Internal control template for small employers
Written by Nicolai Bjerknes Slinning, Founder, Sydera.io Technologies AS. Last reviewed .
A template is useful for getting the order right, and risky when it becomes a filled-in formality. Below is the structure we recommend for a small employer in Norway: eight short parts following section 5 of the Internal Control Regulations, with what you must supply yourself.
The structure, part by part
1) OHS objectives: two or three sentences on what you want to achieve. 2) Responsibility: who holds OHS responsibility, who is the safety representative, who does what. 3) Mapping: which hazards and problems exist here, with a simple assessment of likelihood and consequence. 4) Plans and measures: what is done, by whom, by when. 5) Deviation routines: how something is reported, who follows up, what happens next. 6) Participation: how employees take part. 7) Training: who received what. 8) Review: when the system is read through, and what changed last time.
Fill it with your own conditions
Mapping is the part no template can do for you. Walk through an ordinary working week and write down what can go wrong physically, organisationally and psychosocially. Ten items from your own operation are worth more than fifty generic ones borrowed from an industry you are not in.
Where templates stop too early
Most templates cover parts 1 to 4 well, and parts 5 and 8 poorly. The result is a document describing what you want, without saying what happens when something is found or how the system corrects itself. Those are the two parts an inspection can actually follow the trace through.
Check the result before filing it
Once the template is filled in, read it the way a stranger reads it: find the point where responsibility shifts from the employer to the individual, and note what should have come before that point. You can also upload the document and have us read it through.
How to use the template below
The template below is completed a little at a time. Take one part a day for eight days, and write briefly. Put names where it says roles, and dates where it says deadlines. Once all eight parts contain material from your own operation, you have a document covering section 5. You can print it from this page and fill it in on paper, or copy the headings into your own document.
What is enough for a small employer
Two to ten employees, low risk: four to six pages in total. Short objectives, named responsibility, ten mapping items from your own working week, measures with deadlines, one paragraph on deviations, two sentences on participation, training as a list, and review with a date. Where risk is higher (machinery, chemicals, lone working, night or shift work), it is the mapping and the routines that expand.
Common mistakes when using a template
The most common is keeping the example text. If the template lists hazards that do not exist here, the document says something untrue about the undertaking, and the rest loses credibility. The second is completing parts 1 to 4 and skipping 5 and 8, that is, deviations and review. The third is filing it once completed. An internal control document nobody has read since it was written governs nothing.
What to do first
Write the mapping first, and the objectives afterwards. It is the only part that has to come from you, and everything else gets easier once it exists. Then the deviation routine. When the document is complete, read it the way a stranger reads it, and find the point where responsibility shifts from the employer to the individual.
Internal control template: eight parts to fill in
Follows section 5 of the Norwegian Internal Control Regulations. Print this page and fill it in on paper, or copy the headings into your own document. Write it without health data and without names from individual cases.
1. OHS objectives
Two or three sentences on what you want the OHS work to achieve. Concrete enough that someone can tell whether it is happening.
2. Responsibility and roles
The name of the person holding OHS responsibility, the safety representative where required, and who does what. Put a name next to each role.
3. Hazard mapping
Walk through an ordinary working week. Write down what can go wrong physically, organisationally and psychosocially, with a simple assessment of likelihood and consequence.
4. Plans and measures
For each mapping item: what is done, by whom, by when.
5. Deviation routines
How something is reported, who follows up, what happens next, and where it is recorded.
6. Employee participation
How employees take part in introducing and exercising internal control. Section 5 requires participation.
7. Training
Who received what training, and when. Include safety representative training where relevant.
8. Review of the system
Date of the next review, who carries it out, and what changed last time.
The guide is open online and as a PDF. The Executive Brief is built only on published sources.
Sources
Frequently asked questions
- Is there an official template?
- The Labour Inspection Authority offers guidance and tools, but no template is binding. The requirement is the content of section 5.
- Is filling in a template enough?
- No. Hazard mapping and deviation routines must reflect your own operation, or the document governs nothing.
- Can the template be our internal control?
- The template is a starting point. It becomes your internal control once the items are filled in with your own risks, roles and routines, and once there is a trace showing it is used.
- What should we fill in first?
- The deviation routine and the review date. Those two are most often not described, and they are the clearest way to show the system is in use.