RMMP Template & Checklist: What EPA Victoria Expects From Your Risk Management Plan

The RMMP Checklist

Use this checklist to assess whether your RMMP is complete. Tick items that are fully addressed; note gaps for action.

☐ Document Control

• [ ] 1. Document has a version number and date of issue
• [ ] 2. A revision history records all previous versions with dates and change summaries
• [ ] 3. The document has been formally approved with a named approver, role, and date
• [ ] 4. A document owner is identified with responsibility for maintaining and reviewing the RMMP
• [ ] 5. The scope of the RMMP is clearly defined (which premises, activities, and areas it covers)
• [ ] 6. The relationship to other site documents is noted (e.g., links to Emergency Management Plan, other environmental plans)

☐ Site Description and Context

• [ ] 7. Site address, EPA licence number, and licence categories are stated
• [ ] 8. All licensed activities are described, not just the primary activity
• [ ] 9. A current site plan is referenced or included (showing buildings, drainage, chemical storage areas, sensitive areas)
• [ ] 10. The receiving environment is described — nearby waterways, groundwater, residential areas, conservation areas
• [ ] 11. Sensitive receptors within and adjacent to the site are identified
• [ ] 12. Relevant site history (contamination, incidents, regulatory actions) is noted

☐ Risk Identification and Assessment

• [ ] 13. The risk assessment methodology is documented (risk matrix included, with criteria for each consequence and likelihood category)
• [ ] 14. The risk assessment covers all licensed activities, including maintenance, loading/unloading, and contractor activities
• [ ] 15. The risk assessment addresses normal operations, abnormal/upset conditions, and emergency scenarios
• [ ] 16. Risks from all relevant environmental pathways are assessed: stormwater, groundwater, air, noise, waste
• [ ] 17. The risk register is presented in a table format with a minimum of: risk description, likelihood, consequence, risk rating (pre-controls), existing controls, residual risk rating, required action
• [ ] 18. All risks rated "high" or above have documented actions to reduce them to an acceptable level (SFARP)
• [ ] 19. The basis for the risk rating is defensible — low-rated risks are not simply dismissed without explanation
• [ ] 20. The risk assessment was conducted with input from people who know the site operations (operators, maintenance, EHS staff)
• [ ] 21. The risk assessment references relevant EPA guidance, codes of practice, or industry standards that informed the assessment

☐ Risk Controls

• [ ] 22. Controls are documented for all significant risks (not just the highest-rated risks)
• [ ] 23. Controls are described specifically — what the control is, where it is, how it works, who maintains it
• [ ] 24. The hierarchy of controls has been considered — engineering controls are preferred over administrative controls
• [ ] 25. A gap analysis has been conducted: additional controls required to reach SFARP are identified with a responsible person and target completion date
• [ ] 26. The control register is cross-referenced to the risk register (each risk can be matched to its controls)
• [ ] 27. Inspection and maintenance requirements for physical controls (e.g., bunds, interceptors) are documented

☐ Monitoring Program

• [ ] 28. A monitoring schedule/table is included covering all monitoring activities
• [ ] 29. Each monitoring entry specifies: parameter, monitoring method, monitoring location, frequency, trigger/action level, corrective action procedure
• [ ] 30. The monitoring program can be traced back to the risk register — each significant risk has at least one monitoring activity linked to it
• [ ] 31. Monitoring locations are shown on a site map (sample points labelled and referenced in the monitoring schedule)
• [ ] 32. Trigger levels are defined for all parameters — and the basis for each trigger level is documented (licence condition, EPA guideline, site-specific basis)
• [ ] 33. A corrective action procedure is documented for each trigger level — what happens when a result exceeds the trigger
• [ ] 34. Data recording and retention requirements are specified (format, storage, retention period)
• [ ] 35. Reporting requirements are addressed — when and how monitoring results are reported internally and to EPA

☐ Emergency Response

• [ ] 36. Emergency scenarios identified in the risk register are addressed in the emergency response provisions
• [ ] 37. Immediate response actions are documented for each emergency scenario
• [ ] 38. Notification procedures are documented, including EPA's 24-hour Emergency Line (1300 372 842)
• [ ] 39. Emergency response roles are named (by role, not just "Management") with current contact details
• [ ] 40. Emergency equipment is inventoried with locations referenced to the site plan
• [ ] 41. Post-incident review procedures are documented
• [ ] 42. Emergency response provisions have been reviewed within the past 12 months to ensure contact details and procedures are current

☐ Roles and Responsibilities

• [ ] 43. A table of roles and responsibilities covers all key RMMP activities (monitoring, inspection, corrective action, review)
• [ ] 44. Responsibilities are assigned to roles, not individuals by name (names change; roles persist)
• [ ] 45. Competency requirements for key roles are documented
• [ ] 46. Training records referencing the RMMP exist and are maintained

☐ Review Schedule and Records

• [ ] 47. The scheduled review interval is documented (and meets the minimum required under OL_G5)
• [ ] 48. Material change triggers for unscheduled review are listed
• [ ] 49. The review process is documented (who reviews, how changes are incorporated, how revised versions are approved)
• [ ] 50. Records of previous RMMP reviews are maintained and accessible

☐ General Quality

• [ ] 51. The RMMP is site-specific — it couldn't be mistaken for a generic template
• [ ] 52. The document is internally consistent — cross-references between the risk register, control register, and monitoring program are accurate
• [ ] 53. Language is specific and actionable — not aspirational or vague
• [ ] 54. The RMMP has been reviewed by someone who wasn't involved in preparing it
• [ ] 55. The RMMP is readily accessible to staff and available to EPA on request

Score your RMMP: Count the items ticked. A fully compliant RMMP should tick all 55 items. Gaps in the Document Control, Risk Assessment, and Monitoring sections are typically the most significant from EPA's perspective.

Common Gaps — and How to Close Them

Even experienced EHS teams miss these:

Gap: Monitoring frequency not matched to risk level High-risk pathways (e.g., a bund area containing large volumes of a hazardous chemical adjacent to a waterway) should be monitored more frequently than low-risk pathways. If everything is monitored quarterly regardless of risk level, the monitoring program doesn't reflect a risk-based approach.

Fix: Review each monitoring activity against the risk rating of the pathway it's monitoring. Increase frequency for high-risk pathways; document your rationale.

Gap: Trigger levels set at licence limits rather than action levels Setting your trigger level at the EPA licence limit (the maximum permitted value) means you only act when you're at the boundary of compliance. You have no early warning system.

Fix: Establish two-tier trigger levels: an Alert Level (lower threshold requiring investigation) and an Action Level (higher threshold requiring immediate corrective action). The Action Level can align with your licence limit; the Alert Level should be set below it.

Gap: Risk assessment doesn't cover contractor activities Contractors working on site — maintenance contractors, tanker drivers, demolition contractors — introduce risks that your risk assessment needs to address.

Fix: Add a section to your risk assessment that addresses contractor activities. Map contractor risks to your control register (e.g., contractor induction requirements, permit-to-work systems).

Gap: RMMP prepared but never communicated The RMMP was prepared, approved, and filed — but the people responsible for implementing it have never been told what it requires of them.

Fix: Hold a toolbox talk or training session on RMMP requirements for all staff with implementation responsibilities. Document the training. Update the RMMP's roles and responsibilities section if you find responsibilities were unclear.

Aligning With the GED: What "SFARP" Actually Means for Your RMMP

The General Environmental Duty's SFARP standard doesn't demand the absolute best controls in the world — but it does require you to demonstrate that you've actively considered what controls are available and chosen controls that represent a genuine, proportionate response to the risks.

In practice, aligning your RMMP with the GED means: - Referencing industry standards and best practice — EPA codes of practice, industry association guidelines, and Australian Standards relevant to your activities should inform your risk assessment and control selection - Updating controls as better options become available — if a new technology or practice becomes standard in your industry, you should be evaluating whether to adopt it - Documenting your reasoning for control choices — if you've chosen a lower-cost control over a higher-cost one, document why the cost of the higher-cost option is disproportionate to the benefit

The SFARP assessment isn't a one-time exercise. It's an ongoing obligation embedded in the review cycle of your RMMP.

Review Frequency: What OL_G5 Requires

Most OL_G5 conditions require:

A "material change" includes changes to: - Processes or production methods - Chemicals used or stored (new chemicals, increased quantities) - Plant or equipment (new or significantly modified plant) - Site layout, drainage, or containment - Throughput or operating hours - Key personnel with RMMP responsibilities

Document the change in your RMMP's revision history and update the relevant sections. Don't just update the version number — ensure the content actually reflects the change.

Download Our Free Fact Sheet

For a concise reference summary of RMMP requirements, download our Fact Sheet on Preparing Comprehensive RMMPs. It covers the key content requirements and is useful for sharing with site management or board members who need to understand the obligation at a high level.

Need Help Building or Reviewing Your RMMP?

Automated Environmental has prepared RMMPs for EPA Victoria licence holders across a wide range of industries and licence categories. Whether you're starting from scratch, updating a document that's fallen behind, or preparing for an EPA audit, we can help you produce a compliant, practical RMMP that will hold up to scrutiny.

Learn more about our RMMP development service →

View all environmental compliance services →

Frequently Asked Questions

Q: Can I use this checklist to self-assess my existing RMMP before an EPA audit?

Yes — that's exactly what it's designed for. Work through the 55 items systematically. Any item you can't tick represents a gap you should address before EPA reviews the document. If you find significant gaps, prioritise fixing them rather than waiting for EPA to identify them.

Q: Our RMMP is 200 pages long. Is longer better?

Not necessarily. EPA Publication 1851.1 doesn't specify a minimum length — it specifies minimum content. A clear, well-structured 40-page RMMP with a tight risk register, specific controls, and a linked monitoring program will hold up better than a 200-page document that's padded with generic content and can't be followed by someone new to the site. Quality and clarity beat volume.

Q: How specific do monitoring trigger levels need to be?

Specific enough to be actionable. If your trigger level is "visually turbid", that's too vague — different observers will have different interpretations. If your trigger level is "TSS > 50 mg/L (Alert) or > 100 mg/L (Action) measured by [Method X]", that's actionable. For numerical parameters, your trigger levels should reference a specific value with clear units. For qualitative observations (odour, visual discharge), describe what the alert condition looks like as specifically as possible.

Q: Does the RMMP need to be certified or submitted to EPA?

Under OL_G5, you are not required to submit your RMMP to EPA for approval unless directed to do so. You are required to maintain a current, compliant RMMP and make it available to EPA on request. EPA may review it during a scheduled licence audit, a complaint-response inspection, or an incident investigation. The obligation to ensure compliance sits entirely with you.