Short answer
Internal control is systematic measures that make sure the business is planned, organised and run in line with the HSE rules. The person responsible for the business must see that it exists and is used, together with the employees. Parts of it must be in writing, but the extent can be adapted to the size and risk of the company.
Internal control in one sentence
The Internal Control Regulations define internal control as systematic measures that make sure the business’s activities are planned, organised, carried out and maintained in line with the requirements of the HSE legislation. Put simply: you have a fixed way of making sure the HSE work is actually done, and that you can show it.
Internal control and systematic HSE work
Section 3-1 of the Working Environment Act says the employer must ensure systematic HSE work, in cooperation with the employees and their representatives. Section 5 of the Internal Control Regulations describes the content in the same order. In practice most people talk about the same work under two names. Read more about the requirements in the guide on HSE requirements.
Who is responsible?
The regulations say that the person responsible for the business must see that internal control is introduced and carried out, in cooperation with the employees. This means management owns the work, while the employees must take part. The regulations cover more areas than the working environment, for example electrical safety and fire protection. This guide is about HSE under the Working Environment Act.
What must be in writing?
The regulations say that internal control must be documented in the form and to the extent necessary given the nature, activities, risk and size of the business. Written documentation must at least cover:
- goals for the HSE work,
- an overview of the organisation and responsibilities,
- mapping of hazards, assessment of risk, and plans and measures,
- procedures to detect, correct and prevent breaches of the requirements,
- regular monitoring and review of internal control.
Documentation you have under other rules, such as instructions, permits and proof of competence, must also be included. The regulations have no separate relief for small businesses. The adaptation lies in the extent being proportionate to size and risk: a small office company can make do with simple documentation, while a company with hazardous work needs more.
What it looks like in practice
A simple way to think about it is a cycle you go round every year:
- Plan. Set goals, assign responsibility and map hazards. See the guide on risk assessment.
- Do. Carry out the measures, and make sure employees know the procedures and have been trained.
- Check. Carry out safety inspections, and follow up deviations.
- Improve. Review the whole at least once a year, and update goals and plans.
Common mistakes
- The documents were written once and sit in a folder, without anyone using them.
- Responsibility is unclear, so nobody follows up.
- The employees are not involved, and do not know the procedures.
- Deviations are registered, but nobody closes them.
- No regular review is carried out.
How the portal helps
The HSE system has an overview of the requirements in the Internal Control Regulations, risk analysis and safety inspections from templates, deviations with follow-up, procedures with read confirmation, an HSE handbook and an HSE annual plan. You can also carry out the annual review of internal control there.
Sources
The rules change. Always check the current text with the sources below. Most sources are in Norwegian. This guide is general information and not legal advice.