Legal and other requirements

During the forklift investigation the year before, Elena had been asked a question by the an occupational health and safety officer from the Department that she could not answer on the spot: which of the company's legal requirements applied to the distribution centre specifically, and how did the company know it met them? She knew the general duties by heart. She knew the main regulations for forklifts and lockout. But nobody at Harrowgate Foods Ltd. had a single list of every legal requirement that applied to each site, who was responsible for each, and when compliance had last been checked. The two smaller sites had always assumed the main plant would tell them if something changed. The maturity check in lesson 1 confirmed it: legal requirements scored 1 out of 5 at the distribution centre and the sauces plant.

This lesson covers how a management system identifies the legal and other requirements that apply to the organization, keeps that knowledge current, builds the requirements into daily work, and checks compliance.

What counts as a requirement

Management system standards talk about 'legal requirements and other requirements'. Legal requirements are those the organization must meet because the law says so. Other requirements are those it chooses to adopt or has agreed to, which then become binding on the organization's own system.

• Legislation: Nova Scotia's Occupational Health and Safety Act and other provincial statutes that touch safety, such as fire safety and workers' compensation legislation.
• Regulations: regulations made under those statutes, such as the Workplace Health and Safety Regulations, the Occupational Safety General Regulations, the First Aid Regulations and the WHMIS regulations.
• Codes and standards adopted by law: where a regulation requires compliance with a CSA standard, such as standards for forklift operation, machine guarding or lockout, that standard becomes part of the legal requirement.
• Permits, orders and conditions: orders issued by an officer, conditions in operating permits for ammonia systems or boilers, and requirements of the fire department.
• Other requirements: customer supplier codes, insurer requirements, collective agreement clauses on safety, industry codes of practice, the company's own policy commitments and voluntary standards such as CSA Z45001.

The distinction matters for how requirements are managed but not for how seriously they are taken. Once Harrowgate Foods Ltd. committed in its policy to give agency workers the same orientation as employees, that commitment had to be met as reliably as any regulation. An auditor would check it.

Building a legal register

The usual tool is a legal register: a structured list of requirements, each linked to the activities, hazards and sites it applies to, the person responsible, how the organization meets it, and when compliance was last checked. Some organizations buy a subscription service that provides and updates the list; others build their own. Either way, the organization must understand how each requirement applies to its own work. A list of every regulation in the province is not a legal register.

Elena built Harrowgate Foods Ltd.'s register in three steps. First, she listed the activities and hazards from the site hazard registers in lesson 5: forklifts, lockout, ammonia refrigeration, confined spaces, chemicals, noise, first aid, young workers, harassment, and so on. Second, for each, she identified the legal requirements that applied, with help from a specialist subscription service and a review by the company's lawyer. Third, she translated each requirement into what it meant in practice at each site: what had to be done, documented, trained or inspected, and by whom.

Translating requirements into practice

A register entry is only useful if it tells someone what to do. Elena's team wrote each entry in the form 'At [site], [owner] ensures that [specific action], evidenced by [record], checked by [method and frequency].' The format forced them to think about how each requirement was actually met.

Keeping the register current

Laws change. Regulations are amended, new standards are adopted, exposure limits are lowered, case law reinterprets duties, and courts and tribunals set expectations through decisions. A management system needs a process for finding out about changes, assessing what they mean, and updating procedures, training and controls before the change takes effect.

Harrowgate Foods Ltd. used three sources: the subscription service's monthly update, notices and newsletters from the Department of Labour, Skills and Immigration and the WCB, and Elena's membership in a provincial safety association whose members shared information. Each month Elena reviewed changes, decided which applied, updated the register and sent a short note to the owners affected. The arrival of the harassment prevention rules in September 2025 was an example: the register showed the human resources manager as owner, and the note set out what had to be in place by the effective date.

Other requirements change too. When the grocery customer revised its supplier code to require evidence of a safety management system, the register logged it with Rachel as owner. When the union and the company agreed a new clause on heat stress in the collective agreement at the main plant, it went in with the plant manager as owner.

Evaluating compliance

Knowing the requirements is half the job. The other half is checking, regularly and systematically, that they are met. Management system standards require organizations to evaluate compliance at planned intervals, take action where needed, keep knowledge of their compliance status and retain records of the results.

Compliance evaluation is different from an internal audit (lesson 10). An audit checks whether the management system works as designed. A compliance evaluation checks specifically whether legal and other requirements are met. The two can be done together, but the compliance question must be answered explicitly. Harrowgate Foods Ltd. used a mix of methods: a yearly desk review of every register entry by its owner, field checks by the safety team of high-risk requirements such as lockout and forklift training each quarter, and an external compliance review by a consultant every three years.

# Compliance evaluation summary, distribution site, first full year.
results = {
    "forklift training and evaluation":   ("high",   "partial"),
    "joint committee meetings and minutes": ("medium", "met"),
    "workplace inspections":                ("medium", "met"),
    "hazardous products labels and SDS":    ("medium", "partial"),
    "first aid coverage every shift":       ("high",   "met"),
    "lockout program":                      ("high",   "met"),
    "harassment prevention program":        ("medium", "met"),
    "ammonia system permit conditions":     ("high",   "met"),
}
met = sum(1 for _, s in results.values() if s == "met")
print(f"requirements met: {met} of {len(results)}")
for req, (risk, status) in results.items():
    if status != "met":
        print(f"action needed ({risk} risk): {req}")

requirements met: 6 of 8
action needed (high risk): forklift training and evaluation
action needed (medium risk): hazardous products labels and SDS

Two gaps appeared at the distribution centre. Forklift training was only partly met: four agency drivers on weekend shifts had classroom training but no practical evaluation recorded, the same gap that had contributed to the aisle 14 collision. Safety data sheets were missing for two cleaning products that a new supplier had introduced. Both went into the corrective action process with owners and dates, and the forklift gap was escalated to Rachel because it was a repeat of a known cause.

When the law is unclear

Sometimes the law does not say exactly what is required. A general duty to take every precaution reasonable in the circumstances, or to provide a workplace free of recognized serious hazards, leaves room for judgment. In those cases, a management system helps the organization show it made a reasonable, informed decision: it identified the hazard, assessed the risk, considered recognized guidance and industry practice, chose controls by the hierarchy, and recorded why. That record is part of what HSE-402 called due diligence, and it is often the strongest evidence an organization has if its decisions are later questioned.

Who needs to know what

A register sitting on the safety manager's computer helps nobody on the floor. The requirements have to reach the people whose work they govern, in a form they can use. Elena's team built a short list of 'what the law expects from you' for each role: supervisors, forklift operators, sanitation workers, maintenance mechanics, committee members and managers. Each list was a single page, in plain language, and was used in orientation and refresher training. A supervisor's page, for example, covered the duty to make workers aware of hazards, to make sure controls and protective equipment are used, to respond to work refusals and to report injuries, with the company procedure for each.

Managers received a separate briefing on their personal legal responsibilities, including the possibility of personal liability for directors, officers and supervisors who fail to take reasonable care. HSE-402 covered those duties in depth. The briefing was not meant to frighten anyone. It was meant to show managers why the system's records, such as completed inspections, answered recommendations and verified corrective actions, mattered to them personally as well as to the company.

Requirements that conflict

Occasionally requirements pull in different directions. Food safety rules may require certain doors to stay closed to keep pests out, while fire safety rules require exits to stay unobstructed; a customer may ask for a sanitation schedule that leaves too little time for safe lockout. A management system makes these conflicts visible so they can be resolved deliberately, usually by finding a solution that meets both. At the main plant, the conflict between a customer's demand for a faster changeover and the lockout requirements was resolved by redesigning the changeover so that guards could be removed only after isolation, and by negotiating a slightly longer window with the customer, documented in the register as an agreed other requirement.

Where a real conflict cannot be resolved, the legal requirement wins, and the decision and its reasons are recorded. No customer code or production target can authorize a breach of safety law.

Inspections by the regulator

A legal register also prepares an organization for inspections. When an occupational health and safety officer from the Department visits, they may ask how the company knows it complies with a particular requirement. With the register, a supervisor or manager can show the requirement, the procedure that meets it, the training records and the latest compliance check within minutes. Orders issued by an officer go straight into the register and the corrective action process, with the compliance date as the deadline and the posting requirements followed.