ISO 45001 clause 9.1.2: evaluate fulfilment of OH&S requirements
ISO 45001:2018 clause 9.1.2 requires processes to evaluate fulfilment of legal and other requirements. Determine the frequency and methods, evaluate compliance and take action where needed, maintain knowledge and understanding of compliance status, and retain documented information on the results. A requirement list alone does not perform this evaluation.
What clause 9.1.2 requires in practice
Clause 9.1.2 requires a process for evaluating compliance with the legal requirements and other requirements the organisation has determined under clause 6.1.3. The organisation sets how often and by what methods compliance is evaluated, carries out the evaluation, and takes action where it finds a need, linking to the corrective action route in clause 10.2.
It must also keep its knowledge and understanding of where it stands on compliance, meaning an up-to-date picture rather than a conclusion reached once. The results of the evaluation are retained as documented information. The clause covers other requirements as well as laws, which can include customer commitments or sector codes the organisation has adopted. The output is a supported conclusion for each significant requirement, with evidence, an owner for any gap and a way to keep the picture current.
Start with the applicable requirement
Use the determinations made under clause 6.1.3. Identify the actual duty, affected activity and relevant conditions. A broad legal title or contract heading may not be specific enough to evaluate. Obtain competent interpretation where the requirement’s meaning or applicability is uncertain.
Then determine what evidence can establish the current position. Evidence may come from operational records, observations, measurements or other suitable information. The method should match the requirement; possession of a document may demonstrate one duty but say little about whether an operational condition is fulfilled.
Choose frequency and methods deliberately
Consider the nature of the duty, changes, potential consequences and available information when determining evaluation arrangements. The standard does not impose one annual frequency for all requirements. Some matters may need attention more often or when a relevant change occurs.
Preserve the distinction between an update service and evaluation. Receiving notice of a changed requirement helps keep information current. The organisation still needs to assess applicability, implement any necessary change and evaluate fulfilment through suitable evidence.
Why clause 9.1.2 matters to the business
Knowing which laws apply is not the same as meeting them. Gaps discovered by a regulator, an injured worker or a customer audit can bring penalties, stoppages and lost contracts. A defined evaluation process gives the business an early, controlled way to find and fix those gaps. It also clarifies where specialist advice is needed, so managers do not guess about legal meaning. Customers who impose their own site rules gain confidence when they see these commitments evaluated like legal ones. For groups working in many countries, evaluation helps local managers see which duties apply to them and gives top management a real view of exposure rather than a reassuring summary built from a legal list.
How to implement clause 9.1.2
Work from the requirements you have already determined and test each against real conditions. A practical approach follows. Apply the evaluation to the work as performed, not just to documents held, and remember that no fixed frequency or register layout is specified, so choose arrangements that you can justify and maintain.
- Take the list of applicable legal and other requirements and group them by the activity, site or role they affect.
- Assign an accountable evaluator with enough capability to interpret each group, and seek specialist advice where applicability is uncertain.
- Decide what evidence will show fulfilment, such as observations, operating records, measurements or inspection results, matching it to the duty.
- Set the frequency for each group according to the consequence of failure and the likelihood of change, and add review when work, equipment or the requirement itself changes.
- Record the requirement, evidence considered, conclusion and any action, using plain words.
- Assign every gap an owner and route it through corrective action, and treat unresolved uncertainty as open.
- Report the compliance picture to management review and update it as conditions change.
Two illustrative evaluations
A construction contractor evaluates requirements relevant to a defined project activity. A competent reviewer compares the applicable conditions with current arrangements and records, identifies a gap and assigns an appropriate response. The conclusion is specific to the evidence and period examined. It does not become a blanket statement that every project activity complies with every law.
A software business has accepted client-site OH&S requirements for staff working at the customer’s premises. It checks whether relevant information, reporting arrangements and agreed responsibilities have been implemented. A copy of the signed agreement is a source of requirements, while evidence of actual implementation supports the evaluation.
Act on gaps and uncertainty
Where the evaluation identifies non-fulfilment or insufficient evidence, determine necessary action and the route for resolution. Appropriate specialist advice may be needed. Avoid marking an uncertain item compliant merely to complete a dashboard.
Maintain knowledge and understanding of compliance status as conditions change. An earlier conclusion may no longer apply after new work, altered equipment or changed requirements. Relevant findings also inform management review and other system responses.
Required evidence and common mistakes
Retain documented information on evaluation results. A useful record explains the requirement evaluated, evidence considered, conclusion and necessary action. These are practical elements that support understanding, not a prescribed register layout.
Common weaknesses include repeating the legal register without examining performance, using internal audit as the only assumed evaluation and relying on a provider’s general assurance. Another is recording a gap without an owner or follow-up. Certification does not remove the organisation’s duties or establish a universal legal-compliance guarantee.
Frequently asked questions
Is updating the legal register an evaluation?
No. It supports current requirements; evaluation examines whether those requirements are fulfilled in practice.
Can an internal audit contribute evidence?
Yes, where relevant, but the organisation still needs its defined compliance-evaluation process and conclusions.
What if the evidence is inconclusive?
Record the uncertainty and determine what information or advice is needed. Do not substitute an unsupported positive status.
Trace one requirement to a supported conclusion
Discuss OH&S compliance-evaluation arrangements with Sterling, with legal interpretation scoped where necessary. The ISO 45001 Awareness course explains the system connection. Effivity ISO & GRC automation software can be scoped to agreed evidence processes. See performance evaluation and the directory.