Auditing Legal Requirements Under ISO 45001 Clauses 6.1.3 and 9.1.2

What the Requirement Is, and Why It Exists

ISO 45001 establishes a core mandate requiring organisations to identify, understand, and comply with all legal requirements and other requirements relevant to their occupational health and safety risks. Under Clause 6.1.3, organisations must establish, implement, and maintain a process to determine up-to-date legal requirements and other requirements applicable to their hazards, risks, and management system. This planning requirement ensures that statutory duties and voluntary obligations directly inform operational planning, risk assessment, and control measures. Under Clause 9.1.2, organisations must evaluate compliance with these requirements at planned intervals to maintain an accurate understanding of their compliance status.

This compliance framework applies across all management levels, including top management, compliance leads, facility managers, internal auditors, and non-managerial workers. Failing to maintain an audit-ready legal process exposes organisations to unmanaged workplace hazards, regulatory enforcement actions, financial penalties, and operational disruptions. ISO 45001 connects compliance determination in Clause 6.1.3 directly with performance evaluation in Clause 9.1.2 to create a continuous compliance cycle. Quality managers and compliance leads must build systematic processes that track regulatory updates, assess operational applicability, and verify compliance through objective audit evidence.

Process Steps for Determining and Applying Legal Requirements

Determining and applying legal requirements under Clause 6.1.3 requires a structured, ongoing procedure that integrates regulatory tracking with operational risk management. Annex A.6.1.3 clarifies that legal requirements include legislation, regulations, decrees, orders issued by regulators, permits, licences, court judgments, and collective bargaining agreements. Furthermore, other requirements encompass contractual conditions, employment agreements, non-regulatory standards, voluntary principles, and codes of practice. Organisations must maintain up-to-date documented information on all applicable requirements and execute a structured five-step procedure to ensure audit readiness.

1. Identify applicable legal requirements and other requirements based on organisational context, operational activities, equipment, and identified hazards under Clause 6.1.2.1.
2. Determine how specific legal provisions apply to operational processes, work instructions, competence requirements, and hazard control measures.
3. Consult non-managerial workers on determining how to fulfil legal requirements and other requirements in accordance with Clause 5.4 d) 4).
4. Integrate compliance obligations into operational planning and control processes under Clause 8.1.1 and management of change processes under Clause 8.1.3 b).
5. Communicate applicable legal requirements and relevant compliance information across internal functions and external contractors under Clause 7.4.

Example

A manufacturing facility introduces a new solvent-based cleaning line that generates hazardous chemical vapors. Under Clause 6.1.3, the compliance lead reviews environmental and occupational health legislation to identify applicable airborne exposure limits, local exhaust ventilation standards, and health surveillance duties. The facility consults non-managerial operators under Clause 5.4 d) 4) to determine practical extraction controls and updates the legal register. During the subsequent Clause 9.1.2 compliance evaluation, the internal auditor inspects ventilation testing certificates and air monitoring records to verify that operational controls satisfy statutory exposure limits.

Evaluating Compliance Status and Audit Verification Matrix

Clause 9.1.2 mandates that organisations must establish, implement, and maintain processes for evaluating compliance with legal requirements and other requirements. The organisation must determine the frequency and methods for evaluating compliance, evaluate compliance status, take required action under Clause 10.2 when non-compliance occurs, and retain documented information of evaluation results. Under Annex A.9.1.2, evaluation frequency may vary depending on statutory importance, operating condition variations, past compliance performance, or regulatory revisions.

Internal auditors must evaluate compliance determination and performance evaluation mechanisms using objective evidence across all operational departments. Top management must consider compliance evaluation results during management reviews under Clause 9.3 d) 3) to ensure continuing system suitability, adequacy, and effectiveness.

Before your audit

• Verify that the legal register includes all national, regional, and local statutory requirements applicable to current site operations.
• Confirm that legal requirements account for contractor activities, outsourced processes, and multi-employer workplace arrangements.
• Inspect evidence of worker consultation regarding legal compliance arrangements under Clause 5.4 d) 4).
• Check that legal requirements are linked directly to operational control procedures and risk assessment registers.
• Review documented information demonstrating that legal compliance evaluations were conducted at planned intervals under Clause 9.1.2.
• Ensure that any instances of legal non-compliance resulted in documented corrective actions under Clause 10.2.
• Confirm that legal compliance evaluation results were communicated to top management for review under Clause 9.3 d) 3).

Questions people ask

What is the difference between Clause 6.1.3 and Clause 9.1.2 in ISO 45001?

Clause 6.1.3 is a planning requirement focused on identifying up-to-date legal requirements and determining how they apply to the organisation's hazards and management system. Clause 9.1.2 is a performance evaluation requirement focused on periodically checking whether the organisation actually complies with those legal requirements and retaining evidence of the results.

Does ISO 45001 require a documented procedure for legal compliance?

ISO 45001 requires organisations to maintain and retain documented information on their legal requirements and other requirements under Clause 6.1.3 and to retain documented information of compliance evaluation results under Clause 9.1.2. While the standard requires established processes, documented procedures may be maintained to the extent necessary to ensure processes are carried out as planned.

How often must an organisation evaluate legal compliance under Clause 9.1.2?

ISO 45001 does not dictate a fixed calendar frequency for compliance evaluations. Under Clause 9.1.2 a) and Annex A.9.1.2, the organisation must determine the frequency based on legal requirements, variations in operating conditions, changes in legislation, and past compliance performance.

Who must be involved when determining how to satisfy legal requirements?

Under Clause 5.4 d) 4), organisations must emphasize the consultation of non-managerial workers when determining how to fulfil legal requirements and other requirements. This ensures that operational personnel carrying out work activities provide direct input into legal control arrangements.

Reference documents

• BS ISO 45001:2018 Occupational health and safety management systems — Requirements with guidance for use