Clause 6.1.3: Determination of legal requirements and other requirements in ISO 45001 requires the identification and documentation of legal requirements and other requirements applicable to your organisation.
Your legal and other requirements, along with other elements such as occupational health and safety hazards, play a pivotal role in an organisation’s health and safety performance and in the effectiveness of its safety management system.
In this blog, I explain the clause requirements of 6.1.3 and how to meet them and detail other ISO 45001 clauses that incorporate the determination of legal and other requirements.
Understanding legal requirements and other requirements
“Legal requirements” includes all the occupational health and safety-related obligations and other sources that an organisation must comply with. “Other requirements” are the non-mandatory occupational health and safety-related requirements an organisation has voluntarily chosen to commit to.
Some sources of legal requirements
- Applicable laws and legislation (federal, state/territory and local)
- Australian and International standards called up in legislation
- Codes of practice called up in legislation
- Site licences, permits, consents and other forms of authorisation
- Orders or rules from regulatory agencies
- Judgements of courts or administrative tribunals
- Collective bargaining agreements.
Some sources of other requirements
- Contractual conditions
- Employment agreements
- Australian, International and industry specific standards not called up in legislation
- Codes of practice, guidelines and other documented information not called up in legislation
- Voluntary commitments to government or interested parties
- Public commitments
- Interested party undertakings voluntarily agreed to.
Complying with the requirements of Clause 6.1.3
Clause 6.1.3 of ISO 45001 requires an organisation to establish, implement and maintain processes that determine, document, apply and assess both legal and other requirements that are applicable to the organisation’s OH&S management system and health and safety performance.
The process detailed below demonstrates how this can be achieved in accordance with the ISO 45001 Standard. This process is used by our expert health and safety consultants and is available as part of Environment Essentials Safety Management System Documentation Package.
Determining your legal requirements and other requirements
Your legal and other requirements can be identified from the following sources:
- legal obligations related to your identified occupational health and safety hazards;
- employee agreements;
- any site documents with occupational health and safety legal requirements such as licences, permits, consents or orders;
- internal health and safety policies and objectives;
- contracts with third parties and site insurance policy conditions;
- needs and expectations from interested parties that your organisation choses to adopt as an obligation.
In addition to identifying your legal and other requirements, you also need a comprehensive understanding of these requirements and how they can be applied to your organisation’s operations.
This type of information can be sourced by:
- subscribing to a workplace health and safety online legal obligation directory such as Environment Essentials SafetyLaw and HSE LawGuides, or a similar service;
- engaging an external workplace safety consultant; or
- manually searching government websites.
Documenting your legal and other requirements in an OH&S management system legal register
Your identified legal and other requirements must be readily available to staff, and this can be achieved with a legal requirements register. These requirements should include non-mandatory obligations or voluntary undertakings the organisation has chosen to commit to, and any needs and expectations of interested parties adopted as an obligation.
You may also want to include in your legal register additional information such as the source of the requirements and any compliance actions required. And for ease of compliance monitoring and auditing, consider separating the legal and other requirements into their specific groups (i.e. applicable laws versus internal documented information).
Maintaining the documented information in your legal register
The legal and other requirements documented in your legal register need to be regularly reviewed and updated.
Changes to your legal and other requirements may impact your occupational health and safety hazards, your practices and the overall legal compliance and safety performance of your OH&S management system.
It is important to have a process in place to identify, record and respond to any updated legal and other requirements within your safety management system. This includes monitoring changes to health and safety legislation and other sources such as site-related regulatory documents, notices from regulatory authorities or needs and expectations from interested parties.
Environment Essentials’ online directories, SafetyLaw and HSE LawGuides provide an automatic monthly update service. Alternatively, this monitoring can be performed manually; just ensure that it is scheduled in and conducted regularly.
You may also need to respond to these changes with modifications to site practices, procedures and other documents to address the updated legal or other requirements. Also determine if any new risks and/or opportunities have been created from the updated requirements, and make any required amendments to operational controls, monitoring activities, emergency procedures, safety induction and training materials, etc.
Ensure you retain records of your update review process and include in those records:
- notes on the legal and other requirement changes;
- a list of significant changes to management system documentation resulting from the requirement changes;
- evidence that these changes have been made and communicated.
Involve staff in this work as their engagement can encourage greater compliance efforts.
Evaluating compliance with your legal and other requirements
Assess compliance with your legal and other requirements via legal compliance audits. This is a requirement of Clause 6.1.3 and Clause 9.1.2 in the ISO 45001 Standard. Legal compliance audits can be conducted by internal and external auditors; Environmental Essentials has an auditing service which can assist with these.
Legal compliance audits are used to to identify actual and potential non-compliance with your legal and other requirements. These audits should be scheduled at a frequency related to your risk of non-compliance, however at a minimum, they should be undertaken annually.
The lead auditor performing the audits should be familiar with your legal and other requirements and must be independent of (i.e. not have responsibility for) the processes being audited.
Results from the audits should be communicated to top management (generally as part of papers prepared for management review meetings) and also to responsible parties as appropriate.
Regular audits and compliance monitoring of your legal and other requirements, and your safety management system as a whole, is not just imperative for maintaining compliance with the ISO 45001 Standard, it is also for:
- assessing whether your safety management system is achieving its intended outcomes;
- evaluating continuous improvement efforts to help achieve those intended outcomes;
- identifying potential hazards;
- fulfilling occupational health and safety policy commitments; and
- evaluating a myriad of other elements that are crucial to your overall healthy and safety performance.
The intersect of other ISO 45001 clauses with the determination of legal requirements and other requirements
Your identified legal and other requirements inform other areas of your management system and can aid your conformance with other ISO 45001 clauses.
Determining your occupational health and safety hazards, risks and opportunities
As previously mentioned, your occupational health and safety hazards will guide you in determining legal and other requirements, but conversely, your legal and other requirements can also be useful in bringing to mind additional potential hazards, risks and opportunities.
Developing and implementing health and safety objectives
Your legal and other requirements should also be considered when developing specific and measurable improvement goals within your safety management system to help mitigate risks and improve overall health and safety performance. This is a requirement of clauses 6.2.1 and 6.2.2.
Ensuring compliance with competence and awareness
All workers, including contractors, should have a general awareness of your legal and other requirements and also the personal and safety consequences for “breaking the rules”. This awareness should be provided through training programs and other forms of communication such as internal policies.
All personnel whose work has the potential to contravene an occupational health and safety legal requirement should be aware of the relevant legal requirements and trained in the appropriate operational controls. This is a requirement of clauses 7.2 and 7.3.
Establishing communication streams
Consider your legal and other requirements when establishing your internal and external communication processes for dissemination of information. This is a requirement of clause 7.4.