How to Prepare an RMMP for EPA Victoria — Complete Guide (2026)

If you hold an EPA Victoria operating licence, there's a good chance your licence includes condition OL_G5 — and if it does, you're legally required to have a current, compliant Risk Management and Monitoring Program (RMMP). Getting it right matters: a poorly prepared RMMP won't just fail an EPA audit; it can expose your business to remedial notices, infringement notices, and substantial civil penalties.

This guide walks through everything an EHS manager or environmental professional needs to know about preparing a compliant RMMP under the Environment Protection Act 2017 (EP Act). Bookmark it. You'll come back to it.

What Is an RMMP? (Legal Basis)

A Risk Management and Monitoring Program is a formal, documented plan that identifies the environmental risks associated with your licensed premises, sets out the controls you will implement to manage those risks, and defines the monitoring activities you will undertake to verify those controls are working.

The legal foundation is the Environment Protection Act 2017, which commenced on 1 July 2021 — Victoria's most significant overhaul of environmental protection law in over 50 years. The EP Act shifted from a prescriptive, end-of-pipe regulatory model to a duty-based framework centred on the General Environmental Duty (GED).

Under the GED, any person engaged in an activity that may give rise to a risk of harm to human health or the environment must minimise that risk so far as reasonably practicable (SFARP). This isn't just aspirational language — it's an enforceable legal standard.

The RMMP is how EPA Victoria expects licence holders to demonstrate they're meeting the GED. It turns an abstract duty into a documented, auditable system.

The primary guidance document is EPA Publication 1851.1: Preparing a Risk Management and Monitoring Program — A Guide for Licence Holders. This is the authoritative EPA reference for what your RMMP needs to contain and how to structure it.

Who Needs an RMMP?

Not every person in Victoria needs an RMMP — but if you hold an EPA operating licence with condition OL_G5, you do. Full stop.

OL_G5 is the standard licence condition that requires the holder to: 1. Prepare and maintain a current RMMP for the licensed premises 2. Implement the RMMP in accordance with its terms 3. Make the RMMP available to EPA on request 4. Review and update the RMMP at specified intervals (or when triggered by a material change)

Currently, approximately 720 operating licences are active in Victoria. The vast majority include OL_G5. If your licence has this condition and you don't have a current, compliant RMMP, you're already non-compliant — regardless of whether EPA has knocked on your door yet.

Typical licence holders required to have RMMPs include: - Chemical works and chemical storage facilities - Waste management and resource recovery facilities - Petroleum refining and storage operations - Mining and extractive industries - Food and beverage manufacturing - Concrete batching and asphalt plants - Intensive animal industries

If you're unsure whether OL_G5 applies to your licence, check your licence document directly. It will be listed under the General Conditions section.

What an RMMP Must Include

EPA Publication 1851.1 is explicit about the minimum content requirements. Your RMMP must cover all of the following:

1. Site Description and Context

A clear description of your site, the licensed activities, the receiving environment, and any sensitive receptors nearby (residential areas, waterways, conservation areas). This establishes the "why" — it contextualises all subsequent risk assessment.

2. Risk Identification

A systematic identification of all environmental risks associated with the licensed activity. This means going beyond obvious pollution incidents to capture: - Routine operational risks (e.g., stormwater contamination, dust, odour) - Maintenance-related risks - Upset and emergency scenarios - Cumulative and off-site impacts

The risk identification process should be defensible — it should be clear how you identified risks, who was involved, and what sources you drew on (e.g., incident history, regulatory guidance, industry standards).

3. Risk Assessment

For each identified risk, you must assess: - Likelihood of the risk materialising - Consequence if it does (in terms of harm to human health or the environment) - Risk level (typically using a risk matrix aligned with EPA guidance)

The assessment must take into account existing controls — but don't overestimate how much existing controls reduce your risk level.

4. Risk Controls

For each significant risk, you must document the controls in place and any additional controls you will implement to meet SFARP. Controls should follow the hierarchy of controls principle: 1. Elimination 2. Substitution 3. Engineering controls 4. Administrative controls 5. Personal protective equipment (last resort)

Your RMMP must demonstrate that you've considered each level of control, not just defaulted to PPE and procedures.

5. Monitoring Program

The monitoring program is often the most under-developed component of RMMPs EPA reviews. It must specify: - What parameters you will monitor (e.g., pH, TSS, noise levels, air emissions) - How monitoring will be conducted (method, equipment, detection limits) - Where monitoring will take place (sample point locations) - How frequently monitoring will occur - What the action/trigger levels are - What you will do when a trigger level is exceeded (corrective action)

The monitoring program needs to be directly linked back to the risks identified. If you've identified a risk of contaminated stormwater reaching a nearby drain, your monitoring program should include stormwater monitoring at a point that captures that risk.

6. Emergency Response Provisions

Your RMMP must address what happens when things go wrong. This includes: - Notification procedures (to EPA, emergency services, affected communities) - Immediate containment and response actions - Responsibilities and contact details - Links to your broader Emergency Management Plan

7. Roles and Responsibilities

Who is responsible for implementing each aspect of the RMMP? The document should name roles (not just "Management") and ensure accountability is clear.

8. Review Schedule and Triggers

How often will the RMMP be reviewed? What circumstances will trigger an unscheduled review?

Step-by-Step Preparation Process

Here's a practical sequence for preparing your RMMP from scratch (or significantly revising an existing one):

Step 1: Gather Your Baseline Documentation

Before you write a single word of the RMMP, assemble: - Your EPA operating licence (all conditions, licence schedule, endorsed documents) - Site plans and drainage plans - Process flow diagrams - Existing environmental management plans, procedures, and registers - Previous audit reports, incident records, and EPA correspondence - Relevant industry-specific EPA guidance (EPA codes of practice, guidelines, PIPs)

Step 2: Define the Scope

Determine what activities and areas are in scope for the RMMP. The scope should cover all activities on the licensed premises that relate to the licensed activity — not just the main production process.

Step 3: Conduct the Risk Assessment

Use a structured risk assessment methodology. EPA guidance aligns with ISO 31000 principles. Involve people who know the site — operators, maintenance staff, and EHS personnel. Workshop formats work well for this step.

Document every risk, even low-rated ones. A well-documented "low" risk is defensible. An undocumented risk isn't.

Step 4: Develop the Control Register

Map your existing controls to each risk. Identify gaps. Develop an action plan to close gaps within a defined timeframe. The control register becomes one of the core working documents within your RMMP.

Step 5: Design the Monitoring Program

Work backwards from your significant risks. For each significant risk, ask: "How will I know if this risk is increasing, or if my controls are failing?" The answer to that question defines your monitoring requirements.

Ensure your monitoring program meets any specific monitoring conditions in your EPA licence — OL_G5 doesn't override other licence conditions.

Step 6: Draft the Document

Structure the document to align with EPA Publication 1851.1. Use clear headings, numbered sections, and cross-references between the risk register, control register, and monitoring program. Use tables where possible — EPA officers reviewing your RMMP will appreciate clarity.

Step 7: Internal Review

Have someone who wasn't involved in drafting review the document. Check for gaps, inconsistencies, and language that is too vague to be actionable.

Step 8: Finalise, Sign Off, and Implement

The RMMP should be formally approved by a responsible person with authority (typically the site manager or an executive). Document the approval and version control it. Then — critically — implement it. An RMMP sitting in a drawer is worthless.

Step 9: Communicate and Train

Ensure everyone with a role in implementing the RMMP knows what they're supposed to do. Training records should reference the RMMP.

Common Mistakes That Trigger EPA Scrutiny

These are the patterns EPA officers most commonly identify when reviewing RMMPs:

1. Generic risk registers copied from templates The risks don't reflect the specific site, processes, or receiving environment. EPA can spot a generic template instantly.

2. Monitoring programs disconnected from the risk register Monitoring is being done (or claimed to be done) without any clear link to which risks it's managing.

3. Controls described in aspirational terms, not operational ones "We will maintain containment systems" tells EPA nothing. "Secondary containment bunds with a minimum 110% capacity of the largest stored volume, inspected weekly against Checklist F-03" tells them something useful.

4. No corrective action process Monitoring results are recorded but there's no documented trigger level or corrective action procedure. This renders the monitoring program effectively decorative.

5. Out-of-date documents The RMMP hasn't been reviewed since it was first prepared, despite significant changes to the site, processes, or regulatory requirements.

6. No emergency provisions, or emergency provisions that reference out-of-date contacts and procedures

7. Undocumented risk assessment methodology You can't defend a risk rating if you can't explain how you arrived at it.

Review Frequency

OL_G5 typically requires the RMMP to be reviewed: - At least every three years (for most licence holders) - Within 12 months of a material change to the licensed activity - Following any significant environmental incident at the site - When EPA directs you to review it

"Material change" includes changes to processes, equipment, chemical use, throughput, or site layout that could affect the environmental risk profile of the site.

Don't wait for the three-year clock to run out if your site has changed significantly. An RMMP that doesn't reflect current operations is a liability, not a protection.

Penalties for Non-Compliance

Non-compliance with OL_G5 can result in:

Remedial Notices EPA can issue a remedial notice directing you to prepare or revise your RMMP within a specified timeframe. Failure to comply with a remedial notice is a separate offence.

Infringement Notices Fixed financial penalties issued without going to court. For body corporates, these can be substantial.

Civil Penalty Orders For serious or repeated non-compliance, EPA can seek civil penalties through the Environment Protection Court. Penalties for body corporates for breaching licence conditions can reach hundreds of thousands of dollars.

Licence Suspension or Cancellation In the most serious cases, EPA has the power to suspend or cancel an operating licence — a potentially catastrophic outcome for any manufacturing or resource recovery business.

Beyond formal penalties, a non-compliant RMMP creates significant legal exposure in the event of an incident. If you can't demonstrate you were managing risks SFARP, your liability exposure increases substantially.

Industry-Specific Considerations

Chemical Works (Licence Category G01)

Chemical works present some of the highest-complexity RMMPs. Key considerations include chemical hazard inventories (aligning with Major Hazard Facility classifications where relevant), spill containment design, air quality monitoring for VOCs, and emergency response integration with the Country Fire Authority and emergency services. EPA may also require modelling of worst-case discharge scenarios.

Waste Management (Licence Categories A01, A13)

Waste facilities face particular scrutiny around leachate management, landfill gas, and surface water. RMMPs for landfills should address groundwater monitoring networks and trigger levels, odour management plans, and vermin control. Resource recovery facilities (A13) need to specifically address feedstock variability and the risk of receiving non-conforming waste.

Petroleum (Licence Category G03)

Petroleum storage and refining operations face risks primarily around hydrocarbon contamination of soil and groundwater, fire and explosion, and air quality impacts. Groundwater monitoring bore networks are typically required, with detailed hydrogeological context in the risk assessment.

Mining and Extractive Industries (Licence Category C01)

Mining operations typically have RMMPs that interact with other regulatory frameworks (Work Health and Safety, Mine Safety). Key environmental risks include tailings management, acid and metalliferous drainage (AMD), dust, and dewatering impacts on receiving waterways. RMMP development for mining operations often requires specialist hydrogeological and geochemical input.

When to Engage a Consultant vs. DIY

Whether to develop your RMMP internally or engage an environmental consultant depends on several factors:

Consider DIY if: - You have qualified in-house environmental staff with risk assessment experience - Your operations are straightforward and well-understood - You have time to invest in the process properly - You have developed compliant RMMPs before

Consider engaging a consultant if: - You don't have qualified in-house environmental staff - Your operations are complex (multiple licence categories, high-consequence risks, significant chemical inventories) - Your previous RMMP has been flagged by EPA - You're preparing your first RMMP and want to get it right - You've had a significant incident and need to demonstrate robust risk management - You want an objective review of risks you might be too close to see clearly

The cost of a well-prepared RMMP prepared by an experienced consultant is typically modest relative to the cost of an EPA enforcement action, a significant environmental incident, or the reputational damage that comes with both.

Ready to Get Your RMMP Done Right?

Automated Environmental specialises in RMMP development for EPA Victoria licence holders across all licence categories. Our team has prepared RMMPs for everything from small chemical storage operations to major waste processing facilities, and we understand what EPA expects — because we've worked through it on hundreds of sites.

Learn more about our RMMP development service →

View all environmental compliance services →

You can also download our free Fact Sheet on Preparing Comprehensive RMMPs for a quick-reference summary.

Frequently Asked Questions

Q: Does every EPA operating licence in Victoria require an RMMP?

Most operating licences include condition OL_G5, which requires an RMMP. However, not all do — it depends on the licence category and the activities being licensed. Check your specific licence conditions. If OL_G5 is listed, you need an RMMP.

Q: Can I use a template RMMP as a starting point?

A template can provide a useful structural framework, but an RMMP cannot be template-based in substance. The risk assessment must be specific to your site, your processes, and your receiving environment. EPA will identify — and is unimpressed by — generic documents that clearly haven't been tailored to the actual operations.

Q: How long does it take to prepare an RMMP?

For a competently resourced site with good existing documentation, a straightforward RMMP might take 4–6 weeks to prepare. Complex operations — major waste facilities, large chemical works, mining operations — can take 3–6 months. Factor in time for internal review and sign-off.

Q: What happens if EPA asks to see my RMMP and it's not compliant?

EPA may issue a remedial notice requiring you to revise the RMMP within a specified timeframe (typically 30–90 days). If you fail to comply with the remedial notice, you face further enforcement action. If you don't have an RMMP at all, the enforcement response is likely to be more immediate. Don't wait for EPA to ask.