Internal Control Regulations – Everything Your Business Needs to Know

Complete Overview: How to Comply with the Internal Control Regulations

For many business leaders, the term “Internal Control Regulations” may seem both dry and overwhelming. It conjures up images of thick binders, bureaucracy, and endless checklists. But what if we told you that these regulations are actually one of your most important toolkits for building a safe, efficient, and profitable business? Understanding and implementing systematic HSE practices isn’t just a legal obligation—it’s an investment in your employees, your reputation, and your bottom line. In this blog post, we break down everything you need to know about internal controls, from the legal requirements to practical implementation in your day-to-day operations.

What are the Internal Control Regulations and systematic HSE work?

Let's start with the basics. The official name is “Regulations on Systematic Health, Safety, and Environmental Work in Enterprises,” but it is commonly known as the Internal Control Regulations. At the heart of the regulations is the requirement that all enterprises work systematically with health, safety, and the environment (HSE). This means moving from a reactive approach—where one only responds when accidents or injuries occur—to a proactive approach where one actively works to prevent them from happening in the first place.

Systematic HSE work is therefore an ongoing process, not a one-time event. It is about building a structure and a culture within the company where HSE is an integral part of daily operations. The goal is to create a fully safe working environment, prevent health hazards, protect the external environment from pollution, and ensure that the business operates in accordance with applicable laws and regulations.

This involves:

• Have clear goals for your HSE efforts.
• Be aware of the hazards and risks present in the workplace.
• Have a plan in place to manage and reduce this risk.
• Ensure that all employees have the necessary training and knowledge.
• Have procedures in place to identify and correct errors and omissions.
• Regularly review and improve the system.

An effective internal control system provides predictability, reduces costs associated with sick leave and accidents, and strengthens the company’s competitiveness. It is the foundation for all other HSE work within the organization.

Legal Requirements and Basis in Norwegian Law: Who Is Covered?

An understanding of the law is essential for the proper implementation of internal controls. The regulation is not an isolated rule, but a central part of a broader legal framework governing Norwegian working life.

Who is subject to the Internal Control Regulations?

The answer is simple and clear: All businesses. Section 2 of the regulation stipulates that it applies to any business covered by the Working Environment Act, the Pollution Control Act, the Civil Protection Act, or other relevant laws. This includes:

• Private limited liability companies (AS) and public limited liability companies (ASA)
• Sole Proprietorship with Employees
• Government agencies and municipalities
• Nonprofit Organizations and Foundations
• Small craft businesses and large industrial conglomerates

In practice, this means that as soon as you have an employee, you are fully required to have an internal control system in place. Even sole proprietorships without employees are subject to certain provisions of the law, although the requirements for systematic procedures and documentation are less formal.

Relationship to the Working Environment Act (AML)

The Internal Control Regulations are regulations issued pursuant to, among other things, the Working Environment Act (AML). The AML can be viewed as the “constitution” for the working environment, while the Internal Control Regulations serve as a detailed “user manual” for how to fulfill some of the key obligations under the Act. Section 3-1 of the AML establishes the employer’s overarching duty to ensure a fully safe working environment. The Internal Control Regulations specify what it means to work systematically to achieve this.

Understanding these relationships is crucial, especially for managers. A manager cannot delegate their overall responsibility for HSE. Our HSE course for managers provides a thorough introduction to this responsibility and explains how the internal control system is the manager’s most important tool for fulfilling it.

The 8 requirements in Section 5 of the Internal Control Regulations

The core of the regulation’s content requirements is found in Section 5. This section lists eight specific points that internal controls must cover. The scope of documentation will vary depending on the size and risk profile of the organization, but the functions themselves must be in place.

1. Set goals for health, the environment, and safety: The company must have clear, written goals for its HSE work. These goals must be communicated throughout the organization.
2. Get an overview of your company's organization: The distribution of responsibilities, tasks, and authority for HSE work must be clearly defined. Who does what? Who is responsible for ensuring that things get done?
3. Identify hazards and problems: This is the core of proactive efforts—risk assessment. The organization must identify all potential hazards (e.g., chemicals, noise, heavy lifting, psychosocial factors) and assess the risk of harm to people or the environment.
4. Develop plans and measures to reduce risk: Based on the assessment, an action plan must be developed. What measures should be implemented to eliminate or control the identified hazards? The plan must be specific, with deadlines and designated responsible persons.
5. Implement procedures to detect, correct, and prevent violations: This is the system for handling deviations. What do we do when something goes wrong, or when we discover an error? There must be a procedure for reporting the issue, correcting the error, and learning from it to prevent it from happening again.
6. Ensure systematic monitoring and review: Internal controls are not static. The system and its results must be regularly reviewed to ensure that it is functioning as intended. This includes safety inspections, employee performance reviews, and management reviews.
7. Ensure compliance with laws and regulations: The regulation requires that the business have a procedure in place to stay up to date on relevant HSE regulations and ensure that they are followed.
8. Document the system: All of the above work must be documented in writing. This serves as proof—both internally and to the Norwegian Labor Inspection Authority—that the company operates systematically. A good internal control template or a digital system can be crucial in this regard.

Internal Control in Practice: From a Template to a Living System

Many people start by looking for a simple “internal control template” in the hope of finding a quick solution. A template can be an excellent starting point, but it is crucial to understand that a downloaded file does not, in and of itself, constitute an internal control system. The system must be adapted, implemented, and “come to life” within the organization. It is the transition from a passive document to an active tool that distinguishes the successful organizations from those that merely meet minimum requirements on paper.

Documentation Requirements: What Exactly Needs to Be Written Down?

The requirement for written documentation (Section 5, item 8) often causes uncertainty. How much is enough? The regulation calls for a risk-based approach. A small office-based business with low risk requires significantly less documentation than a large manufacturing company with complex hazards. The following must always be in writing:

• HSE Goals.
• Description of the organization and division of responsibilities.
• The results of risk assessments and action plans.

Other procedures, such as those for handling nonconformities and training, must also be documented to the extent necessary to ensure that they are followed. This is where digital tools come into their own. A digital system like our Komplett HSE Internal Control System makes it easy to store, update, and distribute all necessary documentation, ensuring it’s always available to those who need it.

Risk Assessment: The Core of Systematic HSE Work

If you’re going to remember just one thing about practical internal control, let it be risk assessment. This is the driving force behind all systematic HSE work. The process is logical and can be broken down into four steps:

1. Identify hazards: Examine all work tasks, processes, equipment, and substances. What could potentially cause harm? Involve the employees—they know best where the problems lie. The safety representative plays a key role here, and thorough training is critical. A 40-hour safety representative course provides the necessary skills to perform this task effectively.
2. Analyze and assess risk: For each hazard, assess the likelihood of an undesirable event occurring and the consequences if it does occur. Risk = Likelihood × Consequence. This helps you prioritize where to implement measures first.
3. Planning measures: Develop specific measures to eliminate or control the risk. The hierarchy of measures should be followed: 1) Eliminate the hazard completely, 2) Replace it with something less hazardous, 3) Technical measures (e.g., protective screens), 4) Organizational measures (e.g., training, procedures), and 5) Personal protective equipment as a last resort.
4. Implement and evaluate: Implement the measures and verify that they work as expected. Is the risk now at an acceptable level?

This cycle must be repeated regularly, and always whenever changes occur in the business that could affect the risk profile.

Who needs to know about internal controls?

Knowledge of internal controls is not limited to HSE managers. For the system to function properly, this expertise must be shared throughout the organization.

• General Manager and Senior Management: They have overall legal responsibility. They must understand the requirements in order to allocate resources, set goals, and hold people accountable for results.
• Middle managers and department heads: They are responsible for ensuring that the HSE system is followed in practice within their departments. They must be able to conduct risk assessments, follow up on nonconformities, and ensure that their own employees receive the necessary training.
• Safety Representatives and AMU Members: They are responsible for safeguarding employees’ interests and ensuring that employers fulfill their obligations. They need in-depth knowledge of the regulations in order to perform their role effectively.
• All employees: They must be familiar with the procedures and risk factors relevant to their own daily work. They also have a duty to cooperate, for example by reporting hazardous conditions and nonconformities.

Our Digital Internal Control System: Content and Benefits

Building an internal control system from scratch can be challenging. Our digital system is designed to make this process as simple and efficient as possible, while ensuring compliance with all legal requirements.

Course Content: What will you learn and have access to?

Our system is more than just a course; it's a complete digital platform. Through the system, you'll have access to:

• A complete template structure: A pre-configured digital binder that meets all eight requirements of the regulations, ready to be customized for your business.
• Interactive learning modules: Easy-to-understand lessons that explain the legal framework, roles and responsibilities, and how to perform key tasks such as risk assessment and nonconformity management.
• Digital tools: Modules for conducting and documenting risk assessments, recording and addressing nonconformities, and building a substance database.
• Annual HSE Cycle: A visual tool that helps you plan and keep track of all annual HSE activities, such as safety rounds, employee reviews, and audits.
• Document Archive: A central location for storing all your HSE documentation, accessible from your computer, phone, and tablet.

Duration, Certification, and Price

The advantage of an online system is its flexibility. You work through the content and build up your knowledge at your own pace. There is no set duration. Upon completing the training modules, you can generate a course certificate. This certificate is valuable documentation proving that you have acquired the necessary knowledge of systematic HSE work, which is a requirement for top management (AML § 3-5). The price for access to the entire digital internal control system can be found on the product page. Think of it as a low one-time investment to save time, ensure legal compliance, and build a safer workplace.

Frequently Asked Questions About the Internal Control Regulations (FAQ)

As the owner of a sole proprietorship, am I required to have internal controls?

Yes, if you have employees. In that case, you are fully subject to the Internal Control Regulations. If you operate alone, without employees, you are still subject to laws governing your industry (e.g., the Pollution Control Act or the Electrical Installations Act), and you must take steps to ensure your own health and safety. The requirement for a formal, documented system, however, is primarily linked to having employees.

What exactly is the difference between HSE and internal control?

That’s a good question! HSE (Health, Safety, and Environment) is the field—that is, what you work on. Internal control is the method—that is, how you go about it. The Internal Control Regulations require that HSE work be systematic and planned.

How much documentation is enough?

The regulation states that the documentation must be tailored to “the nature, activities, risk factors, and size of the business.” A small hair salon requires less documentation than a large shipyard. A good rule of thumb is: Document what is necessary to ensure that HSE work is carried out as planned, and so that you can prove to the Labor Inspection Authority that you have a functioning system.

What happens if you do not comply with the Internal Control Regulations?

A violation of the regulations is a violation of the law. The Norwegian Labor Inspection Authority may issue an order to correct deficiencies within a specified time limit. If the order is not complied with, they may impose a coercive fine (a running fine). In the case of serious violations, they may suspend part or all of the business. In the event of very serious incidents caused by a lack of systems, this may also result in fines and, in the most extreme cases, criminal liability for management.

Is a free "internal control template" from the internet good enough?

A template is just a framework. It isn’t “good enough” until you’ve filled it with content specific to your company, your activities, and your risks. You must also ensure that the system is implemented and followed by your employees. A template is a starting point, but the actual work of customizing and implementing it must be done.

How can a digital system help with internal controls?

A digital system simplifies everything. Documents are always up to date and accessible to everyone. Nonconformities can be reported via mobile device on-site. Risk assessments can be easily shared and followed up on. Automatic alerts can remind you of important deadlines from the annual HSE cycle. This reduces paperwork, minimizes the risk of errors, and makes systematic HSE work more efficient and engaging.

What is an annual HSE cycle?

An HSE annual cycle is a visual calendar that provides an overview of all regular, recurring HSE activities throughout the year. Typical activities may include annual safety inspections, reviews of risk assessments, fire drills, updates to the substance inventory, and management reviews of the HSE system. It is a very useful tool for ensuring that nothing is overlooked in the midst of a busy workday.

---

Related Mandatory HSE Courses

A good internal control system works best when employees have completed the legally required training courses referred to in the regulations:

• HSE Course for Managers — Required by law pursuant to Section 3-5 of the Working Environment Act.
• Safety Representative Course (40 hours) — mandatory training for safety representatives.
• Scaffolding and Fall Protection Training Courses — for construction and civil engineering companies.
• FSE Course — Annual Refresher Course for Electrical Workers.

Frequently Asked Questions About the Internal Control Regulations

What is Section 5 of the Internal Control Regulations?

Section 5 lists the eight specific requirements that internal controls must document in writing—including objectives for HSE work, organizational structure, procedures for identifying nonconformities, risk assessment, and follow-up.

Who is responsible for internal control?

The chief executive (CEO/chair of the board) bears formal responsibility in accordance with the Internal Control Regulations, even though certain duties may be delegated.

What risks does a company face if it lacks internal controls?

The Norwegian Labor Inspection Authority may issue orders, impose coercive fines (typically starting at 10,000 kr per day), and, in serious cases, suspend operations. Insurance payouts may also be reduced following accidents.