To Section 4 – Duty to maintain internal control

The duty to introduce and exercise internal control rests with «the party responsible» for the enterprise. By this is meant the management or owner of the enterprise. The appurtenant party or function will vary according to how the enterprise is organised. Although internal control must be exercised at all levels of the enterprise, the primary responsibility for initiating the work («introducing» internal control) and maintaining this («exercising» internal control) lies with the highest level of the enterprise. However, the section clarifies that the duty to introduce and exercise internal control shall be carried out in cooperation with employees, working environment committees, safety delegates and/or employee representatives when applicable.
The «party responsible» for the enterprise will depend on the various acts upon which the Regulations are based. Examples of «the party responsible» for implementing the requirements in the Regulations are:
  • –
    The Working Environment Act: Employer.
  • –
    The Pollution Control Act: The enterprise's management as specified in the enterprise's organisation or corporate structure.
  • –
    The Product Control Act: Manufacturer, importer, trader.
  • –
    The Civil Protection Act: Enterprises.
  • –
    The Fire and Explosion Protection Act: Enterprises.
  • –
    Act relating to supervision of electrical installations and equipment: Owners and users of electrical installations and equipment, manufacturers of, as well as importers and other parts of the sales chain for electrical equipment, electrical installation contractors etc.
  • –
    The Gene Technology Act: The enterprise's management as specified in the enterprise's organisation or corporate structure.
  • –
    The Radiation Protection Act: The enterprise's management as specified in the enterprise's organisation or corporate structure.
Section 4, paragraph one also stipulates that the party responsible for the enterprise is obligated to ensure that internal control is monitored and reviewed to make certain that it functions as intended. This entails a duty to continually assess internal control activities to enable deficiencies to be identified. This duty also includes conducting a full review at regular intervals, i.e. a review of all of the systematic work, cf. Section 5, paragraph two (8).
Section 4, paragraph two explicitly states that employees are obligated to contribute. This will also be a general condition of the employment arrangement. Contributing to the internal control work is therefore part of one’s work duties. The participation of safety delegates and members of working environment committees in connection with the establishment and maintenance of internal control is explicitly stipulated in Sections 6-2 and 7-2 of the Working Environment Act. Furthermore, pursuant to Section 4-2 of the Working Environment Act, employees and their representatives are entitled to participate in connection with management and planning systems. Internal control is regarded as a management and planning system that is covered by Section 4-2 of the Working Environment Act. For companies that are bound by a collective agreement, the same provisions can be found in, for example, Chapter IX of the Basic Agreement between the Confederation of Norwegian Enterprise (NHO) and the Norwegian Confederation of Trade Unions (LO).
It is essential that internal control is integrated into the overall management and planning of the enterprise. An increasing number of enterprises are now focussing on making the relationship with the external environment part of the company's organisational strategy and profile, and internal control is an instrument that can be utilised to strengthen this work within the company. Employees will also be interested in their workplace having an environmental profile and in doing their part for achieving a more environmentally-friendly society. Internal control must also incorporate the requirements relating to the external environment, and is therefore an instrument for employees and their representatives to also influence the actions of the enterprise that impact the environment. In connection with the internal control work, it is also clear that employee experiences are an essential prerequisite for well-functioning internal control. Specific employee experiences with, for example, various input factors in production, purchasing, waste management, etc., constitute valuable knowledge that can contribute to a systematic review of all aspects of the enterprise that have an impact on the external environment. The scope for potential conflicts of interest also appears to be limited, since considerations of the working environment and external environment will generally gravitate in the same direction.
Enterprises that include both employees and customers/users, for example, hospitals, schools, kindergartens and hotels, are responsible for health, safety and the environment for both groups. For these types of enterprises, it is important to remember that the laws may impose the same types of requirements, but these are directed at one of the groups – employee or user – or the laws may impose requirements that include both groups. The Product Control Act pertains to the safety of pupils etc., while the Working Environment Act covers the employees. The Fire and Explosion Protection Act will set requirements that include the safety of both hotel guests and employees. Internal control must therefore include all the acts upon which the Regulations are based to ensure that both employees and users are covered.