Evaluation of Compliance with Legal and Other Requirements
How to identify legal and other requirements, evaluate compliance and prove it to auditors and regulators
Key takeaways
- ISO 14001 and ISO 45001 both require a process to determine compliance obligations or legal requirements, and to evaluate compliance periodically (clause 9.1.2).
- A register of legislation is not enough; each requirement must be translated into what it means for your site.
- Evaluation of compliance is a check against evidence: permits, measurements, inspections, certificates and records.
- The frequency of evaluation should depend on the risk and the nature of the requirement.
- Results go to management review, and non-compliances are handled through corrective action, with urgent escalation where needed.
1. From legislation to site obligations
| Step | Output |
|---|---|
| Identify applicable sources | Laws, regulations, permits, licences, local authority conditions, customer and industry codes the organisation chooses to follow |
| Interpret | What each requirement means for this site: limits, frequencies, reports, competencies, equipment |
| Assign | Owner for each obligation and the process where it is implemented |
| Implement | Procedures, controls, monitoring and records |
| Evaluate | Periodic check that each obligation is met, with evidence |
| Update | Monitoring of legal changes and new permits |
2. Building a useful register
| Column | Purpose |
|---|---|
| Source and reference | Law, regulation, permit number, authority |
| Requirement in plain language | What must be done, measured or reported |
| Applicability | Which activities, areas or equipment |
| Owner | Person responsible |
| How it is met | Procedure, control or contract |
| Evidence | Records that show compliance |
| Evaluation frequency | Based on risk |
| Last evaluation and result | Date, compliant or not, comment |
Specific article numbers should be checked with the competent authority or a legal adviser; the register should state where interpretation was confirmed.
3. Typical obligations to consider
| Area | Environmental examples | OH&S examples |
|---|---|---|
| Permits and licences | Environmental permit, wastewater discharge consent | Operating licences, civil defence approvals |
| Emissions and discharges | Air emission limits, wastewater parameters | Workplace exposure limits for noise, dust and chemicals |
| Waste | Licensed waste carriers and disposal, transfer records | Safe handling of hazardous waste |
| Equipment | Refrigerant handling, fuel storage | Inspection of lifting equipment, pressure vessels, fire systems |
| Competence | Certified technicians for refrigerants | Trained first aiders, forklift operator licences |
| Reporting | Annual environmental reports | Incident reporting to authorities |
4. How to evaluate compliance
Evaluation is more than reading the register. Methods include:
- Reviewing monitoring results against permit limits.
- Checking certificates and inspection reports for validity and dates.
- Site inspections to confirm physical requirements (bunds, guards, signage, fire exits).
- Interviews with responsible staff.
- Reviewing correspondence with regulators.
- Including compliance checks in internal audits.
The result for each obligation should be clear: compliant, not compliant, or not yet assessed, with evidence referenced.
5. Frequency
| Type of obligation | Suggested approach |
|---|---|
| Continuous limits with high risk (e.g. discharge limits) | Monthly or per monitoring cycle |
| Periodic inspections (lifting equipment, fire systems) | At least as often as the legal inspection interval |
| Administrative requirements (licence renewals, reports) | Before due dates, tracked in a compliance calendar |
| Low-risk general requirements | At least annually |
6. When non-compliance is found
- Assess the risk and whether immediate action or notification to an authority is required.
- Correct the situation and record the correction.
- Investigate the root cause.
- Take corrective action and verify its effectiveness.
- Report to top management and include in management review.
Organisations should also maintain knowledge and understanding of their compliance status, which auditors often test by asking managers directly.
7. Common weaknesses
- A long list of laws with no interpretation for the site.
- Evaluation recorded as “compliant” without evidence.
- Expired certificates or permits not detected.
- No process to monitor new or changed legislation.
- Compliance status not reported to management review.
Conclusion
Evaluation of compliance turns legal requirements from a list into assurance. A register written in plain language, owners for each obligation, evidence-based checks and a compliance calendar give management real knowledge of the organisation’s legal position.
Choose five obligations from your register and ask: what evidence shows we complied last month?