Sorry, you need to enable JavaScript to visit this website.
Skip to main content

Internal control

Last updated: 01.09.2021
  • Sisekontrolli käigus kavandatakse, kontrollitakse ja jälgitakse töötervishoiu ja tööohutuse olukorda ettevõttes.
  • Sisekontrollisüsteemi aluseks on töökeskkonna riskianalüüsi tulemused.
  • Tööandja peab korraldama järelevalve ja kontrolli tegevuskava täitmise ning sisekontrolli korralduse efektiivsuse üle.

Internal control

The Occupational Health and Safety Act obliges the employer to conduct regular internal control of the working environment in the process of which the employer plans, organises and monitors the occupational health and safety situation in the enterprise in accordance with the requirements provided in the act. Internal control of the working environment is an integral part of the enterprise’s activities which involves employees and is based on the results of the risk assessment of the working environment.

Essentially, all daily activities and working documents that are a part of the organisation of occupational health and safety pursuant to valid requirements (both legal requirements and rules established in the enterprise are important) form the internal control: job descriptions, instruction and training of employees, supplementing the risk assessment, adhering to the action plan of the working environment, reporting on dangerous situations, proper maintenance of equipment, etc.

To ensure that all activities function as intended, the organisation of internal control of the working environment is reviewed annually, its results are analysed, and measures are adapted to the changed situation if necessary. All legal requirements and

 internal regulations are revised, compliance of the activities with requirements is checked and developments in important working environment-related indicators are monitored (e.g. the number of occupational accidents or number of sick days per employee). No strict rules have been imposed on the method of conducting internal control, therefore an employer can select the suitable approach with the employees or their representatives.

Special attention should also be paid to the surrounding population and bystanders to make sure that the enterprise’s activities do not endanger or

Setting up an internal control system

The initiative to set up an internal control system shall come from the employer. The easiest way would be for the employer to imagine stepping into the shoes of a labour inspector who comes to inspect the enterprise and try to answer the question of whether all the stages of occupational health and safety management are sufficiently regulated.

The employer shall set out the general principles of occupational health and safety in the enterprise. For example, he or she sets a goal of no occupational accidents for an entire year.

Let us repeat:

  • The primary responsibility lies with the employer! The employer should be familiar with the Occupational Health and Safety Act and its by-laws which regulate the activities of a specific enterprise – this is the most correct way to organise the working environment management system. The employer also designates those responsible for various activities to make it easier to ensure that the employees concerned know exactly what is expected of them and that the management of the whole system is not fragmented.
  • Employees also participate in the management of the working environment, for example by informing about risks, illnesses, occupational accidents and accidents, and by proposing various measures or by giving feedback on those that have already been implemented.
  • Working environment representatives and members of the council are involved in planning changes to the working environment or various measures or when the existing working conditions and adopted measures are assessed and the working environment is assessed.

The internal control system is based on the results of the risk assessment of the working environment. It is advisable to conduct a risk assessment based on places of work and seek an answer to the question of which hazards may endanger a particular employee in that place of work. When carrying out a risk assessment, it is essential to take into account the period of time an employee is exposed to a hazard, as this is the only way to objectively assess the magnitude of the risk.

The risk assessment is followed by the preparation of a specific action plan to prevent or reduce the impact of health risks identified in the working environment.

The action plan, which is prepared in a format which can be reproduced in writing, shall be relevant and clear, as well as understandable to employees.

Carrying out internal control

When starting the internal control, an employer’s obligations under the Occupational Health and Safety Act shall be followed. The employer shall be able to answer the questions of whether the requirement provided by law has been met in the enterprise, whether the prescribed activities have been organised and how does it function in practice? Depending on the specifics of the enterprise or institution, it may not be necessary to comply with all legal requirements. For example, some enterprises do require the use of personal protective equipment or do not handle hazardous chemicals.

In order to carry out internal control, it is necessary to determine who has to perform which internal control activities and when, and it is recommended that this be done in writing. In this way, it is clear to all the parties involved what their responsibilities are in managing the enterprise’s working environment.

It is also recommended to document the results of internal control. This makes it easier to designate persons responsible for the activities that result from them and monitor the completion of such activities.

As a suggestion, we provide a recommended questionnaire for conducting internal control which can be found here (in Estonian).


When starting the internal control, one should revise which specific legislation is mandatory for the employer to follow (it would be reasonable to start with the obligations of the employer which are provided in subsection 13 (1) of the Occupational Health and Safety Act). It would be appropriate to put together a list of legislation regulating occupational health and safety concerning the requirements relating to the professional activities of the enterprise.

As no uniform format has been established or proposed for such documents, it is up to the developer of the internal control system to decide. The content of the document is more important than the format.

Next, it is necessary to clarify if and which internal regulations or documents (e.g. procedures for the supervision of employees, first aid procedures, etc.) ensure that the relevant legal requirements are actually met. If no regulation has been established or prepared in the company to meet a specific requirement, this shall be done.

Based on the aforementioned stakeholders, the next step could be designating person(s) responsible for various activities, such as conducting and updating the risk assessment (if necessary), monitoring the action plan, monitoring daily safety, instructing employees, selecting and issuing personal protective equipment, matters related to first aid, and monitoring and arranging medical examinations.

Lastly, rules should be laid down on how the annual internal control organisation shall be reviewed, aiming to review the functioning of the system, and who is responsible for conducting it.



The last activity is to organise supervision and control over the implementation of the action plan and the effectiveness of the internal control organisation.

Such supervision does not mean that an outside control body will come and check how the company organises its work. Rather, it is important to conduct an internal assessment of whether or not the objectives have been achieved, whether a system has been set up to actually prevent occupational accidents and illnesses related to work and whether the requirements of occupational safety legislation are met.