#231 Evaluating Compliance within ISO Management

When stating ISO Management System ‘compliance’, that in reality means the conformance to ISO Standard requirements, compliance in ISO terminology actually refers to compliance with legal and other statutory regulations. It may sound like semantics, but the difference is distinct for a reason, as you don’t get a ‘non-compliance’ for not meeting requirements, rather you get a ‘non-conformity’. When it comes to compliance with the law as required by ISO Standards, you need more than a Legal Register to prove compliance. In this episode, Ian Battersby dives into what is meant by compliance in ISO, how this relates to legal and statutory requirements, and how businesses can effectively evaluate compliance. You’ll learn · What is the difference between ‘Compliance’ and ‘Conformity’? · What are the different types of compliance requirements? · How do Acts and Regulations work in tandem? · Who enforces legal compliance requirements? · Where do these requirements sit in ISO Standards? · How do you prove compliance within ISO management? · How do you evaluate effective compliance? Resources · Isologyhub · From Silos to Synergy: The benefits of Implementing an Integrated ISO Management System Webinar registration In this episode, we talk about: [00:30] Upcoming webinar: If you’d like to learn more about the benefits of integrated management systems, feel free to register for our upcoming webinar here. [01:30] Episode Summary – Ian Battersby discusses the topic of compliance within ISO Standards, and how you can effectively evaluate it within your Management System. [02:30] What is the difference between ‘Compliance’ and ‘Conformity’? It’s a common misconception that you ‘comply’ with an ISO Standard, when in reality, you conform to an ISO Standard, hence why you can receive a ‘non-conformity’ in audits and not ‘noncompliance’. When we talk about compliance within ISO Management, this refers to compliance with the law, regulations and other statutory requirements, as this is a requirement within all ISO Standards. [03:50] What are the different types of compliance requirements? There are many different types of law, Ian focuses on what is known as statute law legislation, as this is distinct from common law, case law and constitutional conventions. Statute law legislation is clearly written and can be cited in something like a Legal Register, or Register of Compliance Obligations. There are different types of legislation that you’ll need to document, including: Primary Legislation: These are put in place by acts of UK Parliament and may have involvement from devolved administrations as well. Statutory compliance refers to compliance with primary legislation. An example of this type of legislation includes the Health & Safety at Work Act. Secondary or delegated legislation: Those primary Acts often require a lot more detail regarding the practicalities of applying them, which is delivered through Secondary or delegated legislation, otherwise more commonly known as regulations. These have more input from relevant public bodies to provide the requirements that can be applied. Both regulations are issues under Statutory Instruments (SI's), which are the formal legal vehicle that gives them effect. Put simply, regulations are the rules and Statutory Instruments are the legal mechanism which brings those rules into effect. [06:05] How Acts and Regulations work in tandem: Taking the Health & Safety at Work Act as an example, at the start this was quite a broad and generic act, it wasn’t until years later that the workplace health, safety and welfare regulations came about to support the Act. This was further bolstered with the Management of Health & Safety at Work Regulations. Both regulations were developed through consultation between Government departments and other bodies such as the Health & Safety Executive. These regulations gave companies much more detail on what’s actually required in order to comply with the Health & Safety at Work Act. [06:50] Who enforces legal requirements? – It’s not just the police that enforce legal requirements, there are a number of other bodies independent of government and the judiciary that can enforce regulations and prosecute for breaches caused by organisations and individuals. This can include bodies such as The Health & Safety Executive, The Financial Conduct Authority, The Environment Agency and the Information Commissioners Office. There are more for other areas, and these are often the bodies involved in the development of specific regulations. [07:45] Where do these requirements sit in ISO Standards? As Is the case with ISO Standards, the requirement for compliance is sprinkled throughout the whole document. Starting with Clause 4 Context. Here ‘Interested parties’ are a...