Category: Compliance

Posted on

What Does an ISO 14001 Legal Register Need to Contain?

If you are working towards ISO 14001 certification, or maintaining it, the legal register is one of the areas auditors return to again and again. As with its ISO 45001 counterpart, it looks straightforward on paper — a list of environmental laws that apply to your business — but in practice it is one of the most common sources of non-conformities.

This article follows on from our piece on the ISO 45001 legal register, and covers the environmental equivalent: what a compliant ISO 14001 legal register needs to contain, why it matters, and how to keep it audit-ready.

What Is a Legal Register Under ISO 14001?

A legal register for ISO 14001 (referred to in the standard as “compliance obligations”) is a structured record of all the environmental laws, regulations, permits, consents, and other obligations that apply to your organisation’s activities, products, and services.

Clause 6.1.3 of ISO 14001:2026 requires organisations to determine and have access to up-to-date compliance obligations related to its environmental aspects, to determine how these apply to the organisation, and to keep this information current. The register is how you evidence that this has been done.

It is worth noting that ISO 14001 deliberately moved away from the term “legal register” in favour of “compliance obligations” to reflect that the scope is broader than statute law — but in practice, most organisations (and most auditors) still refer to it as the legal register, and we will use both terms here.

Why It Matters More Than It Looks

Just as with an OH&S legal register, this document is not a compliance checkbox — it is the foundation your environmental management system (EMS) is built on. It drives your aspects and impacts assessment, your operational controls, your monitoring and measurement programme, and your internal audit criteria. If the register is wrong or incomplete, everything built on top of it is at risk too.

Auditors will typically test the register in two directions:

  • Top-down — picking an environmental aspect (e.g. a waste stream, an emission point, a chemical store) and checking the relevant legislation is listed.
  • Bottom-up — picking an entry in the register and asking how it is being met in practice, such as through a permit condition or monitoring record.

If either direction breaks down, it is usually flagged as a non-conformity.

Core Elements Every Entry Should Include

While the exact format can vary, a robust legal register entry should contain the following information for each requirement:

  1. Legislation or requirement title — the specific act, regulation, permit, licence, or other obligation (e.g. environmental permit condition, corporate group standard, client contractual clause).
  2. Reference number or citation — the official identifier so it can be traced back to source.
  3. Jurisdiction — which country, state, or region it applies to, especially important for multi-site organisations with different permit regimes.
  4. Summary of the requirement — a plain-language description of what the law or permit condition actually requires, avoiding a copy-paste of dense legal text. This is often where expert consultants can be beneficial in interpreting the requirement for your business operations.
  5. Applicability — why and how this requirement applies to your specific sites, processes, or environmental aspects. Generic entries (“Environmental Protection Act applies to all businesses”) are a common audit finding.
  6. Compliance status — a clear statement of whether you currently comply, partially comply, or are working towards compliance. Particularly useful when first implementing ISO 14001.
  7. Evidence of compliance — links or references to the specific permits, monitoring data, procedures, or records that demonstrate compliance.
  8. Responsible person or role — who owns the register and is accountable for maintaining compliance.
  9. Review date and frequency — when it was last checked and when it is next due for review.
  10. Source of update information — how you monitor for changes (e.g. legislation update service, environmental regulator bulletin, trade body alert).
  11. Date of last legislative change — useful for showing the register reflects the current version of the law or permit, not an outdated one.

Beyond Statutory Law: “Other Requirements”

Like ISO 45001, ISO 14001 explicitly extends beyond legislation to other compliance obligations the organisation has to, or chooses to, meet. These are easy to miss but often specifically probed by auditors. In an environmental context, they may include:

  • Environmental permits, licences, and consents (waste, water discharge, emissions to air)
  • Industry codes of practice and sector environmental guidance
  • Client or contractual environmental requirements
  • Corporate group environmental standards (for multi-site or multinational organisations)
  • Voluntary agreements, industry schemes, or accreditation body conditions
  • Producer responsibility obligations (e.g. packaging, WEEE, battery regulations)

If your register only lists statutory legislation and ignores these, it will not fully meet the clause requirement.

Your ISO 14001 legal register must include obligations as well as legislation
Your ISO 14001 legal register must include obligations as well as legislation

How to Structure the Register

There is no single structure every register must follow, and it is often shaped by the size, sector, and complexity of the organisation. Most organisations use a spreadsheet, a document, or a dedicated compliance software tool. Common groupings for an ISO 14001 register include:

  • General environmental legislation
  • Waste management and disposal
  • Water and effluent discharge
  • Air emissions
  • Hazardous and chemical substances
  • Energy and resource use
  • Sector-specific legislation (construction, manufacturing, healthcare, etc.)
  • Packaging and producer responsibility

Structuring it this way makes the register easier to cross-reference against your aspects and impacts register and operational controls, and much faster to navigate during an audit.

Keeping It Live: Review and Monitoring

A legal register is only useful if it stays current. ISO 14001 requires that this information be kept up to date, so your process needs to show:

  • A defined review frequency (many organisations review quarterly, with a full review annually)
  • A named responsible person for monitoring legislative and permit changes — this can be an internal representative or an external consultant
  • A method for capturing changes (legal update subscription services are common, as manually tracking regulator publications is unreliable)
  • A record of how changes were assessed and, where relevant, action taken (updated aspects and impacts assessments, new controls, revised monitoring)

Common Mistakes to Avoid

  • Treating it as a one-off exercise. Registers built once for certification and never revisited are one of the most frequent non-conformities.
  • Copying generic templates without tailoring. A register that does not reflect your actual sites, processes, and environmental aspects will not withstand scrutiny.
  • No link to evidence. Listing a requirement without showing how it is actually met leaves a gap between the register and reality.
  • Missing permit conditions. Focusing only on primary legislation and overlooking the specific conditions attached to site permits and licences.
  • No ownership. Without a named responsible person, updates tend to fall through the cracks.

Do I Need a Legal Register for ISO 14001 Certification?

Yes. A legal register (compliance obligations register) is a mandatory requirement of Clause 6.1.3 and is one of the first documents an auditor will ask to see, both at initial certification and at every surveillance audit. Without one, an organisation cannot demonstrate it has identified and is managing its environmental compliance obligations, which is a core requirement of the standard.

Final Thoughts

A well-built legal register does more than satisfy Clause 6.1.3 — it becomes a working tool that keeps your entire environmental management system grounded in what the law, your permits, and your other obligations actually require. Getting the structure right from the start, and building in a genuine review cycle, is what separates a register that passes audit from one that merely exists on paper.

If you are managing both standards together, it is worth reading this alongside our companion article on the ISO 45001 legal register — many organisations choose to maintain a single combined register covering both health and safety and environmental obligations, provided it clearly distinguishes between the two.

If you would like support building or auditing your legal register as part of your ISO 14001 journey, get in touch with our team for a consultation.

Posted on

What Does an ISO 45001 Legal Register Need to Contain?

If you are working towards ISO 45001 certification, or maintaining it, one of the most common sticking points during audits is the legal register. It sounds like a simple document — a list of laws that apply to your business — but auditors consistently find registers that are either incomplete, out of date, or too vague to demonstrate real compliance.

This article breaks down exactly what a compliant legal register needs to contain, why it matters, and how to keep it audit-ready.

What Is a Legal Register?

A legal register (sometimes called a “legal and other requirements register”) is a structured record of all the health and safety laws, regulations, codes of practice, and other obligations that apply to your organisation’s activities, products, and services.

Under ISO 45001, Clause 6.1.3 requires organisations to determine and have access to up-to-date legal requirements and other requirements relevant to their occupational health and safety management system (OH&S MS), and to keep this information current. The register is how you evidence that you have done this.

Legal register
Is your legal register up to date?

Why It Matters More Than It Looks

A legal register is not just a compliance checkbox. It is the foundation your OH&S management system is built on — it drives your risk assessments, your operational controls, your training needs, and your internal audit criteria. If the register is wrong or incomplete, everything built on top of it is at risk too.

Auditors will typically test the register in two directions:

  • Top-down — picking an activity or hazard on site and checking the relevant legislation is listed.
  • Bottom-up — picking an entry in the register and asking how it is being met in practice.

If either direction breaks down, it is usually flagged as a non-conformity.

Core Elements Every Entry Should Include

While the exact format can vary, a robust legal register entry should contain the following information for each requirement:

  1. Legislation or requirement title — the specific act, regulation, code of practice, standard, or other obligation (e.g. industry code, insurer requirement, client contractual clause).
  2. Reference number or citation — the official identifier so it can be traced back to source.
  3. Jurisdiction — which country, state, or region it applies to, especially important for multi-site organisations.
  4. Summary of the requirement — a plain-language description of what the law actually requires, avoiding a copy-paste of dense legal text.  This is often where expert consultants can be beneficial in interpreting the law to your business operations.
  5. Applicability — why and how this requirement applies to your specific operations, sites, or activities. Generic entries (“Health and Safety at Work Act applies to all businesses”) are a common audit finding.
  6. Compliance status — a clear statement of whether you currently comply, partially comply, or are working towards compliance.  This is particularly useful when first implementing ISO 45001.
  7. Evidence of compliance — links or references to the specific procedures, records, permits, certificates, or controls that demonstrate compliance.
  8. Responsible person or role — who owns the register and is accountable for maintaining compliance.
  9. Review date and frequency — when it was last checked and when it is next due for review.
  10. Source of update information — how you monitor for changes (e.g. legislation update service, trade body bulletin, government gazette, etc.).
  11. Date of last legislative change — useful for showing the register reflects the current version of the law, not an outdated one.

Beyond Statutory Law: “Other Requirements”

ISO 45001 explicitly extends beyond legislation to “other requirements.” These are easy to miss but often specifically probed by auditors. They may include:

  • Industry codes of practice and guidance documents
  • Client or contractual health and safety requirements
  • Relevant insurance provider conditions
  • Corporate group standards (for multi-site or multinational organisations)
  • Voluntary agreements or membership scheme conditions
  • Permits, licences, and consents tied to specific sites or activities

If your register only lists statutory legislation and ignores these, it will not fully meet the clause requirement.

How to Structure the Register

There is no single structure that every register must follow, and it is often determined by the type, size or nature of the organisation itself.  Most organisations use a spreadsheet, text document or a dedicated compliance software tool. Common groupings include:

  • General health and safety legislation
  • Fire safety
  • Environmental (where it overlaps with H&S, e.g. hazardous substances)
  • Sector-specific legislation (construction, manufacturing, healthcare, etc.)
  • Equipment and machinery
  • Chemical and hazardous substances
  • Transport and vehicles
  • Welfare and employment law touching on H&S

Structuring it makes the register easier to cross-reference against your risk assessments and operational controls, procedures and much faster to navigate during an audit.

Keeping It Live: Review and Monitoring

A legal register is only useful if it stays current. ISO 45001 requires that this information be kept up to date, so your process needs to show:

  • A defined review frequency (many organisations review quarterly, with a full review annually)
  • A named responsible person for monitoring legislative changes, this can be a representative in the organisation but could also be an external consultant
  • A method for capturing changes (legal update subscription services are common, as manually tracking government publications is unreliable)
  • A record of how changes were assessed and, where relevant, actioned (updated risk assessments, new controls, revised training)

Common Mistakes to Avoid

  • Treating it as a one-off exercise. Registers built once for certification and never revisited are one of the most frequent non-conformities.
  • Copying generic templates without tailoring. A register that does not reflect your actual sites, activities, and hazards will not withstand scrutiny.
  • No link to evidence. Listing a requirement without showing how it is actually met leaves a gap between the register and reality.
  • Missing “other requirements.” Focusing only on statute law and ignoring client, insurer, or industry obligations.
  • No ownership. Without a named responsible person, updates tend to fall through the cracks.

Final Thoughts

A well-built legal register does more than satisfy Clause 6.1.3 — it becomes a working tool that keeps your entire OH&S management system grounded in what the law and your other obligations actually require. Getting the structure right from the start, and building in a genuine review cycle, is what separates a register that passes audit from one that merely exists on paper.

If you would like support building or auditing your legal register as part of your ISO 45001 journey, get in touch with our team for a consultation.

Posted on

Health & Safety Legal Register vs Compliance Audit: What is the Difference?

If you have been told you need a “legal register” and separately advised to commission a “compliance audit,” you could be forgiven for wondering whether these are two names for the same thing. They are not — and understanding the difference matters, because most organisations that fall foul of a health and safety enforcement notice have one of these two documents in place but not the other.

This article explains what each one actually does, how they work together, and which one your organisation needs first.

The short answer

A health and safety legal register identifies which legal requirements apply to your organisation. A compliance audit (or compliance evaluation) tells you whether you are actually meeting them.

One is a map. The other is a health check against that map. You need both, but they answer different questions, and confusing them is one of the most common gaps we find when we review a client’s health and safety management system.

Health and safety consultant reviewing legal register documentation

What is a legal register?

A legal register is a structured record of the health and safety legislation, regulations, approved codes of practice, and other legal requirements that apply to your organisation’s specific activities, sites, and operations.

A good legal register will typically:

  • List each applicable piece of legislation (for example, the Management of Health and Safety at Work Regulations, COSHH, the Work at Height Regulations, or sector-specific rules)
  • Summarise what that legislation requires of your organisation
  • Identify which parts of your business or which activities the requirement applies to
  • Identify the controls in place to meet the legal requirements
  • Be reviewed and updated as legislation changes or your operations evolve

Crucially, a legal register is a document of applicability. It answers the question: “What law applies to us, and what does it say we must do?” It does not, by itself, tell you whether you are doing it.

What is a compliance audit or evaluation?

A compliance audit takes the requirements identified in the legal register (or an equivalent framework) and tests them against reality. It asks: “Are we actually meeting this requirement, in practice, today?”

A compliance audit typically involves:

  • Site visits and observation of actual working practices
  • Review of documentation, records, and evidence (permits, training records, inspection logs, risk assessments)
  • Interviews with staff, supervisors, and duty holders
  • Gap analysis against each legal requirement
  • A findings report ranking non-conformities by risk and urgency
  • Recommendations and an action plan to close the gaps

Where the legal register is a snapshot of obligations, the compliance audit is a live assessment of performance. It is the difference between having a checklist and actually checking the boxes — and finding out, in evidence-based detail, which ones you cannot honestly tick yet.

Legal Register

  • Records applicable legislation for the organisation

  • Sets the bench mark for compliance

  • Must be regularly reviewed & updated

  • Identifies controls in place

  • Bespoke to the organisation

  • Can be one jurisdiction or more

Compliance Audit

  • Identifies if you actually meet the legal requirements

  • Assesses at a specific point in time

  • Site visits, observations & staff interviews

  • Review of documentation, records, etc.

  • Gap analysis

  • Recommendations & action plan

Why the difference matters

We regularly see organisations that have invested in one of these tools and assumed it covers the other. Both mistakes carry real risk.

Legal register without an audit: You know what the law requires, but nobody has verified whether it’s happening on the ground. This is common where a legal register was purchased as a subscription product or generated once and filed away. It creates a false sense of security — the document exists, so the box feels ticked, but there is no evidence of actual conformance if an inspector, insurer, or regulator asks for it.

Audit without a legal register: You get a snapshot of current practice, but without a clear, maintained baseline of what should apply, the audit scope is often built from generic checklists or the auditor’s working knowledge rather than your organisation’s specific legal exposure. Gaps in obligations you did not know applied to you can be missed entirely.

Used together, the legal register defines the scope of what to check, and the audit provides the evidence of whether you are meeting it. This combination is also what regulators, insurers, and courts expect to see when assessing whether an organisation exercised due diligence — a legal register with no corroborating evidence of compliance checking is a weak defence in an enforcement case or civil claim.

How they fit into a health and safety management system

Think of it as a three-stage cycle:

  1. Identify — the legal register captures every applicable requirement
  2. Evaluate — the compliance audit tests current practice against each requirement
  3. Act — a corrective action plan closes the gaps the audit identifies, and the cycle repeats on a review schedule

This mirrors the “Plan-Do-Check-Act” approach that underpins recognised health and safety management standards such as ISO 45001 and HSG65. A legal register alone only covers “Plan.” Without the “Check” stage — the audit — you have no mechanism to confirm the plan is working.

Which do you need first?

If your organisation does not currently have a legal register, that is the logical starting point — you cannot meaningfully audit compliance against requirements you have not formally identified.

If you already have a legal register but it has not been tested against actual site practice in the last 12 months, a compliance audit should be your next step. An out-of-date or unverified register can quietly become a liability rather than an asset.

Get a clear picture of your legal exposure and compliance status

Many organisations discover during an audit that gaps have existed for months or years without anyone noticing — often because the legal register and the audit process were never properly connected.

If you are not sure whether your current legal register is complete, whether your last audit was thorough enough, or where to start with either, we can help. We carry out legal register development, gap analysis, and full compliance audits tailored to your sector and operations, with a clear, prioritised action plan at the end of it — not just a list of problems. We have experience in a variety of sectors to meet your needs.

Get in touch to arrange a no-obligation discussion about your current legal register or compliance status, and we will tell you honestly where your priorities should be.

Posted on

The Essential Guide to Environmental Permit Management Systems

Executive Summary

An environmental permit management system provides a structured framework of procedures to minimise pollution risks from permitted activities.

For regulated waste management, mining, or installation facilities, maintaining a written management system is a regulatory requirement.

This document outlines statutory compliance frameworks, risk assessments, site planning, and operational records to satisfy Environment Agency expectations.

Regulatory context and application requirements

1. Regulatory Context and Application Requirements – Environmental permit management system

The scope and submission requirements depend on the nature of the application.

Moreover, the complexity of site operations determines the system needs, including • Environmental permit management system.

Additionally, Standard Rules permits the – Environmental permit management system.

  • Risk Identification: Specific operational risks are pre-determined within generic risk assessments.
  • Submission Protocol: You do not need to submit the system documentation during the application phase.
  • Deployment Deadline: The complete management system must be fully operational prior to commencing site activities.
  • Regulatory Assessment: Documentation is typically evaluated during the pre-operation site inspection by an Environment Agency officer.
  • Combustible Waste Provision: Standard rules applications involving combustible waste storage require the concurrent submission of a robust Fire Prevention Plan (FPP).
Man sampling water

We manage bespoke permits through the environmental permit management system.

  • Risk Identification: Operational hazards must be explicitly identified via a site-specific risk assessment.
  • Submission Protocol: A comprehensive summary of the management system must be included as part of the formal application pack.
  • Water & Groundwater Exemptions: Standalone water discharge or groundwater activity applications (Forms B6.5 or B6.6) do not require advance submission of the management system summary, but the system must be fully implemented prior to operation.

2. Certified Environmental Management System (EMS) Standards. Additionally, they align with the environmental permit management system to meet regulatory requirements.

For large-scale or high-risk facilities, such as industrial installations and hazardous waste processing operations, the Environment Agency favours these systems.

Moreover, they are part of the environmental permit management system and are built around recognised international frameworks.

Utilising an independently verified system enhances regulatory confidence and can reduce inspections under the OPRA methodology.

As part of the environmental permit management system, operators must state if their system is modelled on accredited standards. Additionally, they should indicate whether it is modelled on any listed standards.

Note: Accredited certification (verified by UKAS) demonstrates robust governance, but it does not absolve the operator of liability.

However, this does not absolve the operator of liability for individual permit breaches within the environmental permit management system.

3. Site Infrastructure and Spatial Planning Requirements are addressed within the environmental permit management system.

Operators must compile scaled, detailed site plans showing where permits and exemptions take place within the environmental permit management system. Additionally, high-risk or complex sites frequently require multiple standalone drawings to fulfil regulatory requirements.

Core infrastructure components (Waste, Installations, and Mining) are central to the environmental permit management system.

Site plans for the management system must clearly mark the locations of the following assets.

Additionally, this relates to the environmental permit management system.

  • Structural Assets: Buildings, treatment facilities, incinerators, silos, and perimeter security fencing.
  • Hazardous Storage: Containment areas for oils, fuel tanks, chemical bunds, and raw waste stock.
  • Emergency Equipment: Spill kits, absorbents, and critical emergency response machinery.
  • Logistics Access: Dedicated entry and exit pathways for emergency service vehicles.
  • Pollution Control Points: Environmental monitoring stations, sampling points, and inspection manholes.
  • Effluent Infrastructure: Trade effluent or sewage treatment plants and final discharge outfalls.
  • Historical Liabilities: Any parcels of land with known or suspected historical ground contamination.

Additionally, mapping of drainage and utilities supports the environmental permit management system for regulatory compliance.

Drainage networks require precise colour-coding and directional labelling. Additionally, implementing an environmental permit management system supports consistent labelling and compliance.

  • Foul and Combined Drainage: Must be marked clearly in red.
  • Surface Water Drainage: Must be marked clearly in blue.
  • Flow Mechanics: Plans must display water flow direction, discharge connection points (to sewer, soak-away, or watercourse), manhole covers, interceptor tanks, and isolating stop/diverter valves.
  • Utility Routing: Main inlets and distribution paths for mains water, gas, and electricity must be charted, with explicit positioning of water stop taps and utility isolation switches.

Additionally, standalone water discharge and groundwater activities are managed under the environmental permit management system.

Furthermore, for point-source water and groundwater authorisations, the site plan must isolate within the environmental permit management system.

  • The wastewater treatment infrastructure.
  • Statutory sample collection and monitoring points.
  • Mitigation infrastructure and environmental emergency equipment.
  • The defined surface water outlet or groundwater infiltration system.
  • The designated field boundaries for land-spreading activities (where applicable).

4. Operational Control Plans and Specific Sub-Systems for the environmental permit management system.

A compliant management system breaks down site operations into distinct phases.

Additionally, start-up, normal operation, and shut-down are the phases for the environmental permit management system.

Operators must identify the environmental risks associated with each sub-process and outline specific mitigation actions.

Waste storage plans are integral to the environmental permit management system and ensure safe, compliant operations.

Waste facility operators must document an explicit waste storage strategy detailing.

In addition, this record should be maintained in the environmental permit management system.

  • Maximum storage duration thresholds for every distinct waste streams.
  • Control measures to prevent emissions during extended storage.
  • Absolute volume limits and maximum pile heights for all stored materials.
  • Waste identification procedures and strict segregation protocols for incompatible materials.
  • Pre-acceptance and acceptance procedures to prevent the receipt of unpermitted waste.

The environmental permit management system manages Fire Prevention Plans (FPP).

Facilities storing combustible waste must submit a standalone, robust Fire Prevention Plan detailing prevention, detection, containment, and mitigation measures.

Within the environmental permit management system, the Environment Agency assesses these plans stringently against hourly review rates.

Consequently, failing to secure approval on initial submission significantly elevates regulatory costs.

Site Condition Reports (SCR) relate to the environmental permit management system.

For installations, waste operations, and mining permits, a Site Condition Report must be maintained throughout the lifecycle of the permit. This document logs historical spills, baseline land/groundwater data, and evidence verifying effectiveness in the environmental permit management system. It serves as the primary legal benchmark when applying to surrender a permit.

Standalone Environmental Management Documents cover the environmental permit management system and its related compliance.

Depending on site risks, the Environment Agency will require separate, standalone document submissions for individual environmental vectors.

Consequently, this enables the environmental permit management system to support distinct internal specialist reviews.

  • Odour Management Plan (OMP)
  • Emissions Management Plan (EMP)
  • Noise and Vibration Management Plan (NVMP)
  • Pests Management Plan (PMP)

5. Additionally, Contingency, Emergency, and Climate Change Resilience within the environmental permit management system.

Accident prevention and risk mitigation are essential in the environmental permit management system.

Operators must maintain emergency contingency frameworks that assess the likelihood and consequences of unexpected disruptions.

Additionally, the system must outline proactive preventative actions and emergency response procedures for environmental permit management system.

  • Core equipment breakdowns or sudden utility failures.
  • Enforced or emergency facility shutdowns.
  • Vandalism, security breaches, and deliberate damage.
  • Fires, flash flooding, and severe weather anomalies.

Emergency documentation must include formal accident logging forms, emergency contact directories, and a transparent review schedule. Additionally, operators should actively engage local emergency services and verify flood warning registrations within the environmental permit management system.

Cyber security protocols are essential and an environmental permit management system can support compliance and business continuity.

Modern waste infrastructure and environmental monitoring systems rely heavily on automated computer control systems. Additionally, operators must integrate risk controls aligned with NCSC guidelines to protect software in the environmental permit management system.

Climate Change Adaptation Strategy supports the environmental permit management system to enhance resilience.

In accordance with UK climate projections, operators must evaluate the long-term impact of severe weather shifts on permit compliance. Additionally, these shifts are relevant to the environmental permit management system.

  • Short-to-Medium Term: Operational processes must show resilience against a 2°C global mean temperature rise by 2050.
  • Long-Term Asset Planning: For long-lifecycle facilities, operators must evaluate potential risks up to a 4°C temperature rise by 2100.
  • Methodology: Risk assessments should leverage ISO 14090:2019 standards and the Environment Agency’s industry sector examples for climate adaptation.

6. Corporate Governance, Training, and Audits

Moreover, staff competence and training infrastructure supports operational effectiveness in the environmental permit management system.

For the environmental permit management system, compliance with the permit requires adequate resource allocation and clearly defined operational roles. Additionally, operators must establish formal procedures.

  • Assign and document individual technical competence responsibilities.
  • Verify external contractor credentials and internal staff qualifications.
  • Maintain central registries of regulatory certifications, safety inductions, and refresher training.

Public Information Provisions outline the environmental permit management system.

Waste and installation permits carry a statutory obligation.

Maintain a clearly visible, weatherproof notice board at the site entrance as part of the environmental permit management system.

The board must display:

  • The registered permit holder’s corporate name.
  • A designated 24/7 emergency contact name and phone number.
  • Explicit confirmation that the facility is regulated by the Environment Agency.
  • The unique environmental permit reference number.
  • Statutory Environment Agency contact numbers: General Enquiries (03708 506506) and the Incident Hotline (0800 807060).

7. Record keeping, auditing, and system reviews support environmental permit management system.

This statutory record retention checklist applies to the environmental permit management system.

Operators must maintain structured archives documenting the active execution of the permit management system. Critical records include:

  • Current and historical environmental permits and legal variations.
  • Comprehensive risk assessments and secondary management plans (e.g., Mops).
  • Detailed calibration records for environmental monitoring and sampling equipment.
  • Logs of all internal compliance checks, audit findings, and remedial actions.
  • Formal complaints ledgers detailing root-cause investigations and resolution outcomes.

Waste Transfer Log Obligations

For every incoming delivery of waste material, operators must capture and preserve the following metrics:

  • Absolute quantity (verified weight or volume).
  • The statutory six-digit List of Waste (LoW) Code.
  • Origin location and complete corporate identity of the waste producer.
  • Date and time of arrival on site.
  • The original generation date (mandatory for odorous or putrescible waste streams).
  • Detailed containment logs for any rejected or quarantined materials.

Mandatory System Review Triggers

A permit management system is a dynamic document. It must be updated immediately upon the occurrence of any of the following events:

  • Technical modifications to onsite machinery, infrastructure, or operational capacities.
  • The submission of an application to vary the existing environmental permit.
  • Post-incident reviews following a site accident, permit breach, or formal complaint.
  • The introduction of new environmental controls to mitigate an emerging risk.

8. Site Closure and Permit Surrender

Environmental permits cannot be abandoned unilaterally when operations cease. Legal obligations remain active until the Environment Agency formally approves a Permit Surrender Application.

For landfills and Category A mining waste facilities, a transitional period of site closure applies. During this phase, operators must maintain active emissions monitoring regimes and submit final site closure updates via the Site Condition Report, proving conclusively that the land and groundwater have been returned to a satisfactory state.

Technical Support and Consultancy

Developing, implementing, and defending a regulatory management system requires specialist technical oversight. For bespoke assistance with permit applications, Fire Prevention Plans, or standalone environmental management documents, contact our regulatory advisory team for professional consultation.

Posted on

Do I really need a legislation register?

A legislation register is a critical component of any robust corporate governance framework. In an increasingly complex regulatory landscape, organisations must actively track, evaluate, and fulfil their legal obligations. Integrating a centralised legal register into your management system ensures continuous compliance, mitigates operational risk, and satisfies the rigorous requirements of international standards like ISO 9001, ISO 14001, and ISO 45001 (previously OHSAS 18001).

auditor with clipboard
A legislation register with ensure your business is prepared for change

The Strategic Value of a Legislation Register in ISO Management Systems

Modern corporate governance demands a proactive approach to regulatory risk. Organisations can no longer afford to treat legal compliance as an afterthought or a reactive exercise. To achieve long-term commercial resilience, executive leadership must embed a structured legislation register directly into the core of their business management frameworks.

A legislation register—often referred to as a legal register—is a comprehensive database that identifies, organises, and monitors all statutory, regulatory, and contractual obligations applicable to an organisation’s operations. Far from being a static document, it serves as a dynamic compliance anchor that protects businesses from litigation, financial penalties, and reputational damage.

For enterprises operating under international management standards, maintaining this register is not merely a best practice; it is a foundational requirement.

Aligning Legal Registers with ISO Standards

International standards established by the International Organisation for Standardisation (ISO) place significant emphasis on compliance management. A well-maintained legislation register serves as definitive evidence that an organisation understands and actively manages its legal landscape.

1. ISO 9001: Quality Management Systems (QMS)

While ISO 9001 focuses primarily on consistently meeting customer expectations and enhancing satisfaction, it explicitly intersects with statutory and regulatory mandates. Clause 1.1 states that the standard applies to organisations needing to demonstrate their ability to consistently provide products and services that meet both customer and applicable statutory and regulatory requirements.

A legislation register ensures that the legal parameters governing product safety, consumer protection, and industry-specific manufacturing laws are clearly defined and mapped to operational quality controls.

2. ISO 14001: Environmental Management Systems (EMS)

Under ISO 14001, the management of environmental compliance obligations is a strict, mandatory requirement. Clause 6.1.3 demands that organisations determine and have access to the compliance obligations related to their environmental aspects. Furthermore, Clause 9.1.2 requires planned evaluations of compliance status.

An environmental legislation register provides the exact framework needed to track complex rules concerning emissions, waste disposal, hazardous material handling, and resource consumption. Without it, verifying adherence during a third-party ISO audit is virtually impossible.

3. ISO 18001 / ISO 45001: Occupational Health and Safety (OH&S)

Historically, OHSAS 18001 set the global benchmark for workplace safety, requiring organisations to identify and access applicable legal requirements. This standard has since been succeeded and elevated by ISO 45001, which maintains an even stricter focus on legal frameworks. Clause 6.1.3 of the modern OH&S standard requires the systematic determination of legal and other requirements, while Clause 9.1.2 mandates periodic compliance evaluations.

A safety-focused legislation register tracks building regulations, machine guarding standards, personal protective equipment (PPE) mandates, and workers’ compensation laws, fundamentally reducing workplace incidents and liability.

Core Operational Benefits of a Centralised Legal Register

  • Risk Mitigation: Isolates potential compliance breaches before they result in punitive fines, operational shutdowns, or executive prosecution. Valued by regulatory bodies such as the Health and Safety Executive, the Environment Agency and others.
  • Streamlined Auditing: Provides internal and external auditors with immediate, organised, and verifiable evidence of regulatory adherence.
  • Operational Continuity: Centralises specialised regulatory knowledge, ensuring corporate compliance protocols survive leadership transitions or personnel changes.
  • Proactive Adaptability: Establishes a systematic review cycle that alerts management to upcoming legislative adjustments, giving operations ample time to adapt.
Legal register flow chart

Best Practices for Execution

An effective legislation register must transcend a simple list of titles. To deliver true corporate utility, it should include:

  • Specific Granularity: Reference exact sections, clauses, and amendments relevant to the business.  Ensure the register entries are relevant to your business, off the shelf update services may not provide this level of detail.
  • Process Mapping: Link every legal requirement directly to an internal policy, operating procedure, or specific asset.
  • Assigned Accountability: Designate a qualified internal owner responsible for monitoring each piece of legislation.
  • Evidence Log: Maintain a digital audit trail proving when compliance was last evaluated and verified.
  • Maintain the register: once your register is in place, ensure that it is regularly maintained and updated.  Laws and regulations change and your business must be aware and plan for such changes.

Conclusion

A legislation register is an indispensable component of successful ISO 9001, ISO 14001, and ISO 45001 management systems. By transforming legal compliance from an administrative burden into an organised asset, organisations safeguard their operational integrity, validate their commitment to corporate responsibility, and build a sustainable foundation for international commercial growth.

Need Help Implementing This?

If you require expert assistance preparing or maintaining a legal register for your business, please reach out to the Ashbrooke advisory team today.

Would you like a free copy of our health and safety and environmental legal register checklist?

Checklist
Posted on

Safe Systems of Work

A lack of safe systems of work resulted in a cargo handling company being fined after the employee was fatally crushed at a container park in Portsmouth.

On 25 August 2017, Mr Mieczyslaw Tadeusz Siwak, a 34-year-old father-of-one, was working for Portico Shipping Limited (formerly MMD (Shipping Services) Limited) on the night shift in the container park. His job was to connect refrigerated container units to electrical supplies, which his colleague had lifted into position for him using a container stacker vehicle. It was during one of these manoeuvres that Mr Siwak was fatally crushed between two containers.

An investigation by the Health and Safety Executive (HSE) found that the company routinely failed to provide adequate supervision of operatives and drivers working on the night shift to ensure safe systems of work were followed. This included failure to use safe walkways to segregate pedestrians from vehicles and the safe operation of container stackers by driving with shipping containers in the raised position to allow visibility.

Portico Shipping Limited of Guildhall Square, Portsmouth, Hampshire pleaded guilty to breaching Section 2(1) of the Health & Safety at Work etc. Act 1974. At Portsmouth Magistrates’ Court the company was fined £200,000 and ordered to pay costs of £15,631.61.

“Safe systems of work should be in place on sites with moving vehicles to prevent pedestrians coming into contact with traffic or moving machinery. When moving containers by container stacker, the load should be transported as low as possible whilst maintaining full line of sight.

“Supervisors must be given the necessary instruction and training to implement the safe systems of work and manage hazards during operation processes.

“This tragic incident was entirely preventable had the correct safety management procedures and supervision been in place at the site.”

HSE inspector Rebecca Lumb

Safe Systems of Work

A formal management system or framework can help you manage health and safety and ensure that you have safe systems of work in place – the decision whether to use a recognised management system is up to employers and it is not a requirement of the HSE. Examples include:

National and international standards such as:

  • ISO 45001:2018 Occupational health and safety management systems – Requirements with guidance for use
  • BS EN ISO 9001:2015 Quality management system

in-house standards, procedures or codes

sector-specific frameworks such as the:

  • Energy Institute’s High-level framework for process safety management
  • Chemical Industries Association’s Responsible Care framework

Although the language and methodology vary, the key actions can usually be traced back to Plan, Do, Check, Act methodology.

safe systems of work
Is a certified management system right for your business?

HSE Position on ISO 45001

ISO 45001 is an international standard for health and safety at work developed by national and international standards committees independent of government.  Introduced in March 2018, it replaced the current standard (BS OHSAS 18001) which will be withdrawn. Businesses had a three-year period to move from the old standard to the new one.

Businesses are not required by law to implement ISO 45001 or other similar management standards, but they can help provide a structured framework for ensuring a safe and healthy workplace.

If your organisation is small or low-risk, you will probably be able to demonstrate effective risk management without a formal management system. A simpler and less bureaucratic approach may be more appropriate such as that outlined in HSE’s guidance on health and safety made simple.

Implementing ISO 45001 may help your organisation demonstrate compliance with health and safety law. But, in some respects, it goes beyond what the law requires, so consider carefully whether to adopt it.

If your organisation already has a developed health and safety management structure, or you are familiar with other management standards, it may be straightforward for you to adopt ISO 45001. However, if your organisation is small, with less formal management processes, you may find it difficult to interpret what the standard asks for or gauge what proportionate implementation looks like.  This may particularly be the case if you are adopting management standards to meet supply chain requirements of customers or contracting bodies.

The HSE has expressed concern about the practical implementation of the standard, including audit and certification, and whether it can be easily tailored to work effectively for organisations of all sizes and levels of complexity in a way that’s in proportion to the risks they must control.

Contracting bodies and customers should therefore ask themselves whether the supplier really needs certification to 45001, or whether they can demonstrate competence in managing health and safety using other means.

Compliance with health and safety law

HSE inspectors continue to rely on a wide range of evidence and observations when assessing an organisation’s compliance with health and safety law, not just whether they claim to meet the ISO 45001 standard or not.  The HSE’s guide on managing for health and safety (HSG 65) may help your organisation as it provides a clear process-based approach to risk management. However, adopting a formalised management system approach, whether HSG65 or ISO 45001, may not be the most appropriate model for your businesses, particularly if it is small or low-risk.

Certification

Your organisation can apply the standard to your activities (in full, or in part) to help provide evidence of good health and safety management, and improvements made, without getting certification. However, you can only claim to conform to the standard if it is implemented fully.

Audit

To implement ISO 45001 in a proportionate way, auditors or certifiers should understand that it needs to be (i) tailored to an organisation’s size and level of complexity, and (ii) in proportion to the risks.  You should ensure that any auditor or certifier you use has evidence that they are competent to a recognised standard.  The certification body should be accredited by either the United Kingdom Accreditation Service (UKAS) for ISO 45001 or an equivalent accretion body that is member of the European Cooperation for Accreditation (EA) or the International Accreditation Forum (IAF).

Documentation

Businesses should try to keep health and safety documents functional and concise, with the emphasis on their effectiveness rather than sheer volume of paperwork.  Focusing too much on the formal documentation of a health and safety management system will distract you from addressing the human elements of its implementation – the focus becomes the process of the system itself rather than actually controlling risks.

Attitudes and behaviours

Effectively managing for health and safety and having safe systems of work is not just about having a management or safety management system. The success of whatever process or system is in place still hinges on the attitudes and behaviours of people in the organisation (this is sometimes referred to as the ‘safety culture’).

The HSE has published Are you doing what you need to do? Which provides examples of what positive health and safety attitudes and behaviours will look like in the workplace. On the other hand, the examples provided of ‘What it looks like when done badly or not at all’ could indicate underlying cultural issues which employers should address.

Our health, safety and environmental consultants have experience in implementing management systems into client operations including ISO 9001, ISO 14001 and ISO 45001.  If your business needs advice and support with your management system, please contact one of the Ashbrooke team.

Posted on

Keeping it Legal

In this article, Keeping it legal, we consider the expanding burdens on business from legislation. The legal burden on business continues to increase each year with the introduction of new rules, European legislation and domestic laws.  Legal compliance is seen as a significant risk by many business leaders such that a recent MORI poll identified the worst aspect of being a business leader was keeping up to date with legislation.  Legislation governs all of our lives and the business world is no different. 

Continue reading “Keeping it Legal”
Posted on

Investing in corporate governance adds value to the bottom line and improves resilience in uncertain times.

We often say that the best companies to invest in are those that have good corporate governance principles but such measures need to be more than superficial gloss and need to be embedded in the organisation if they are to influence the bottom line.  Listed companies are subject to detailed rules on corporate governance which requires significant resources to maintain.  However, private companies which are not subject to these rules are increasingly embracing the governance principles as a means of demonstrating good practice to investors, customers and other stakeholders. 

Continue reading “Investing in corporate governance adds value to the bottom line and improves resilience in uncertain times.”
Posted on

Can too much corporate governance stifle SMEs?

Corporate governance has been a major topic in recent years following the economic crisis and various financial scandals.  For companies it is important to have corporate governance in place to ensure that the management team operates the company in the best interests of shareholders and other stakeholders – for listed companies there are detailed rules to follow. 

Continue reading “Can too much corporate governance stifle SMEs?”