ISO 45001:2018

Introductory clause. Explains that an organization carries responsibility for the health and safety at work of its workers and of others its activities affect, and that the standard supplies a framework within which those OH&S risks and opportunities are managed. Not a requirement.

• None: introductory text, not audited

• Treating introductory text as a requirement

Introductory clause. Explains that an OH&S management system exists to give a framework for managing risks and opportunities, so that injury and ill health caused by work are prevented and workplaces are kept safe and healthy. Not a requirement.

• None: introductory text, not audited

• Treating introductory text as a requirement

Introductory clause. Lists the factors on which an effective OH&S management system depends, including top management leadership, worker participation, resources, policy alignment and integration into business processes. Not a requirement.

• None: introductory text, not audited

• Treating introductory text as a requirement

Introductory clause. Describes the PDCA structure the requirements follow: plan, do, check, act, applied to the management system as a whole and to its elements. Not a requirement.

• None: introductory text, not audited

• Treating introductory text as a requirement

Introductory clause. Explains the Annex SL high-level structure the standard shares with other management system standards and how requirements are worded. Not a requirement.

• None: introductory text, not audited

• Treating introductory text as a requirement

The organization works out which external and internal issues bear on its purpose and on whether its OH&S management system can deliver what it is meant to deliver: safe and healthy workplaces, prevention of injury and ill health caused by work, and continual improvement of OH&S performance. Since Amendment 1 it must also decide, as part of this analysis, whether climate change is one of those issues for it. Where the answer is yes, auditors expect the effect of climate change on workers (heat stress, extreme weather, smoke, flooding, shifting disease patterns, disrupted emergency arrangements) to flow on into hazard identification, risk assessment and emergency planning.

• Context analysis record naming external and internal OH&S issues, with a dated entry stating the climate change decision (relevant or not) and the reasoning behind it
• Issue register with review dates, linking any climate-related issue to the hazard register and the emergency plan
• Management review minutes showing the context, including the climate change entry, was revisited

• No recorded decision on climate change since the climate amendment, or a bare yes or no with no reasoning
• Climate change judged relevant but heat, storm or flood exposure never reaches hazard identification or emergency preparedness
• Context copied from a quality system with no OH&S-specific issues and never revisited after certification

The organization identifies which interested parties other than its own workers matter to its OH&S management system; what workers and those parties need and expect of it that is relevant (their requirements); and which of those needs and expectations are already, or may turn into, legal requirements and other requirements it must meet or chooses to adopt. Amendment 1 adds a note that these parties may hold climate-related requirements, so the review considers, for example, regulator rules on working in heat or severe weather, client or insurer climate clauses, and worker concerns about climate exposure.

• Interested party register covering workers by role, contractors, regulators, unions, clients, insurers and neighbours
• Documented needs and expectations for each party, including any climate-related expectation identified
• Record of which expectations were adopted as legal or other requirements and where they feed the 6.1.3 register

• Workers listed as one undifferentiated group with no distinction by role or vulnerability
• Climate-related expectations of regulators, clients or workers not considered after the climate amendment
• No recorded decision on which expectations become requirements

In defining the scope, the organization works out where the system's boundaries lie and what it applies to, taking into account its external and internal issues, the requirements of interested parties, and the work-related activities it plans or carries out. The system covers those activities, products and services that the organization controls or influences and that can affect its OH&S performance, and the scope is available as documented information.

• Documented scope statement covering sites, activities and workers
• Justification for any activity outside scope
• Evidence the scope covers contractors and off-site work under the organization's control

• High-risk activities carved out of scope without justification
• Scope names locations but not activities
• Work performed at customer sites excluded

The organization builds an OH&S management system, puts it in place, maintains it and keeps improving it, with the processes it requires and the way those processes interact, as the standard requires.

• System description with process map and interactions
• Process ownership matrix
• Records of system maintenance and improvement

• System is a set of documents with no defined processes or interactions
• No owner for the system as a whole

Drawing on what performance evaluation shows, the organization identifies opportunities to improve and takes the actions needed for its OH&S management system to deliver what it is meant to deliver.

• Improvement register drawing on audits, reviews, incidents and performance data
• Evidence actions implemented

• Improvement limited to closing audit findings

The organization sets up, runs and keeps processes, covering reporting, investigation and action, for identifying and managing incidents and nonconformities. Whenever one of these arises, it: responds promptly, acting to bring it under control and correct it and dealing with what it has caused; decides, with workers taking part and other relevant interested parties involved, whether corrective action is needed to remove the root causes so that the problem neither happens again nor happens somewhere else, by looking into the incident or examining the nonconformity, finding its causes, and finding out whether similar incidents or nonconformities exist or might arise; reviews, where appropriate, the assessments already made of OH&S risks and of other risks; decides on and carries out corrective action following the hierarchy of controls and the management of change; assesses the OH&S risks

• Incident and nonconformity register
• Investigation reports with root cause analysis and worker participation
• Corrective actions showing hierarchy of controls applied
• Risk assessment reviews triggered by incidents
• Effectiveness reviews and communication records to workers

• Investigations stop at immediate cause
• Workers not involved in investigations
• Risk assessments not updated after incidents
• Effectiveness of corrective actions not reviewed

The organization keeps making its OH&S management system more suitable, adequate and effective. It does so by raising OH&S performance; fostering a culture that backs the system; encouraging workers to take part in carrying out improvement actions; telling workers, and their representatives, the relevant outcomes of continual improvement; and keeping and retaining documented information that shows continual improvement taking place.

• Improvement records with measured effect on performance
• Evidence of worker participation in improvement actions
• Communication of improvement results to workers
• Culture initiatives and their evaluation

• Improvement results not communicated to workers
• No evidence of a culture programme
• Improvements not measured

Top management shows leadership and commitment by: taking overall responsibility, and being accountable, for preventing injury and ill health caused by work and for keeping workplaces and activities safe and healthy; making sure the OH&S policy and objectives are set and fit the organization's strategic direction; building the system into business processes; making resources available; explaining why effective OH&S management, and meeting the system's requirements, matter; making sure the system achieves what it is meant to; guiding and supporting people to contribute; making sure continual improvement happens and encouraging it; backing other relevant managers in their own leadership; building and promoting a culture that supports what the system is meant to achieve; shielding workers from reprisal when they report hazards, incidents, opportunities and risks; and making sure processes e

• Executive accountability statements and safety leadership visits
• Board or executive minutes with OH&S performance reviewed
• Resource decisions traceable to OH&S needs
• Non-reprisal policy and evidence it is communicated
• Health and safety committee terms of reference

• Leadership demonstrated only by signing the policy
• No protection from reprisal for reporting
• Culture programme absent, safety seen as the safety officer's job

Top management sets up, puts in place and keeps an OH&S policy. The policy commits the organization to providing working conditions that are safe and healthy so that injury and ill health caused by work are prevented, in a way that suits its purpose, size and context and the particular nature of the OH&S risks and opportunities it faces; gives a framework within which OH&S objectives are set; commits to meeting legal and other requirements; commits to removing hazards and lowering OH&S risks; commits to continual improvement of the system; and commits to consulting workers, and their representatives where they exist, and to their participation. The policy is documented, communicated within the organization, available to interested parties as appropriate, and relevant and appropriate.

• Approved OH&S policy carrying every required commitment
• Communication records to workers and contractors
• Availability to interested parties (website, noticeboards)
• Review records

• Commitment to worker consultation and participation missing
• Policy not communicated to contractors
• Generic policy not tailored to the organization's hazards

Top management makes sure that, for the relevant roles in the OH&S management system, responsibilities and authorities are given out and made known at every level, and are kept as documented information. At every level, workers take responsibility for those parts of the system they control. Top management gives responsibility and authority for making sure the system conforms to the standard and for reporting to top management on how the system performs.

• Documented responsibility matrix for OH&S roles at all levels
• Job descriptions with OH&S accountabilities
• Named person responsible for conformity and performance reporting
• Communication records

• Responsibilities assigned to the safety function only
• Line managers' OH&S accountabilities not written down
• No defined reporting route to top management

The organization sets up, runs and keeps processes through which workers at every applicable level and in every applicable function, and their representatives where they exist, are consulted on and take part in developing, planning, putting in place, evaluating and improving the OH&S management system. It supplies the mechanisms, time, training and resources this needs; gives workers prompt access to information that is clear, easy to understand and relevant; removes, or reduces as far as possible, obstacles to taking part; puts weight on consulting non-managerial workers on set matters, such as the needs of interested parties, the policy, roles, legal requirements, objectives, controls over outsourcing and procurement, monitoring, audit and improvement; and puts weight on non-managerial workers taking part in identifying hazards, assessing risks, deciding on controls, determining compet

• Documented consultation and participation process
• Committee minutes and representative election records
• Evidence of consultation on the specified matters (policy, objectives, procurement, audit)
• Evidence of participation in hazard identification, risk assessment and incident investigation
• Records of barriers identified and removed (language, shift patterns, fear of reprisal)

• Consultation limited to a committee that meets quarterly
• Non-managerial workers absent from risk assessments
• No evidence of consultation on outsourcing, procurement or audit programmes

The organization sets up processes to put in place, and keep under control, planned changes, temporary or permanent, that affect OH&S performance. These include: new products, services and processes, or alterations to existing ones (such as where workplaces are and what surrounds them, how work is organized, working conditions, equipment and the workforce); changes to legal and other requirements; new knowledge or information about hazards and risks; and advances in knowledge and technology. It looks at what unintended changes lead to and acts, as needed, to limit any harmful effects.

• Management of change procedure covering all listed change types
• Change risk assessments before implementation
• Records of unintended changes reviewed and mitigated
• Change log with approvals

• Change control limited to plant modifications
• Temporary changes and workforce changes not assessed
• No review of unintended changes after incidents

The organization sets up, runs and keeps processes that govern how it buys products and services, so that what it buys is in line with its OH&S management system.

• OH&S requirements in purchasing specifications
• Pre-purchase hazard and risk review for equipment, chemicals and services
• Receipt inspection or verification records

• Equipment purchased without OH&S review
• Chemicals introduced without safety data sheet assessment

The organization aligns its procurement processes with its contractors so that hazards are identified and the OH&S risks are assessed and controlled where they come from three sources: contractor activities and operations that affect the organization; the organization's own activities and operations that affect contractor workers; and contractor activities and operations that affect other interested parties at the workplace. It makes sure contractors and their workers satisfy what its OH&S management system requires, and its procurement processes set and apply OH&S criteria for choosing contractors.

• Contractor selection criteria including OH&S performance
• Pre-work hazard exchange and risk assessments between the organization and contractors
• Contractor induction and monitoring records
• Evidence contractors' workers are covered by the system's requirements

• Contractors selected on price with no OH&S criteria
• Risks the organization's operations pose to contractors not assessed
• No monitoring of contractor performance during the work

The organization makes sure that functions and processes it outsources are kept under control and that its outsourcing arrangements fit both its legal and other requirements and the results its OH&S management system is meant to deliver. Within the system it sets how much control, and of what kind, is applied to those outsourced functions and processes.

• Register of outsourced functions with the defined type and degree of control
• Agreements specifying OH&S requirements and reporting
• Evidence of oversight of outsourced processes

• Outsourced processes treated as out of scope
• Degree of control never defined

The organization plans, puts in place, controls and keeps the processes required to satisfy its OH&S management system. The clause covers the general requirement (8.1.1), removing hazards and lowering OH&S risks (8.1.2), management of change (8.1.3) and procurement (8.1.4).

• Operational procedures and controls

• Operational controls not linked to the risk assessment

The organization plans, puts in place, controls and keeps the processes required to satisfy what its OH&S management system demands, and to carry out the actions decided under Clause 6. It does this by setting criteria for those processes, controlling them against the criteria, keeping and retaining documented information that gives confidence the processes ran as intended, and fitting the work to the workers. Where several employers share a workplace, the organization coordinates the relevant parts of its system with the other organizations there.

• Safe work procedures with process criteria
• Records demonstrating controls applied as planned
• Evidence work is adapted to workers (ergonomics, fitness for work)
• Coordination arrangements at shared workplaces

• No criteria to judge whether a control was applied correctly
• Shared workplaces with no coordination between employers
• Work not adapted to workers with changed capacity

The organization sets up, runs and keeps processes for removing hazards and lowering OH&S risks by working down the hierarchy of controls: first remove the hazard; next replace it with processes, operations, materials or equipment that are less hazardous; then apply engineering controls and reorganize the work; then apply administrative controls, training included; and finally provide personal protective equipment that is adequate.

• Risk assessments showing controls selected in hierarchy order with justification
• Engineering control records (guarding, ventilation, isolation)
• Evidence elimination and substitution were considered before administrative controls and PPE

• Controls default to PPE and training
• No record of why higher-order controls were rejected
• Hierarchy quoted in the procedure but not visible in the assessments

Duplicate representation of clause 8.1.3, retired 2026-09-16. The live control is code 8.1.3 under Operation. Excluded from every count.

• Hazard register
• Worker consultation
• Legal register
• Emergency response
• Incident management

• Worker consultation limited to OHS committee; not extended to non-management workforce.
• Contractor hazards covered in onboarding but not refreshed for scope changes.

The organization controls the procurement of products and services to ensure conformity with its OH&S management system. This clause covers the general requirement (8.1.4.1), contractors (8.1.4.2) and outsourcing (8.1.4.3).

• Procurement controls for OH&S

• Procurement treated as outside OH&S scope

The organization sets up, runs and keeps the processes it needs to get ready for, and respond to, possible emergencies identified under 6.1.2.1. This includes: setting a planned response, first aid included; training people in that response; testing and exercising the capability to respond at intervals; assessing how the response performed and revising it after tests and after real emergencies; telling workers what their duties and responsibilities are; passing relevant information, as appropriate, to contractors, visitors, emergency services, government authorities and the local community; and, when the planned response is developed, taking account of what every relevant interested party needs and is able to do. Documented information on the processes and the plans is kept.

• Emergency plans per identified scenario including first aid
• Drill and exercise records with evaluations
• Revisions to plans after drills and real events
• Training records for response roles
• Communication to contractors, visitors and external services

• Plans cover fire only, not the scenarios identified in hazard identification
• Drills held but never evaluated or used to revise the plan
• Visitors and contractors not covered

The organization monitors, measures, analyses and evaluates its OH&S performance. This clause covers the general requirement (9.1.1) and evaluation of compliance (9.1.2).

• Measurement framework and compliance evaluation records

• Measurement limited to injury statistics

The organization sets up, runs and keeps processes for monitoring, measuring, analysing and evaluating performance. It decides what is to be monitored and measured (including how far legal and other requirements are met, activities and operations linked to identified hazards, risks and opportunities, progress on objectives, and how effective operational and other controls are); which methods will give valid results; the criteria against which performance is judged; when monitoring and measuring take place; and when the results are analysed, evaluated and communicated. It evaluates its OH&S performance and how effective the system is, makes sure that equipment used to monitor and measure is calibrated or verified, used correctly and properly looked after, and keeps documented information as evidence.

• Monitoring and measurement plan with methods, criteria and frequencies
• Leading and lagging indicator reports
• Calibration and verification records for monitoring equipment (noise, gas, exposure)
• Records of analysis and communication of results

• Only lagging indicators measured
• Effectiveness of controls never evaluated
• Monitoring equipment uncalibrated

The organization sets up, runs and keeps processes for evaluating whether it complies with legal and other requirements. It decides how often and by what methods compliance is evaluated, carries out the evaluation and acts where needed, keeps up its knowledge and understanding of where it stands on compliance, and retains documented information on the results.

• Compliance evaluation schedule and method
• Compliance evaluation reports with status per requirement
• Actions raised for non-compliances
• Evidence the organization knows its current compliance status

• Compliance assumed rather than evaluated
• Evaluation covers permits but not operational duties
• No action taken on identified non-compliance

At planned intervals the organization carries out internal audits to find out whether its OH&S management system meets its own requirements and those of the standard, and whether the system is implemented and maintained effectively. The clause covers the general requirement (9.2.1) and the internal audit programme (9.2.2).

• Audit programme and reports

• Audits cover documents, not workplace conditions

At planned intervals the organization carries out internal audits that tell it whether its OH&S management system meets the organization's own requirements for that system (its policy and objectives included) and the requirements of the standard, and whether the system is implemented and maintained effectively.

• Audit reports covering conformity to own requirements and to the standard
• Evidence audits assess implementation, not only documentation

• Audits check paperwork and never observe work
• Objectives and policy commitments not audited

The organization plans, sets up, runs and keeps an audit programme, covering how often audits happen, the methods used, who is responsible, consultation, planning requirements and reporting, with regard to how important the processes involved are and what earlier audits found. It sets the criteria and scope of every audit; chooses auditors and runs audits so that they are objective and impartial; makes sure results reach the relevant managers, workers and their representatives, and other relevant interested parties; acts on nonconformities and to keep improving its OH&S performance; and keeps documented information as evidence.

• Audit programme showing frequency weighted by risk and previous results
• Audit plans with criteria and scope
• Auditor independence and competence records
• Evidence results reported to workers and representatives
• Corrective actions from audit findings

• Same programme every year regardless of risk or past findings
• Results reported to management only, never to workers
• Auditors audit their own areas

At planned intervals top management reviews the OH&S management system so that it stays suitable, adequate and effective. Inputs cover: where actions from earlier reviews stand; changes in internal and external issues, in what interested parties need and expect, in legal and other requirements, and in risks and opportunities; how far the policy and objectives have been achieved; information on OH&S performance, including incidents, nonconformities, continual improvement and corrective actions, results of monitoring and measurement, the outcome of compliance evaluation, audit results, consultation and participation of workers, and risks and opportunities; whether resources are adequate; relevant communications with interested parties; and opportunities for continual improvement. Outputs cover decisions on whether the system remains suitable, adequate and effective, on opportunities to imp

• Management review agenda covering every required input
• Minutes with decisions, actions, owners and resource decisions
• Evidence of communication of outputs to workers and representatives
• Follow-through of previous actions

• Review is an incident statistics meeting
• Worker consultation results not an input
• Outputs not communicated to workers

Set up, run and keep a hazard identification process that is continuous and looks ahead. The process shall take into account: social factors and the way work is organized; activities that are routine and those that are not; incidents that have happened before; possible emergencies; people, including workers, contractors, visitors and others; how workplaces and equipment are designed; changes; and changes to legal requirements, whether actual or proposed.

• Documented hazard identification procedure
• Hazard registers by site and activity
• Job hazard analyses / task risk assessments
• Records covering routine, non routine, emergency, contractor, visitor, public
• Psychosocial and ergonomic hazard assessments
• Worker reported hazard logs

• Psychosocial and ergonomic hazards omitted
• Visitors, public and contractors not assessed
• Hazard ID treated as annual rather than ongoing

Set up, run and keep processes that assess the OH&S risks arising from hazards that have been identified, with regard to how effective the current controls are, and that assess other risks connected with setting up, running, operating and maintaining the OH&S MS.

• Documented risk assessment methodology with defined criteria
• Risk register considering effectiveness of existing controls
• Separate assessment of risks to the OH&S MS itself
• Reviewer competence records

• Existing controls assumed effective without verification
• OH&S MS risks not separately considered

Set up, run and keep processes that assess two kinds of opportunity: OH&S opportunities to raise OH&S performance, with planned changes taken into account, and opportunities to make the OH&S MS itself better.

• Opportunities register
• Linkage to objectives and improvement plans
• Records of opportunities considered during change planning

• Opportunities section blank or trivial
• Not refreshed when changes are planned

When planning the system, the organization weighs its context, its interested parties and its scope, and identifies which risks and opportunities need addressing. The clause covers the general planning requirement (6.1.1), hazard identification plus the weighing of risks and of opportunities (6.1.2), identification of legal and other requirements (6.1.3), and the planning of action (6.1.4).

• Planning records linking context, hazards, legal requirements and actions

• Planning elements held in separate documents with no link between them

When planning the system, the organization weighs the issues identified under 4.1 and the requirements under 4.2 and 4.3, and identifies the risks and opportunities it must address so as to be confident the system can deliver what it is meant to, prevent or lessen unwanted effects, and keep improving. It takes account of hazards, of risks and opportunities (OH&S ones and others alike), and of legal and other requirements; weighs risks and opportunities that arise from changes and from emergencies; and keeps documented information on its risks and opportunities and on the processes and actions it needs for identifying and addressing them.

• Register of OH&S risks and opportunities and of risks and opportunities to the management system
• Documented processes for determining risks and opportunities
• Evidence that planned changes and emergency scenarios were considered

• Only hazard risks captured, not risks to the management system itself
• Opportunities never recorded
• Risks from planned changes not assessed

The organization sets up and keeps processes that identify hazards (6.1.2.1), assess risks, both OH&S risks and others, to the management system (6.1.2.2), and assess opportunities, both OH&S opportunities and others (6.1.2.3).

• Hazard identification and risk assessment procedures
• Hazard and risk registers

• Hazard identification, risk assessment and opportunity assessment held as one undifferentiated process

The organization sets up, runs and keeps processes that identify, and give it access to, current legal and other requirements that apply to its hazards, its OH&S risks and its OH&S management system; that establish how these requirements affect the organization and what must be communicated; and that make sure they are taken into account as the system is set up, run, kept and continually improved. Documented information on legal and other requirements is kept, and it is updated whenever they change.

• Legal and other requirements register with applicability per requirement
• Subscription or process for tracking regulatory change
• Evidence of communication of requirements to affected roles
• Update history of the register

• Register lists statutes but not how each applies to the organization's hazards
• No process for detecting legal change
• Other requirements (customer, industry codes, union agreements) omitted

The organization plans actions on its risks and opportunities and on its legal and other requirements, and also plans how it will get ready for and respond to emergencies. It plans how those actions will be built into and carried out through the processes of its OH&S management system or other business processes, and how their effectiveness will be judged. In planning, it takes account of the hierarchy of controls and of what the system produces, and it considers good practice, the technology options available, and its financial, operational and business requirements.

• Action plans with owners, dates and integration points
• Evidence the hierarchy of controls was applied in selecting actions
• Effectiveness evaluation records for completed actions

• Actions default to PPE and procedures with no consideration of elimination or substitution
• No plan for evaluating whether actions worked
• Actions not integrated into operational processes

The organization sets OH&S objectives for the relevant functions and levels (6.2.1) and plans how it will reach them (6.2.2).

• Documented OH&S objectives and plans

• Objectives without plans, or plans without objectives

The organization sets OH&S objectives for the relevant functions and levels, with the aim of keeping up and continually improving both the system and OH&S performance. The objectives match the OH&S policy, can be measured where this is practicable or otherwise lend themselves to performance evaluation, take account of the requirements that apply and of the results of assessing risks and opportunities and of consulting workers, and are monitored, communicated and updated as appropriate.

• Documented OH&S objectives with measures and targets
• Traceability to the policy, risk assessment results and worker consultation
• Monitoring reports and communication records

• Objectives limited to lagging indicators such as injury rates
• No link from risk assessment results to the objectives set
• Workers not consulted on objectives

In planning how its OH&S objectives will be reached, the organization decides what is to be done, what resources it needs, who is responsible, when the work will be finished, how the results will be judged (including the indicators used to track them), and how the actions will fit into business processes. Documented information on the objectives and the plans is kept.

• Action plans per objective with resources, owners, dates and indicators
• Evidence of integration into budgets and operational plans
• Progress reviews against indicators

• Objectives set with no plan behind them
• Indicators undefined so progress cannot be evaluated
• Plans not resourced

OH&S policy and commitment. Control from ISO 45001 framework, domain: ISO 45001: OH&S Policy & Planning.

• OH&S policy statement
• Hazard register
• Legal register
• Worker consultation records

• Stale hazard inventory
• Missing legal updates
• Token consultation
• Objectives without measures

Hazard identification and risk assessment. Control from ISO 45001 framework, domain: ISO 45001: OH&S Policy & Planning.

• OH&S policy statement
• Hazard register
• Legal register
• Worker consultation records

• Stale hazard inventory
• Missing legal updates
• Token consultation
• Objectives without measures

Legal and regulatory compliance. Control from ISO 45001 framework, domain: ISO 45001: OH&S Policy & Planning.

• OH&S policy statement
• Hazard register
• Legal register
• Worker consultation records

• Stale hazard inventory
• Missing legal updates
• Token consultation
• Objectives without measures

OH&S objectives and action plans. Control from ISO 45001 framework, domain: ISO 45001: OH&S Policy & Planning.

• OH&S policy statement
• Hazard register
• Legal register
• Worker consultation records

• Stale hazard inventory
• Missing legal updates
• Token consultation
• Objectives without measures

Worker consultation and participation. Control from ISO 45001 framework, domain: ISO 45001: OH&S Policy & Planning.

• OH&S policy statement
• Hazard register
• Legal register
• Worker consultation records

• Stale hazard inventory
• Missing legal updates
• Token consultation
• Objectives without measures

Elimination and substitution of hazards. Control from ISO 45001 framework, domain: ISO 45001: Operational Controls.

• OH&S policy statement
• Hazard register
• Legal register
• Worker consultation records

• Stale hazard inventory
• Missing legal updates
• Token consultation
• Objectives without measures

Engineering and administrative controls. Control from ISO 45001 framework, domain: ISO 45001: Operational Controls.

• Control hierarchy register
• PPE issue log
• Emergency response plan
• Contractor safety pack

• PPE as first resort
• Untested emergency drills
• No contractor onboarding
• Missing control review cycle

Personal protective equipment management. Control from ISO 45001 framework, domain: ISO 45001: Operational Controls.

• Incident investigation report
• OH&S audit plan
• Management review minutes
• Corrective action register

• Root cause not identified
• Audit findings not closed
• No trend analysis
• Lessons not shared

Emergency preparedness and response. Control from ISO 45001 framework, domain: ISO 45001: Operational Controls.

• Control hierarchy register
• PPE issue log
• Emergency response plan
• Contractor safety pack

• PPE as first resort
• Untested emergency drills
• No contractor onboarding
• Missing control review cycle

Contractor and visitor safety management. Control from ISO 45001 framework, domain: ISO 45001: Operational Controls.

• Control hierarchy register
• PPE issue log
• Emergency response plan
• Contractor safety pack

• PPE as first resort
• Untested emergency drills
• No contractor onboarding
• Missing control review cycle

Establish processes for reporting, investigating and taking action to control and correct incidents and nonconformities.

• Incident reports
• Root cause analyses
• ICAM/TapRooT records
• CAPA register

• Blame-focused investigation
• Near-miss under-reported

Continually improve suitability, adequacy and effectiveness of OH&S MS to enhance OH&S performance.

• Improvement initiative register
• Trend analysis
• Best practice sharing

• Status quo bias
• No benchmarking

Incident investigation and reporting. Control from ISO 45001 framework, domain: ISO 45001: Performance & Improvement.

• Incident investigation report
• OH&S audit plan
• Management review minutes
• Corrective action register

• Root cause not identified
• Audit findings not closed
• No trend analysis
• Lessons not shared

OH&S monitoring and measurement. Control from ISO 45001 framework, domain: ISO 45001: Performance & Improvement.

• Incident investigation report
• OH&S audit plan
• Management review minutes
• Corrective action register

• Root cause not identified
• Audit findings not closed
• No trend analysis
• Lessons not shared

Internal OH&S audit program. Control from ISO 45001 framework, domain: ISO 45001: Performance & Improvement.

• Incident investigation report
• OH&S audit plan
• Management review minutes
• Corrective action register

• Root cause not identified
• Audit findings not closed
• No trend analysis
• Lessons not shared

Management review and continual improvement. Control from ISO 45001 framework, domain: ISO 45001: Performance & Improvement.

• Incident investigation report
• OH&S audit plan
• Management review minutes
• Corrective action register

• Root cause not identified
• Audit findings not closed
• No trend analysis
• Lessons not shared

Corrective actions and lessons learned. Control from ISO 45001 framework, domain: ISO 45001: Performance & Improvement.

• Incident investigation report
• OH&S audit plan
• Management review minutes
• Corrective action register

• Root cause not identified
• Audit findings not closed
• No trend analysis
• Lessons not shared

Determine external and internal issues relevant to OH&S management system purpose and ability to achieve intended outcomes.

• PESTLE/SWOT for OH&S
• Context register
• Strategic OH&S issues log

• No OH&S-specific context
• Stale issue list

Identify workers and other interested parties and determine their relevant needs, expectations and which become compliance obligations.

• Interested party register
• Worker consultation records
• Compliance obligations register

• Contractors omitted
• No worker rep input

Define boundaries and applicability of OH&S MS including activities, products, services and workplaces under organizational control.

• Documented OH&S MS scope
• Site/activity list
• Exclusion rationale

• Mobile workers excluded
• Contractor scope vague

Top management demonstrates leadership for OH&S MS including taking accountability for prevention of work-related injury and ill health.

• CEO OH&S statement
• Management review minutes
• Visible felt leadership records

• Delegated to HSE only
• No site walks

Establish, implement and maintain OH&S policy with commitments to safe and healthy working conditions, hazard elimination and worker consultation.

• Signed OH&S policy
• Communication evidence
• Policy review log

• Missing consultation commitment
• Not communicated to contractors

Assign and communicate responsibilities and authorities for relevant roles in the OH&S MS.

• RACI for OH&S
• Position descriptions
• Org chart with OH&S roles

• No worker-level accountability
• HSE manager bottleneck

Establish processes for consultation and participation of workers, including non-managerial workers, at all applicable levels.

• HSE committee minutes
• Toolbox talk records
• Suggestion system stats

• Token committee
• No non-managerial input

Establish ongoing proactive process for hazard identification considering routine and non-routine activities, human factors and emergency situations.

• Hazard register
• Job safety analyses
• Risk assessment matrix
• Human factors review

• Only physical hazards
• No psychosocial assessment

Determine and have access to up-to-date legal and other requirements applicable to OH&S hazards.

• Legal register
• Compliance evaluation
• Subscription to regulatory updates

• Outdated register
• No state/jurisdictional split

Plan actions to address risks, opportunities, legal requirements and emergency situations and integrate into OH&S MS processes.

• OH&S action plan
• Hierarchy of controls applied
• Integration evidence

• PPE-first thinking
• No elimination/substitution

Establish measurable OH&S objectives at relevant functions and levels consistent with policy.

• SMART OH&S objectives
• KPI dashboards
• Owner assignments

• Lagging only
• No leading indicators

Determine necessary competence of workers affecting OH&S performance and ensure they are competent through education, training or experience.

• Training matrix
• Licences/tickets register
• Competency assessments

• Contractor competence not verified
• Refreshers overdue

Workers aware of OH&S policy, their contribution to OH&S MS, incidents and outcomes, hazards relevant to them and right to remove themselves from imminent danger.

• Induction records
• Toolbox talk logs
• Stop-work authority policy

• No stop-work rights communicated

Determine internal and external communications relevant to OH&S MS including what, when, with whom and how.

• Communication matrix
• Safety alerts
• Crisis comms plan

• No language accommodations
• Top-down only

Establish processes for elimination of hazards and reduction of OH&S risks using hierarchy of controls.

• Hierarchy of controls applied per hazard
• Engineering control register
• Design reviews

• PPE as primary control
• No design out

Establish process for implementation and control of planned temporary or permanent changes that impact OH&S performance.

• MOC procedure
• Pre-startup safety review
• Change register

• Temp changes bypass MOC
• No HAZOP on changes

Coordinate procurement processes including contractors and outsourced functions to ensure conformity with OH&S MS requirements.

• Contractor prequalification
• Site induction records
• Contractor performance reviews

• No prequalification
• Lowest cost wins

Establish, implement and maintain processes to prepare for and respond to potential emergency situations.

• Emergency response plan
• Drill records
• First aider register
• Evacuation diagrams

• Drills not tested
• No scenario variation

Determine what, methods, when and analyse OH&S performance and effectiveness of OH&S MS.

• KPI reports
• Leading indicators
• Calibration of monitoring equipment

• Lagging only
• No statistical analysis

Plan, establish, implement and maintain processes to evaluate fulfilment of legal and other requirements.

• Compliance evaluation reports
• Action items log
• Regulator correspondence

• Annual only
• No documented evaluation

Conduct internal audits at planned intervals to provide information on whether OH&S MS conforms and is effectively implemented.

• Audit programme
• Audit reports
• Auditor competence records

• Auditor independence weak
• Findings not closed

Top management reviews OH&S MS at planned intervals to ensure continuing suitability, adequacy and effectiveness.

• Management review minutes
• Input/output evidence
• Action register

• No worker input
• Skipped inputs

The organization works out, and then supplies, the resources required so that its OH&S management system can be set up, run, kept going and continually improved.

• Resource plans and budgets for OH&S activities
• Records of resource needs raised and decisions taken
• Evidence of resources provided for worker participation

• Resources approved reactively after incidents only
• Time and resources for worker participation not provided

The organization decides what competence workers need where their work affects, or could affect, OH&S performance. It makes sure workers are competent, which includes being able to spot hazards, through education, training or experience; where applicable it acts to gain and keep that competence and checks whether those actions worked; and it keeps documented information as proof of competence.

• Competency matrix by role including hazard identification ability
• Training records and competence assessments
• Effectiveness evaluations of training
• Licence and certification records for high-risk work

• Competence defined as attendance at training
• Hazard identification competence not assessed
• Contractor competence not verified

Workers are made aware of: the OH&S policy and objectives; how they contribute to an effective system, including what better OH&S performance brings; what can follow, and what it can mean, if requirements are not met; incidents, and the findings of investigations, that concern them; the hazards, OH&S risks and decided actions that concern them; and that they are able to remove themselves from a work situation they believe poses serious and imminent danger, together with the arrangements that shield them from unfair consequences for doing so.

• Induction and awareness material covering every listed item
• Communication of incident outcomes to relevant workers
• Documented stop-work authority and non-reprisal arrangements
• Evidence workers can describe hazards relevant to them

• Stop-work right not communicated or not protected
• Incident learnings not shared beyond the site involved
• Awareness delivered once at induction only

The organization sets up, runs and keeps processes for communicating, inside and outside the organization, on matters that bear on its OH&S management system, covering what is communicated, when, to whom and by what means. The clause covers the general requirement (7.4.1), communication inside the organization (7.4.2) and communication with outside parties (7.4.3).

• Communication process and plan

• Communication needs never determined

The organization sets up, runs and keeps the processes it needs for communicating, inside and outside the organization, on matters that bear on its OH&S management system, deciding what is communicated, when, to whom and by what means. It takes account of diversity, such as gender, language, culture, literacy and disability; weighs the views of outside interested parties; has regard to legal and other requirements; makes sure the OH&S information it communicates matches what the system itself produces and can be relied on; replies to relevant communications; and keeps documented information as evidence.

• Communication plan naming content, timing, audience and channel
• Evidence diversity aspects considered (translations, accessible formats)
• Records of communications and responses
• Consistency check between communicated and internal OH&S data

• Communication in one language for a multilingual workforce
• No process for responding to external communications
• Published OH&S figures inconsistent with internal records

The organization shares information about its OH&S management system internally across its levels and functions, changes to the system included where appropriate, and makes sure its communication processes let workers play a part in continual improvement.

• Toolbox talks, briefings and bulletins with attendance
• Communication of system changes
• Channels for workers to raise suggestions and evidence they are acted on

• Communication is top-down only
• System changes not communicated to affected workers

The organization communicates information about its OH&S management system to outside parties in the way its communication processes lay down, having regard to its legal and other requirements.

• Records of external communications (regulators, clients, public)
• Evidence legal notification requirements are met
• Process for handling external enquiries and complaints

• Statutory incident notifications late or missing
• No defined owner for external OH&S communication

The OH&S management system includes the documented information required by the standard and determined by the organization as necessary. This clause covers the general requirement (7.5.1), creating and updating (7.5.2) and control (7.5.3).

• Document index and control procedure

• Required records not identified

The OH&S management system contains the documented information the standard requires, plus whatever documented information the organization decides it needs for the system to be effective. How much is needed can vary with the size of the organization and the kind of activities, processes, products and services it has, with the need to show that legal and other requirements are met, with how complex its processes are, and with how competent its workers are.

• Master list of OH&S system documents and records
• Mapping of documented information to standard clauses and legal requirements
• Justification for the extent of documentation chosen

• Only mandatory records identified
• Legal record-keeping (exposure monitoring, statutory inspections) not mapped

Whenever documented information is created or updated, the organization makes sure it is suitably identified and described (for example by title, date, author or reference number), in a suitable format and medium, and reviewed and approved so that it is fit and adequate.

• Templates with identification fields
• Approval records
• Version history on procedures and risk assessments

• Risk assessments circulated unapproved
• No version control on safe work procedures

Documented information that the standard, or the OH&S management system itself, calls for is controlled so that it can be found and used, in a fit state, at the place and time it is needed, and so that it is properly protected. Control covers how it is distributed, accessed, retrieved and used; how it is stored and preserved, legibility included; how changes are controlled; and how long it is kept and how it is disposed of. Documented information from outside sources that the organization judges necessary is identified and controlled.

• Document control procedure covering access, change, retention and disposal
• Controlled register of external documents (regulations, safety data sheets, manufacturer instructions)
• Retention schedule including health surveillance and exposure records
• Evidence current versions are available at the point of use

• Superseded procedures in use at sites
• Safety data sheets out of date
• Health records not retained for the statutory period