Introduction

In the previous article, “[ISO 45001 Series] Planning: Overview and Hazard Identification,” I spent considerable time explaining the PDCA process and principles of an occupational health and safety management system. I also proposed a hazard-identification method designed to reduce omissions: build a hazard checklist from applicable occupational safety and health legislation and use it to structure the discussion of hazard categories.

In this article, I want to discuss how ISO 45001 addresses the determination of legal requirements and other requirements, together with a practical way to carry out the work.

ISO 45001 Requirements for Determining Legal and Other Requirements

Under ISO 45001, the purpose of determining legal requirements and other requirements is to identify current requirements applicable to hazards that have already been identified, as well as current requirements relevant to OH&S risks and the occupational health and safety management system.

ISO 45001 does not prescribe a particular method or procedure for determining these requirements. It indicates that legal requirements may include: (a) national, regional, or international legislation and regulations; (b) decrees and directives; (c) orders issued by regulators; (d) permits, licences, or other forms of authorization; (e) judgments of courts or administrative tribunals; (f) treaties, conventions, and protocols; and (g) collective bargaining agreements. CNS 45001 indicates that other requirements may include: (a) organizational requirements; (b) contractual conditions; (c) employment agreements; (d) agreements with interested parties; (e) agreements with health authorities; (f) non-regulatory standards, consensus standards, and guidelines; (g) voluntary principles, codes of practice, technical specifications, and charters; and (h) public commitments made by the organization or its parent organization.

The organization must determine how current legal and other requirements apply to it, which requirements need to be communicated, and how they will be taken into account when establishing the occupational health and safety management system.

Recommended Practical Approach

Why I Changed the Sequence

Readers who are somewhat familiar with ISO 45001 may notice that the sequence used in this series differs from the order in which the requirements appear in the standard.

Within the “Planning” section and its requirements for “Actions to Address Risks and Opportunities,” the sequence in the standard moves through hazard identification, assessment of risks, assessment of opportunities, and then the determination of legal requirements and other requirements.

To explain why I use a different sequence, we first need to look at the purpose of determining legal and other requirements.

This step is intended to find current legal and other requirements applicable to hazards identified in the initial review. For example, occupational safety and health legislation may require guardrails where work at height exposes workers to fall hazards. The organization must then determine how those current requirements apply and take them into account within its occupational health and safety management system.

As suggested in “[ISO 45001 Series] Planning: Overview and Hazard Identification,” an organization can use a hazard-identification checklist and add items drawn from legislation and other requirements that apply specifically to the organization. In other words, creating the checklist already involves reviewing the current legal and other requirements applicable to each hazard.

I therefore believe that determining legal and other requirements should immediately follow the initial hazard-identification step. In practice, that creates a smoother and more efficient workflow.

More specifically, when identifying hazards, the organization can identify both the relevant sources and the hazards they address while also recording the legal and other requirements applicable to those hazards. This integrates the two steps and reduces the likelihood of omissions.

Reviewing Legal Requirements

To provide useful input for the later assessment of risks and opportunities, this article draws on practical guidance[1] and divides the review of legal requirements into two parts: an applicability review and a compliance review.

Legal Applicability Review

A legal applicability review determines which legal requirements apply to particular job titles or work activities within the organization. The following form is an example that readers can adapt.

Sample legal applicability review form
Sample Legal-Requirement Applicability Form

For an applicability review, the organization should identify relevant legislation as thoroughly as possible by considering its characteristics, workers’ activities, and whether any workers belong to particular groups, such as migrant workers or women who work at night. Each requirement should then be reviewed to determine whether and how it applies.

The organization must also make sure that it is reviewing the current amended version of each requirement rather than relying on superseded legislation.

For this part of the process, I recommend using the worker and work-environment inventory forms introduced in “[ISO 45001 Series] Identifying Internal Issues in the Context of the Organization.” Reviewing the information together can reduce duplicate work and save time.

Legal Compliance Review

A legal compliance review examines each article, paragraph, and subparagraph of the requirements already found to apply and checks whether the organization’s current practices comply. The following form is an example of how the review can be recorded.

Sample legal compliance review form
Sample Legal-Requirement Compliance Form

Occupational safety and health rules, regulations, and guidance are often issued under enabling provisions in parent legislation such as the Occupational Safety and Health Act. To help the organization review the relationships among applicable instruments, the sample form includes a field for the “enabling authority in parent legislation.” This allows the organization to identify the statutory authority for relevant regulations, enforcement rules, or guidance during the review.

Where a legal requirement calls for it, the organization may need workplace environmental monitoring to confirm compliance. For example, the Standards of Permissible Exposure Limits at Job Site, promulgated under Article 12, Paragraph 2 of the Occupational Safety and Health Act, prescribe permissible concentrations of hazardous substances in the working environment. The organization must review the workplace in accordance with the applicable standards and monitoring requirements to determine whether its current conditions comply.

Reviewing Other Requirements

Other requirements do not necessarily carry the same statutory force as legal requirements. When building the hazard checklist described above, the organization can therefore consider its relationship with the party raising a requirement and the requirement’s potential effect on the organization when deciding how to include it, then evaluate whether current practices conform to it.

For other requirements, I do not believe a separate legal-applicability review is necessary; the organization can focus on evaluating conformity. Because other requirements differ from legal requirements in their source and content, I use a separate sample form below.

Sample compliance review form for other requirements
Sample Other-Requirements Compliance Form

For other requirements, the source and substance of the requirement are especially important. I recommend including requirements that are as clear and specific as possible. If a requirement is unclear, the organization can ask the source to clarify what is intended or negotiate wording that can be evaluated and incorporated into the occupational health and safety management system.

For example, nearby residents—external interested parties—might demand that an organization achieve “zero pollution.” Because “zero pollution” is unclear and, strictly speaking, may be impossible to achieve, the organization could discuss the expectation with residents and agree on a more measurable requirement, such as keeping hazardous substances below applicable statutory limits.

Conclusion

Both hazard identification and the determination of legal requirements can easily miss important items. During hazard identification, I use the legal requirements applicable to the organization to narrow and structure the hazard categories and process, reducing the risk that hazards will be overlooked.

Under this more concrete design for the planning process, legal requirements have already been reviewed once during hazard identification. The later legal-requirements step therefore becomes much easier. An organization may even combine the two activities into one integrated step, making the overall process far more efficient.

This is why the occupational health and safety management procedure I later developed does not follow the same sequence as the clauses in ISO 45001.

For other requirements, “[ISO 45001 Series] Defining External Interested Parties and External Issues” already explains how to discuss needs and expectations through different categories of external interested parties. Organizations can use that context here when determining other requirements for the occupational health and safety management system.

Although the sequence I use differs slightly from the order in ISO 45001, it is a process design that I believe works better in practice. I hope it offers a useful reference for readers who need one.

In the next article, I will discuss how to assess risks and opportunities for improvement after hazard identification and the determination of legal and other requirements. See you in the next article : ).

References

[1] Industrial Development Bureau, Ministry of Economic Affairs. Practical Handbook for Promoting Occupational Health and Safety Management Systems in Manufacturing—ISO 45001, 2019, pp. 67–74.