for violations found during a voluntary environmental audit. However, these violations must be promptly reported and quickly corrected. The EPA can bring action if an independent basis exists for a violation.).

129. See Orts & Murry, supra note 1 at 22 (State statutes vary widely: some offer complete immunity from administrative, civil, and criminal liability while some offer a qualified privilege and reduced fines. Most of these state privilege statutes are subject to in camera review by a judge.).

132. See generally Reichold Chems. Inc. v. Textron, Inc., 157 F.R.D. 522 (N.D. Fla. 1994) (a self-evaluation privilege for environmental audits is already recognized under federal common law.).

133. See Brooks M. Beard, The New Environmental Federalism: Can The EPA's Voluntary Audit Policy Survive?, 17 Va. Envtl. L.J. 1, 38 (1997) (Author discusses the fact that EPA needs to review the current policy and ether promulgate new regulations in which all parties are satisfied or Congress needs to enact legislation.); See also, supra note 110 at 66,710 (Legislation creating an ISO audit privilege would require the U.S. EPA to re-evaluate its current policy positions, because the EPA, "remains firmly opposed to a the establishment of a statutory evidentiary privilege for environmental audits. . ." The agency feels that audits promote secrecy and that if a privilege were granted for audit material, regulators would not be able to establish cases against individuals even in cases of criminal conduct.).

134. See Orts & Murry, supra note 1 at 4 (This program is similar to that proposed by Professors Orts and Murry, however I am suggesting linking the self-evaluative privilege directly to ISO 14000. They argue for a federal statute for self-evaluative privilege. Their program would be run by the EPA and would grant the privilege to businesses conducting audits if they are enrolled in an EPA program that assures the "annual public disclosure of accurate information about the firm's environmental performance.").

135. See Strelow & Varney, supra note 41 at 20 (The author discusses an example where the EPA and Pennsylvania worked together in order to get an AT&T facility in Allentown to implement ISO 14000. In exchange for independent certification, the plant was allowed to reduce certain water monitoring and reporting requirements.).

137. Id. at 18 (quoting Dutch to Simplify Permits for Companies with Environmental Management Systems, Business and the Environment, 6:16 (Nov. 1995).

138. Id. (quoting ISO 14001 and EMAS, Business and the Environment's ISO 14000 Update, 6:2 (Nov. 1995)).

139. Id. at 18 (quoting Dutch to Simplify Permits for Companies with Environmental Management Systems, Business and the Environment, 6:16 (Nov. 1995)).

142. See Va. Code Ann. � 10.1-1198 et seq. ( This section of the Virginia code deals with Voluntary Environmental Assessments and completely exempts persons involved in preparing documents from being compelled to disclose such information. Furthermore, anyone making such disclosures voluntarily is immune from administrative or civil penalties for any violations.).

144. See supra note 32 (As of February 3, 1999 ISO registrations stood at 8,436. Japan, Germany and the UK are by far the leaders with 1,632, 1,250, and 800 respectively, the U.S. lags considerably behind other developed nations at 330.).