EPA Risk Management Program (RMP)

The EPA Risk Management Program (RMP) is the Clean Air Act rule that requires facilities holding large amounts of certain toxic or flammable chemicals to prevent accidental releases and plan their emergency response. Covered facilities must analyze worst-case release scenarios, run a prevention program, coordinate with local responders and submit a Risk Management Plan to EPA. The rule protects nearby communities, emergency responders and the environment from chemical accidents.

The program covers a wide range of operations, including chemical manufacturers, refineries, ammonia refrigeration plants in food and cold storage, water and wastewater treatment plants using chlorine, fertilizer distributors and propane distributors. EPA estimates roughly 11,500 facilities are currently covered.

What Is the Risk Management Program?

The RMP rule implements Section 112(r) of the 1990 Clean Air Act Amendments and is codified at 40 CFR Part 68. It works alongside OSHA's Process Safety Management standard, which protects workers inside the fence line, while RMP focuses on releases that could affect the public and the environment outside it.

Key terms include:

• Regulated substance: a chemical on EPA's list in 68.130. EPA's guidance describes 140 listed substances, 77 toxic and 63 flammable, each with its own threshold quantity.
• Process: any activity involving a regulated substance, including storage, handling and use. Interconnected vessels, or separate vessels close enough that one release could involve them, count as a single process.
• Stationary source: the buildings and equipment on one or more contiguous properties under the same control.

Who Must Comply?

Under 68.10, the owner or operator of a stationary source with more than a threshold quantity of a regulated substance in a process must comply. Compliance is due by the date the substance first exceeds the threshold in a process, so a new or expanded process must be ready before the chemical arrives.

Each covered process is assigned to one of three program levels:

• Program 1: processes with no accidental release with offsite consequences in the past five years, no public receptors within the worst-case endpoint distance, and emergency response coordinated with local responders. Requirements are limited.
• Program 3: processes subject to OSHA PSM, or in listed NAICS codes such as petroleum refineries, pulp mills and several chemical manufacturing sectors, that do not qualify for Program 1. This is the full prevention program.
• Program 2: all other covered processes, with a streamlined prevention program.

Most states rely on EPA to run the program, but some states and local agencies have delegated authority or their own accidental release programs, so check who implements RMP where you operate.

Key Requirements

Hazard assessment

Every covered facility must analyze a worst-case release scenario, and Program 2 and 3 facilities must also analyze alternative, more likely scenarios. The analysis estimates how far a release could travel before reaching a toxic or flammable endpoint and what population and environmental receptors lie within that distance. Facilities must also compile a five-year accident history.

Prevention program

Program 3 processes need a full prevention program similar to OSHA PSM, including process safety information, a process hazard analysis, written operating procedures, training, mechanical integrity, management of change, pre-startup safety reviews, compliance audits, incident investigation, employee participation, hot work permits and contractor safety. Program 2 uses a streamlined version built around a hazard review.

Emergency response

Facilities must coordinate with local emergency planning and response organizations at least annually. Facilities whose own employees respond to releases must have an emergency response program and plan. Under 68.96, all Program 2 and 3 facilities must run notification exercises every calendar year. Responding facilities must also hold a tabletop exercise by December 21, 2026 and at least every three years after, and a field exercise by March 15, 2027 and generally at least every ten years after. An evaluation report is due within 90 days of each tabletop or field exercise.

The Risk Management Plan

The plan itself is submitted to EPA electronically and summarizes the facility's registration, hazard assessment, accident history, prevention program and emergency response program.

Recent rulemaking

EPA's 2024 Safer Communities by Chemical Accident Prevention rule, published March 11, 2024, added requirements such as safer technology and alternatives analysis for certain sectors, third-party audits and root cause analysis after accidents, expanded employee participation and community notification. Several of its provisions carry a compliance date of May 10, 2027.

In February 2026, EPA proposed the Common Sense Approach to Chemical Accident Prevention rule, which would roll back or narrow many of the 2024 additions. The comment period closed May 11, 2026. As of early November 2026, EPA's RMP pages describe it as a proposal, so the 2024 rule remains in effect until a final rule is issued. Track this closely before planning compliance work on the affected provisions.

Updates, Audits and Recordkeeping

• Plan updates: Under 68.190, update and resubmit the RMP at least every five years, and sooner when a new regulated substance or process goes above threshold. Changes that require a revised process hazard analysis, a revised offsite consequence analysis or a different program level require an update within six months.
• Corrections: Add a reportable accident to the accident history within six months, and correct emergency contact information within one month.
• Process hazard analysis: For Program 3, update and revalidate the PHA at least every five years.
• Operating procedures: Certify annually that Program 3 procedures are current and accurate.
• Refresher training: At least every three years for Program 3 operators.
• Compliance audits: At least every three years, keeping the two most recent audit reports.
• Incident investigation: Begin within 48 hours of an incident that resulted in, or could reasonably have resulted in, a catastrophic release, and keep reports for five years.
• General records: Under 68.200, keep records supporting implementation of the program for five years unless another section requires otherwise.

Common Compliance Mistakes

• Missing a process. Ammonia refrigeration expansions or new chlorine storage can push a process over threshold without triggering an update.
• Letting the five-year update lapse. The clock resets with certain updates, so track the actual due date.
• Stale emergency contacts. They must be corrected within one month of a change.
• Unresolved PHA and audit recommendations. Inspectors look for documented resolution, not just findings.
• Weak management of change. Undocumented equipment or procedure changes undermine the whole prevention program.
• No exercise records. Notification exercise records must be kept for five years.

EPA enforces RMP under the Clean Air Act and can assess civil penalties for each day of violation, adjusted annually for inflation. Chemical accidents can also lead to investigations by the U.S. Chemical Safety and Hazard Investigation Board and OSHA.

How to Comply: Step by Step

1. Inventory regulated substances and compare the maximum quantity in each process to its threshold.
2. Define your processes and assign each one a program level.
3. Complete the hazard assessment, including worst-case and alternative scenarios and the five-year accident history.
4. Build the prevention program elements required for each program level, aligned with OSHA PSM where both apply.
5. Coordinate with local responders and decide whether you are a responding or non-responding facility.
6. Schedule exercises: annual notification, plus tabletop and field exercises for responding facilities.
7. Submit the RMP and calendar the five-year update and six-month triggers.
8. Audit at least every three years and track every recommendation to closure.

How SMS360 Helps

Management of change sits at the heart of RMP compliance, because most update triggers, PHA revisions and pre-startup reviews start with a change to equipment, chemicals or procedures. SMS360's Management of Change module helps teams document proposed changes, route them for review and approval, and assign follow-up tasks such as updating procedures, retraining operators or reviewing the hazard analysis before startup.

Teams can also track PHA, audit and incident investigation recommendations as corrective actions, store procedures and exercise records, and set reminders for five-year updates, annual procedure certifications and three-year audits. This creates a clear record that supports both EPA RMP and OSHA PSM reviews, along with process safety and risk assessment activities across the site.

Frequently Asked Questions

What is the difference between EPA RMP and OSHA PSM?

OSHA's Process Safety Management standard protects employees from catastrophic releases inside the facility, while EPA's Risk Management Program focuses on protecting the public and the environment. Their prevention elements are closely aligned, and any process subject to PSM is generally Program 3 under RMP unless it qualifies for Program 1. RMP adds offsite consequence analysis and the requirement to submit a plan to EPA.

How often must a Risk Management Plan be updated?

At least every five years. An earlier update is required when a new regulated substance or new process exceeds a threshold, and within six months after changes that require a revised process hazard analysis, offsite consequence analysis or program level. Emergency contact changes must be corrected within one month.

Is the 2024 RMP rule still in effect?

Yes, for now. EPA proposed rolling back many 2024 provisions in February 2026, but a proposed rule does not change the regulation. Until EPA publishes a final rule, the current Part 68 requirements, including the 2024 amendments and their compliance dates, remain in effect. Check EPA's RMP rulemaking page for the latest status.

What emergency response exercises does RMP require?

All Program 2 and 3 facilities must conduct a notification exercise each calendar year to confirm emergency contact information. Facilities that respond with their own employees must also run tabletop exercises at least every three years and field exercises generally at least every ten years, with evaluation reports within 90 days.