How to Implement EPAP Requirements


How to Implement EPAP Requirements

The AER will create a file of all active operators from the data that is available from PETRINEX and AER Systems The PAT will assign a member to each operator and the assigned PAT member will contact each of their assigned operator to introduce themselves, to answer questions, and to offer assistance, to ensure the EPAP System has the contact information you required.

Prior to your first declaration
Prior to making your first declaration, you will probably want to do the following:

  1. Ensure you understand the new EPAP requirements.
  2. Communicate these requirements to your senior management.
  3. Start thinking about when you want your declaration period to be. (You have the first year to decide.)
  4. Act on your compliance assessment reports when you start receiving them.
  5. Determine which risks of noncompliance apply to which of your facilities.
  6. Develop your understanding of controls.
  7. Identify existing or design new controls to address the risk of noncompliance.
  8. Develop and test your evaluation of controls procedures.
  9. Make a test declaration (within the first year) so you can get some feedback without risk of enforcement for anything you might have overlooked.

Ensure you have documentation for your business processes, your control processes, and your evaluation of controls processes.

Annually after first declaration
Then, every year after that, you would do well to continue to do the following:

  1. Act on the monthly compliance assessment report.
  2. Prepare an annual evaluation of controls plan and review with your senior management.
  3. Review and confirm the applicability of risks of noncompliance to the facilities.
  4. Review your control designs.
  5. Evaluate your controls.
  6. Submit your declaration (a key component is using it as a reason for discussing your successes and your plans for improvements with the executives who matter).
  7. Review and update your documentation, as necessary.