A Legal Register That Missed a Reissued Permit
You are auditing a 180-employee metal-finishing plant against ISO 14001:2015. The environmental manager presents a legal register last updated 18 months ago. In the facility's permit files you find a stormwater permit reissued eight months ago, acknowledged with the plant manager's signature, that adds quarterly zinc benchmark monitoring and a revised SWPPP deadline. You also determine that a state air-toxics rule lowered a reporting threshold six months ago, making the plant subject to annual reporting for the first time; no air-toxics report has been filed. No zinc samples have been collected for the last two quarters. The manager says the consultant who maintains the register 'hasn't sent the update yet,' and that the annual compliance evaluation was completed 10 months ago with no findings. The internal audit programme last covered legal requirements 20 months ago. The facility's stormwater outfall discharges to a river about 400 meters downstream.
1. Identify the clauses implicated and decide whether this is a major nonconformity.
Read the worked answer
The core failure is 6.1.3: the organization must identify and have access to up-to-date legal and other requirements and determine how they apply. The stormwater permit was received and acknowledged eight months ago, so the organization had access; the register update process did not work. Clause 9.1.2 is also implicated: the organization must evaluate compliance and maintain knowledge and understanding of its compliance status. An 18-month-old register, a missed permit condition, and an unfiled new report do not demonstrate that. I would treat this as a major nonconformity because it is systemic - reliance on a consultant without verification - and it has already produced actual noncompliance: two missed zinc quarters and a missing air-toxics report. The 10-month-old compliance evaluation is not itself evidence of failure for the permit reissue, which came later, but the organization still has no mechanism to update the register between evaluations. I would verify the air-toxics applicability myself before writing the finding, because thresholds and exemptions are fact-specific. I would also sample other permits reissued in the last two years to see whether this is isolated.
2. What immediate and corrective actions do you require, and how do you handle the potential violations?
Read the worked answer
Immediate: determine whether the current quarter's zinc sample can still be taken within the permit window; if not, document the missed monitoring and follow the permit's noncompliance notification requirement. Evaluate the air-toxics rule applicability and file the report late if the state allows; if not, advise the client to consult counsel about self-disclosure. Do not let the client treat the register update as the whole fix. Corrective action should address root cause: no one verified the consultant's work, no subscription or monitoring of state rulemaking, and no assigned owner for the register. The plan should name an owner, require quarterly verification against the state website and permit file, build a change-management step for new permits and rules, and refresh the entire register - not just the two known items. Verification should be by sampling the updated register against source documents. I would report the system nonconformity and the compliance violations separately, because the corrective action for one does not automatically fix the other. I would also check whether the internal audit programme covered legal requirements in its last cycle, since 20 months is a long gap for a metal finisher.