If you're running a business under an EPA Victoria operating licence, the regulatory landscape shifted significantly on 1 July 2021 — and if you haven't fully adjusted your environmental management approach since then, you may be more exposed than you realise.
This article cuts through the regulatory language to give you a clear, practical understanding of what RMMP compliance actually requires under the current framework.
Victoria's Environment Protection Act 2017 (EP Act) replaced the Environment Protection Act 1970 and brought the most substantial reform to environmental regulation in the state in half a century. The core change was philosophical: from a system based on setting discharge limits and policing exceedances, to a duty-based system that requires proactive identification and management of risk.
The centrepiece of this shift is the General Environmental Duty (GED) — a legally enforceable obligation on anyone whose activities may pose a risk of harm to human health or the environment. The GED requires you to minimise those risks so far as reasonably practicable (SFARP).
"So far as reasonably practicable" isn't a get-out clause. It requires you to actively consider what measures are available to reduce risk and implement them unless the cost or difficulty is grossly disproportionate to the benefit. It's a framework borrowed from work health and safety law, and it comes with teeth.
For operating licence holders, the RMMP is the primary mechanism through which the GED is operationalised. It's not enough to manage your risks — you need to document that you're managing them, and do so in a way that EPA can audit.
OL_G5 is the standard licence condition that requires operating licence holders to prepare, maintain, implement, and review a Risk Management and Monitoring Program (RMMP).
The condition is typically worded to require the holder to: - Prepare and maintain a current RMMP for the licensed premises - Implement the RMMP - Make the RMMP available to the EPA Authority on request - Review the RMMP at defined intervals or when triggered by material changes to the operation
OL_G5 appears in the vast majority of the approximately 720 operating licences currently active in Victoria. If your licence includes this condition, compliance with OL_G5 is a legal obligation — not a best-practice recommendation.
If you're uncertain whether your licence includes OL_G5, locate your licence document (EPA's online licence register is publicly accessible) and review the General Conditions section.
EPA Publication 1851.1 (Preparing a Risk Management and Monitoring Program — A Guide for Licence Holders) sets out the content requirements for a compliant RMMP. Here's what each component needs to address:
This is the foundation of the RMMP. It must systematically identify and assess all environmental risks associated with the licensed premises and activities.
A compliant risk assessment: - Covers the full scope of the licensed activities (not just the "main" process) - Identifies risks from routine operations, maintenance activities, and abnormal/emergency scenarios - Assesses both likelihood and consequence for each risk - Documents the methodology used (risk matrix, rating criteria) - Considers the receiving environment and any sensitive receptors
EPA expects the risk assessment to be site-specific. A risk register that could have come from any site in the same industry category is a red flag.
For each significant risk, the RMMP must document the controls you have in place and any additional controls required to meet SFARP.
Controls must be described with enough specificity to be actionable and auditable. "Maintain spill kits" is not sufficient. "Spill kits rated for [specific chemical class] located at [specific locations], inspected monthly against Checklist ENV-04 by the Site Environment Officer" is.
The control assessment should reference the hierarchy of controls — EPA will look to see whether you've considered engineering controls before relying solely on procedures and training.
The monitoring program defines how you will verify that your controls are working and detect early signs of environmental harm.
A compliant monitoring program specifies: - Parameters being monitored (e.g., pH, conductivity, suspended solids, noise levels, VOC concentrations) - Methods — how monitoring is conducted, what equipment is used, what detection limits apply - Locations — specific sample points or monitoring locations, referenced to a site plan - Frequency — how often monitoring occurs under normal and alert conditions - Trigger/action levels — the values that require a defined response - Corrective action procedures — what happens when a trigger level is exceeded
The monitoring program must be directly linked to your risk register. If you've identified a significant risk of contaminated stormwater discharging to a waterway, your monitoring program must include a mechanism to detect that risk.
The RMMP must address how environmental risks will be managed in emergency scenarios. This includes: - Emergency scenarios identified in the risk assessment - Immediate response actions for each scenario - Notification procedures (EPA emergency line, emergency services, affected community) - Named roles and contact details for the emergency response team - Linkage to the site's broader Emergency Management Plan and EPA's Emergency Response Arrangements
The RMMP must document when and how it will be reviewed. OL_G5 conditions typically require: - Periodic review at least every three years (some licences specify shorter intervals) - Review within 12 months of a material change to the licensed activity - Review following a significant environmental incident - Review when directed by EPA
One of the most important aspects of RMMP compliance under the EP Act is understanding that the GED is a dynamic standard. What constitutes SFARP risk management today may not be sufficient in three years as technology improves, better practices emerge, or the regulatory context changes.
This means your RMMP can't be a one-and-done document. The SFARP obligation requires you to periodically reassess whether your controls remain appropriate given current technology, industry practice, and available information.
EPA Publication 1851.1 provides guidance on what factors are relevant to assessing "reasonable practicability" — including the probability of harm occurring, the severity of potential harm, the available means of reducing risk, and the cost and feasibility of implementing those means.
When EPA reviews your RMMP, they will assess not just whether you have documented controls, but whether those controls represent genuine SFARP risk management for your type of operation.
Beyond the substantive content of the RMMP, there are practical documentation requirements that affect compliance:
Version control: The RMMP must be version-controlled so it's clear which version is current and what has changed.
Approval records: The RMMP should be formally approved by a responsible person with authority (typically the site manager or an executive). The approval should be dated and documented.
Implementation records: Simply having an RMMP is not enough — OL_G5 requires you to implement it. You need records that demonstrate implementation: monitoring results, inspection checklists, corrective action logs, training records referencing the RMMP, and review documentation.
Availability: The RMMP must be available to EPA on request. This means it needs to be findable, current, and in a format that can be provided promptly.
Based on the pattern of EPA enforcement activity and guidance, the most common compliance gaps in RMMPs submitted to or reviewed by EPA are:
1. Incomplete risk identification Risks associated with maintenance activities, contractor operations, or abnormal operating conditions are frequently missing. The risk assessment covers "normal" operations but not the scenarios that most commonly lead to incidents.
2. Controls too vague to implement or audit Descriptions like "implement best practice waste management" or "ensure staff are trained" can't be audited. If EPA asks "how do you know this control is in place?", you need a documentable answer.
3. Monitoring not linked to risk Environmental monitoring is happening (or at least being claimed) but it's not clear which risks the monitoring is detecting. The monitoring program reads as a list of things being measured rather than a risk management tool.
4. No trigger levels or corrective action procedures Data is being collected but there's no defined trigger level that requires action, and no documented procedure for what to do when something is wrong. The monitoring becomes a record-keeping exercise rather than an early warning system.
5. RMMP doesn't reflect current operations The RMMP was prepared when the licence was first issued and hasn't been updated to reflect changes in process, chemical use, site layout, or throughput. The document describes operations that no longer exist or misses operations that do.
6. Emergency response provisions out of date Contact details, emergency procedures, or equipment inventories are out of date. This is a common finding in audits and is particularly serious because it affects emergency preparedness.
7. No evidence of implementation The RMMP is a polished document but there are no records that it's actually being followed — no monitoring results, no inspection records, no training records.
For most operating licence holders, preparing a compliant RMMP takes 6–12 weeks from commencement to final sign-off. The timeline depends on:
Site complexity: A single-activity site with a small chemical inventory and simple processes might be done in 4–6 weeks. A multi-activity facility with significant chemical inventories and multiple environmental pathways could take 3–6 months.
Quality of existing documentation: If you have good process documentation, site plans, incident records, and existing environmental procedures, the risk assessment phase goes much faster. If the site is poorly documented, establishing the baseline alone can take weeks.
Internal review requirements: Factor in time for internal review by site management, legal counsel if required, and sign-off by the appropriate authority.
Specialist inputs: Some risk assessments require specialist inputs — hydrogeological assessments for groundwater risks, air quality modelling for atmospheric emissions, or noise assessments. These have their own lead times.
If your RMMP is already overdue (i.e., you don't have one, or it's significantly out of date and EPA has flagged this), prioritise getting a compliant document in place quickly. A credible draft presented to EPA proactively is far better than waiting until enforcement action forces your hand.
The cost of RMMP development varies widely based on:
For most small-to-medium licence holders (single primary activity, moderate risk profile), consultant-developed RMMPs typically cost in the range of $8,000–$25,000. Complex facilities can cost significantly more. Annual maintenance and review costs should also be budgeted.
Internal development works well when: - You have qualified, experienced environmental staff with risk assessment skills - Operations are well-documented and your team knows them intimately - You have adequate time to allocate to the task - The operation is relatively straightforward
External development is preferable when: - You lack qualified in-house capability - Your previous RMMP has been criticised by EPA - You're in a high-scrutiny licence category - You want the defensibility of an independently prepared document - Time constraints make internal development impractical
A hybrid approach often works well: internal staff handle site familiarisation, data gathering, and review; an external consultant leads the risk assessment methodology, document structure, and quality assurance.
At Automated Environmental, we've developed RMMPs for licence holders across all major categories — from small chemical storage operations to major waste processing facilities. We understand what EPA Publication 1851.1 requires and what EPA officers actually look for when they review RMMP documents.
Find out more about our RMMP development service →
View all our environmental compliance services →
Q: My licence was issued under the old EP Act (1970). Do I still need an RMMP under OL_G5?
Yes. When the EP Act 2017 commenced on 1 July 2021, existing licences were transitioned to the new framework. If your current licence document (issued or reissued after 1 July 2021) includes OL_G5, you are required to comply with it regardless of when you first received a licence for your operations.
Q: We have an Environment Management Plan (EMP) from our development approval. Does that satisfy OL_G5?
Not automatically. A planning EMP may have some overlap with RMMP content, but they serve different regulatory purposes and are prepared to different standards. Your RMMP needs to meet the specific requirements of EPA Publication 1851.1 and OL_G5. In some cases, an existing EMP can be used as a starting point, but it will almost certainly need significant development to be RMMP-compliant.
Q: How often does EPA actually check whether our RMMP is current and compliant?
EPA has a range of mechanisms for checking compliance: scheduled audits, complaint-response inspections, incident investigations, and licence renewal reviews. The frequency varies. But the more important point is that if an incident occurs and EPA investigates, the first thing they will want to see is your RMMP — and a document that's out of date, generic, or poorly implemented will significantly worsen your position.
Q: Can we self-certify that our RMMP is compliant, or does EPA need to approve it?
Under OL_G5, you are responsible for preparing and maintaining a compliant RMMP. EPA does not routinely pre-approve RMMPs — they audit compliance. This means the obligation sits with you to ensure your RMMP meets the requirements of EPA Publication 1851.1 before EPA asks to see it.