The Internal Control Regulations – What your business must have in place
For all businesses in Norway, systematic HSE work is not just a recommendation, but a statutory requirement. The key to this work lies in the Regulations on systematic health, environment, and safety work in enterprises, better known as the Internal Control Regulations. These regulations are the foundation for a safe and healthy working environment, and they set clear requirements for what your business must have in place. Let's delve into what the internal control regulations entail and how you can ensure that your business complies with them.
What are the Internal Control Regulations?
The Internal Control Regulations were introduced to ensure that all businesses work systematically with HSE to prevent injuries, accidents, and health problems. They impose a responsibility on the employer to establish and maintain a system that continuously identifies, assesses, and implements measures to improve the working environment. The goal is to create a proactive culture where HSE is an integrated part of daily operations, not just a reactive response to incidents.
Who do the Internal Control Regulations apply to?
The Internal Control Regulations apply to all businesses in Norway, regardless of size, industry, or type of activity. This includes everything from large industrial companies and construction sites to small offices, shops, and sole proprietorships with employees. No business is exempt from the requirement for systematic HSE work.
The 8 requirements in the Internal Control Regulations (§5)
Section 5 of the Internal Control Regulations specifies eight key requirements that must be met to ensure a sound internal control system. These are:
- Set goals for HSE work: Clear and realistic goals for what the company wants to achieve with its HSE work.
- Have an overview of laws and regulations: Be familiar with and follow the HSE-related laws and regulations that apply to your own business.
- Identify hazards and problems: Systematically identify potential hazards and problems, and assess the risk of injury or illness (risk assessment).
- Prepare plans and measures: Plan and implement necessary measures to reduce risk and improve the working environment.
- Implement measures: Ensure that the planned measures are carried out and that they are effective.
- Systematic monitoring and review: Regularly check that the internal control system is functioning as it should, and revise it as needed.
- Documentation: Written documentation of HSE work, including risk assessments, action plans, non-conformities, and training.
- Competence: Ensure that all employees, including managers and safety delegates, have sufficient competence and training in HSE.
Key elements of a good HSE system
To meet the requirements of the Internal Control Regulations, it is important to have a robust HSE system in place. The most important elements include:
Risk assessment
This is the core of HSE work. A risk assessment involves systematically identifying hazards, assessing the likelihood of an undesirable event occurring, and the consequences thereof. Based on the assessment, measures must be implemented to eliminate or reduce the risk to an acceptable level.
Deviation handling
An effective system for deviation handling is crucial. It involves reporting, registering, investigating, and correcting all undesirable incidents, near misses, and deviations from current procedures. The goal is to learn from mistakes and prevent similar incidents from happening again.
Documentation
The Internal Control Regulations require that HSE work be documented. This includes risk assessments, action plans, training, deviation reports, safety inspections, and meeting minutes. Good documentation is important to be able to demonstrate that the company works systematically with HSE, and to have a basis for continuous improvement.
The benefits of a well-functioning internal control system
Having a good internal control system in place gives your company a number of benefits:
- Reduced risk: Fewer accidents, injuries, and illnesses.
- Better working environment: Increased well-being and motivation among employees.
- Legal compliance: Avoid orders, fines, and potential criminal liability.
- Economic savings: Reduced costs associated with absenteeism, production loss, and compensation.
- Improved reputation: Appears as a serious and responsible player.
Komplett HMS AS helps you with internal control
Komplett HMS AS has 10 years of experience in the industry and specializes in helping companies establish and maintain effective internal control systems. We offer customized solutions that are easy to implement and ensure that your business meets all legal requirements.
Our HSE systems are designed to make HSE work clear and manageable, so you can focus on your core business. We also offer advice and guidance to ensure that you understand and can operate the system effectively.
Training in internal control
For the internal control system to function optimally, it is crucial that employees and managers have the necessary competence. Our HSE courses cover central aspects of internal control and provide participants with insight into their roles and responsibilities.
Remember that many of our courses are available in several languages, which ensures that all employees, regardless of nationality, receive the necessary competence to contribute to a safe working environment in accordance with the internal control regulations.
Let Komplett HMS AS be your partner in internal control work. Contact us at kundeservice@kompletthms.no or call us at 46 66 64 67 for a non-binding conversation. We are located at Kanalveien 107, 5068 Bergen, and our organization number is 918 899 197.
Invest in a solid internal control system – it is an investment in your company's future and your employees' safety.
Consequences of inadequate internal control
Businesses that do not comply with the Internal Control Regulations risk serious consequences:
- Orders from the Norwegian Labour Inspection Authority: The Norwegian Labour Inspection Authority can issue orders to establish or improve the internal control system, with a set deadline.
- Coercive fines and penalties: If orders are not complied with by the deadline, coercive fines and penalty fees may be imposed.
- Suspension of operations: In serious cases, the Norwegian Labour Inspection Authority may demand that operations be suspended until the requirements are met.
- Insurance problems: In the event of workplace accidents, inadequate internal control may lead to the insurance company reducing or rejecting the claim for compensation.
- Criminal liability: The general manager and board members may be held personally liable for serious breaches of HSE legislation.
Frequently asked questions about internal control
Do the Internal Control Regulations apply to small businesses?
Yes, the Internal Control Regulations apply to all businesses with employees, regardless of size. The scope of the documentation is adapted to the size and risk of the business, but the requirements apply to everyone.
What is the difference between an HSE system and internal control?
Internal control is the overarching legal requirement for systematic HSE work. An HSE system is the tool that helps the company meet the requirements of the Internal Control Regulations – including risk assessment, deviation handling, and documentation.
How often must internal control be updated?
The internal control system should be a living document that is continuously updated. Risk assessments should be reviewed at least annually, and the system should be updated in the event of changes in the organization, new tasks, or after serious incidents.
What courses do managers need for internal control?
Managers should at a minimum have completed HSE courses for managers, which is legally required under Section 3-5 of the Working Environment Act. In addition, safety delegates should have completed safety delegate courses to be able to contribute effectively to internal control.