The Permit Variation Nobody Read

They are different failures and both exist.

Non-compliance with a compliance obligation is a failure to meet a legal or other requirement. From 1 March the monthly average COD limit is 80 mg/L. March at 131 and April at 104 exceed it. The F-gas rule requires quarterly leak checks on a 29 tCO2e unit; one check in 14 months breaches it. These are regulatory failures with external consequences - enforcement, sewer consent action, reporting duties.

Nonconformities against ISO 14001 are failures to meet the standard's requirements:

• 6.1.3 - the organisation must determine and have access to compliance obligations, and must determine how they apply and which it subscribes to. A register of statute titles, two years stale, with no permit conditions and no capture of a variation, fails this. So does missing the F-gas rule.
• 9.1.2 - it must evaluate compliance and take action. Averaging a quarter when the permit sets a monthly average is not an evaluation against the obligation; it is a redefinition of it designed to reach a passing answer.

Note the causal link: the 6.1.3 failure produced the 9.1.2 failure, which allowed the non-compliance to continue for two months unnoticed. An auditor should raise both, but should not treat the regulatory exceedance as automatically an ISO nonconformity - it is evidence, and it is the missing identification and evaluation processes that constitute the nonconformity. Conversely, fixing the register does not cure the discharge.

9.1.2 requires the organisation to evaluate compliance with its compliance obligations, determine the frequency of evaluation, evaluate compliance and take action where needed, maintain knowledge and understanding of its compliance status, and retain documented information as evidence of the results.

The averaging argument fails on the wording of the obligation. The permit sets a monthly average; a quarterly average is a different parameter. Compliance is assessed per calendar month against 80 mg/L from 1 March. Redefining the metric to reach a passing number is not an evaluation; it is the opposite. Any defensible evaluation must use the permit's own definitions, units, averaging periods and sampling rules.

Practical requirements:

• A compliance register with the actual conditions, not statute titles: the numeric limits, monitoring frequency, reporting dates, and the person accountable for each.
• A scheduled evaluation, e.g. monthly for discharge parameters, quarterly for F-gas, annual for the whole register.
• Method confidence (9.1.1): sampling point, accredited laboratory, detection limit appropriate to an 80 mg/L limit, calibration and chain of custody - otherwise even a passing result is arguable.
• Status summary - compliant, non-compliant, or unknown - with gaps flagged. 'Unknown' is a legitimate and useful status; it drives action.
• Retained records: the evaluation results, the evidence behind them, and the actions taken. A spreadsheet showing each month against each limit, signed and dated, is sufficient and far more useful than a narrative report.

Where an exceedance is found, the evaluation is not complete until the action to restore compliance is recorded.

React (10.2 a). Assess and control the actual discharge: what volume and load went to the sewer, is the receiving treatment works affected, does the permit require notification, and what product batches drove the March spike? Divert or pre-treat while the issue is live. Log the notification decision and its basis.

Correct. Identify the cause of the COD rise - new product, cleaning regime, dosing failure, or reduced pretreatment residence time. Fix that, not the spreadsheet.

Address the cause of the undetected breach. This is the systemic part: the variation was received, filed and never routed to anyone. The 6.1.3 process needs a named owner, a subscription or regulator-notification route, a procedure for assessing how each new obligation applies to the site, and a change trigger into operational control and monitoring. The legal register must contain conditions, not statute titles.

Scope the check wider. If one variation was missed, others may have been: the F-gas rule was also missed, and the permit may contain other changed conditions. Run a full reconciliation of permit, register and monitoring plan.

Verify effectiveness. Define the test before acting: three consecutive calendar months below 80 mg/L with weekly data, zero missed leak checks, and an updated register independently checked. Set a review date and an owner; record the result.

Retain documented information (10.2): the nature of the nonconformities, actions taken, and results of the corrective action. Feed the trend into management review (9.3) as evidence of compliance status and of the need for resources.