The EPA Risk Management Program (RMP) at 40 CFR Part 68 and OSHA Process Safety Management (PSM) at 29 CFR 1910.119 are the two cornerstone U.S. regulations preventing catastrophic chemical releases. They share a common purpose — preventing the kind of incidents that hurt workers, devastate communities, and damage the environment — but they differ in scope, audience, and the deliverables they require. Many facilities are subject to one. Many are subject to both. Understanding where they overlap and where they diverge is essential to building a compliance program that satisfies both without duplicating work.
Quick Comparison
| EPA RMP (40 CFR 68) | OSHA PSM (29 CFR 1910.119) | |
|---|---|---|
| Administering Agency | EPA (Environmental Protection Agency) | OSHA (Occupational Safety and Health Administration) |
| Statutory Authority | Clean Air Act, Section 112(r) | OSH Act, Section 6 |
| Primary Audience | Surrounding communities and the environment | Workers inside the facility |
| Covered Substances | ~140 listed toxic and flammable substances with individual TQs | ~130 highly hazardous chemicals + flammables >10,000 lbs |
| Plan Submission | Required — RMP submitted to EPA every 5 years via RMP*eSubmit | Not required — documentation maintained on-site |
| Hazard Assessment | Required — worst-case and alternative release scenarios | Not required (PHA covers process hazards, not offsite consequence) |
| Emergency Response | Required, with explicit LEPC and local responder coordination | Required, focused on on-site response |
| Public Information | Required — chemical hazard data available to the public | Not required |
| Tiered Levels | Three program levels (1, 2, 3) scaled to risk | Single coverage with no tiers |
| Penalty Maximum | Up to $121,275 per day per violation (civil) | Up to $165,514 per willful or repeat violation |
Why Each Regulation Exists
OSHA PSM came first (1992)
Promulgated in 1992 in response to a series of catastrophic releases at petrochemical plants in the late 1980s, PSM established a comprehensive, performance-based standard for managing the hazards of highly hazardous chemicals in the workplace. It was the first U.S. regulation to formalize the elements that are now considered baseline practice: process hazard analysis, mechanical integrity, management of change, employee participation, and the rest of the 14 elements.
EPA RMP followed (1996, effective 1999)
The Clean Air Act Amendments of 1990 added Section 112(r) requiring EPA to issue rules preventing accidental releases that could harm the public and environment. EPA published the RMP rule in 1996 with full compliance required by 1999. RMP intentionally borrowed the prevention program elements from PSM and extended them outward, adding hazard assessment for offsite consequences, emergency response coordination, and the public-facing Risk Management Plan submission.
Who Each Regulation Covers
OSHA PSM applicability
PSM applies to any process that involves a chemical at or above its specified threshold quantity (TQ) listed in Appendix A to 29 CFR 1910.119, or any process involving a flammable liquid or gas in quantities of 10,000 pounds or more. PSM is implemented by the workplace's OSHA-covered employer.
EPA RMP applicability
RMP applies to facilities with stationary sources holding any of the regulated substances listed at 40 CFR 68.130 above their threshold quantities. The list includes approximately 77 toxic substances and 63 flammable substances, plus a separate listing of explosives. See our complete list of RMP regulated substances and threshold quantities.
RMP Program Levels (Unique to RMP)
RMP classifies covered processes into three program levels with progressively more rigorous prevention program requirements. PSM has no equivalent tiering — coverage is binary. See our complete guide to RMP program levels.
Program 1
Available only when no public receptors are within the worst-case release distance, no offsite-consequence accidents have occurred in the last five years, and emergency response is coordinated with local responders. Lowest burden — basically a worst-case scenario, accident history, emergency coordination, and the RMP submission itself.
Program 2
The default for most processes that don't qualify for Program 1 and aren't subject to OSHA PSM. Streamlined prevention program: safety information, hazard review, operating procedures, training, maintenance, compliance audits, and incident investigation.
Program 3
Required for any process subject to OSHA PSM or in any of ten specific NAICS codes. The Program 3 prevention program is essentially identical to PSM — same elements, same depth.
Where the Prevention Programs Overlap
PSM has 14 elements; RMP Program 3 requires nearly the same set. The prevention work is essentially identical:
Shared prevention program elements
- Process safety information — documentation of chemical, technology, and equipment hazards
- Process hazard analysis — HAZOP, What-If, Checklist, FMEA, or Fault Tree, revalidated every 5 years
- Operating procedures — written procedures for startup, normal ops, shutdown, and emergencies
- Training — initial and refresher (every 3 years) for operators
- Contractors — selection, evaluation, and oversight of contractor work on covered processes
- Pre-startup safety review — verification before introducing regulated substances to new or modified facilities
- Mechanical integrity — inspection, testing, and maintenance of process equipment
- Hot work permits — for non-routine work on or near covered processes
- Management of change — structured review of any change to chemicals, technology, equipment, or procedures
- Incident investigation — root cause analysis of catastrophic and near-miss releases
- Employee participation — written plan and consultation on PHA and other elements
- Compliance audits — at least every 3 years
- Trade secrets — access to information without compromising proprietary data
What Is Unique to Each
Unique to EPA RMP
- Hazard Assessment — worst-case and alternative release scenarios with offsite consequence analysis
- 5-Year Accident History — rolling history of releases with offsite or significant on-site consequences
- Risk Management Plan submission — electronic filing with EPA via RMP*eSubmit, every 5 years
- Public information — chemical hazard data available to the public on request
- LEPC coordination — documented coordination with Local Emergency Planning Committee
- Three program levels — tiered requirements based on offsite risk
- Emergency response exercises — periodic notification drills and tabletop or full-scale exercises
Unique to OSHA PSM
- Stronger trade secret provisions for personal protective equipment and exposure data
- OSHA inspection focus on workplace conditions, employee interviews, and on-site documentation
- Worker-centered enforcement — OSHA citations focus on protecting employees, with worker input through participation requirements
- Different penalty structure — willful, serious, and other-than-serious classifications, with multipliers for repeat violations
- State Plan variation — states with OSHA-approved State Plans may have additional or stricter PSM requirements
Submission Is the Single Biggest Operational Difference
Most prevention work is the same. The biggest operational difference between the two regimes is that RMP requires you to submit something to EPA, while PSM only requires you to maintain records on-site.
RMP submission requirements
The Risk Management Plan is filed electronically through RMP*eSubmit. It includes facility identification, registration, executive summary, accident history, prevention program data for each program level, emergency response program data, and senior official certification. Initial submission is required within three years of becoming subject to RMP, with full resubmissions at least every five years and within six months of certain triggering events.
PSM documentation requirements
PSM documentation lives on-site. There is no submission to OSHA. Records are produced when an OSHA inspector visits or in response to specific requests during an investigation. The full burden of "showing your work" happens during inspections, not at scheduled filing intervals.
Enforcement Posture
EPA enforcement
EPA has designated chemical accident risk reduction as a National Enforcement and Compliance Initiative (NECI) for fiscal years 2024–2027, with particular focus on facilities using anhydrous ammonia or hydrogen fluoride. Civil penalties can reach $121,275 per day per violation. EPA inspectors review the submitted RMP against actual facility conditions — gaps between the plan and the facility are routine findings.
OSHA enforcement
OSHA's National Emphasis Program for Process Safety Management (NEP) targets refineries and chemical plants for programmed PSM inspections, focusing on PSI accuracy, PHA quality, mechanical integrity, and operating procedures. Penalties can reach $165,514 per willful or repeat violation. Inspections often follow incidents and complaints, with deep document review and operator interviews.
One Platform, Both Regulations
For the many facilities subject to both regulations, the practical answer is to operate one integrated prevention program that satisfies both at once. Maintaining parallel sets of PHAs, MOCs, training records, and audit reports for the same chemicals on the same equipment is wasteful and creates conflicting documentation that auditors and inspectors will exploit.
Ecesis Software for RMP and PSM
EPA RMP Software
Centralized RMP compliance for all program levels
PSM Software
Manage all 14 OSHA PSM elements in one platform
Hazard Analysis
PHA documentation, findings, and 5-year revalidation cycles
Management of Change
Workflows for changes to PSM/RMP-covered processes
Incident Management
Investigation, root cause, and 5-year accident history
Emergency Planning
Plans, exercises, and LEPC coordination tracking
