CM. Management System

Code 7.0

Participants shall adopt or establish a management system with a scope that is related to the content of this Code. The management system shall be designed to ensure: (a) compliance with applicable laws, regulations and customer requirements related to the Participant's operations and products; (b) conformance with this Code; and (c) identification and mitigation of operational risks related to this Code. It shall also facilitate continual improvement.

NOTE: In VAP 7.0.0 this was a single generic management system (Appendix E2–E11) assessed across Labor, Health & Safety, Environment and Ethics with one set of audit questions and rating tables. The text below reflects that generic management system scoped to the Environment component. If a component has a valid certification (e.g. a valid third-party ISO 14001 certificate for Environment), that is considered conformance for the component on the relevant question.

1. Policy

A documented management system and supporting policies are established for the Environment component, including:

• a. Management accountability and responsibility (E2). A senior executive and management representative(s) are identified and assigned responsibility for ensuring implementation of the management system and associated programs, including compliance with laws and regulations and the requirements of the RBA Code, with authority to implement programs, procedures and corrective actions as needed.
• b. Legal and customer requirements (E3). A policy to identify, monitor and understand applicable laws, regulations and customer requirements, including the requirements of this Code.
• c. Risk assessment and risk management (E4). A policy to identify the legal-compliance and environmental risks associated with operations, determine the relative significance of each risk, and implement appropriate procedural and physical controls.
• d. Improvement objectives (E5). Written performance objectives, targets and implementation plans to improve environmental performance, with periodic assessment of performance against those objectives.
• e. Documentation and records (E11). A policy for the creation and maintenance of documents and records to ensure regulatory compliance and conformity to company requirements, with appropriate confidentiality to protect privacy.

2. Procedures & Practices

Procedures & Practices are in place such that:

• a. Management accountability (E2.1). Responsibilities and authorities of each organizational level are documented in position plans, job descriptions and/or the facility's management system documentation, for both normal and emergency situations, including conditions under which an override of the management system would be allowed.
• b. Management review (E2.2). An adequate and effective annual management system review process is in place, with senior management assessing the status of the management system on a regular (at least annual) basis.
• c. Compliance process (E3.1). An adequate and effective quarterly compliance process maintains a current understanding of applicable legal and customer requirements: identify, track, assess, integrate, implement and record.
• d. Risk management (E4.1). An adequate and effective risk assessment process using the hierarchy of controls (or equivalent) identifies the most significant environmental risks (including applicable legal and customer requirements); the risk assessment is updated when there is a Significant Change; each identified risk has an action plan with procedural controls and/or an improvement objective; and control effectiveness is evaluated on a regular basis. Scope of the risk assessment includes every site operation/process, physical location, and consideration of multiple chemical exposures and combined physical/chemical exposure effects (as applicable).
• e. Performance management (E5.1). An adequate and effective annual performance management process is in place with formal and communicated indicators, objectives and targets, including additional action plans where an indicator, objective or target is off track. Scope of indicators/objectives/targets considers risk-assessment results, legal and regulatory requirements, and company standards/requirements, with assigned owners, implementation plans, completion dates, communication to workers (as appropriate), and a defined review frequency, designed to achieve continual improvement.
• f. Training (E6.1). An adequate and effective training process is established for all managers/workers on policy/procedures/job-related aspects and performance targets, including a new-employee orientation plan, training-needs analysis, training plan, training material, training records, training frequency and training-effectiveness verification, with minimum environmental training topics covered (reduction programs; hazardous-waste handling, storage and disposal; solid-waste handling, storage and disposal; air emissions and control systems; material restriction; water use, discharge and contamination protection; storage and disposal; GHG/energy use and reduction). The training program is evaluated on a regular basis not exceeding 3 years or sooner upon a Significant Change.
• g. Communication (E7.1). An adequate and effective worker/manager, Supplier and customer communication/reporting process for environmental policies, practices and performance is established, covering the minimum communication topics. The communication program is evaluated on a regular basis not exceeding 3 years or sooner upon a Significant Change.
• h. Worker feedback, participation and grievance (E8). An adequate and effective grievance/complaint process allows work-related and Code-related grievances or complaints to be communicated confidentially without fear of reprisal or intimidation — internal (for workers and staff) and external (for workers of suppliers, the local community, interested actors and whistleblowers) — with clear, communicated channels in workers' native language(s); the Participant promptly investigates the validity of any grievance and takes prompt remedial action, protecting the identity of those who file and ensuring a no-reprisal approach. An adequate and effective process is also in place to solicit and encourage worker participation, input and feedback for improvement (e.g. surveys, suggestion boxes, focus groups, joint worker-management committees, worker/union representatives, process-improvement teams), with prompt evaluation and action on valid input.
• i. Audits and assessments (E9.1). An adequate and effective self-audit process periodically assesses conformance with applicable regulatory requirements, RBA Code requirements, the Participant's own policies/standards/management system, and other requirements to which the facility subscribes; audit findings are reviewed by senior management. Audit scope includes all areas of the facility, all processes, physical conditions and work practices, review of documents and records, and interviews with individuals responsible for social and environmental responsibility.
• j. Corrective action process (E10.1). An adequate and effective corrective action process is established to rectify and close non-conformances, containing corrective action reports/plans and tracking tables, additional actions when a corrective action is off track, a demonstrated link between the corrective action plan (CAP) and performance-management objectives and targets, and closure of action items confirmed by a management representative after verification by the appropriate person. Scope covers all non-conformances identified via internal or external audits, assessments, inspections, investigations and reviews against the RBA Code (including legal and customer requirements), with root-cause analysis, specific corrective actions, owners and due dates.
• k. Documentation and records (E11.1). An adequate and effective documentation and records process with appropriate retention (on and off site) and appropriate levels of access ensures privacy and conforms to regulatory requirements (including record-retention laws).

3. Controls & Monitoring

Controls & Monitoring should include:

• a. Control measures are in place for identified environmental risks, and the effectiveness of controls (including control processes) is evaluated on a regular basis.
• b. Where controls are not yet in place, an implementation plan with owners and due dates is in place and on track.
• c. Progress in meeting environmental objectives and targets is reviewed at the defined frequency, with additional action plans where any indicator, objective or target is off track.
• d. Self-audit findings, regulatory citations/penalties and grievance/feedback outcomes are tracked through to closure, with closure verified by an appropriate person and, where not verified by an independent third party or the original government agency, by the auditor.

4. Records

Records are maintained including:

• a. Management system documentation; senior-representative assignment; responsibilities and reporting lines.
• b. Management system review meeting minutes (agenda, date, attendees including senior manager, presentation materials, progress towards objectives, results of audits, completion of corrective/preventive actions, risks/issues) and the preventive/corrective action plan following each review.
• c. Compliance register and compliance calendar; summaries of applicable laws, regulations and key customer requirements; new/changed operations/policies/procedures resulting from the review process.
• d. Formal risk assessment reports; corrective/preventive action plans for identified risks; documented procedural controls; implementation plans (owners, due dates) where controls are not yet in place.
• e. Formal target, indicator and objective tracking; regular progress reporting.
• f. Training records including verification of training effectiveness; training evaluation reports and any corrective action; educational materials.
• g. Communication records including verification of communication effectiveness; educational materials; presentations to Suppliers.
• h. Grievance/complaint records retained for at least 12 months; written information to workers on how to report grievances and complaints; input/feedback records retained for at least 12 months and written information on how to provide input/feedback; action plans available, implemented or on track.
• i. Self-audit reports and resulting corrective action plans (with additional actions if off track).
• j. Records documenting each non-conformance; CAP for each non-conformance; progress reports; closure verification reports (with management confirmation); copies of any regulatory citations/violation notices received in the past three years and related communications.
• k. A listing/table of documents and records required; record retention conforming to requirements; the minimum records available for review (including risk assessments, work practices and procedures, performance in meeting objectives and targets, reports of inspections by regulatory agencies, incident investigations, worker complaints, training records, management system review minutes and action items, and corrective action records).

5. Serious conditions that will result in a severe finding

• A confirmed grievance/complaint case not investigated or without a corrective action plan.
• No action taken or recorded for a grievance/complaint for 3 months.
• One or more unaddressed regulatory actions or penalties.

1.0.0 (2021-01-01)

Changed

• Initial historical baseline — generic Management System scoped to environment (RBA Code of Conduct 7.0): Earliest imported version. In VAP 7.0.0 a single generic 'Management System' section (Appendix E2–E11) was assessed across Labor, Health & Safety, Environment and Ethics with one set of audit questions and rating tables. This version captures that generic management system scoped to the Environment component: management accountability and responsibility (E2), legal and customer requirements (E3), risk assessment and risk management (E4), improvement objectives (E5), training (E6), communication (E7), worker feedback/participation and grievance (E8), audits and assessments / self-audit (E9), corrective action process (E10), and documentation and records (E11). No environment-specific stakeholder identification, hierarchy-of-controls medium enumeration, per-medium owners, or public GHG-footprint reporting is yet required — those arrive with the 7.1.2 split into C.M.