Posted By Graham Russell A question regarding the inclusion of section 4.5.2 Evaluation of compliance in the 2007 revision of the standard. Without an up to date version of 18002 I am unsure what should be included in a procedure to cover this section. Can anyone provide some information on what should be covered and what audit evidence would be required. Thank you.

Posted By David Balkwell Hello Graham More than happy to explain this and forward you process/procedure guidance As a Certification Body Assessor for the last 18yrs and over 3500 days of ISO9001 ISO14001 OHSAS18001(now BS OHSAS18001:2007) certification assessment But not online............. I also have some transition ie OHSAS18001:1999 to BS OHSAS18001:2007 guidance if anyone wants it davidbalkwell@mobileemail.vodafone.net Regards David

Posted By David Balkwell Hi Bob I am more than happy to talk to any one off line There were good reasons for 4.5.2 being a separate clause and I contributed enough effort into ISO14001:2004 draft and BSOHSAS18001:2007 draft to agree and be quite clear of the requirements and benefits of the split And as co-founder of OHSAS18001:1999 I am quite passionate about this I could go on but please feel free to contact off line I could give my business name but I'm not allowed :) Drop me an email on.............. davidbalkwell@mobileemail.vodafone.net regards David

Posted By Carl Deaves I would expect to see more than a list of what is involved. I have seen thi clause addressed by expanding the legal register on landscape sheets to provide an overview of requirements of each piece in one column, the documents and records used to evidence compliance in the next and the final column left blank and used for the "CHECK" which can be lists os samples taken during internal audits. Hope this helps Carl

Posted By Robert K Lewis David Audits etc are part of a different clause. This one does require a register of legislation but a procedure to ensure that the organisation complies with the requirements of the "legal and other requirements" affecting the organisation. Bob

Posted By David Balkwell As this seems to be attracting some interest I will further the discussion I am a Lead 9K 14K 18K Certification Auditor for 9 certification bodies and was the co-founder of OHSAS18001:1999 I spent 10yrs as an operations manager or a leading certification body before leaving to do my own thing in 1999 Evaluation of Compliance is one of the most underestimated sections in BSOHSAS18001:2007 (And ISO14001:2004) Starting at the beginning – During the 14k 2004 drafting a selection of ISO14001 users were asked a number of questions, one of the questions was do you feel that certification to 14k helps demonstrate legal and requirements compliance ? 95% said no – well this caused quite a stir as it was in fact already contained in monitoring and measurement (ie the need to check legal compliance) – So the committee decided to add a new section called Evaluation of Compliance They could have added it to Internal Audit – but didn't as this would add a whole series of questions ie compliance evidence coverage ie at what point will you have completed the task cycle and what about auditor legal knowledge So it was kept separate plus the clear distinction made having identified the division in Policy requirements and legal management to separate Legal and Requirements – two different things So.............................. The function of periodic evaluation of legal and requirements compliance is coming under greater scrutiny from certification bodies. European co-operation for Accreditation (http://www.european-accreditation.org ) is in the process of adopting new informative guidance on "The relationship between ISO 14001 management system conformity assessments and Regulatory Compliance". The guidance is intended to be used by accreditation and certification bodies, as well as organisations using ISO 14001 as their EMS. The latest draft of the guidance distinguishes between the role of the internal EMS audit and the periodic evaluation of legal compliance: -the internal EMS audit is to be used to ensure that the system as a whole (including the commitment to comply with applicable legislation and requirements is undertaken) is challenged for compliance -and Evaluation of Compliance, to undertake periodic evaluations of legal and requirement compliance as a separate function as planned, but shouldn't be used to carry out audit functions of the system. This has implications on the way that organisations structure both their internal EMS audit arrangements and their periodic evaluation of compliance. It's also worth noting that the guidance states that "It is the organisation’s responsibility, and a function of the EMS, to ensure that the organisation periodically evaluates compliance with each and every applicable legal requirement and that it is aware of its compliance status." Although auditing can be used to support this, (dependent upon the size scale and complexity of the organisation) sampling just a few legal requirements and then assuming that this represents compliance with "each and every legal requirement.." wouldn't be acceptable. See UKAS document http://www.european-accr...n.org/n1/doc/ea-7-04.pdf Section 3.7.2 and 4 are key (And support the content of this posting) Anyway the same logic is being applied to EofC for BSOHSAS18001:2007 The idea is to keep separate from Audit to allow for clarity and to follow a plan:(although for very low impact organisations it is possible to combine with audit - each case is different) It is possible to consider ranking the entries on the register of legal and requirements ie H M L with respect to impact significance - and linkage into aspect evaluation / risk assessment and operational control Then it is possible to use this information ie the impact (what the legislation means to the business) as a question set to test compliance and therefore prove evaluation of compliance has taken place The ranking would help demonstrate impact/significance has been recognised and importance attached to test plus it is then easier to plan/schedule based upon significance Do it in line with the Management Review/Audit Cycle so that feedback in relation to So How Compliant are we” can be challenged at the Management Review Also bear in mind the need to be stronger with respect to corrective and preventive action especially findings closeout period ie asap that day for obvious reasons (a finding reflects a breach or possible breach and needs to be dealt with straight away - well as straight away as practically possible As usual I am happy for any further off line discussion @ davidbalkwell@mobileemail.vodafone.net Regards David

Posted By Robert K Lewis David Excellent summary of this important clause. Just wonder whether it will be remembered by those involved. Doubtless like you I see many organisations who see this clause as simply checking that they have listed all relevant legislation and other requirements pertaining to the business. Bob

Posted By R Joe David / Bob Interesting discussion. Putting 18001 to one side for a moment, however, isn't the underlying issue the often very narrow, unquestioning approach to OHS auditing? There isn't in my experience a one size fits all OHS audit that can be rolled out annually to confirm all aspects of OHS management or all aspects of OHS legal compliance. If an informed debate takes place as part of the bigger picture of internal control at the start of the annual audit programme, a question about what aspects of legal OHS compliance need to be audited, why, and what level of confidence is being sought, should be part of this. There are many aspects of OHS that can be audited, the issue is understanding what is needed over the next 12 months and why (as well as where to best target resources). This is where many approaches to OHS auditing fall down, they are too regimented, restrictive and silo based. Used as you would like to see it, 18001 takes account of this I suspect, the danger is that used as many practitioners seem to approach it, it provides one unquestioning approach to replace another. Just a thought.