40 CFR 68: EPA Risk Management Program

Regulatory citation: Clean Air Act Section 112(r)(7); 40 CFR Part 68, Risk Management Program

What Is EPA's Risk Management Program?

The Risk Management Program (RMP) rule, issued under Clean Air Act Section 112(r)(7) and codified in 40 CFR Part 68, requires facilities that hold more than a threshold quantity of certain toxic or flammable substances in a process to develop a risk management program and submit a Risk Management Plan to EPA.

Why RMP Matters

Accidental releases of toxic and flammable chemicals can harm nearby communities as well as workers. RMP focuses on preventing these releases and on preparing emergency responders and the public if one occurs.

Core Requirements

1. Determine Coverage

A facility is covered if it has more than a threshold quantity of a regulated substance in a process. Regulated substances and thresholds are listed in the rule.

2. Assign Program Levels

Each covered process falls into Program 1, 2 or 3 based on accident history, potential offsite impacts and whether the process is also subject to OSHA's PSM standard. Program 3 has the most extensive requirements.

3. Conduct a Hazard Assessment

Facilities must analyze worst-case and alternative release scenarios and document a five-year accident history.

4. Implement a Prevention Program

Program 2 and 3 processes require prevention programs. Program 3 closely mirrors OSHA's Process Safety Management elements.

5. Plan Emergency Response

Facilities must coordinate with local emergency responders and, depending on their role, maintain an emergency response program.

6. Submit and Update the RMP

The Risk Management Plan must be submitted to EPA and updated at least once every five years, or sooner after certain changes.

Common Compliance Approaches

Coordinate With PSM

Where a process is covered by both RMP and PSM, align your programs to avoid duplication.

Engage Local Responders

Share information and run exercises with local fire departments and emergency planners.

Track Rule Changes

EPA has amended the RMP rule several times in recent years, so confirm you're working to the current version.

Example: RMP in Practice

A municipal water treatment plant stores chlorine above the threshold quantity. It determines the chlorine process is Program 3, completes worst-case and alternative release scenarios, implements a prevention program, holds a joint exercise with the local fire department, and submits its Risk Management Plan to EPA, with an update scheduled within five years.

Related regulations: OSHA Process Safety Management, EPA General Duty Clause, EPA Tier II Reporting.

Note: This summary reflects federal EPA requirements. Many states run authorized programs with additional or stricter rules. Always check the current regulation text and your state environmental agency's requirements.

Frequently Asked Questions

What facilities need a Risk Management Plan?

Facilities with more than a threshold quantity of a regulated toxic or flammable substance in a process must comply with the RMP rule and submit a Risk Management Plan. Common examples include chemical manufacturers, refineries, water treatment plants and ammonia refrigeration facilities.

How often must an RMP be updated?

A Risk Management Plan must be updated and resubmitted at least once every five years, and sooner after certain changes such as adding a new regulated substance or process.

What's the difference between RMP and PSM?

OSHA's Process Safety Management standard focuses on worker protection, while EPA's RMP focuses on protecting the public and environment. Many facilities are covered by both, and RMP Program 3 prevention requirements closely match PSM.