Legal and other requirements

During the forklift investigation the year before, Elena had been asked a question by the an OSHA compliance safety and health officer that she could not answer on the spot: which of the company's legal requirements applied to the distribution center specifically, and how did the company know it met them? She knew the general duties by heart. She knew the main regulations for forklifts and lockout. But nobody at Harrowgate Foods Inc. had a single list of every legal requirement that applied to each site, who was responsible for each, and when compliance had last been checked. The two smaller sites had always assumed the main plant would tell them if something changed. The maturity check in lesson 1 confirmed it: legal requirements scored 1 out of 5 at the distribution center and the sauces plant.

This lesson covers how a management system identifies the legal and other requirements that apply to the organization, keeps that knowledge current, builds the requirements into daily work, and checks compliance.

What counts as a requirement

Management system standards talk about 'legal requirements and other requirements'. Legal requirements are those the organization must meet because the law says so. Other requirements are those it chooses to adopt or has agreed to, which then become binding on the organization's own system.

• Legislation: the OSH Act, including its General Duty Clause, and other federal and state laws that touch safety, such as fire codes and Georgia's workers' compensation law.
• Standards: OSHA's general industry standards in 29 CFR 1910, such as hazard communication, lockout, powered industrial trucks, machine guarding, respiratory protection, noise and process safety management, and recordkeeping in 29 CFR 1904.
• Standards incorporated by reference: consensus standards that OSHA rules incorporate, such as certain ANSI and NFPA standards, which become part of the requirement to the extent incorporated.
• Permits, citations and conditions: abatement requirements from OSHA citations or settlements, local fire marshal requirements, and conditions in permits for refrigeration systems or boilers.
• Other requirements: customer supplier codes, insurer requirements, collective agreement clauses on safety, industry codes of practice, the company's own policy commitments and voluntary standards such as ANSI/ASSP Z10.0.

The distinction matters for how requirements are managed but not for how seriously they are taken. Once Harrowgate Foods Inc. committed in its policy to give agency workers the same orientation as employees, that commitment had to be met as reliably as any regulation. An auditor would check it.

Building a legal register

The usual tool is a legal register: a structured list of requirements, each linked to the activities, hazards and sites it applies to, the person responsible, how the organization meets it, and when compliance was last checked. Some organizations buy a subscription service that provides and updates the list; others build their own. Either way, the organization must understand how each requirement applies to its own work. A list of every regulation in the province is not a legal register.

Elena built Harrowgate Foods Inc.'s register in three steps. First, she listed the activities and hazards from the site hazard registers in lesson 5: forklifts, lockout, ammonia refrigeration, confined spaces, chemicals, noise, first aid, young workers, harassment, and so on. Second, for each, she identified the legal requirements that applied, with help from a specialist subscription service and a review by the company's lawyer. Third, she translated each requirement into what it meant in practice at each site: what had to be done, documented, trained or inspected, and by whom.

Translating requirements into practice

A register entry is only useful if it tells someone what to do. Elena's team wrote each entry in the form 'At [site], [owner] ensures that [specific action], evidenced by [record], checked by [method and frequency].' The format forced them to think about how each requirement was actually met.

Keeping the register current

Laws change. Regulations are amended, new standards are adopted, exposure limits are lowered, case law reinterprets duties, and courts and tribunals set expectations through decisions. A management system needs a process for finding out about changes, assessing what they mean, and updating procedures, training and controls before the change takes effect.

Harrowgate Foods Inc. used three sources: the subscription service's monthly update, OSHA news releases and Federal Register notices, and Elena's membership in a regional safety association whose members shared information. Each month Elena reviewed changes, decided which applied, updated the register and sent a short note to the owners affected. Changes to OSHA's penalty amounts, revisions to the hazard communication standard and updates to OSHA's directives on enforcement and recognition programs were all handled this way.

Other requirements change too. When the grocery customer revised its supplier code to require evidence of a safety management system, the register logged it with Rachel as owner. When the union and the company agreed a new clause on heat stress in the collective agreement at the main plant, it went in with the plant manager as owner.

Evaluating compliance

Knowing the requirements is half the job. The other half is checking, regularly and systematically, that they are met. Management system standards require organizations to evaluate compliance at planned intervals, take action where needed, keep knowledge of their compliance status and retain records of the results.

Compliance evaluation is different from an internal audit (lesson 10). An audit checks whether the management system works as designed. A compliance evaluation checks specifically whether legal and other requirements are met. The two can be done together, but the compliance question must be answered explicitly. Harrowgate Foods Inc. used a mix of methods: a yearly desk review of every register entry by its owner, field checks by the safety team of high-risk requirements such as lockout and forklift training each quarter, and an external compliance review by a consultant every three years.

# Compliance evaluation summary, distribution site, first full year.
results = {
    "forklift training and evaluation":   ("high",   "partial"),
    "joint committee meetings and minutes": ("medium", "met"),
    "workplace inspections":                ("medium", "met"),
    "hazardous products labels and SDS":    ("medium", "partial"),
    "first aid coverage every shift":       ("high",   "met"),
    "lockout program":                      ("high",   "met"),
    "harassment prevention program":        ("medium", "met"),
    "ammonia system permit conditions":     ("high",   "met"),
}
met = sum(1 for _, s in results.values() if s == "met")
print(f"requirements met: {met} of {len(results)}")
for req, (risk, status) in results.items():
    if status != "met":
        print(f"action needed ({risk} risk): {req}")

requirements met: 6 of 8
action needed (high risk): forklift training and evaluation
action needed (medium risk): hazardous products labels and SDS

Two gaps appeared at the distribution center. Forklift training was only partly met: four agency drivers on weekend shifts had classroom training but no practical evaluation recorded, the same gap that had contributed to the aisle 14 collision. Safety data sheets were missing for two cleaning products that a new supplier had introduced. Both went into the corrective action process with owners and dates, and the forklift gap was escalated to Rachel because it was a repeat of a known cause.

When the law is unclear

Sometimes the law does not say exactly what is required. A general duty to take every precaution reasonable in the circumstances, or to provide a workplace free of recognized serious hazards, leaves room for judgment. In those cases, a management system helps the organization show it made a reasonable, informed decision: it identified the hazard, assessed the risk, considered recognized guidance and industry practice, chose controls by the hierarchy, and recorded why. That record is part of what HSE-402 called due diligence, and it is often the strongest evidence an organization has if its decisions are later questioned.

Who needs to know what

A register sitting on the safety manager's computer helps nobody on the floor. The requirements have to reach the people whose work they govern, in a form they can use. Elena's team built a short list of 'what the law expects from you' for each role: supervisors, forklift operators, sanitation workers, maintenance mechanics, committee members and managers. Each list was a single page, in plain language, and was used in orientation and refresher training. A supervisor's page, for example, covered the duty to make workers aware of hazards, to make sure controls and protective equipment are used, to respond to work refusals and to report injuries, with the company procedure for each.

Managers received a separate briefing on their personal legal responsibilities, including the possibility of personal liability for directors, officers and supervisors who fail to take reasonable care. HSE-402 covered those duties in depth. The briefing was not meant to frighten anyone. It was meant to show managers why the system's records, such as completed inspections, answered recommendations and verified corrective actions, mattered to them personally as well as to the company.

Requirements that conflict

Occasionally requirements pull in different directions. Food safety rules may require certain doors to stay closed to keep pests out, while fire safety rules require exits to stay unobstructed; a customer may ask for a sanitation schedule that leaves too little time for safe lockout. A management system makes these conflicts visible so they can be resolved deliberately, usually by finding a solution that meets both. At the main plant, the conflict between a customer's demand for a faster changeover and the lockout requirements was resolved by redesigning the changeover so that guards could be removed only after isolation, and by negotiating a slightly longer window with the customer, documented in the register as an agreed other requirement.

Where a real conflict cannot be resolved, the legal requirement wins, and the decision and its reasons are recorded. No customer code or production target can authorize a breach of safety law.

Inspections by the regulator

A legal register also prepares an organization for inspections. When an OSHA compliance officer visits, they may ask for written programs, training records, the OSHA 300 log and evidence of hazard assessments. With the register, a supervisor or manager can show the requirement, the program that meets it, the records and the latest compliance check within minutes. Any citation goes straight into the register and the corrective action process, with abatement dates as deadlines and the posting requirements followed.