Management system guidance
6.1 Address Risks and Opportunities
ISO Navigator Pro™ is a free tool that provides practical, expert guidance for businesses wishing to interpret and better implement the requirements of ISO 9001:2015, ISO 14001:2015 and ISO 45001:2018.
Our range of templates cover the requirements of ISO 9001:2015, ISO 14001:2015 and ISO 45001:2018, and offer an easy way to implement your next management system.
6.1.3 Legal and other requirements
Legal requirements can result in risks and opportunities to the organization and may arise from mandatory requirements, applicable laws and regulations, voluntary commitments such as organizational and industry standards, contractual relationships, principles of good governance and community and ethical standards. Maintain documented information on legal, and other requirements. The introduction of new legislation and changes to current legislation can be monitored through following sources:
- NETRegs service www.netregs.gov.uk
- Environment and Health & Safety www.cedrec.com/home/index.htm
- Health & Safety www.croner.co.uk
- Health & Safety www.hse.gov.uk/guidance/index.htm
- Relevant publications and professional bodies.
Using your Legal and Other Requirements Register, determine the compliance obligations related to your environmental aspects and the legal requirements associated with OHS hazards. These may arise from mandatory requirements; applicable laws and regulations, voluntary commitments such as organizational and industry standards; contractual relationships; principles of good governance and community; and ethical standards. The needs and expectations from interested parties only become obligatory requirements for an organization if it chooses to adopt them.
Identifying legal requirements
Form a review team comprising relevant Department Managers to actively identify any relevant mandatory and voluntary legal and other requirements, and determine how impacts associated with non-compliance should be mitigated. The Health and Safety Manager should employ several techniques to track, identify, and evaluate applicable safety related legal and other requirements including;
- Listing out all the hazardous chemicals with their maximum quantities that are stored and used at any given time.
- Listing out the properties of all the hazardous chemicals from their respective MSDS/SDS and COSHH assessments;
- Listing out the characteristics of all the activities, operations, and process inputs based on the available and measured data, or by the information provided by suppliers;
- Conducting detailed risk assessments and determine their risk level. All risk-control methods must take the relevant legal requirements into account;
- Taking into account arrangements for the preventive maintenance of plant and equipment, which may also be covered by legal requirements;
- Determining whether a piece of legislation is ‘relevant’ or ‘irrelevant’.
- Identifying and maintaining legal and other requirements related to safety from the interested parties;
- Identifying statutory inspections in order to fulfil the legal requirements, e.g. LOLER/PUWER.
- Determining whether your organization is compliant with the legislation:
- Describe how the legal requirements apply;
- Describe what controls are in place to manage the requirement;
- Describe what controls are in place to mitigate the related health and safety hazard.
- Determining the applicable controls defined in the respective assessments. Applying recognised legal and industry principles to determine and demonstrate ALARP for all identified risks and hazards;
- Preparing a list of applicable requirements from all the applicable legislation and linking them to the identified health and safety risks;
- Defining the criteria of operational controls as specified in the rules or from other sources (manufacturer’s manual, industrial best practices manual, historical data, information available on public domain, guidelines or from experts);
- Determining the level of compliance in respect of all the identified requirements from all the applicable legislation as they apply to:
- Procedural requirements;
- Operational requirements;
- Monitoring requirements.
- Assigning responsibilities across the organization for compliance and reporting;
- Subscribing to an external agency for regular legislation updates;
- As and when any update or change in legal requirement occurs, the above steps are repeated.
Document all applicable health and safety legal requirements and other requirements that apply to your organization’s processes using the Legal and Other Requirements Register. The introduction of new legislation, changes to existing legislation, or new government agendas, charters or policies should be considered Top management, and if considered to be of particular relevance to relevant health and safety hazards, it should then assessed and cascaded to relevant process owners as quickly as practicable.
Evaluating legal requirements
The Health and Safety Manager must assess all relevant occupational health and safety related legal requirements, regulations and Approved Codes of Practice (ACoPs) using http://www.legislation.gov.uk to ensure that all identified occupational health and safety hazards are evaluated and understood in terms of current legislation, including as appropriate:
- Health and Safety at Work Act 1974;
- The Regulatory Reform (Fire Safety) Order 2005;
- Workplace (Health, Safety and Welfare) Regulations 1992;
- Management of Health and Safety at Work Regulations 1999;
- Reporting of Injuries, Diseases and Dangerous Occurrences Regulations (RIDDOR) 2013;
- Control of Substances Hazardous to Health Regulations (COSHH) 2002;
- Safety Representatives and Safety Committees Regulations 1977;
- Health and Safety (Consultation with Employees) Regulations 1996;
- Building Regulations 2000;
- Lifting Operations and Lifting Equipment Regulations (LOLER) 1998;
- Provision and Use of Work Equipment Regulations (PUWER) 1998;
- Health and Safety (First Aid) Regulations 1981.
The Health and Safety Manager is often responsible for ensuring this information is kept up-to-date and communicating relevant information on compliance with legal and other requirements to relevant stakeholders or interested parties and for management review.
Determining other requirements
Other requirements include the requirements of interested parties and workers, national and international standards, contract requirements, business codes, guidance notes, code of practices, other technical memoranda and other practice notes produced by government agencies as well as professional institutions.
- Subscription to publisher legal update newsletters;
- Membership of trade associations;
- Research via reputable government websites;
- Use of competent consultants;
- Competent employee membership of occupational health and safety institutes;
- Employee attendance of occupational health and safety training courses.
The evaluation of other requirements should be documented within the Legal and Other Requirements Register in order to identify and demonstrate applicability.
Documenting legal requirements
Your organization should maintain an indexed list of relevant legal requirements, and other requirements such as standards and procedures in connection with identified safety critical tasks and associated hazards by referencing the minimum acceptable legal, industry standards and technical specifications against the associated equipment and operating routines at your facility. Information in the register for each requirement includes but is not limited to:
- Title and description of the legal and other requirement;
- Description of how the requirement applies and whether relevant licenses or approvals are required;
- Title and description of supporting documents that demonstrate compliance;
- How compliance is verified.
The Legal and Other Requirements Register must be reviewed and updated for adequacy, both for new regulations and updated regulations, and communicated to relevant staff whose responsibilities or actions can affect compliance.
Updating legal requirements
Departmental Managers should inform a member of Health and Safety Committee of any changes to the requirements relevant to their functions or departments, so as to ensure that up-to-date copies of the legal and other requirements relevant to their departments are accessible.
Legal and other requirements should be reviewed for applicability on a regular basis with assistance from the automatic emails received whenever legislation is updated or is newly published. Legislative requirements are kept up to date through membership of peak professional bodies and subscription to legislative updating services. Sources of legal information are also gathered in many ways including:
- Information from trade associations;
- The internet and email lists;
- Outside consultants;
- Direct communication with regional, national, and local agencies;
- Networking with industry peers;
- Industry trade shows;
- Industry publications;
- Participation in professional organizations;
- Training courses on health and safety laws.
The introduction of new legislation, changes to existing legislation, or new government agendas, charters or policy is of particular relevance and importance to your organization it should then be cascaded to relevant employees as quickly as practicable. Review the Legal and Other Requirements Register, specifically to:
- Determine whether a piece of amended legislation, or new legislation is ‘relevant’ or ‘irrelevant’;
- Determine whether our organization is compliant with the legislation whilst describing how the requirements apply and what controls are in place to manage the requirement and mitigate related health and safety hazards;
- Undertake a periodic review of legal requirements, and other standards and codes of practice when changes are planned to ensure continued compliance;
- Determine whether other legal requirements relevant to our organization and those that we have adopted whilst describing how the requirements apply and what controls exist to remain compliant.
Each update received should be reviewed for relevance and a record of the review is retained. The Legal and Other Requirements Register should be amended and communicated, where necessary, within one calendar month. Report findings are communicated during management review meetings.
Monitoring compliance status
The compliance audit frequency is reduced when repeat compliance audits find zero non-compliances. Where additional legal requirements are identified when the list of legal requirements is reviewed by the compliance auditor, these are reviewed and considered by Top management. Nonconformities resulting from the legal compliance audits must be recorded, actioned and tracked according to your nonconformity and corrective action process.
More information on PDCA
More information on PDCA
Planning
Context
Planning
Support
Doing
Support
Operations
Checking
Monitoring, measurement, analysis and evaluation
Acting
Improvement
Want to know more?
- Read our customer's feedback
- Client list - who's using our templates?
- How the templates are formatted and download examples
- Why we use turtle diagrams and process maps
- What's the difference between a process and a procedure?
- About documented information
SSL certification
A certificate guarantees the information your internet browser is receiving now originates from the expected domain - https://www.iso9001help.co.uk. It guarantees that when you make a purchase, sensitive data is encrypted and sent to the right place, and not to a malicious third-party.
Free PDCA guidance
ISO Navigator™ is our FREE online training tool that shows you how to apply the principles of PDCA to your operations. We also offer many helpful templates that get you on the road to documenting your management system, please visit the download page.