Legal matrix

What is the legal matrix?

Decree 1072 of 2015, the Single Regulatory Decree of the Labor Sector of Colombia, defines the legal matrix in numeral 24 of article 2.2.4.6.2 as the compilation of the regulatory requirements applicable to the company according to the activities inherent to its productive activity, which provide the regulatory and technical guidelines to develop the Occupational Safety and Health Management System, and which must be updated as new applicable provisions are issued.

Therefore, this is not a general list of legislation. It is a document specific to each organization: it outlines what is required of it due to its activity, processes, facilities, and staff, and serves as a reference for building and maintaining the management system.

Its logic is that of regulatory compliance in OSH : knowing what is required, verifying compliance, and preserving proof of that compliance.

What does Decree 1072 of 2015 require?

• Definition. Article 2.2.4.6.2, number 24, establishes the concept and the obligation to update.
• Employer’s obligation. The paragraph of Article 2.2.4.6.8, on employers’ obligations, establishes that the employer must identify the applicable national regulations of the General System of Occupational Risks, which must be reflected in a legal matrix, updated as new provisions applicable to the company are issued.
• Documentation. Article 2.2.4.6.12, on system documentation, includes among the documents that must be kept available and updated the legal matrix that includes the regulations of the General System of Occupational Risks applicable to the company.
• Minimum standards. Resolution 0312 of 2019 of the Ministry of Labor develops the minimum standards of the management system gradually according to the size and risk level of the company.

What should distinguish a useful legal matrix

1. Identification of applicable requirements. Which regulation, of what rank, which specific article, and why is it applicable to this company and not to just anyone.
2. Compliance assessment. Whether the requirement is met, partially met, or not met, with the date of the assessment.
3. Evidence. The document, record or action that demonstrates compliance, with its location.
4. Responsible parties. Who is responsible for each requirement within the organization.
5. Regulatory updates. How often and by what means are new regulations monitored, and who performs this task?

Confusing these five levels is the most frequent mistake: a matrix that only lists standards does not prove compliance, and one that only points out responsible parties does not allow for auditing.

Functional equivalents in other legal systems

Identifying and monitoring applicable legal requirements is common practice in management systems, even though the term “legal matrix” does not appear in the standard. In Spain, Law 31/1995 and Royal Decree 39/1997 do not require a document with that name, but they do require that the prevention plan, risk assessment, and planning of preventive activities be prepared and kept available for the labor authority, which in practice requires knowledge and control of the applicable regulations.

In certifiable management systems, determining and monitoring applicable legal and other requirements is an integral part of the standard’s requirements. However, these instruments are not interchangeable: each legal framework defines its own scope, mandatory documents, and sanctions regime, so simply transferring a Colombian legal framework to another country does not guarantee compliance there.

How it is made and maintained

1. Define the scope: economic activity, processes, centers, types of contracts and present risks.
2. Identify the applicable regulations by levels, from the law and the regulation to the technical standard and the sectoral provision.
3. Break down each standard into specific and verifiable requirements, not generic references.
4. Assign responsibility, evidence, and compliance status to each requirement.
5. Define regulatory monitoring: official source consulted, frequency and record of changes detected.
6. Review the matrix when regulations, activity, or organization change, and document the review.

Limits and common mistakes

1. It is incorrect to state that every company, in any country, is required to have a document called a legal matrix. This requirement, with its specific name, is unique to Colombian law.
2. Copying matrices from other companies: the applicable requirement depends on the specific activity.
3. Confusing the identification of requirements with the evaluation of their compliance.
4. Maintain it as a static list, without regulatory oversight or review dates.
5. Include only health and safety regulations and omit related regulations that are also mandatory, for example regarding facilities or chemical substances.
6. Using it as a substitute for risk assessment , which serves a different purpose.

Regulatory framework

• Decree 1072 of 2015, articles 2.2.4.6.2, 2.2.4.6.8 and 2.2.4.6.12 . Definition, employer obligation and documentation of the management system.
• Resolution 0312 of 2019. Minimum standards of the management system, graduated by size and risk level.
• Law 31/1995, articles 16 and 23. In Spain, obligation to assess and to prepare and keep preventive documentation.
• Royal Decree 39/1997 . Content of the prevention plan and the planning of preventive activity.

Outside of Colombia, the term is frequently used in the professional field, but it is always advisable to indicate the legal system to which the collected requirements refer.