John Keel, CPA State Auditor An Audit Report on Inspection and Enforcement Activities in the Field Operations Section of the Railroad Commission August 2007 Report No. 07-046 An Audit Report on Inspection and Enforcement Activities in the Field Operations Section of the Railroad Commission SAO Report No. 07-046 August 2007 Overall Conclusion The Railroad Commission (Commission) is a significant presence in the state's oil and gas industry. In the five fiscal years ended August 31, 2006, the Commission reports that it conducted 566,062 on-site inspections of the oil and gas facilities it regulates, which is an average of more than Background 113,000 inspections per year. The The Railroad Commission (Commission), Commission also reports that it conducted at which has three elected Commissioners, least one inspection on 90,724 (53.4 percent) regulates the state's oil and gas industry, gas utilities and pipeline safety. It also of the 169,770 oil and gas leases that were regulates safety in the liquefied petroleum active as of October 31, 2006. Leases can gas industry and the surface mining of coal and uranium. have as many as 100 or more wells each, The Field Operations Section within the which may necessitate multiple inspections Commission's Oil and Gas Division comprises by Commission employees on one lease. 12 districts that are governed by 9 district The Commission prioritizes the complaints and notices it receives from the industry and the public regarding possible incidents of pollution and public endangerment to ensure that the highest risk incidents receive the quickest response, and it follows up to determine whether most violations are remediated by operators. The Commission has several opportunities for enhancing its processes for selecting, conducting, and documenting inspections and pursuing violators to ensure that it makes the best use of its resources to minimize pollution associated with oil and gas activities. offices. These districts were responsible for regulating 367,646 oil and gas wells in fiscal year 2006. See Appendix 2 for a map of the districts. The Commission employed 87 inspectors who performed more than 118,000 inspections of oil and gas facilities in fiscal year 2006, and reported finding more than 90,000 violations. In fiscal year 2006, the Commission assessed $1.4 million in penalties and received $2.7 million in oil and gas violation revenue. In addition, collection efforts by the Office of the Attorney General on behalf of the Commission resulted in $833,000 being credited into the Oilfield Cleanup Fund. Source: Railroad Commission, Uniform Statewide Accounting System. The Commission's enforcement process ensures that most violations referred to it by districts inspectors are corrected, and the Commission consistently assesses penalties in accordance with state rules and laws. In addition, the Commission has developed a clearly defined schedule of penalties, which its Enforcement Section consistently follows. The Commission can strengthen its enforcement process by monitoring the amounts of uncollected penalties and ensuring all cases are properly documented. This audit was conducted in accordance with Texas Government Code, Section 321.0132. For more information regarding this report, please contact Lisa Collier, Audit Manager, or John Keel, State Auditor, at (512) 936-9500. An Audit Report on Inspection and Enforcement Activities in the Field Operations Section of the Railroad Commission SAO Report No. 07-046 Auditors also identified less significant issues that were communicated separately to Commission management. Key Points While the Commission's inspections of oil and gas facilities provide significant protection of the environment and public safety, the Commission should improve its oversight of the inspection process. Although the Commission has a process for prioritizing complaints and notices received, it lacks a formal approach for ensuring that all oil and gas facilities are inspected regularly. Implementing a formal approach for scheduling periodic inspections of oil and gas facilities that ensures all of the state's leases are inspected on a regular basis could help the Commission identify potential threats to the environment. The Commission's district offices are inconsistent in how they notify operators of violations. Requiring districts to provide formal, written notification of all violations to operators, and requiring operators to correct similar violations within similar timeframes, would give greater assurance that all operators are treated in an equitable way across the state. The Commission's enforcement process is designed and operates to protect the environment and ensure public safety. The Commission can strengthen its enforcement process by monitoring the amounts of uncollected penalties and ensuring all enforcement cases are properly documented. The Commission is able to properly account for penalties it collects on settled case, but it does not reconcile penalties collected on its behalf by the Office of the Attorney General against the outstanding penalties owed on each case. This increases the risk that the Commission will not know when an oil and gas operator still owes outstanding penalties to the State. Summary of Management's Response The Commission is in general agreement with the majority of the recommendations in this report; however, its responses indicate that it does not intend to implement our recommendation to ensure that district offices document complaints and notices on the date they are received. ii An Audit Report on Inspection and Enforcement Activities in the Field Operations Section of the Railroad Commission SAO Report No. 07-046 Summary of Information Technology Review Auditors performed application and control reviews of the Commission's D-Forms System (D-FORMS), a database used to capture inspection results and information regarding complaints and notices the Commission receives from the industry and the public. Auditors also reviewed the integrity of data within D-FORMS and found that it has several weaknesses that limit its use as an effective business and decision-making tool. The system contains inaccurate and incomplete data and lacks sufficient controls to safeguard inspection data from intentional or accidental changes. Summary of Objectives, Scope, and Methodology The objectives of this audit were to: ! Determine whether the Commission's Field Operations' inspection processes are designed and operate to minimize pollution associated with oil and gas activities. Determine whether the Commission's enforcement function is designed and operates to ensure that violations of state laws and rules identified by Field Operations are corrected and sanctions are administered in accordance with state law, rules, and Commission policy. ! The scope of this audit included activities related to the Commission's Oil and Gas Division and the Enforcement Section within the Commission's Office of General Counsel from September 1, 2005, to March 31, 2007. The audit methodology included collecting and reviewing information and documentation, analyzing data from the Commission's information systems, testing selected transactions, analyzing and evaluating the results of testing, and conducting interviews with the Commission's management and staff. iii Contents Detailed Results Chapter 1 While the Commission's Inspections of Oil and Gas Facilities Provide Significant Protection of the Environment and Public Safety, the Commission Should Improve Its Oversight of the Inspection Process.................. 1 Chapter 2 The Commission's Enforcement Process Is Designed and Operates to Protect the Environment and Ensure Public Safety................................................................... 11 Chapter 3 The Information System the Commission Uses to Record Inspections and Complaints Lacks Adequate Control, Review, and Oversight Processes to Provide Complete, Accurate, and Reliable Data ........................................ 15 Appendices Appendix 1 Objectives, Scope, and Methodology.............................. 19 Appendix 2 Oil and Gas Division District Boundaries .......................... 22 Appendix 3 Railroad Commission's Prioritization Policy...................... 23 Appendix 4 Recent State Auditor's Office Work ............................... 25 Detailed Results Chapter 1 While the Commission's Inspections of Oil and Gas Facilities Provide Significant Protection of the Environment and Public Safety, the Commission Should Improve Its Oversight of the Inspection Process The Railroad Commission (Commission) is a significant presence in the state's oil and gas industry. In the five fiscal years ended August 31, 2006, the Commission reports that it conducted 566,062 on-site inspections of the oil and gas facilities it regulates (see Figure 1), which is an average of Inspections more than 113,000 inspections per year. The Commission also reports Oil and gas leases in Texas have as few that it conducted at least one inspection on 90,724 (53.4 percent) of the as 1 well to as many as 100 or more 169,770 oil and gas leases that were active as of October 31, 2006. wells, which may necessitate multiple inspections by Commission employees on Inspections of leases may involve numerous oil and gas wells (see text one lease. In fiscal year 2006, the box). Commission reported that it conducted more than 118,000 inspections and found more than 90,000 violations of the State's rules regarding environmental protection and public safety. The Commission prioritizes the complaints and notices it receives from the industry and the public regarding possible incidents of pollution and public endangerment to ensure the highest risk incidents receive the quickest response, and it follows up to determine whether most violations are remediated by operators. However, the Commission has several opportunities for enhancing its processes for selecting, conducting, and documenting inspections and pursuing violators to ensure that the Commission makes the best use of its resources to minimize pollution associated with oil and gas activities. Figure 1 On-site Inspections Conducted by the Commission's District Offices 120,000 115,000 110,000 105,000 100,000 106,462 115,474 110,624 115,393 118,109 Fiscal year Fiscal year Fiscal year Fiscal year Fiscal year 2002 2003 2004 2005 2006 Source: Railroad Commission data in the Automated Budget and Evaluation System of Texas (ABEST). An Audit Report on Inspection and Enforcement Activities in the Field Operations Section of the Railroad Commission SAO Report No. 07-046 August 2007 Page 1 Chapter 1-A Although the Commission Has a Process for Prioritizing Complaints and Notices Received, It Lacks a Formal Approach for Ensuring All Oil and Gas Facilities Are Inspected Regularly Since 1998, the Commission has recorded 11,593 complaints received from the industry and the public regarding potential pollution or safety violations and 318,914 notices from the industry of planned activities that could impact public safety and protection of the environment, such as well casing and plugging operations. According to Commission policy, most of these complaints and notices require on-site inspections by district office employees to determine whether a violation has occurred or whether the oil and gas operator is adequately protecting the environment and public safety. In October 2001, the Commission adopted a policy that district personnel use to assess the seriousness of each complaint and notice received so that they respond to the most serious complaints and notices first. Examples of firstpriority incidents include emergencies that pose an immediate threat to the general public, such as explosions and major spills affecting environmentally sensitive areas. The Commission's policy states that first-priority incidents require immediate action with continuous surveillance until the incident is brought under control. District personnel also should respond to active pollution or safety-related complaints within 24 hours, while all other complaints should receive a response within 72 hours unless other arrangements are made with the complainant. (See Appendix 3 for details on the Commission's prioritization policy.) Three district offices that auditors reviewed had prioritized and conducted onsite inspections in compliance with the policy for 85 of 122 (70 percent) complaints and notices of spills or possible violations reviewed at those offices. The remaining 37 of 122 (30 percent) of the complaints and notices of spills or possible violations reviewed at three district offices either did not comply with the Commission's priority policy because initial inspections were performed either late or not at all, or auditors were unable to determine compliance due to missing records, or the Commission recorded and dated the complaint or notice after the inspection was performed. If a complaint or notice date is recorded inaccurately by district offices, it is not possible for the Commission to determine whether the response complied with the policy. The Commission does not ensure that all oil and gas facilities are inspected regularly. While the Commission has a policy for prioritizing on-site inspections that result from complaints and notices, in fiscal year 2006 these types of An Audit Report on Inspection and Enforcement Activities in the Field Operations Section of the Railroad Commission SAO Report No. 07-046 August 2007 Page 2 inspections accounted for about 25 percent of all inspections performed by district personnel. The remaining 75percent were routine, usually unannounced, inspections of facilities. District employees decide where to conduct these "field initiated" inspections based on factors such as where they are located after completing other higher-priority inspections, what word-ofmouth information they have heard about a facility, or their knowledge of where problems have occurred in the past. Although these are appropriate factors to consider when selecting where to conduct inspections, the Commission can enhance this process to ensure all leases have an equal opportunity for inspection. As of October 2006, the Commission reported that wells on 46.6 percent of the state's oil and gas leases had not been inspected in the past five years. This increases the risk that there may be significant environmental threats the Commission has not identified. Routine inspections, along with observations of well plugging and casing operations, serve as a strong deterrent for potential violators and are critical for identifying potential problems. In the five years ending on October 31, 2006, the Commission reports that it conducted on-site inspections of wells on 90,724 (53.4 percent) of the 169,770 oil and gas leases that were active at the end of that period. Implementing a formal approach for scheduling periodic inspections of oil and gas facilities that ensures all of the state's leases are inspected on a regular basis could help the Commission identify potential threats to the environment. Ensuring that all of the state's leases are inspected at least every five years also would encourage compliance by operators by making it certain that a Commission inspector may show up at anytime. Recommendations The Commission should: " Ensure that district offices consistently comply with the Commission's policy for assigning and conducting on-site inspections resulting from complaints and notices. The Commission also should ensure that districts document complaints and notices on the date they are received. Develop a formal approach for scheduling periodic inspections of oil and gas facilities that ensures all of the state's leases are inspected on a regular basis. Factors the Commission should consider when scheduling fieldinitiated inspections include the length of time since a lease was last inspected, the compliance history of the lease and the operator, whether the lease is in an environmentally sensitive area, the age of the facilities, and other risk factors that the Commission deems significant. " An Audit Report on Inspection and Enforcement Activities in the Field Operations Section of the Railroad Commission SAO Report No. 07-046 August 2007 Page 3 Management's Response Recommendation: The Commission should ensure that district offices consistently comply with the Commission's policy for assigning and conducting on-site inspections resulting from complaints and notices. The Commission also should ensure that districts document complaints and notices on the date they are received. Management's Response: The Commission concurs that District offices should consistently comply with the Commission's policy for assigning and conducting on-site inspections resulting from complaints and notices. The current Complaint policy (amended effective December 1, 2002) requires that the Commission respond to 100% of complaints, unless they are nonjurisdictional. This policy includes specific time requirements for contacting complainants and performing inspections, if necessary. The "Job Prioritization" policy (amended effective October 10, 2001) is a guideline used to determine which activities take priority over others for field inspection purposes. Many of the activities listed in the document require that industry provide notice to the Commission. These types of activities are referred to in the audit report as "notices." The policy does not require that an activity of higher priority always be performed over one with a lower priority. It is quite clear to management that inspecting 100% of notices such as operator pluggings, surface casing jobs, and mechanical integrity tests (MIT's) is not possible with current resources. The Commission's Field Operation Section recently performed an evaluation of statewide job performance for FY 2006. It was determined that over 91% of the time devoted to field inspections was spent on activities that are listed in the current "Job Prioritization" policy. Factors such as timing of an activity, location of inspectors relative to the activity, and overall industry activity in an area, all impact the Commission's ability to perform inspections. This may result in the appearance of inconsistency across District lines. To the extent resources become available in future legislative sessions, the Commission could witness more activities. Oil and Gas Division management will review performance in both areas described above, and reconfirm present policy requirements with all District management. Responsibility for Implementation: Charlie Ross, Deputy Director, Oil and Gas Division. Ensuring that the Commission document complaints and notices on the date they are received is not practical and the Commission does not concur with this recommendation. This is because many are received after hours and on weekends by the Commission's contracted answering service. These are An Audit Report on Inspection and Enforcement Activities in the Field Operations Section of the Railroad Commission SAO Report No. 07-046 August 2007 Page 4 entered into the system on the next working day. When the data is entered, the "date of notice" should match the date the complaint or notice was received. In addition, field inspectors while on the job receive some complaints. Generally, these will not be entered until the inspection report is processed in the District office. Recommendation: The Commission should develop a formal approach for scheduling periodic inspections of oil and gas facilities that ensure all of the state's leases are inspected on a regular basis. Factors the Commission should consider when scheduling field-initiated inspections include the length of time since a lease was last inspected, the compliance history of the lease and the operator, whether the lease is in an environmentally sensitive area, the age of the facilities, and other risk factors that the Commission deems significant. Management's Response: The Commission concurs with the recommendation and agrees that a methodology should be developed to help identify leases for inspection that pose a greater risk based on factors such as operator history of compliance, nature of activity, location, etc. Once this is done, a formal approach can be developed for periodic inspections. This will be evaluated and implemented FY 2008. Responsibility for Implementation: Charlie Ross, Deputy Director, Oil and Gas Division, and Bowden Hight, Director, ITS Division. Chapter 1-B The Commission's District Offices Are Inconsistent in How They Notify Operators of Violations The Commission has not provided district offices with standard, written criteria or guidance on how long to give operators of oil and gas facilities to correct violations, or on the appropriate way to communicate violations to operators. As a result, the length of time that districts give operators of oil and gas facilities to correct violations, and the way districts communicate those violations to the operators, varies considerably from district to district. There were significant differences in the way violations found during on-sight inspections were handled at three district offices that auditors visited. For instance, the Houston district handled violations of rules requiring the posting of certain signs on oil and gas facilities by providing the operator with formal, written notification of the problem and providing a timeframe for corrective action. The San Angelo district handles the same violations via informal, undocumented methods; as a result, there is no record that a timeframe for corrective action was communicated to the operator. The Commission's An Audit Report on Inspection and Enforcement Activities in the Field Operations Section of the Railroad Commission SAO Report No. 07-046 August 2007 Page 5 records retention schedule requires it to retain documents related to inspections for at least one year. The districts also were inconsistent in how quickly they notified operators of violations. For example, the Midland district took as long as 64 days to provide operators with formal, written notifications after violations were found. When the San Angelo district notified operators in writing of similar violations, it did so within seven days after finding the violation. Requiring districts to provide formal, written notification of all violations to operators, and requiring operators to correct similar violations within similar timeframes, would give greater assurance that all operators are treated in an equitable way across the state. Corrective action guidelines that specify the amount of time districts should give violators for coming into compliance could assist districts in ensuring consistency. Such guidelines could specify the number or severity of violations that trigger different timeframes for compliance. In any case, immediate action should always be taken if the violations or problems found threaten life or health. The Commission's district offices did not consistently perform timely follow-up inspections to determine whether operators had remediated violations. When the three districts visited provided formal, written notifications with timeframes for compliance to operators, inspectors performed follow-up inspections within one week of the compliance date in 60 percent of the follow-up inspections that auditors reviewed. The remaining follow-up inspections were often performed weeks after the compliance date communicated to the operators. In one instance, inspectors in the Houston district did not perform a follow-up inspection to determine whether an operator had remediated groundwater pollution until 279 days after the compliance date given to the operator. As a result, the Commission may not know if or when an operator has come into compliance. Recommendations The Commission should: " Establish corrective action guidelines that specify the amount of time districts should allow violators to come into compliance. The guidelines, which could assist districts in ensuring consistency, should specify the number or severity of violations that trigger different timeframes for compliance. Require districts to provide written notification of all violations to operators. Establish a policy defining when districts should complete follow-up inspections and ensure districts consistently apply this policy. The " " An Audit Report on Inspection and Enforcement Activities in the Field Operations Section of the Railroad Commission SAO Report No. 07-046 August 2007 Page 6 Commission may want to consider the severity of violations when developing the policy and, if exceptions are allowed, include a requirement for documenting the reasons for exceptions. Management's Response Recommendation: The Commission should establish corrective action guidelines that specify the amount of time districts should allow violators to come into compliance. The guidelines, which could assist districts in ensuring consistency, should specify the number or severity of violations that trigger different time frames for compliance. Management's Response: The Commission concurs with the recommendation. A general guidance document will be developed with the understanding that violations of different rules, and the magnitude of a specific rule violation, all warrant different time frames to meet compliance requirements. A guidance document will be completed by the end of the 2007 calendar year. Responsibility for Implementation: Charlie Ross, Deputy Director, Oil and Gas Division. Recommendation: The Commission should require districts to provide written notification of all violations to operators. Management's Response: The Commission concurs that operators should be notified of all violations. Currently the District offices use three forms of notice, which include verbal, "speed memos" (handwritten notices prepared in the field by an inspector, and provided to an operator) and written notices. All forms of notice are documented in the files. Requiring a written notice for all violations may not be practical, could reduce efficiency, may take staff away from more critical work functions, and it could increase the time before an operator is informed of the violation, thus increasing the length of time a violation exists. However, the Commission recognizes the importance of documenting violations. In response to the audit comment, the Commission will prepare well-defined and narrow guidelines for districts on verbal notifications. Verbal notifications will only be used for violations that do not involve pollution or safety issues. An Audit Report on Inspection and Enforcement Activities in the Field Operations Section of the Railroad Commission SAO Report No. 07-046 August 2007 Page 7 Recommendation: The Commission should establish a policy defining when districts should complete follow-up inspections and ensure districts consistently apply this policy. The Commission may want to consider the severity of violations when developing the policy and, if exceptions are allowed, include a requirement for documenting reasons for exceptions. Management's Response: The Commission concurs with the recommendation. All Notice of Violations (NOV's) have a scheduled follow-up date, usually stated as "the week of." The ability to meet this follow-up deadline will be impacted by staff resources, weather, and other job priorities. A guidance document will be completed by the end of the 2007 calendar year. The tracking mechanism will be evaluated in FY 2008. Responsibility for Implementation: Charlie Ross, Deputy Director, Oil and Gas Division. Chapter 1-C The Commission Lacks Adequate Policies and Procedures to Ensure Sufficient Oversight of Inspectors The Commission's inspectors typically work out of their homes with minimal supervision. They travel directly to inspection sites, often in remote locations. While this decreases the amount of time employees must use to travel to the locations they regulate, auditors identified three areas in which the Commission could improve its oversight of inspectors: " The Commission does not require employees to periodically disclose actual or perceived conflicts of interest that may impair their ability to objectively carry out their duties. Impairments that may create a conflict include accepting gifts offered by operators, holding outside employment, having immediate family members employed by the industry, and holding personal investments such as royalty or working interests in oil or gas properties. This lack of disclosure inhibits management's ability to monitor the objectivity of its employees. The Commission has an unwritten policy that encourages supervisors to occasionally accompany and observe district employees as they conduct inspections. However, according to employees in the districts visited, this policy is not practiced consistently. Supervisors generally rely only on the inspector's written reports, without any other method to ensure that the inspections were conducted and recorded accurately. This increases the risk that inconsistencies, errors, or omissions in inspection reports may go undetected. " An Audit Report on Inspection and Enforcement Activities in the Field Operations Section of the Railroad Commission SAO Report No. 07-046 August 2007 Page 8 " Under the Commission's current policy, employees are not allowed to accept any gift as long as the employee knows or should know that it was offered with the intent to influence the employee in the discharge of his or her official duties. Although the Commission's policy is in agreement with state law, it does not give employees clear guidance on the limitations imposed by state law. As a result, the Commission's employees may inadvertently violate the State's laws regarding gifts to public servants. For example, while the acceptance of small gifts is acceptable under state law, the law limits such gifts to a value of $50 or less. In the three districts visited, employees reported that they accept meals, caps, gift baskets, and other small gifts from oil and gas operators that they regulate. While this may not violate the Commission's policies, any acceptance of gifts by district employees from industry may create a public perception that the employee is not objective. Recommendations The Commission should: " Require employees to periodically disclose any actual or perceived conflicts of interest, such as accepting gifts offered by operators, holding outside employment, having immediate family members employed by the industry, and holding personal investments such as royalty or working interests in oil or gas properties. Establish policies and procedures for a quality control review of the performance of inspectors to ensure that inspections were conducted and recorded accurately. Update its policy regarding the acceptance of gifts to provide clear guidance on the limitations imposed by applicable state law, such as the $50 limitation stipulated by Texas Penal Code, Section 36.08. " " Management's Response Recommendation: The Commission should require employees to periodically disclose any actual or perceived conflicts of interest, such as accepting gifts offered by operators, holding outside employment, having immediate family members employed by the industry, and holding personal investments such as royalty or working interests in oil or gas properties. An Audit Report on Inspection and Enforcement Activities in the Field Operations Section of the Railroad Commission SAO Report No. 07-046 August 2007 Page 9 Management's Response: The Commission concurs with the recommendation. The Commission will email all employees annually to be mindful of our policy in the RRC Employee Handbook along with a link to a section regarding the acceptance of gifts. Responsibility for Implementation: Mark Bogan, Director, Personnel Division. Recommendation: The Commission should establish policies and procedures for a quality control review of the performance of inspectors to ensure that inspections were conducted and recorded accurately. Management's Response: The Commission concurs with the recommendation. Everything the Commission does in the field is subject to audit by complainants, operators, and RRC staff. Audit methods exist now, which includes review of all inspection reports (D-FORMS) by management and/or technical staff, review of individual performance utilizing D-System data, and review of performance data in Austin. In addition, the Lead Techs, Technical staff, and Management staff are encouraged to ride with inspectors periodically to evaluate specific job performance. Formal Quality Control guidelines will be developed and implemented by March 2008. Responsibility for Implementation: Charlie Ross, Deputy Director, Oil and Gas Division. Recommendation: The Commission should update its policy regarding the acceptance of gifts to provide clear guidance on the limitations imposed by applicable state law, such as the $50 limitation stipulated by Texas Penal Code, Section 36.08. Management's Response: The Commission concurs with the recommendation. We will add the phrase "of a value of $50 or more" to the Handbook section entitled Employee Conduct. In that section, there is a subsection entitled "Illegal Activity" and the second bullet with that subsection would now read: To accept a gift or other benefit of a value of $50 or more from anyone subject to regulation, inspection, or investigation by you or the Commission. Responsibility for Implementation: Mark Bogan, Director, Personnel Division. An Audit Report on Inspection and Enforcement Activities in the Field Operations Section of the Railroad Commission SAO Report No. 07-046 August 2007 Page 10 Chapter 2 The Commission's Enforcement Process Is Designed and Operates to Protect the Environment and Ensure Public Safety The Commission's enforcement process ensures that most violations referred to it by districts are corrected, and the Commission consistently The Enforcement Process assesses penalties in accordance with state rules and laws. In When inspectors in the Commission's district addition, the Commission has developed a clearly defined offices identify a violation, they contact the schedule of penalties, which its Enforcement Section responsible operator and demand remediation. If the district's attempts to have the operator consistently follows. The Commission can strengthen its come into compliance fail, the case is referred enforcement process by monitoring the amounts of uncollected to the Enforcement Section within the Commission's General Counsel's office. penalties and ensuring all cases are properly documented. The Enforcement Section, which is responsible for prosecuting individuals and companies charged with violating Commission rules and regulations, attempts to negotiate a settlement with the operator. If a settlement is reached, a consent agreement is prepared. If there is no response from the operator, a formal complaint is filed for an administrative hearing. The case is presented to hearing examiners and their recommendations are presented to the Railroad Commissioners for a decision in an open conference. Once the administrative hearing is final, any unpaid penalties are referred to the Office of the Attorney General for collection. Figure 2 Most violations found by district inspectors are resolved at the district level. Those violations that are not resolved are referred to the Commission's Enforcement Section for further action (see text box). According to the Commission, the Enforcement Section assessed penalties on 311 cases referred to it by district offices in fiscal year 2006. As of June 2007, the Commission reported that it had settled and received payments for 209 (67 percent) of those cases (see Figure 2). Also, the Commission reported that it assessed penalties totaling $1.4 million in fiscal year 2006 a Status of Cases on Which the Commission Assessed Penalties in Fiscal Year 2006 Referred to the Office of Attorney General 68 cases (22%) Protested 19 cases (6%) Motion for Rehearing Filed 8 cases (3%) Other Settled and Payment Received 209 Cases (67%) 34 cases (11%) Motion for Rehearing Denied 6 cases (2%) Motion for Rehearing Approved 1 case (Less than 1%) a Status reported by the Commission as of June 2007. An Audit Report on Inspection and Enforcement Activities in the Field Operations Section of the Railroad Commission SAO Report No. 07-046 August 2007 Page 11 The Commission does not track uncollected penalties for cases referred to the Office of the Attorney General for collection. While the Commission is able to properly account for penalties it collects on settled case, it does not reconcile penalties collected on its behalf by the Office of the Attorney General against the outstanding penalties owed on each case. The Commission stated that it would be a difficult and manual process to determine the amount of uncollected penalties or the length of time that penalties have been outstanding for each case or in total. This increases the risk that the Commission will not know when an oil and gas operator still owes outstanding penalties to the State. Although the Commission referred only 22 percent of its fiscal year 2006 cases to the Office of the Attorney General, these cases accounted for 43 percent of the amount of penalties assessed during that year. The Commission's Enforcement Section consistently followed its penalty guidelines. The Commission's Enforcement Section applied penalties in compliance with its penalty guidelines in all 33 cases auditors tested that had been settled or referred to the Office of the Attorney General. In addition, 29 (88 percent) of the 33 case files properly documented the violations and penalty assessments. Four of the files were missing documents such as original inspection reports from the district or findings and recommendations made by the Commission's staff attorney. In 13 of 17 (76 percent) cases in which operators had paid their penalties, the Enforcement Section had obtained documented evidence that violators had come into compliance. However, the Commission does not have written policies and procedures requiring the Enforcement Section to obtain documented evidence of compliance before settling a case. As a result, 4 of the 17 (24 percent) case files did not have sufficient documented evidence that the operator had come into compliance. This increases the risk that a noncompliant operator may be able to settle without first coming into compliance. Recommendations The Commission should: " Monitor the amounts of penalties and reimbursements that remain uncollected by the Office of the Attorney General and reconcile all penalties collected against the amounts due for each case at least monthly. Ensure that the Enforcement Section consistently documents all supporting evidence for enforcement actions, including documentation indicating that operators have come into compliance before closing cases. " An Audit Report on Inspection and Enforcement Activities in the Field Operations Section of the Railroad Commission SAO Report No. 07-046 August 2007 Page 12 Management's Response Recommendation: The Commission should monitor the amounts of penalties and reimbursements that remain uncollected by the Office of the Attorney General and reconcile all penalties collected against the amounts due for each case at least monthly. Management's Response: Management agrees that the Commission should monitor the amounts of penalties and reimbursements that remain uncollected by the Office of the Attorney General and reconcile all penalties collected against the amounts due for each case. The Commission currently reviews the amounts of penalties and reimbursements that remain uncollected by the Office of the Attorney General and the length of time that penalties have been outstanding. The Commission receives monthly reports from the Office of the Attorney General of the active outstanding uncollected penalties and reimbursement cases and how long the cases have been filed. The Office of the Attorney General also sends notice when it closes a referred case and its disposition, including information concerning payments received. As the Office of the Attorney General provides that information, it is recorded on an individual case basis against the amount owed. Guidelines will be implemented in FY2008 to reconcile all penalties collected against the amounts due for each case. Management does not believe its current practice places the Commission at greater risk of not knowing when an oil and gas operator still owes outstanding penalties. When a final judgment or final administrative order finding a violation is entered against an operator, the Commission "tags" that organization and it's officers and directors. This "tag," implemented under the authority of Texas Natural Resources Code, Section 91.114 prevents the Commission from approving a renewal of that entity's organization report, permit or certificate of compliance or any other entity with a common officer or director. Once the "tag" is placed against an operator, it is not released until compliance and payment is documented. Responsibility for Implementation: Lowell Williams, Director of Enforcement Section, Office of Attorney General. Recommendation: The Commission should ensure that the Enforcement Section consistently documents all supporting evidence for enforcement actions, including documentation indicating that operators have come into compliance before closing cases. An Audit Report on Inspection and Enforcement Activities in the Field Operations Section of the Railroad Commission SAO Report No. 07-046 August 2007 Page 13 Management's Response: Management agrees that the enforcement files should be consistently documented with all supporting evidence for enforcement actions, including documentation indicating that operators have come into compliance before closing cases. The Director of the Enforcement Section will review, revise, and reconfirm with all departmental personnel appropriate procedures requiring the enforcement files document the supporting evidence and compliance status before the case files are closed. Responsibility for Implementation: Lowell Williams, Director of Enforcement Section, Office of General Council. An Audit Report on Inspection and Enforcement Activities in the Field Operations Section of the Railroad Commission SAO Report No. 07-046 August 2007 Page 14 Chapter 3 The Information System the Commission Uses to Record Inspections and Complaints Lacks Adequate Control, Review, and Oversight Processes to Provide Complete, Accurate, and Reliable Data The Commission's D-Forms System (D-FORMS), a database used to capture inspection results and information regarding complaints and notices it receives from the industry and the public, has several weaknesses that limit its use as an effective business and decision-making tool. The system contains inaccurate and incomplete data and lacks sufficient controls to safeguard inspection data from intentional or accidental changes. The Commission uses information from D-FORMS to monitor the performance of its districts and to calculate performance measure results that are reported to the Legislative Budget Board. It also uses D-FORMS as a timekeeping system to record the time and mileage of district personnel, including inspectors. Information written in hardcopy inspection reports did not match the inspection information recorded in D-FORMS, or the hardcopy reports were missing altogether, for 107 of 182 (59 percent) of inspection reports tested in three districts visited. Examples of information that was missing or did not match included records of supervisor reviews, dates of notices, and the types of inspection activities performed by inspectors. Auditors identified the following weaknesses over controls for input, processing, output, and security: " Users of D-FORMS can overwrite complaint and inspection data when an existing record is modified, and the original data is not saved and cannot be recovered. As a result, D-FORMS cannot be relied upon to maintain an accurate history of complaints, inspections, and violations. Users also can modify data that D-FORMS retrieves from the mainframe, which could result in discrepancies between the data in the mainframe and in DFORMS. Although D-FORMS contains an audit trail, it is limited because DFORMS does not record what change was made. Therefore, the audit trail would be of little use to management if there were a problem that needed to be investigated. D-FORMS does not fully enforce security roles and allows users to inappropriately add, change, or delete data and/or user accounts. For example, nothing prevents users from exceeding their authority to change the results of an inspection or mark violations as resolved. There is a lack of edit checks in D-FORMS to prevent improper dates, inaccurate mileage information and time charged for an inspection, and incorrect operator information from being entered. Inaccurate records " " " An Audit Report on Inspection and Enforcement Activities in the Field Operations Section of the Railroad Commission SAO Report No. 07-046 August 2007 Page 15 could hinder districts' ability to conduct inspections. For instance, this could prevent the Commission from conducting timely follow-up inspections or maintaining the accurate compliance history of an operator. " D-FORMS does not require users to change their passwords on a regular basis. Recommendations The Commission should: " Strengthen D-FORM's input controls to prevent duplicate entries, improper dates, and other data entry errors. In addition, the Commission should develop improvements to D-FORMS that enable the system to enforce security roles and prohibit users from inappropriately adding, changing, or deleting data or authorized user accounts. Strengthen the audit trail in D-FORMS so that it maintains a record of exactly what changes were made to data in the database. Implement a policy requiring users of D-FORMS to change their passwords on a regular basis, such as every 60 or 90 days. Develop a policy regarding what information from the hardcopy inspection reports it wants districts to capture in D-FORMS. In addition, the Commission should develop a data entry and review process for districts to use to ensure districts consistently enter required data and that the data entered is correct and complete. Provide training to district employees to ensure the data entry and review processes are applied consistently. " " " " Management's Response Recommendation: The Commission should strengthen D-FORM's input controls to prevent duplicate entries, improper dates, and other data entry errors. In addition, the Commission should develop improvements to D-FORMS that enable the system to enforce security roles and prohibit users from inappropriately adding, changing, or deleting data or authorized user accounts. Management's Response: The Commission concurs with the recommendation. The Commission will review the D-FORM's application and will implement enhanced edit checks, such as limiting the date ranges that can be entered into the system. A review An Audit Report on Inspection and Enforcement Activities in the Field Operations Section of the Railroad Commission SAO Report No. 07-046 August 2007 Page 16 of what edit checks or processes can be implemented to prevent duplication of entries will be performed, and the appropriate controls will be implemented. In addition, a review of current security will be performed to evaluate changes required to enable additional roles within the current security system. The system review should be completed by December 31, 2007, and the system changed by August 31, 2008. Responsibility for Implementation: Charlie Ross, Deputy Director, Oil and Gas Division and Bowden Hight, Director, ITS Division. Recommendation: The Commission should strengthen the audit trail in D-FORMS so that it maintains a record of exactly what changes were made to data in the database. Management's Response: The Commission concurs with the recommendation. The Commission will review D-FORMS data and will identify critical inspection data. An audit trail of changes made to critical data will be implemented. The system review should be completed by December 31, 2007, and the system changed by August 31, 2008. Responsibility for Implementation: Charlie Ross, Deputy Director, Oil and Gas Division, and Bowden Hight, Director, ITS Division. Recommendation: The Commission should implement a policy requiring users of D-FORMS to change their passwords on a regular basis, such as every 60 or 90 days. Management's Response: The Commission concurs with the recommendation. The Commission will review the application access controls and related risks and will determine the appropriate access control policies that should be implemented for an internal application that is only accessible from within the Commission's internal network. The password change policy will be implemented based on the review of the risks and impact. The system review should be completed by December 31, 2007 and the system changed by August 31, 2008. Responsibility for Implementation: Charlie Ross, Deputy Director, Oil and Gas Division, and Bowden Hight, Director, ITS Division. Recommendation: The Commission should develop a policy regarding what information from the hard copy inspection reports it wants districts to capture in D-FORMS. In addition, the Commission should develop a data entry and review process for districts to use to ensure districts consistently enter required data, and the data entered is correct and complete. An Audit Report on Inspection and Enforcement Activities in the Field Operations Section of the Railroad Commission SAO Report No. 07-046 August 2007 Page 17 Management's Response: The Commission concurs with the recommendation. Much of this policy exists currently in the form of the ORACLE Manual, which was provided to all Districts when the system was implemented in 1998. There have been very few changes to the system since. The manual is in the process of being updated, and will be placed on the RRC Intranet so that all staff will have access to the most current policy. The updated manual will be completed by the end of 2007. The data entry and review process will be evaluated during FY 2008 with assistance from IT. Responsibility for Implementation: Charlie Ross, Deputy Director, Oil and Gas Division, and Bowden Hight, Director, ITS Division. Recommendation: The Commission should provide training to district employees to ensure the data entry and review processes are applied consistently. Management's Response: The Commission concurs with the recommendation. This will be done in conjunction with providing the updated manual described above, which will be completed by the end of 2007. Responsibility for Implementation: Charlie Ross, Deputy Director, Oil and Gas Division, and Bowden Hight, Director, ITS Division. An Audit Report on Inspection and Enforcement Activities in the Field Operations Section of the Railroad Commission SAO Report No. 07-046 August 2007 Page 18 Appendices Appendix 1 Objectives, Scope, and Methodology Objectives The objectives of this audit were to: " Determine whether the Railroad Commission's (Commission) Field Operations' inspection processes are designed and operate to minimize pollution associated with oil and gas activities. Determine whether the Commission's enforcement function is designed and operates to ensure that violations of state laws and rules identified by Field Operations are corrected and sanctions are administered in accordance with state law, rules, and Commission policy. " Scope The scope of this audit included activities related to the Commission's Oil and Gas Division and the Enforcement Section within the Commission's Office of General Counsel from September 1, 2005, to March 31, 2007, including inspections, complaints, job notices, violation letters, monthly use reports for vehicle mileage, enforcement dockets, closing reports, and data from P-5 Organization Reports and P-4 Certificates of Compliance and Transportation Authority. This audit also covered a review of related automated information systems including the D-Forms System (D-FORMS). Methodology The audit methodology included collecting and reviewing information and documentation, analyzing data from Commission's information systems, testing selected transactions, analyzing and evaluating the results of testing, and conducting interviews with the Commission's management and staff. Information collected and reviewed included the following: " " " Texas State Review, State Review of Oil and Natural Gas Environmental Regulations, Inc., August 2003. Oil, Gas, and Alternative Fuel Issues, Senate Committee on Natural Resources Interim Report to the 80th Legislature, December 2006. Staff Report on the Railroad Commission of Texas, Sunset Advisory Commission, November 2000. An Audit Report on Inspection and Enforcement Activities in the Field Operations Section of the Railroad Commission SAO Report No. 07-046 August 2007 Page 19 " A Performance Audit of the Oil Field Cleanup Program and Related Enforcement Efforts, State Auditor's Office, Report No. 3-113, April 1993. A review of recent literature on oil and gas activities, including news clippings and online articles. Performance measure data from the Automated Budget and Evaluation System of Texas. Commission policies and procedures. Commission documents including the Field Operations Handbook, organizational charts, inspection and complaint files, vehicle mileage reports, and enforcement docket files. Interviews with Commission management and staff. Telephone survey of Commission employees. Data from the Commission's automated information systems, including the D-FORMS database system, the Docket system, and the Commission's mainframe. " " " " " " " Procedures and tests conducted included the following: " " Analysis of Commission enforcement orders. Analysis of data from the Commission's automated information systems, including the D-FORMS database system, the Docket system, and the Commission's mainframe. Walkthroughs of various procedures and development of detailed flowcharts for the Commission's inspection and enforcement functions. Testing of selected inspection and complaint reports for consistency and compliance with state rules and Commission policies and procedures. Testing of enforcement files for consistency and compliance with state rules and Commission policies and procedures. Walkthroughs of inspections performed by Commission employees. Interviews with the Commission's Chairman, executive management, district management, and staff members. Analysis of data from the Uniform Statewide Accounting System. Reviews of policies, procedures, and documentation related to inspection, complaint, and enforcement files. " " " " " " " An Audit Report on Inspection and Enforcement Activities in the Field Operations Section of the Railroad Commission SAO Report No. 07-046 August 2007 Page 20 " " Reviews and analysis of district employee responses to State Auditor's Office telephone survey. Reviews of the Commission's organizational charts Criteria used included the following: " " " " " Texas statutes and the Texas Administrative Code. General Appropriations Acts and riders from 2000 through 2006. The Commission's policies and procedures. Carrying Out a State Regulatory Program, National State Auditors Association best practices document, 2004. Sunset Occupational Licensing Model, Sunset Advisory Commission, April 10, 2007. Project Information Audit fieldwork was conducted from May 2007 through July 2007. This audit was conducted in accordance with generally accepted government auditing standards. The following members of the State Auditor's staff performed the audit: " " " " " " " " " " " Walton Persons, CPA (Project Manager) Mary Ann Wise, CPA (Assistant Project Manager) John Boyd Kelli Davis Ashlee C. Jones, MAcy Anthony W. Rose, MPA, CPA, CGFM Michael A. Simon, MBA, CGAP Gary Leach, CQA, CISA (Information Systems Audit Team) Ralph O. McClendon, CISA, CISSP (Information Systems Audit Team) J. Scott Killingsworth, CIA, CGFM (Quality Control Reviewer) Lisa R. Collier, CPA (Audit Manager) An Audit Report on Inspection and Enforcement Activities in the Field Operations Section of the Railroad Commission SAO Report No. 07-046 August 2007 Page 21 Appendix 2 Oil and Gas Division District Boundaries Figure 3 depicts the boundaries of the Railroad Commission's twelve districts. These districts are governed by nine district offices. Figure 3 Railroad Commission's Oil and Gas Division Districts Source: Railroad Commission. An Audit Report on Inspection and Enforcement Activities in the Field Operations Section of the Railroad Commission SAO Report No. 07-046 August 2007 Page 22 Appendix 3 The Railroad Commission's Prioritization Policy The following information summarizes the Railroad Commission's (Commission) policy for prioritizing district offices' responses to complaints and notices of incidents that may pose a risk to the public and the environment. The policy became effective on October 10, 2001. Under the policy, active pollution and safety-related complaints should generally be inspected within 24 hours. Other complaints should be inspected within 24 to 72 hours, unless other arrangements are made with the complainant. First Priority (These require immediate action by district personnel.) " " " " Emergency incidents. Blowouts1 Major spills. Accidents/injuries/deaths. Generally these activities require immediate reaction with continuous surveillance until brought under control. Second Priority (These can be overridden by first-priority activities.) " " " " Active pollution/safety-related complaints. Well plugging. Surface casing. Reportable spills. Third Priority " " " " " " State Wide Rule 36 inspections (hydrogen sulfide). General complaints. Mechanical-integrity testing. Commercial disposal operations. Lease inspections (sensitive areas and problem areas). Hydrocarbon storage operations. 1 A blowout is a sudden rush of oil or gas from an oil well to the surface. An Audit Report on Inspection and Enforcement Activities in the Field Operations Section of the Railroad Commission SAO Report No. 07-046 August 2007 Page 23 " " H-15s (tests on an inactive well that is more than 25 years old). Pit permitting/landfarming/minor permits. Fourth Priority " " " General lease inspections (non-sensitive areas). General Underground Injection Control inspections. Plant inspections. Fifth Priority " " " " Enforcement action. Oil theft. Production testing. Audits. An Audit Report on Inspection and Enforcement Activities in the Field Operations Section of the Railroad Commission SAO Report No. 07-046 August 2007 Page 24 Appendix 4 Recent State Auditor's Office Work Recent SAO Work Number 05-036 05-030 03-362 02-067 Product Name An Audit Report on the Railroad Commission's Oil and Gas Migration Project An Audit Report on Performance Measures at Five State Agencies A Legislative Summary Document Regarding Railroad Commission A Review of Implementation of Sunset Advisory Commission Management Actions at 13 State Agencies Release Date June 2005 March 2005 February 2003 August 2002 An Audit Report on Inspection and Enforcement Activities in the Field Operations Section of the Railroad Commission SAO Report No. 07-046 August 2007 Page 25 Copies of this report have been distributed to the following: Legislative Audit Committee The Honorable David Dewhurst, Lieutenant Governor, Joint Chair The Honorable Tom Craddick, Speaker of the House, Joint Chair The Honorable Steve Ogden, Senate Finance Committee The Honorable Thomas "Tommy" Williams, Member, Texas Senate The Honorable Warren Chisum, House Appropriations Committee The Honorable Jim Keffer, House Ways and Means Committee Office of the Governor The Honorable Rick Perry, Governor Railroad Commission The Honorable Michael L. Williams, Chairman The Honorable Victor G. Carrillo, Commissioner The Honorable Elizabeth A. Jones, Commissioner Mr. Richard A. Varela, Executive Director This document is not copyrighted. Readers may make additional copies of this report as needed. In addition, most State Auditor's Office reports may be downloaded from our Web site: www.sao.state.tx.us. In compliance with the Americans with Disabilities Act, this document may also be requested in alternative formats. To do so, contact our report request line at (512) 936-9880 (Voice), (512) 936-9400 (FAX), 1-800-RELAY-TX (TDD), or visit the Robert E. Johnson Building, 1501 North Congress Avenue, Suite 4.224, Austin, Texas 78701. The State Auditor's Office is an equal opportunity employer and does not discriminate on the basis of race, color, religion, sex, national origin, age, or disability in employment or in the provision of services, programs, or activities. To report waste, fraud, or abuse in state government call the SAO Hotline: 1-800-TX-AUDIT.