Section 5 of the Norwegian Internal Control Regulations
Written by Nicolai Bjerknes Slinning, Founder, Sydera.io Technologies AS. Last reviewed .
Section 5 is where occupational health and safety in Norway stops being an intention and becomes something that must be documented. It states what internal control must contain, and which parts must be in writing. Here is what each item means for a governance document.
What the section requires
Internal control must be adapted to the nature, activities, risk and size of the undertaking. The following must be documented in writing: OHS objectives; an overview of organisation, responsibilities, tasks and authority; mapping of hazards and problems with an assessment of risk; plans and measures following from that mapping; routines for detecting, correcting and preventing breaches of the rules; and systematic monitoring and review of the internal control itself. The section also requires employees to take part in introducing and exercising internal control.
In writing means verifiable, not voluminous
The requirement is not a thick document. The requirement is that an outsider can read what the undertaking has decided, who is responsible, and what happens when something is found. A small, low-risk employer can meet section 5 in a handful of pages. What rarely holds is a text describing good intentions without saying who does what, and when.
Where documents usually fall short
Two items are missing most often. One is the deviation routine: how something is actually picked up, and what happens next. The other is the review of internal control itself — the last item, the one that makes the system learn. Without it, the annual review becomes a formality and the same findings return year after year.
How to check your document
Work through the items one by one and locate each of them in the document. Where you cannot find it, you have a gap. Pay particular attention to what has to happen before anything happens: if almost everything is triggered by an employee raising an individual case, the governance is reactive in form even when the objectives are proactive.
Who it applies to
The Internal Control Regulations apply to undertakings covered by Norwegian health, safety and environment legislation — in practice, anyone with employees. There is no minimum headcount. What varies is scope: two office employees present a different risk picture than a workshop with twelve, and internal control is adapted accordingly. The duty rests with the employer, including where tasks are delegated to an OHS coordinator, a safety representative or an external adviser. Delegation moves the work, not the responsibility.
What is enough for a small employer
A small, low-risk employer can meet section 5 in four to six pages plus a handful of routines. Objectives can be three sentences. The responsibility overview can be a table of names and roles. Mapping can be ten items taken from your own working week, with a simple assessment of how likely and how serious each one is. The deviation routine can be one paragraph stating how something is reported, who follows up, and where it is recorded. Short and true governs more than long and generic.
Common mistakes
Four recur. The document is borrowed from another industry, so the hazards described do not exist here. Responsibility is written as «management» without names, so nobody owns it. Deviations are described as a form rather than a sequence with follow-up. And the review has no date, so nobody knows when the system was last read. A fifth: writing that something is «offered on request» where the need is predictable — that makes the arrangement reactive in form, however good the intention.
What the Labour Inspection Authority looks for
At an inspection the documents are read as a trace, not as prose. Does what is written match what employees describe? Are there examples of deviations reported, handled and closed? Can somebody show what changed after the last review? Has a safety representative been elected where required, and received training? A thin document with traces running through it makes a better impression than a thick one without.
What to do first
Start with the two items that are missing most often, not with the objectives. Write the deviation routine as one paragraph, and set a fixed review date with somewhere to note what changed. Then work through the remaining items and locate each one in the document. If you are unsure whether the handbook covers them, you can have it read through.
One governance document reviewed free of charge. We read the governance logic, not employees.
Sources
Frequently asked questions
- What must be in writing?
- OHS objectives, responsibilities and tasks, hazard mapping with risk assessment, plans and measures, deviation routines, and systematic monitoring and review of internal control.
- Does it apply to small employers?
- Yes. Internal control is adapted to the nature, risk and size of the undertaking, but the written items apply regardless of headcount.
- Must employees be involved?
- Yes. Employees must take part in introducing and exercising internal control.
- What does the Labour Inspection Authority look for?
- Written goals and routines, responsibility placed on named roles, deviations that are actually handled, and reviews that leave a trace. The inspector looks for signs that the system is used, not only that it exists.
- Where do we start if nothing is written down?
- Map the risks in your own operations, write down who does what, and make one routine for how deviations are reported and followed up. That is enough to begin; the rest is built out according to the risk picture.