Why Clause 6.1.3 Is One of the Most Misunderstood Requirements in ISO 45001
Ask most organisations to show you their legal register and they will hand you a spreadsheet. Ask them when it was last updated and you will often see a date from twelve months ago. Ask who reviewed it and the answer gets vague. This is where auditing the legal register under ISO 45001 Clause 6.1.3 gets interesting, and where a lot of organisations fall short.
On this page
Clause 6.1.3 requires the organisation to determine and have access to the legal requirements and other requirements applicable to its OH&S hazards and risks. It also requires the organisation to determine how these requirements apply, to take them into account when establishing its OH&S management system, and to keep and retain documented information on those requirements. That sounds straightforward. In practice, it requires a functioning process, not just a document.
This article walks you through how to audit Clause 6.1.3 properly. It covers what the clause actually demands, the evidence you need to gather, the questions to ask, and the nonconformities that come up most often. Whether you are conducting an internal audit or preparing for a certification audit, this is a practical guide grounded in real audit experience.
What Clause 6.1.3 Actually Requires
Before you can audit a requirement, you need to understand what it is actually asking. Clause 6.1.3 has several distinct elements, and organisations often comply with one while failing another.
Determining Applicable Legal Requirements
The organisation must identify which legal requirements apply to it. In Australia, this includes Commonwealth legislation, state and territory WHS Acts and Regulations, codes of practice issued under those Acts, and any industry specific legislation that touches on occupational health and safety. For a construction company in Queensland, this includes the Work Health and Safety Act 2011 (Qld), the Work Health and Safety Regulation 2011, and relevant codes of practice covering things like scaffolding, working at heights, and confined spaces.
Other requirements beyond legislation include enterprise agreements, industry standards that the organisation has committed to, customer contract requirements relating to safety, and requirements from industry bodies. These all count under Clause 6.1.3.
Determining How Requirements Apply
It is not enough to list the legislation. The organisation must understand how each requirement applies to its specific operations, hazards, and risks. A company that lists the Dangerous Goods Act but cannot explain which of its activities are regulated under it has not met this part of the clause.
Taking Requirements Into Account in the OHSMS
The requirements must actually be reflected in the management system. Safe work method statements, procedures, training content, and operational controls should trace back to specific legal obligations. If the legal register lists a requirement for confined space entry permits but the organisation has no permit procedure, the register is decorative rather than functional.
Keeping and Retaining Documented Information
The organisation must maintain documented information on its legal and other requirements and keep it up to date. This is the part that generates the most nonconformities, because many organisations have a register but no process for keeping it current.
Exemplar Global Recognised Training ProviderRTP No. 310970
Planning Your Audit of Clause 6.1.3
Good audit planning makes the difference between a surface level review and one that actually tests the system. Before you walk into the audit, do some preparation.
Understand the Organisation's Industry and Hazard Profile
The applicable legislation varies significantly depending on what the organisation does. A mining contractor faces different legal obligations than a healthcare provider or a transport company. Before the audit, identify the industry and the main hazard categories. This tells you which legislation you would expect to see in the register and gives you a basis for testing completeness.
You do not need to be a legal expert, but you should have a working knowledge of the major WHS legislation in the relevant jurisdiction. For Australian auditors, that means knowing the model WHS Act and Regulations, understanding that each state and territory has its own version, and being aware of jurisdiction specific variations such as the situation in Victoria where the Occupational Health and Safety Act 2004 operates under a different framework.
Review the Legal Register Before the On Site Audit
Request the legal register as part of your document review. Look at its structure, the legislation it lists, when it was last reviewed, and who is responsible for maintaining it. This gives you a baseline and helps you identify gaps before you start asking questions. If the register has not been updated in eighteen months, that is already a flag worth pursuing.
Identify the Process Owner
Find out who is responsible for maintaining the legal register. This is often the WHS Manager, a compliance officer, or in smaller organisations, the person who wears multiple hats. Knowing who to interview means you can direct your questions to the right person and test whether the responsibility is clearly assigned and understood.
What to Look for in the Legal Register Itself
The register is your primary document, but do not treat it as the only evidence. Here is what to examine.
Completeness
Does the register cover the legislation you would expect given the organisation's activities and hazards? Compare what is in the register against what you know about the industry. Common gaps include:
- State specific regulations that differ from the model WHS Regulations
- Codes of practice that have been adopted as admissible evidence in court
- Regulations covering specific hazards such as hazardous chemicals, plant, noise, or asbestos
- Requirements from licences, permits, or approvals held by the organisation
- Industry body requirements the organisation has committed to
Relevance and Specificity
A register that lists an entire Act without breaking it down into applicable sections is of limited use. The register should identify the specific obligations that apply, not just the name of the legislation. Ask the process owner how they determined which sections apply. If they cannot explain it, the register may be a copy from another source rather than something genuinely assessed against the organisation's own context.
Currency
Check the review date and the version of legislation referenced. Legislation changes. In Australia, WHS regulations and codes of practice are updated periodically. The organisation needs a process for monitoring changes and updating the register accordingly. Ask how they find out about legislative changes. Common answers include subscriptions to government update services, legal advisors, industry associations, or SafeWork Australia notifications. If the answer is we just check occasionally, probe further.
How Requirements Are Linked to Controls
A mature legal register does more than list legislation. It maps each requirement to the controls, procedures, or documents that address it. Check whether the register includes a column or linkage showing how each obligation is met. Then pick two or three items and trace them through to the actual controls. Does the procedure exist? Is it current? Is it being followed?
Interview Questions That Get to the Truth
The document tells you what the organisation says it does. The interview tells you what actually happens. Here are the questions that work well when auditing Clause 6.1.3.
Questions for the Process Owner
- Can you walk me through how you identify new legal requirements that apply to the organisation?
- When did you last receive a notification of a legislative change, and how did you handle it?
- Who reviews the legal register, and how often?
- How do you confirm that the controls in your system actually address the legal obligations listed in the register?
- Are there any obligations in the register that you are currently not fully meeting?
That last question is a good one. It is open and honest, and a mature organisation will be able to identify areas where they are working toward compliance rather than pretending everything is perfect.
Questions for Operational Managers and Workers
Do not limit your questioning to the process owner. Test whether the legal requirements have actually filtered down into operations.
- Can you tell me what your main legal obligations are in relation to [specific hazard]?
- Where would you find the requirements for [specific task, e.g. working in a confined space]?
- Has there been a change to any regulations or codes of practice recently that affected how you do this work?
If workers and supervisors have no idea what the legal register contains or how it connects to their work, the system is not functioning as intended even if the document looks fine on paper.
Common Nonconformities Against Clause 6.1.3
After conducting hundreds of ISO 45001 audits, certain patterns come up repeatedly. Here are the most common findings against this clause.
The Register Has Not Been Updated Following Legislative Changes
This is the most frequent nonconformity. The organisation has a register, but it references superseded legislation or does not reflect amendments that have been in force for months or years. In Australia, this has been a particular issue in states that have progressively adopted or amended the model WHS framework. Check the dates on the legislation cited in the register against the actual current versions.
No Defined Process for Monitoring Legislative Changes
Some organisations cannot demonstrate any systematic process for identifying changes to applicable legislation. The register exists but there is no procedure, no subscription, no assigned responsibility, and no evidence of periodic review. This is a systemic gap rather than a documentation gap, and it usually warrants a major nonconformity because the organisation cannot demonstrate ongoing compliance.
The Register Lists Legislation Without Identifying Specific Obligations
Listing Work Health and Safety Act 2011 without identifying the specific duties, sections, or obligations that apply to the organisation does not meet the requirement to determine how requirements apply. The register needs to be specific enough to be useful.
No Linkage Between Legal Requirements and Operational Controls
The register is maintained in isolation from the rest of the management system. There is no traceability between the legal obligations and the procedures, safe work method statements, or training programs that address them. When you pull on that thread, you often find controls that exist for historical reasons but have no clear connection to a current legal obligation, or legal obligations that have no corresponding control.
Responsibility for the Register Is Unclear or Unassigned
In smaller organisations especially, the legal register is often maintained by whoever had time when it was first created. There is no documented responsibility, no review schedule, and no one who can clearly articulate what the process is. This connects to Clause 5.3 on roles and responsibilities, but the evidence will surface when you audit Clause 6.1.3.
Gathering Evidence: What Counts and What Does Not
When you raise a finding against Clause 6.1.3, you need evidence that is specific, factual, and traceable. Here is how to build that evidence base.
Document Evidence
- The legal register itself, including version and review dates
- The procedure or process for maintaining the register
- Records of legislative change notifications received and acted upon
- Meeting minutes or review records showing periodic evaluation of the register
- Linkages between the register and operational controls or procedures
Interview Evidence
Record the specific answers given by interviewees. If the WHS Manager cannot explain how they monitor for legislative changes, note exactly what they said. If a supervisor has no awareness of the legal obligations relevant to their work area, record that too. Vague impressions do not hold up in an audit report. Specific statements do.
Observation Evidence
Where possible, observe whether the controls linked to legal requirements are actually in place. If the register says the organisation complies with requirements for hazardous chemicals management and references the relevant regulation, walk through the chemical storage area and check whether the controls are visible and functioning. Evidence from observation triangulates with document and interview evidence to build a complete picture.
For more on how to build a solid evidence base across these three channels, see our article on understanding the ISO 45001 hazard identification audit trail, which covers similar triangulation principles in the hazard identification context.
How This Clause Connects to the Rest of the System
Clause 6.1.3 does not sit in isolation. Understanding its connections helps you audit more effectively and spot systemic issues rather than isolated gaps.
Connection to Clause 6.1.1: Risks and Opportunities
The legal requirements identified under Clause 6.1.3 feed into the risk and opportunity assessment under Clause 6.1.1. If the legal register is incomplete, the risk assessment may be missing obligations that create legal exposure. Always check whether the two are aligned.
Connection to Clause 9.1.2: Evaluation of Compliance
Having a legal register is not the same as evaluating compliance with it. Clause 9.1.2 requires the organisation to evaluate its compliance with legal and other requirements and to take action when noncompliance is found. The legal register under Clause 6.1.3 provides the basis for that evaluation. If the register is out of date or incomplete, the compliance evaluation under Clause 9.1.2 is also compromised. When you find gaps in the legal register, always check how the compliance evaluation is conducted and whether it would have caught those gaps. For a deeper look at how this evaluation works in practice, our article on auditing compliance evaluation under ISO 45001 Clause 9.1.2 covers the key evidence and audit questions.
Connection to Clause 8.1.1: Operational Controls
The operational controls required to manage OH&S risks must address the applicable legal requirements. If the legal register identifies a requirement for a specific type of risk assessment before high risk work, the operational control should include that requirement. Testing this linkage is one of the most valuable things you can do when auditing Clause 6.1.3.
Connection to Clause 7.2: Competence
Legal requirements often specify competence requirements for workers performing certain tasks. Working at heights, operating plant, handling hazardous chemicals, and performing high risk construction work all have legislated competence requirements in Australia. Check whether the legal register captures these and whether the competence records reflect them.
Writing Up Findings Against Clause 6.1.3
A well written nonconformity against this clause is specific about what was found, what requirement it relates to, and what evidence supports the finding. Avoid vague statements like the legal register is not adequate. Instead, write something like:
The legal register reviewed during the audit (version 3, last reviewed January 2024) does not include the requirements of the Work Health and Safety Regulation 2023 (Qld) Chapter 5 relating to managing risks of hazardous chemicals, despite the organisation storing and using chemicals identified as hazardous under Schedule 10 of that Regulation. No evidence was provided of a process for monitoring legislative changes or of any review of the register since January 2024. This does not meet the requirements of ISO 45001:2018 Clause 6.1.3, which requires the organisation to determine and have access to up to date legal requirements applicable to its OH&S hazards and risks.
That level of specificity gives the organisation a clear basis for corrective action and demonstrates that the finding is grounded in evidence rather than opinion. For more guidance on writing findings that are specific and defensible, our article on how to write nonconformities that hold up is worth reading before your next audit.
Exemplar Global Recognised Training ProviderRTP No. 310970Practical Tips for Auditors
A few things learned from experience that will make your audit of Clause 6.1.3 more effective.
- Do not try to be the legal expert. Your job is to verify that the organisation has a functioning process for identifying and keeping up with its legal obligations, not to audit the legislation itself. You are testing the system, not providing legal advice.
- Start with the process, not the document. Ask how the register is maintained before you look at the register. If the process is sound, the document is likely to reflect that. If the process is weak, the document will tell you how weak.
- Sample the linkages. Pick three or four items from the register and trace them through to the controls. This is where you find the real gaps. A register that lists an obligation for confined space entry permits is meaningless if there is no permit procedure and no evidence of permits being issued.
- Check the date of the most recent legislative change notification. If the organisation subscribes to a service, ask to see the most recent notification received and what action was taken. This is concrete evidence of a functioning monitoring process.
- Consider jurisdiction carefully. In Australia, the applicable legislation depends on the state or territory. An organisation operating in Western Australia is subject to the Work Health and Safety Act 2020 (WA), which came into force in March 2022 and introduced some differences from the model Act. An organisation that has not updated its register to reflect the WA legislation is likely to have gaps.
Preparing for a Certification Audit on This Clause
If you are a WHS Manager or quality professional preparing for a certification audit rather than conducting one, here is what the auditor will be looking for and how to get ready.
Make sure your legal register is current. Check the legislation against the current versions published on the relevant government websites. If you are not sure whether a code of practice has been updated, check the SafeWork Australia website and the relevant state regulator's website.
Document your process for monitoring legislative changes. Even a simple procedure that describes who monitors for changes, how often, and what they do when a change is identified will demonstrate a functioning system. If you use a subscription service, have evidence of recent notifications and the actions taken in response.
Map your legal obligations to your controls. This does not need to be a complex exercise. A column in your register that references the procedure or document that addresses each obligation is sufficient. The auditor will sample these linkages, so make sure they hold up.
Be ready to explain the register to the auditor. The auditor will ask questions. If you can walk them through the register, explain how it was built, how it is maintained, and how it connects to your operational controls, you will demonstrate a level of understanding that goes well beyond having a document in a folder.
If you want to build confidence in auditing this clause from either side of the table, the ISO 45001 auditor training courses at Audit Workshop cover Clause 6.1.3 in depth, including practical exercises that take you through the evidence gathering and finding writing process with real audit scenarios.
