Internal Control Regulations

1. Section 1. Purpose

   Through requirements for the systematic implementation of measures, these Regulations shall promote efforts to improve conditions in enterprises with regard to:

   • –

     working environment
   • –

     safety
   • –

     prevention of damage to health or disturbances to the environment from products or consumer services
   • –

     protection of the external environment against pollution and improved treatment of waste
   • –

     prevention of incidents and accidents associated with own lawful activity
   • –

     prevention of undesirable intentional incidents

   in order to achieve the objectives of the health, environmental and safety legislation.

2. Section 2. Scope

   The Regulations apply to enterprises governed by the:

   • –

     Act relating to supervision of electrical installations and equipment (Act No. 4 of 24 May 1929)
   • –

     Section 23 (own protection measures for enterprises) of the Civil Protection Act (Act No. 45 of 25 June 2010)
   • –

     Product Control Act (Act No. 79 of 11 June 1979)
   • –

     Working Environment Act (Act No. 62 of 17 June 2005)
   • –

     Pollution Control Act, if the enterprise has employees (Act No. 6 of 13 March 1981)
   • –

     Gene Technology Act (Act No. 38 of 2 April 1993)
   • –

     Radiation Protection Act (Act No. 36 of 12 May 2000).
   • –

     Fire and Explosion Protection Act (Act No. 20 of 14 June 2002).

   These Regulations do not apply to:

   • –

     Svalbard,
   • –

     undertakings referred to in Section 1-3 of the Working Environment Act,
   • –

     onshore facilities in the petroleum activities referred to in Section 6 of Regulations No. 158 of 12 February 2010 relating to health, safety and the environment in the petroleum activities and at certain onshore facilities (Framework Regulations), with the exception of activities that come under Section 23 of the Civil Protection Act.

3. Section 3. Definitions

   The following definitions apply in these Regulations:

   Internal control: Systematic measures intended to ensure that the activities of the enterprises are planned, organised, executed, secured and maintained in accordance with requirements laid down in or pursuant to health, safety and environmental legislation.

   Health, safety and environmental legislation: The acts referred to in Section 2, paragraph one, and regulations laid down pursuant thereto.

4. Section 4. Duty to maintain internal control

   The party responsible for the enterprise must ensure that internal control is introduced and exercised at the enterprise and that this takes place in cooperation with the employees and their representatives.

   The employees shall contribute in connection with the introduction and exercise of internal control.

5. Section 5. Content of the systematic health, safety and environmental work. Documentation requirements

   Internal control shall be adapted to the nature, activities, risk factors and size of the enterprise to the extent that is necessary for complying with requirements stipulated in or pursuant to the health, safety, and environmental legislation.

   Internal control entails that the enterprise shall:	Documentation
   1. ensure that the laws and regulations in the health, safety and environmental legislation which apply to the enterprise are accessible, and have an overview of the requirements that are of particular importance to the enterprise,	–
   2. ensure that the employees have sufficient knowledge of and proficiency in the systematic health, safety and environmental work, including information regarding changes,	–
   3. ensure employee participation so as to utilise combined knowledge and experience,	–
   4. establish goals for health, safety and the environment	Must be documented in writing
   5. have an overview of the enterprise's organisation, including how responsibilities, tasks and authority for health, safety and environmental work are allocated,	Must be documented in writing
   6. identify hazards and problems and, on this basis, assess risk, and prepare appurtenant plans and measures to reduce these risk factors,	Must be documented in writing
   7. implement routines to detect, rectify and prevent violations of requirements laid down in or pursuant to health, safety and environmental legislation,	Must be documented in writing
   8. conduct systematic monitoring and review of internal control to ensure that it functions as intended,	Must be documented in writing

   Internal control must be documented in the form and to the extent necessary based on the type, activities, risk factors and size of the enterprise. Documentation associated with requirements stipulated in or pursuant to the health, safety and environmental legislation, for example, instructions, permits, certificates of competence etc. must be included.

   Written documentation pursuant to these Regulations must, at a minimum, include the items listed in paragraph one (4) up to and including paragraph one (8) of this section.

   Voluntary certificates may also form part of the documentation.

6. Section 6. Coordination

   When multiple enterprises perform work at the same workplace, they must, when necessary, agree in writing as to which of them will be responsible for coordinating internal control for their common activities or areas. If no such agreement is reached, the supervisory authorities may decide which of the enterprises shall have this responsibility. If considerations relating to health, safety or the environment argue in favour of a different allocation of responsibility, the supervisory authorities may reverse an agreement that has been entered into.

   When an enterprise that is the contracting authority engages contractors etc. to perform assignments at the enterprise's own area or installation, the contractor's internal control must, insofar as possible, constitute the basis for the activities covered by the assignment. This applies when the assignment is performed by the contractor personally, by own employees or by others. The contracting authority must provide information relating joint rules etc. and ensure that potential deficiencies are rectified or necessary adjustments made in its own internal control or that of the contractor.

7. Section 7. Supervisory authority

   The supervisory authority pursuant to the health, safety and environmental legislation shall supervise and provide guidance on the implementation of and compliance with these Regulations.

8. Section 8. Exemptions

   After consulting with the Ministry of Climate and Environment, Ministry of Justice and Public Security and Ministry of Health and Care Services, the Ministry of Labour and Social Affairs may grant an exemption from these Regulations when there are special circumstances for doing so.

9. Section 9. Appeals

   Individual decisions that have been made pursuant to these Regulations may be appealed to the administrative agency that is the immediate superior to the administrative agency that made the decision, cf. the Public Administration Act.

10. Section 10. Sanctions

    The provisions relating to penalties and other sanctions stipulated in the health, environmental and safety legislation are applicable in the event of contravention of the provisions in these Regulations.

11. Section 11. Entry into force

    These Regulations enter into force on 1 January 1997.

    Royal Decree No. 159 of 22 March 1991 relating to internal control shall be repealed from the same date.

12. Remarks to the Regulations relating to Systematic Health, Environmental and Safety Activities in Enterprises (Internal Control Regulations

    To Section 2 – Scope

    These Regulations apply to enterprises governed by the acts referred to in this section. Exceptions to this are onshore facilities in the petroleum activities that are covered by the Regulations relating to health, safety and the environment in the petroleum activities and at certain onshore facilities (Framework Regulations). Activities at the onshore facilities covered by Section 23 of the Civil Protection Act are included. The Regulations cover both public and private sector undertakings of all types and all forms of commercial activity (enterprise/company), including consumer services. The Regulations also cover the public administration and public services. However, private individuals/consumers are not covered by the Regulations. For further clarification of how the term «enterprise» should be understood, reference is made to the individual acts. If there are any doubts regarding the scope of these Regulations, clarification can be obtained by contacting the relevant supervisory authority.

    In order for the Regulations to apply in the area covered by the Pollution Control Act, it is a requirement that the enterprise has employees. As a general rule, the same applies to the area covered by the Working Environment Act. Among other things, this entails that sole proprietorships are not directly subject to requirements for internal control for compliance with the Pollution Control Act or regulations based on the Working Environment Act. However, such enterprises may be covered by a co-ordinated internal control system if they perform work together with other enterprises at the same workplace, cf. Section 6 of the Regulations.

    In the areas covered by the Radiation Protection Act, Electrical Supervision Act, Fire and Explosion Protection Act, Product Control Act and the Gene Technology Act, the application of the Regulations is not dependent on whether or not the enterprise has employees. This is based on the purpose of the individual acts. Any enterprises, including sole proprietorships, that are subject to the system of rules within these acts are therefore covered by the Internal Control Regulations unless it is specifically stated that the Regulations are not applicable.

    The Internal Control Regulations do not apply to construction clients and the performance of duties imposed by the Construction Client Regulations. In the instances in which the construction client is the employer and performs work with own employees at the building or the construction site, the Internal Control Regulations will apply for protecting the health, safety and environment of the employees. In relation to the Product Control Act, the Regulations apply to enterprises which manufacture, process, import, sell, use or otherwise process a product, and enterprises which offer a service to consumers. Enterprises which offer the use of products or services are subject to the Regulations, irrespective of whether or not they receive payment for doing so. For example, when municipalities offer the use of goalposts, playground equipment etc., they are subject to the Regulations.

    The Regulations also cover the obligations that municipalities have under the Fire and Explosion Protection Act to ensure the establishment and operation of fire brigades.

    The use of internal control as a principle of management and supervision has been adopted in several areas. Many enterprises are therefore required to have internal control that encompasses a number of different acts and regulations, including for the food and fisheries industry and schools and kindergartens. Enterprises that are covered by several different internal control provisions must consider the most appropriate means of complying with the requirements. For many, a practical approach would be to draw up an overall system which takes all of the acts into consideration.

    To Section 4 – Duty to maintain internal control

    The duty to introduce and exercise internal control rests with «the party responsible» for the enterprise. By this is meant the management or owner of the enterprise. The appurtenant party or function will vary according to how the enterprise is organised. Although internal control must be exercised at all levels of the enterprise, the primary responsibility for initiating the work («introducing» internal control) and maintaining this («exercising» internal control) lies with the highest level of the enterprise. However, the section clarifies that the duty to introduce and exercise internal control shall be carried out in cooperation with employees, working environment committees, safety delegates and/or employee representatives when applicable.

    The «party responsible» for the enterprise will depend on the various acts upon which the Regulations are based. Examples of «the party responsible» for implementing the requirements in the Regulations are:

    • –

      The Working Environment Act: Employer.
    • –

      The Pollution Control Act: The enterprise's management as specified in the enterprise's organisation or corporate structure.
    • –

      The Product Control Act: Manufacturer, importer, trader.
    • –

      The Civil Protection Act: Enterprises.
    • –

      The Fire and Explosion Protection Act: Enterprises.
    • –

      Act relating to supervision of electrical installations and equipment: Owners and users of electrical installations and equipment, manufacturers of, as well as importers and other parts of the sales chain for electrical equipment, electrical installation contractors etc.
    • –

      The Gene Technology Act: The enterprise's management as specified in the enterprise's organisation or corporate structure.
    • –

      The Radiation Protection Act: The enterprise's management as specified in the enterprise's organisation or corporate structure.

    Section 4, paragraph one also stipulates that the party responsible for the enterprise is obligated to ensure that internal control is monitored and reviewed to make certain that it functions as intended. This entails a duty to continually assess internal control activities to enable deficiencies to be identified. This duty also includes conducting a full review at regular intervals, i.e. a review of all of the systematic work, cf. Section 5, paragraph two (8).

    Section 4, paragraph two explicitly states that employees are obligated to contribute. This will also be a general condition of the employment arrangement. Contributing to the internal control work is therefore part of one’s work duties. The participation of safety delegates and members of working environment committees in connection with the establishment and maintenance of internal control is explicitly stipulated in Sections 6-2 and 7-2 of the Working Environment Act. Furthermore, pursuant to Section 4-2 of the Working Environment Act, employees and their representatives are entitled to participate in connection with management and planning systems. Internal control is regarded as a management and planning system that is covered by Section 4-2 of the Working Environment Act. For companies that are bound by a collective agreement, the same provisions can be found in, for example, Chapter IX of the Basic Agreement between the Confederation of Norwegian Enterprise (NHO) and the Norwegian Confederation of Trade Unions (LO).

    It is essential that internal control is integrated into the overall management and planning of the enterprise. An increasing number of enterprises are now focussing on making the relationship with the external environment part of the company's organisational strategy and profile, and internal control is an instrument that can be utilised to strengthen this work within the company. Employees will also be interested in their workplace having an environmental profile and in doing their part for achieving a more environmentally-friendly society. Internal control must also incorporate the requirements relating to the external environment, and is therefore an instrument for employees and their representatives to also influence the actions of the enterprise that impact the environment. In connection with the internal control work, it is also clear that employee experiences are an essential prerequisite for well-functioning internal control. Specific employee experiences with, for example, various input factors in production, purchasing, waste management, etc., constitute valuable knowledge that can contribute to a systematic review of all aspects of the enterprise that have an impact on the external environment. The scope for potential conflicts of interest also appears to be limited, since considerations of the working environment and external environment will generally gravitate in the same direction.

    Enterprises that include both employees and customers/users, for example, hospitals, schools, kindergartens and hotels, are responsible for health, safety and the environment for both groups. For these types of enterprises, it is important to remember that the laws may impose the same types of requirements, but these are directed at one of the groups – employee or user – or the laws may impose requirements that include both groups. The Product Control Act pertains to the safety of pupils etc., while the Working Environment Act covers the employees. The Fire and Explosion Protection Act will set requirements that include the safety of both hotel guests and employees. Internal control must therefore include all the acts upon which the Regulations are based to ensure that both employees and users are covered.

    To Section 5 – Content of the systematic health, safety and environmental work. Documentation requirements

    Section 5 sets out requirements for the content and documentation of internal control. In accordance with paragraph two (2), all employees are required to have knowledge and skills that enable them to perform the work in a manner that is safe and has no adverse effects on health or the environment. This also entails that employees are familiar with changes in internal control. Some knowledge requirements are stipulated in rules or agreements, for example, for safety delegates, emergency response personnel, etc. Other requirements will naturally follow from the nature of the enterprise and its activities or risk factors.

    In accordance with paragraph two (3), preparing, exercising and making changes to the enterprise’s internal control must take place in cooperation with and involvement of the employees at the enterprise, cf. also Section 4.

    As is the case with other operational areas, the enterprise must have an objective for its health, safety and environmental work. This is stipulated in paragraph two (4). The objectives are an important prerequisite for plans and activity, and should be as definitive as possible. Objectives of a more overarching nature must also be established. Objectives must be documented in writing.

    Paragraph three states that documentation of internal control will vary according to the nature, activities, risk and size of the enterprise. Some enterprises will prepare extensive analyses of risk, while others may be content with basic documentation. Internal control requires orderliness and a well-thought-out system. It also involves everyone who works at the enterprise being familiar with how internal control is performed in the areas of health, safety and the environment, and the supervisory authorities must have a clear understanding of how the enterprise works with health, safety and the environment.

    If there are routines and procedures for protecting health, safety and the environment, the requirement for systematic work will entail that the enterprise must further develop and create a coherent system for the existing routines and procedures. This will also include having to systematise the written work routines, instructions etc. that already exist to enable them to be adopted and included in the internal control. When rules impose requirements for certification, certificates must be included in the internal control. It may also be beneficial and appropriate that other documentation obtained by the enterprise, for example, voluntary certificates confirming that a product, service or activity, or a person's qualifications is in compliance with specified requirements, is included as part of the documentation.

    To Section 6 – Coordination

    This provision applies in situations where multiple enterprises perform work/activities together, at the same workplace, or for each other. Among other things, paragraph one covers the situations referred to in Section 2-2 of the Working Environment Act, while paragraph two includes instances in which an enterprise engages others to perform work on its behalf, for example, maintenance, building or construction work.

    Pursuant to paragraph one, enterprises that simultaneously perform work at the same workplace must agree in writing as to which of them will be responsible for coordinating internal control for common activities or areas. The reason for this is the obvious need for someone to be responsible for, and have an overview of, the overall health, environmental and safety situation at such workplaces. The requirement is limited to instances in which coordination is deemed necessary. Coordination must be deemed necessary when multiple enterprises that perform work at the same workplace collectively have more than 10 employees, cf. Section 2-2 of the Working Environment Act. In instances in which the number of employees is fewer than 10, situations may arise in which the risk associated with multiple enterprises being at the same workplace is considered to be so high that coordination of the enterprises' internal control is deemed necessary.

    In addition to establishing which enterprise is responsible for coordination, the agreement should also include an overview of the areas and/or activities to which this responsibility applies. The enterprise that will stand out as the most obvious for having responsibility for coordination will vary in each individual instance. It may be the enterprise that orders the work, while for some enterprises, responsibility for coordination may be stipulated in their licence conditions.

    Rules governing coordination between multiple enterprises can be found in, among others, Section 2-2 of the Working Environment Act and the Construction Client Regulations. Enterprises regarded as the principal undertaking pursuant to Section 2-2 of the Working Environment Act will normally also be able to have responsibility pursuant to the Internal Control Regulations. Pursuant to the Construction Client Regulations, the construction client is responsible for appointing a health, safety and environmental coordinator at the building or construction site. The primary purpose of the construction client's coordination is to prevent unnecessary conflict between different enterprises and different work operations to ensure that there is no danger to health, safety and the working environment. If there are multiple enterprises that each fulfil duties under different rules, these enterprises must again coordinate themselves to ensure that the result is in accordance with the rules. For enterprises operating at, for example, shopping centres, industrial parks, etc., it may often be natural for the operating company or holding company to assume responsibility for coordination. In any event, the enterprise in question must have the necessary overview, expertise and authority.

    If no agreement has been entered into, the supervisory authorities can decide which of the enterprises will be responsible for coordination. In special cases, the supervisory authorities may also reverse an agreement that has been entered into. The starting point is that the enterprise that will be responsible for coordinating internal control in an area where multiple enterprises will be working must have the necessary overview, expertise and authority to fulfil this responsibility. If the supervisory authorities find that the enterprise that has assumed responsibility for coordination in the agreement is unable to fulfil this responsibility, the agreement may be reversed.

    Paragraph two applies to internal control in contracting arrangements. This provision only applies to work performed on assignment at the contracting authority’s own area of installation.

    The starting point is that the party that engages in activities related to a physical facility etc. must ensure that all activities in the area are covered by internal control, irrespective of whether or not those who perform the activity are employed by the enterprise. The reason for this is that it is often irrelevant as to whether or not the persons who are exposed to risk during the performance of their work are in an employment arrangement with the enterprise. The same will of course apply in connection with the risk of pollution of the external environment, and otherwise to general safety and protective measures that are necessary for preventing dangerous or harmful situations from occurring in connection with own activities.

    It is the internal control system of the enterprise that will perform the assignment that must be used as a basis. Among other things, this entails that the contracting authority must assess the risk that arises when suppliers and contractors carry out activities within the contracting authority's area. In instances in which the use of contractors is a permanent arrangement or occurs frequently, it may be necessary to establish regular routines for this in the enterprise's own internal control system. When contractors are only engaged in exceptional cases, risk must be assessed on a case-by-case basis. The starting point is that there are strains or hazards associated with the assignment that need to be assessed.

    The rules entail that the party responsible for the enterprise must investigate whether the contractors engaged by the enterprise have satisfactory internal control. It will often be necessary to assess whether one's own internal control covers general routines and measures in the area that is of significance, for example, for the working environment, use of fire, protective equipment or the risk of pollution.

    The degree of adaptation and/or correction between the contracting authority's internal control and the contractor's internal control will vary in accordance with both the type and scope of the assignment, the size of the enterprise and risk factors, and how satisfactory the contractor's internal control is considered to be. The starting point will always be to ensure that internal control is coordinated to the extent that is necessary for the result to be in compliance with the legislation.

    As a general rule, instances in which the enterprise purchases components, parts and equipment from another enterprise will not trigger a duty to coordinate.

    To Section 7 – Supervisory authority

    This provision establishes who is responsible for supervising compliance with the Regulations. The following agencies will be supervisory authorities pursuant to the Regulations:

    • –

      Norwegian Labour Inspection Authority (Working Environment Act).
    • –

      Norwegian Directorate for Civil Protection and Emergency Planning/municipal fire prevention authorities (Fire and Explosion Protection Act).
    • –

      Norwegian Directorate for Civil Protection and Emergency Planning/Local Electrical Safety Inspection Authorities (Act relating to supervision of electrical installations and equipment and the Product Control Act when concerning consumer services and the physical, thermal, mechanical and fire prevention properties of the products).
    • –

      Norwegian Environment Agency (Pollution Control Act, Product Control Act, Gene Technology Act; release of genetically modified organisms).
    • –

      County Governors (Pollution Control Act and the Product Control Act with associated regulations for the industries in which the County Governor is the pollution control authority).
    • –

      Norwegian Industrial Safety Organisation (Civil Protection Act, industrial safety).
    • –

      Norwegian Maritime Authority (Regulations relating to recreational craft based on the Product Control Act).
    • –

      Norwegian Directorate of Health (Gene Technology Act; contained use of genetically modified organisms).
    • –

      Norwegian Radiation Protection Authority (Radiation Protection Act, the Pollution Control Act when concerning radioactive pollution and radioactive waste).
    • –

      Norwegian Civil Aviation Authority (Section 9 of the Working Environment Act and Regulations relating to worker protection and working environment etc. for civil aviation; supervisory authority for the working environment for flying personnel in civil aviation).

    The supervisory authorities use system audits and verification to assess the health, safety and environmental status of the enterprises, and place an emphasis on preventive HSE work. The supervisory authorities do not exclusively consider the direct consequences such as injuries, emissions and sick leave. The supervisory authorities will be able to provide guidance on the understanding of the requirements in the Regulations and the principles of internal control. The scope of the obligation to provide guidance is regulated by the Public Administration Act. If the enterprise is affiliated with a trade association or similar, it is also possible to obtain guidance from the association regarding, among other things, appropriate solutions in the relevant industry.

    To Section 8 – Exemptions

    The assessment must take into account the consequences of an exemption for the health, safety and environmental work in the enterprise. Exemptions are normally granted for a limited period of time.

    To Section 9 – Appeals

    The supervisory authorities may make different types of decisions in connection with the enforcement of these Regulations. An example of a decision may be an order from a supervisory authority to comply with the requirement in the Regulations to ensure that the enterprise has established internal control. Another example could be ordering an enterprise to comply with the requirements to document internal control. Such decisions will normally take the form of individual decisions that can be appealed to the immediate superior to the administrative agency that made the decision (see the overview below). Orders relating to system failures etc. are issued based on the Internal Control Regulations. Orders concerning specific violations of the underlying laws and regulations are issued pursuant to the Internal Control Regulations. Both types of decision can be appealed to the immediate superior to the administrative agency that made the decision.

    Decisions made by the Labour Inspection Authority may be appealed to the Directorate of Labour Inspection. Decisions made by the Directorate of Labour Inspection in the first instance may be appealed to the Ministry of Labour and Social Affairs.

    Decisions made by the municipal council or the County Governor may be appealed to the Directorate for Civil Protection and Emergency Planning. Section 28, paragraph two of the Public Administration Act applies to other municipal decisions.

    Decisions made by the Local Electrical Safety Inspection Authorities may be appealed to the Directorate for Civil Protection and Emergency Planning.

    Decisions made in the first instance by the Directorate for Civil Protection and Emergency Planning may be appealed to the Ministry of Justice and Public Security.

    Decisions made by the County Governor as the first instance may be appealed to the Norwegian Environment Agency.

    Decisions made by the Norwegian Environment Agency as the first instance may be appealed to the Ministry of Climate and Environment.

    Decisions made by the Norwegian Industrial Safety Organisation may be appealed to the Directorate for Civil Protection and Emergency Planning.

    Decisions made by the Norwegian Maritime Authority concerning recreational craft may be appealed to the Ministry of Trade, Industry and Fisheries.

    Decisions made by the Directorate of Health may be appealed to the Ministry of Health and Care Services.

    Decisions made by the Norwegian Radiation Protection Authority pursuant to radiation protection laws may be appealed to the Ministry of Health and Care Services.

    Decisions made by the Norwegian Radiation Protection Authority pursuant to pollution laws may be appealed to the Ministry of Climate and Environment.

    Decisions made by the Civil Aviation Authority pursuant to the Working Environment Act may be appealed to the Ministry of Labour and Social Affairs.