Management system guidance
9.1 Monitoring, Measurement, Analysis and Performance Evaluation
ISO Navigator Pro™ is a free tool that provides practical, expert guidance for businesses wishing to interpret and better implement the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018.
Our range of ISO templates cover the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018, and offer an easy way to implement your next management system.
9.1.2 Evaluation of compliance
ISO 45001 clause 9.1.2 requires your organization to establish, implement and maintain a process(es) for evaluating compliance with the legal requirements and other requirements it has determined under 6.1.3. It is not enough to hold a register of legislation; you need to check, at planned intervals, that each requirement is actually being fulfilled.
What the standard requires
Your organization must:
- Decide how often, and by what method(s), compliance will be evaluated;
- Carry out the evaluation and take action where needed, using the process in 10.2 Incident, nonconformity and corrective action;
- Keep up-to-date knowledge and understanding of where it stands in relation to its legal requirements and other requirements;
- Retain documented information of the results of each compliance evaluation.
Frequency and methods
The frequency and timing of compliance evaluations can vary according to the importance of each requirement, changes in operating conditions, changes to legal requirements and other requirements, and your organization's past performance. A statutory examination of lifting equipment, for example, has a fixed legal interval, whereas a general fire risk assessment review may be triggered by changes to premises or occupancy.
A variety of methods can be used to evaluate compliance and to keep knowledge of your compliance status up to date, including:
- Internal audits that include legal compliance in their scope (see 9.2);
- Workplace inspections and safety tours;
- Reviews of documented information, such as thorough examination reports, permits, licences, training records and health surveillance records;
- Exposure monitoring results compared with legal exposure limits;
- Interviews with workers and their representatives, and observation of work;
- Reports and correspondence from enforcing authorities, insurers and other external parties;
- Evaluation by a competent external adviser where specialist knowledge is needed.
Remember that the evaluation covers other requirements too – for example collective agreements, client and contractual OH&S requirements, corporate standards, industry codes of practice and insurance conditions to which your organization has subscribed.
Taking action
If an evaluation reveals a failure to fulfil a legal requirement or other requirement, it should be treated as a nonconformity and actioned through your incident, nonconformity and corrective action process. This may involve contacting the relevant regulator to agree the action to be taken and a timescale. The causes and contributing factors of any non-compliance should be analyzed and addressed, and your assessment of OH&S risks reviewed where appropriate.
Maintaining knowledge of compliance status
Top management should be able to explain the organization's current compliance status at any time. A simple compliance register that lists each requirement alongside the date of the last evaluation, the result, any open actions and the next due date is an effective way to demonstrate this. Results of compliance evaluations are a required input to management review.
A certification auditor will not verify your compliance with every law, but will assess whether your evaluation process is effective and whether you understand your compliance status. Your organization therefore needs means of evaluation – inspections, tests, audits – that are frequent and robust enough to keep that understanding current.
You should seek and record evidence that your organization has a process for evaluating compliance with its legal requirements and other requirements; that the frequency and methods of evaluation have been defined; that evaluations have been carried out and any gaps actioned; that the organization understands its current compliance status; and that documented information of the compliance evaluation results has been retained.
More information on PDCA
Planning
Context
Planning
Support
Doing
Support
Operations
Checking
Monitoring, measurement, analysis and evaluation
Acting
Improvement
Want to know more?
- Read our customer's feedback
- Client list - who's using our templates?
- How the templates are formatted and download examples
- Why we use turtle diagrams and process maps
- What's the difference between a process and a procedure?
- About documented information
SSL certification
A certificate guarantees the information your internet browser is receiving now originates from the expected domain - https://www.iso9001help.co.uk. It guarantees that when you make a purchase, sensitive data is encrypted and sent to the right place, and not to a malicious third-party.
Free PDCA guidance
ISO Navigator™ is our FREE online training tool that shows you how to apply the principles of PDCA to your operations. We also offer many helpful templates that get you on the road to documenting your management system, please visit the download page.