ISO45001 Occupational health and safety management systems — Guidance on the use of this International Standard

Annex A

(informative)Guidance on the use of this Internationale Standart

A.1 General  

The explanatory information given in this annex is intended to prevent misinterpretation of the requirements contained in this International Standard. While this information addresses and is consistent with these requirements, it is not intended to add to, subtract from, or in any way modify them.

The requirements in this International Standard need to be viewed from a systems perspective and should not be taken in ishttp://iso45.blogspot.com/p/iso45001-occupational-health-and-safety.htmlolation, i.e. there can be an interrelationship between the requirements in a clause with the requirements in other clauses.

A.2 Normative references  

There are no normative references in this International Standard. Users can refer to the documents listed in the Bibliography for further information.

A.3 Terms and definitions  

In addition to the terms and definitions given in Clause 3, and in order to avoid misunderstanding, clarifications of selected concepts are provided below.

— ”Continual” indicates duration that occurs over a period of time, but with intervals of interruption (unlike ”continuous” which indicates duration without interruption). ‘Continual’ is therefore the appropriate word to use in the context of improvement.

— The word ”consider”’ means it is necessary to think about but can be rejected, whereas ”take into account” means it is necessary to think about but cannot be rejected.

—  The words ”appropriate” and ”applicable” are not interchangeable. ”Appropriate” means suitable (for, to) and implies some degree of freedom, while ”applicable” means relevant or possible to apply and implies that if it can be done, it shall be done.

— This International Standard uses the term ”interested party”, the term ”stakeholder” is a synonym as it represents the same concept.

— The word “ensure” means the responsibility can be delegated, but not the accountability to make sure that it is performed.

— “Documented information” is used to include both documents and records. This International Standard uses the phrase “retain documented information as evidence of…” to mean records, and ‘shall be available as documented information’ to mean documents, including procedures. The phrase “to retain documented information as evidence of…” is not intended to require that the information retained will meet legal evidentiary requirements. Instead, it is intended to define the type of records that need to be retained.

Organizations can be subject to requirements related to the OH&S management system that mandate the use of specific terms and their meaning. If these other terms are used, conformity to this International Standard is still required.

A.4 Context of the organization  

A.4.1 Understanding the context of the organization  

The intent of this clause is for the organization to obtain an understanding of the issues, positive and negative, that the organization needs to consider in establishing its OH&S management system.

The issues of interest are those that affect or could affect the organization’s ability to achieve the intended outcomes. Issues can include conditions, characteristics or changing circumstances that can affect the OH&S management system, for example:

a) external context issues, such as:

1) the cultural, social, political, legal, financial, technological, economic and natural surroundings and market competition, whether international, national, regional or local;

2) introduction of new competitors, contractors, suppliers, partners and providers, new technologies, new laws and the emergence of new occupations;

3) key drivers and trends relevant to the industry or sector having impact on the organization;

4) relationships with, and perceptions and values of, its external interested parties;

5) changes in relation to any of the above.

b) internal context issues, such as:

1) governance, organizational structure, roles and accountabilities;

2) policies, objectives and the strategies that are in place to achieve them;

3) the capabilities, understood in terms of resources, knowledge and competence (for example capital, time, human resources, processes, systems and technologies);

4) information systems, information flows and decision-making processes (both formal and informal);

5) introduction of new products, services, new tools, new software, new premises and equipment;

6) relationships with, and perceptions and values of workers;

7) the culture in the organization (see A.5.1);

8) standards, guidelines and models adopted by the organization;

9) the form and extent of contractual relationships, including for example outsourced activities;

10) working time arrangements;

11) changes in relation to any of the above.

An understanding of the context of an organization is used to establish, implement, maintain and continually improve its OH&S management system (see 4.4), especially in the establishment of its OH&S policy (see 5.2) and the setting of its OH&S objectives (see 6.2.1).

The internal and external issues that are determined in 4.1 can result in risks and opportunities to the organization or to the OH&S management system (see 6.1.1 to 6.1.3). The organization determines those that need to be addressed and managed (see 6.1.4, 6.2, Clause 7, Clause 8 and 9.1).

A.4.2 Understanding the needs and expectations of workers and other interested parties  

An organization is expected to gain a general understanding of the expressed needs and expectations of the internal and external interested parties that have been determined by the organization to be relevant.

The organization should determine the needs and expectations of both managerial and non-managerial workers, and where they exist, workers’ representatives, that can affect the OH&S management system, or which perceive themselves to be affected by it.

Other interested parties to an OH&S management system can include:

a) legal and regulatory authorities (local, regional, state/provincial, national or international);

b) parent organizations;

c) suppliers, contractors and subcontractors;

d) workers’ organizations (trade unions) and employers’ organizations;

e) owners, shareholders, clients, visitors, local community and neighbours of the organization and the general public;

f) customers, medical and other community services, media, academia, business associations and non-governmental organizations (NGOs);

g) occupational health and safety organizations and occupational safety and health-care professionals (for example doctors and nurses).

Interested party needs and expectations are not necessarily requirements of the organization. It is important to distinguish between these needs and requirements such as:

— mandatory requirements: laws, regulations, corporate requirements, provisions of the organization’s collective agreements that relate to the health and safety of workers where they are given legal effect;

— commitment requirements: voluntary commitments to interested parties to which the organization voluntarily subscribes. It also includes rules, guides and technical references;

— other requirements to which the organization voluntarily subscribes that relate to the OH&S management system.

Needs and expectations from interested parties become obligatory requirements for an organization if that organization chooses to adopt them. Once the organization adopts them, then they become requirements and should be considered when planning and establishing the OH&S management system.

A.4.3 Scope of the OH&S management system  

The scope of the OH&S management system is intended to clarify the boundaries to which the organization’s system will apply, especially if the organization is a part of a larger organization at a given location. An organization has the freedom and flexibility to define its boundaries taking into account its work related activities. It may choose to implement this International Standard with respect to the entire organization, or to (a) specific part(s) of the organization, as long as the top management of that part of the organization hasits own functions, responsibilities and authorities for establishing an OH&S management system.

When determining the scope, the credibility of the organization’s OH&S management system will depend upon the choice of the boundaries. It should be noted that 4.3 requires that the organization take into account its activities, products or services that are within its control or influence that can impact on its OH&S performance.

The scope should be factual and representative of the organization’s operations included within its OH&S management system boundaries so that it does not mislead interested parties.

The scope should address hazards and potential OH&S risks to persons in the organization and furthermore consider its impacts on persons, outsourced or subcontracted, carrying out activities or producing products or delivering services for the organization or on its behalf.

A.4.4 OH&S management system  

The organization retains authority, accountability, and autonomy, to decide how it will fulfil the requirements of this International Standard, including the level of detail and extent to which it will:

a) integrate requirements of the OH&S management system into its various business operations, such as design & development, procurement, human resources, sales and marketing, etc.;

b) incorporate the issues associated with its context (4.1), its interested party requirements (4.2) and the scope (4.3) of its OH&S management system.

If this International Standard is implemented for a specific part(s) of an organization, the policies and processes developed by other parts of the organization can be used to meet the requirements of this International Standard, provided that they are applicable to the specific part(s) that will be subject to them and that they comply with the requirements of this International Standard.

Examples of these processes could be:

— corporate OH&S policies;

— document management system;

— competency programmes;

— procurement controls, etc.

A.5 Leadership and worker participation 

A.5.1 Leadership and commitment  

Commitment, awareness, responsiveness, active support and feedback from the organization’s top management are critical for the success of the OH&S management system and therefore they have specific responsibilities for which they need to be personally involved or which they need to direct. To achieve improved acceptance and implementation of OH&S management system processes, leadership includes communicating the requirements of "what" needs to be done and "why" it should be done. It is also important to ensure that the intended outcomes are achieved.

Top management should develop, lead and promote a culture in the organization that supports the OH&S management system and which encourages workers, and where they exist, workers’ representatives, to actively participate in the OH&S management system, as well as the involvement of relevant interested parties. This is a key factor in the establishment and implementation of an effective OH&S management system and an occupational health and safety culture.

An organization’s occupational health and safety culture is largely determined by top management and is the product of individual and group values, attitudes, perceptions, competencies and patterns of activities that determine the commitment to, and the style and proficiency of, its OH&S management system.

An occupational health and safety culture that supports an organization’s OH&S management system is characterized by communications founded on mutual trust, by shared perceptions of the importance of the OH&S management system and by confidence in the effectiveness of preventive measures. An organization with such a culture is sometimes denoted as a “learning” organization. In the context of occupational health and safety, learning organizations encourage a culture where people at all levels of the organization continually expand their capacity to understand how work activities, and the way in which they are organized, impact OH&S performance.

Cooperation between managers, workers, and where they exist, workers’ representatives, is an essential element of workplace-related prevention measures.

OH&S management system deficiencies can include, but are not limited to:

a) poor feedback and communication processes;

b) excessive workloads;

c) budget constraints;

d) deficient work coordination;

e) inadequate supervision, etc.

The organization should identify and address such deficiencies to improve its OH&S management system.

Identifying hazards, reducing risk, and a focus on compliance, will not in itself create or maintain an effective OH&S management system.

A.5.2 Policy  

The OH&S policy is a set of principles stated as commitments in which top management outlines the long-term direction of the organization to support and continually improve its OH&S performance. The OH&S policy provides an overall sense of direction, provides a framework for the organization to set its objectives and take actions to achieve the intended outcomes of the OH&S management system.

Five basic commitments for the OH&S policy are specified in this International Standard to:

a) provide safe and healthy working conditions for the prevention of work-related injury and ill health;

b) satisfy applicable legal requirements and other requirements;

c) control OH&S risks using the hierarchy of controls (see 8.1.2);

d) the continual improvement of the OH&S management system (see 10.2) to enhance the organization’s OH&S performance;

e) participation.

These commitments are then reflected in the processes an organization establishes to address specific requirements in this International Standard, to ensure a robust, credible and reliable OH&S management system.

The OH&S policy should be established by the top management after having taken into account:

a) OH&S opportunities;

b) the needs and expectations of workers, and where they exist, workers’ representatives, and other relevant interested parties;

c) applicable legal requirements and other requirements to which the organization subscribes.

The organization’s OH&S policy should be appropriate to the nature and scale of its identified OH&S risks and OH&S opportunities and should be realistic. In developing its OH&S policy, an organization should consider its coordination with other policies.

While all the commitments are important, some interested parties are especially concerned with the organization’s commitment to fulfil its applicable legal requirements. This International Standard specifies a number of interconnected requirements related to this commitment. These include the need to:

— determine the applicable legal requirements;

— ensure operations are carried out in accordance with these legal requirements;

— evaluate fulfilment of the legal requirements;

— correct nonconformities.

A.5.3 Organizational roles, responsibilities, accountabilities and authorities  

Top management has overall OH&S management system responsibility, accountability and authority for the protection of workers’ safety and health. Workers, in the course of performing their work, should co-operate with top management, middle-management and supervisors in fulfilling those responsibilities. Every person in the workplace needs to consider not only his or her own health and safety, but also the health and safety of others.

Accountability means ultimate responsibility and relates to the person who is held to account if something is not done, is not done properly, does not work or fails to achieve its objective.

OH&S management system responsibilities should be assigned in appropriate areas of the organization, such as operational management (e.g. design, maintenance, manufacturing) or other staff functions (e.g. middle-management and supervisors). The responsibilities, accountabilities and authorities should be reviewed when a change in structure of the organization occurs.

Workers, when assuming responsibility for those aspects of the OH&S management system over which they have control should be entitled to report about dangerous situations so that action can be taken. They should be able to report concerns to responsible authorities as required without the threat of dismissal, disciplinary action or other such reprisals.

Top management may assign the responsibility and authority for ensuring that the OH&S management system conforms to the requirements of this International Standard and for reporting on the performance of the OH&S management system, to an individual (sometimes referred to as the ‘management representative’), to a member of top management, or to several individuals.

Workers should have sufficient competency and authority to remove themselves from hazardous situations as necessary, without fear of reprisals.

A.5.4 Participation and consultation  

The participation of workers, and where they exist, workers’ representatives, is a key factor of success for an OH&S management system.

The top management of the organization should encourage the participation of workers, and where they exist, workers’ representatives, in the development, implementation and maintenance of the OH&S management system. This should include the receipt of suggestions for the improvement of the OH&S management system, which can lead to improvements in the organization’s OH&S performance.

NOTE 1 The ILO’s ILS recommend that the processes for the receipt of suggestions are more effective if workers do not fear the threat of dismissal, disciplinary action, or other such reprisals, when making them.

The process of consultation can include two-way communications. For example, workers nearest to OH&S risks, and where they exist, workers’ representatives, can be asked about decisions to be taken to control those OH&S risks, so they can give their opinions about them.

The participation of workers is a process of cooperation between managers and non–managers, and where they exist, workers’ representatives, in order to contribute to decision-making processes on OH&S performance measures and proposed changes.

Means of encouraging cooperation and the participation of workers, and where they exist, workers’ representatives, in order to assist them in exercising their functions in the OH&S management system and avoiding barriers, can include:

a) the provision of information and communication regarding the scope and objectives of the OH&S management system;

b) the provision of operational information and training on identified hazards, hazard elimination and control strategies, and residual risks assessments;

c) creating awareness of hazards and OH&S risks;

d) improving competency;

e) access to other workers for the purpose of communicating about health and safety issues;

f) the provision of adequate time and resources to accomplish the items from bullets a) to c);

NOTE 2   The ILO’s ILS recommend that time for the items in bullets a) to e) should be permitted during working hours.

g) the provision of mechanisms to foster, promote and enable effective cooperation between managers and non-managers, e.g. workers’ safety delegates, workers’ health and safety committees, or joint health and safety committees, as well as provision for the selection of representatives (through worker or union organizations) in accordance with applicable legal requirements and other requirements;

h) providing protection from dismissal or reprisals, including disciplinary or other adverse measures, for reporting, or removing themselves from situations of serious danger or imminent harm;

i) creating and maintaining a culture in the organization that supports the OH&S management system.

Removing barriers to participation, or reducing them to a minimum when removal is not possible, is essential if the OH&S management system is to be effective.

Feedback in the OH&S management system is dependent upon worker participation. The organization should ensure workers at all levels are encouraged to report hazardous situations, so that preventive measures can be put in place and corrective action taken.

NOTE 3 The ILO’s ILS recommend that workers should be empowered to report their concerns about hazardous situations to responsible external authorities.

A.6 Planning  

A.6.1 Actions to address risks and opportunities 

A.6.1.1 General  

The purpose of planning in the OH&S management system is to prevent undesired effects (such as lack of application of legal requirements, damage to reputation, work-related injury and ill health), by anticipating hazardous events and their likelihood and consequences, and applying appropriate risk controls, in order to achieve the intended outcomes. It also identifies opportunities that can offer a potential advantage or beneficial outcome, such as improved OH&S performance.

Planning is not a single event but an on-going process, anticipating changing circumstances and continually identifying risks and opportunities, both for the workers as individuals and for the organization. When planning the organization’s OH&S management system, the context (see 4.1) in which it will operate, the views of its workers and other interested parties (see 4.2) and its scope (see 4.3) should be considered. An initial review or gap analysis may be conducted when planning for the OH&S management system; the output from such a review can be used in the planning process.

This International Standard requires the organization to identify hazards and assess its OH&S risks (see 6.1.2.3) and identify its OH&S opportunities (see 6.1.2.4), determine its applicable legal requirements and other requirements (see 6.1.3), and to assess other risks (see 6.1.2.3) and identify other opportunities (see 6.1.2.4) to the OH&S management system. This information is then used to determine how the risks and opportunities should be managed (see 6.1.4). Planning also includes determining how to incorporate the actions deemed necessary or beneficial into the OH&S management system through objective setting (see 6.2), operational control (see 8.1) or other parts of the OH&S management system, for example, resource provisions (see 7.1) and competence (see 7.2). The mechanism for evaluating the effectiveness of the preventive and protective measures should also be planned and should include monitoring and measurement techniques (see 9.1), internal audit (see 9.2) and management review (see 9.3).

Changes can present both risks to workers, and opportunities to improve the performance of the OH&S management system, and need to be carefully planned before being implemented (see 8.2).

Documented information (such as for the identification of workplace hazards, the assessment of OH&S risks and identification of OH&S opportunities) assists in demonstrating and maintaining the planning process. The processes established and the outcome of the implementation of these processes (see 6.1.2.2, 6.1.2.3 and 6.1.2.4) should be maintained as documented information by the organization, to facilitate internal and external communication of these processes and their outcomes. Documented information as described above can be used when planning and conducting internal and external audits.

A.6.1.2 Hazard identification and assessment of OH&S risks 

A.6.1.2.1 Hazard identification  

The process for hazard identification should begin at the conceptual design stage of any new workplace, facility, product or organization. It should continue as design is detailed and then comes into operation, and then be on-going during its full lifecycle to reflect current, changing and future activities. This can include inputs from the review and analysis of data; reports of past incidents, work-related injuries or ill health; and complaints, from both inside and outside the organization.

The hazard identification process helps the organization recognize and understand the hazards in the workplace and to workers, in order to assess, prioritize, and eliminate or reduce, the OH&S risks as low as reasonably practicable.

Hazard identification should proactively identify any source or situation (or combination of these), arising from an organization’s activities, with a potential for work-related injury and ill health.

Sources and situations can include, but are not limited to:

— sources: hazardous substances, radiation, temperature, pressure, dust, noise and vibration;

— situations: working at heights, working in confined spaces, working alone, worker fatigue, aggressive behaviour or harassment, workload and task control.

Hazards can be categorised in many ways including: physical, chemical, biological, psychosocial, physiological; or mechanical and electrical; or based on movement and energy.

In carrying out its identification of hazards the organization should consider all of the categories detailed in the requirements; however, the lists provided in 6.1.2.1 are not exhaustive and it is always the responsibility of the organization to have an on-going process which identifies all hazards.

The organization’s hazard identification process should consider:

a) Routine and non-routine activities and situations:

1) Routine activities and situations create hazards through day-to-day operations and normal work processes. Non-routine activities and situations are occasional or unplanned, short-term or long-term, and can create hazards through incidents; these include reasonably foreseeable situations such as: extended work hours, or exceptional shift work, an incident involving a small oil leak, repair, disruption to utility services (e.g. water, gas, electricity or sewage), or temporary relocation of facilities.

2) Physical conditions can cause hazards at the work location and include, for example, lighting, ambient temperature, humidity and surrounding noise, proximity to other workers, or the condition of work surfaces.

3) Human factors refers to such things as capabilities and limitations, skill levels and competence needs, differing levels of literacy or language fluency, familiarity with the site or activity and other considerations such as ergonomics or individual actual or potential behaviours. An organization should look at the underlying causes when considering human factors that contribute to risks and hazards, such as contradictory instructions or lack of information, management condoning unsafe behaviour, age-related behaviour, fear of reporting incidents or concerns. Human capabilities such as physical stature, pregnancy or physical or mental impairment should also be considered.

b) Emergency situations:

These are unplanned or unscheduled situations that require an immediate response, for example a machine catching fire in the workplace, or a natural disaster in the vicinity of the workplace or at another location where workers are performing work-related activities. It also includes situations such as civil unrest at a location at which workers are performing work-related activities, which requires their urgent evacuation.

c) People:

The reference to people is intended to direct the organization to consider all those who can be directly affected by the organization’s activities:

1) within the workplace;

2) in the vicinity of the workplace; e.g. passers-by, contractors, or immediate neighbours, who could be affected by the activities of the organization;

3) workers at a location not under the direct control of the organization, e.g. mobile workers (for example a postman or a bus driver); those workers who travel to perform work-related activities at another location (for example service engineers travelling to and working at a customer’s site); home-based workers, or those who work alone.

d) Other issues:

1) Hazards can be created through poor design, for example a machine which cannot be cleaned or maintained without working at an unsafe height, or requiring work in an unsafe position or in a confined space.

2) Situations can occur in the vicinity of the workplace that present hazards, such as within multi-organization worksites, where the activities of any one of the organizations could cause work-relatedinjury and ill health to persons doing work for another organization on the worksite.

3) Situations not controlled by the organization and occurring in the vicinity of the workplace can cause injury and ill health to persons in the workplace, for example a fire or explosion in an adjacent property or a nearby public protest which escalates into civil disobedience.

e) Changes in an organization:

Hazards can arise from changes in an organization. These include a reduction in the number of workers, an increase of unskilled trainees, inadequate succession planning, unfamiliar or ageing equipment, temporary loss of facilities due to routine maintenance or emergency repair. The organization should also consider hazards created by the introduction of new materials, technologies or processes.

f) Changes in knowledge of, and information about, hazards:

Sources of knowledge and information about hazards can include published literature, research and development, feedback from workers, and review of the organization’s own operational experience. These sources can provide new information about the hazards and risks, including changes in: potential exposures; chemical, biological and physical properties; associated toxicity and epidemiological information.

g) Previous incidents:

Previous incidents and their causes, both within the organization and in other organizations, locations or situations, should be considered when identifying hazards.

h) How work is organized or social factors:

How work is organized and social factors can include, for example, excessive work hours, poor leadership and culture in the organization, poor communication, excessive production pressure, bullying, harassment or substance misuse.

This International Standard does not address product safety (that is, safety to end-users of products manufactured by the organization), however hazards to workers occurring during manufacture, construction, assembly or testing of products should be considered.

A.6.1.2.2 Assessment of OH&S risks and other risks to the OH&S management system  

An organization can use different methods to assess OH&S risks as part of its overall strategy for addressing different hazards or activities. Each method should be appropriate to the OH&S risks being considered. The complexity of assessment does not depend on the size of the organization but on the hazards associated with the activities of the organization.

The assessment(s) provides an understanding of the OH&S risks and their current controls, and enables the organization to identify appropriate control actions.

The purpose of the organization's OH&S management system should be to achieve safe and healthy working conditions with a residual OH&S risk which is as low as reasonably practicable (”residual OH&S risk” is the OH&S risk remaining after appropriate preventive and protective measures have been taken.)

The organization should also give consideration to those risks which are not directly related to the health and safety of people and address factors affecting the OH&S management system, its performance and intended outcomes. These risks should be assessed using an appropriate method.

Potential sources of risk to the OH&S management system can include:

a) inappropriate context analysis; outdated analysis;

b) inadequate consideration of OH&S management system requirements, change management and other health and safety issues in strategic planning and other business processes;

c) the absence of resources for the OH&S management system, whether financial, human or other;

d) an ineffective audit programme;

e) poor succession planning for key OH&S management system roles;

f) poor top management engagement in the OH&S management system activities;

g) failure to address the needs and expectations of relevant interested parties;

h) poor OH&S performance leading to reputational risks.

A.6.1.2.3 Identification of OH&S opportunities and other opportunities  

OH&S opportunities to improve occupational health and safety include:

a) eliminating hazards and reducing risks by integrating occupational health and safety at the earliest stage of the lifecycle of facilities, equipment or processes or moving up the hierarchy of controls;

b) improving OH&S performance during planned changes, such as facilities relocation, process re-design or replacement of machinery and plant;

c) improve OH&S performance by alleviating monotonous work or work at a pre-determined work rate;

d) using new technologies to improve OH&S performance;

e) improving the occupational health and safety culture by extending competence related to occupational health and safety beyond requirements or encouraging workers to report incidents in a timely manner.

Opportunities to improve the OH&S management system can include:

— improving the visibility of top management’s support for the OH&S management system;

— enhancing incident investigation processes;

— improving the processes for worker participation;

— benchmarking, including consideration of both the organization’s own past performance and that of other organizations;

— collaborating in forums which focus on topics dealing with health and safety.

A.6.1.3 Determination of applicable legal requirements and other requirements  

The applicability of legal requirements and other requirements can be based on the hazards and OH&S risks related to an organization’s activities. These can include:

a) legal requirements, such as:

1) legislation (national, regional or international), including statutes, regulations and codes of practice;

2) decrees and directives;

3) orders issued by regulators;

4) permits, licences or other forms of authorization;

5) judgements of courts or administrative tribunals;

6) treaties, conventions, protocols, collective bargaining agreements.

b) other requirements, such as:

1) the organization’s requirements;

2) contractual conditions;

3) agreements with employees;

4) agreements with interested parties;

5) agreements with health authorities;

6) non-regulatory standards, consensus standards and guidelines;

7) voluntary principles, codes of practice, technical specifications, charters;

8) public commitments of the organization or its parent organization.

A.6.1.4 Planning to take action  

The actions planned to address the risks and opportunities identified may be managed through the OH&S management system or through other business processes, such as those for business continuity, risks, financial or human resource management, or a combination of these. Equally, the effectiveness of the actions taken may be measured through the OH&S management system or through other processes.

When the assessment of risks has identified the need for controls, the planning activity determines how these are implemented in operation (see Clause 8); for example, determining whether to incorporate these controls into work instructions or into actions to improve competence. Other controls can take the form of measuring or monitoring (see Clause 9).

Actions to address opportunities should be considered under the management of change (see 8.2), to ensure there are no resulting unintended consequences.

A.6.2 OH&S objectives and planning to achieve them 

A.6.2.1 OH&S objectives  

Objectives are established to maintain and improve OH&S performance. This includes reducing risks, improving health, or improving the OH&S management system's processes. Objectives may also be set to improve the well-being of workers, if this is in the scope of the organization’s OH&S management system.

The objectives should be linked to the OH&S risks, opportunities and performance criteria which the organization has identified as having the highest priority for the achievement of the intended outcomes of the OH&S management system. Once a level of performance has been achieved and no further improvement is practicable, an objective may be set to maintain that level of performance pending new opportunities.

OH&S objectives can be integrated with other business objectives and should be set at relevant functions and levels. Objectives can be strategic, tactical and operational, and should be set to achieve the intended outcomes of the OH&S management system:

a) strategic objectives can be set to improve the overall performance of the OH&S management system, for example reduce noise exposure;

b) tactical objectives can be set at project or process level, for example reduce noise at source;

c) operational objectives can be set at the activity level, for example enclosure of individual machines to reduce noise.

The measurement of OH&S objectives can be qualitative or quantitative. Qualitative measures are approximations such as those obtained from surveys, interviews and observations. The organization is not required to establish OH&S objectives for each of the risks it determines or identifies.

A.6.2.2 Planning to achieve OH&S objectives  

The organization can plan to achieve objectives individually or collectively.

The organization might need to develop more formal project plans for complex objectives with multiple tasks. In considering the means necessary for such planning, the organization should examine the resources required (financial, human, equipment, infrastructure) for the tasks to be performed. The organization should assign responsibility and completion dates for individual tasks to ensure that the objective can be accomplished within the overall timeframe.

When practicable, each objective should be associated with an indicator which can be strategic, tactical and operational (see also A6.2.1 and A.9.1.2).

A.7 Support 

A.7.1 Resources  

Resources include human resources, natural resources, infrastructure, technology, and financial resources.

Human resources include demography, diversity, skills and knowledge.

In considering the need for resources the organization should determine the need for preventive andprotective measures (see 8.1.2) and the competence needed as part of a job requirement.

Infrastructure includes the organization’s buildings, plant, equipment, utilities, information technology and communications systems, emergency containment systems, etc.

A.7.2 Competence  

The competence of workers should include the knowledge and skills needed to appropriately address the hazards and OH&S risks associated with their work and workplace.

In determining the criteria of the competence for each role an organization should take into account such things as:

a) the education, training, qualification and experience necessary to undertake the role and re-training necessary to maintain competence;

b) the work environment in which they will be working;

c) the hazards identified and associated OH&S risks;

d) the preventive and control measures resulting from the risk assessment process;

e) requirements applicable to the OH&S management system;

f) the rights and responsibilities of persons based upon legal requirements and other requirements;

g) the importance of compliance with the OH&S policy;

h) the potential consequences of compliance and noncompliance, including the impact on occupational health and safety;

i) the value of their participation in the OH&S management system;

j) the duties and responsibilities associated with the roles;

k) individual capabilities, including experience, language skills, literacy and diversity;

l) the relevant updating of the competencies made necessary by context or work changes.

Workers, and where they exist, workers’ representatives, can assist in both identifying competencies and developing processes to achieve them.

NOTE  The ILO’s ILS recommend that an organisation should provide training in matters related to occupational health and safety to workers at no cost to themselves.

Workers should be evaluated periodically to ensure that they meet the necessary competence criteria for their roles and, where appropriate, gaps in their competence should be filled by providing additional education, training and experience. An evaluation of their competence should also be carried out whenever there are planned changes that can impact upon the activities undertaken in their roles.

Top management, other managers, and workers should have common understanding on what situations constitute conditions to be considered to pose imminent and serious dangers with clear examples. Workers should have sufficient competency and authority to remove themselves from situations of imminent and serious danger.

As appropriate, workers’ representatives should receive the training required to enable them to carry out their representative functions effectively.

Contracting and re-assignment could be used, for example when workers need to have very specific competencies, such as for asbestos removal, radio-protection, etc.

A.7.3 Awareness  

To ensure they work or act in safe and healthy conditions, the organization should make workers sufficiently knowledgeable of:

a) actions to take in emergency situations;

b) the consequences of individual actions and behaviour in relation to OH&S risks;

c) the benefits of improved OH&S performance;

d) the need to conform to OH&S policies and established working practices and the potential consequences of departing from requirements of the OH&S management system.

Awareness programmes should be provided for contractors, temporary workers and visitors, etc., according to the OH&S risks to which they are exposed.

A.7.4 Information and communication  

The communication processes established by the organization should provide for the flow of information upwards, downwards and across the organization. It should provide for both the gathering and the dissemination of information. It should ensure that pertinent information is provided, received and understood by all relevant workers and interested parties.

When determining the need for communication with external interested parties, the organization should consider both its normal operations and potential emergency situations; often external communication processes include the identification of designated contact individuals and contact numbers. This allows for appropriate information to be communicated in a consistent manner and can be especially important in emergency situations where regular updates are requested and a wide range of questions need to be answered.

A.7.5 Documented information  

It is important to keep the level of complexity of the documented information at the minimum level possible to ensure effectiveness, efficiency and simplicity at the same time.

This should include documented information on applicable legal requirements and other requirements and on the results of evaluations of compliance.

The actions described in 7.5.3 are particularly aimed at preventing the risk of unintended use of obsolete documented information.

The control of documented information should not have the effect of, nor be for the purpose of, preventing workers from obtaining a full and complete picture of the hazards and risks of their work.

The confidentiality of personal information of individuals should be respected.

A.8 Operation 

A.8.1 Operational planning and controls  

A.8.1.1 General  

Operational planning and controls should be established and implemented as necessary to enhance occupational health and safety, eliminate hazards or, if impossible, to reduce the OH&S risks to levels as low as reasonably practicable for operational areas and activities.

When planning and developing operational controls, priority should be given to control options with higher reliability in preventing work-related injury and ill health. Operational controls can use a variety of different methods, for example:

a) the introduction of procedures and systems of work;

b) ensuring the competency of workers;

c) establishing preventive / predictive maintenance and inspection programmes;

d) specifications for the procurement of goods and services;

e) compliance with preventive regulations and manufacturer's instructions for equipment;

f) engineering controls (physical devices such as barriers) followed by administrative controls (warnings,safety signs, alarms and signals, or access control procedures and other work instructions).

g) adapt work to workers.

Work can be adapted to workers by, e.g.:

— defining, or redefining, how it is organized;

— the induction of new recruits;

— defining, or redefining, processes and working environments to workers;

— designing a new workplace and new equipment by using ergonomic approaches, etc.

The OH&S management system’s processes and activities should be established to ensure that operational controls are implemented effectively (see 9.1.1), and actions taken to mitigate issues or determined nonconformities (see 10.1).

A.8.1.2 Hierarchy of controls  

The hierarchy of controls is intended to provide a systematic approach to enhance occupational health and safety, eliminate hazards, and reduce or control OH&S risks. Each step is considered less effective than the one before it. It is usual to combine several steps in order to succeed in reducing the OH&S risks to a level that is as low as reasonably practicable.

The following examples are given to illustrate measures that can be implemented at each level:

a) hazard elimination: avoiding risks, adapting work to workers, e.g. : integrate health, safety and ergonomics when planning new workplaces; create physical separation of traffic between pedestrians and vehicles;

b) substitution: replacing the dangerous by the non-dangerous, or the less dangerous; combating the risks at source; adapting to technical progress, e.g. : replacing solvent based paint by water based paint;

c) engineering controls: implement collective protective measures, e.g. : isolation; machine guarding; ventilation systems; mechanical handling; noise reduction; protecting against falls from height by using guard rails;

d) administrative controls: giving appropriate instructions to workers, e.g.: lock out processes; periodical safety equipment inspections; health and safety coordination with subcontractors’ activities; induction; forklift driving licenses; rotation of workers;

e) personal protective equipment (PPE) : provide adequate PPE, and instructions for PPE utilization and maintenance, e.g. : safety shoes; safety glasses; hearing protection; chemical and liquid resistant gloves; electrical protection gloves; cutting resistant gloves.

A.8.2 Management of change  

The objective of a management of change process is to enhance occupational health and safety at work, by minimizing the introduction of new hazards and OH&S risks into the work environment as changes occur, such as in technology, equipment, facilities, work practices and procedures, design specifications, raw materials, staffing changes, and standards or regulations. Depending on the nature of an expected change, the organization should use an appropriate methodology(ies) for assessing the OH&S risks and the OH&S opportunities of the change. The need to manage change can be an outcome of the planning process (see 6.1.4).

The organization should plan how to implement a change in a manner that does not introduce new (unforeseen) hazards (see 6.1.4) or increase the OH&S risks. Additionally, the organization should use this process to find OH&S opportunities, such as less hazardous and/or toxic alternatives in order to continue to reduce the OH&S risks to workers and/or others who are responsible for handling or working with the products, materials, etc.

The organization should specify and assign adequate resources for the implementation of a change.

As part of the change management process, the organization should review potential changes to hazards andOH&S risks (see 6.1). The implementation of a decision to change should ensure that all affected workers are properly informed and are competent to cope with the change.

A.8.3 Outsourcing  

An outsourced process is one that fulfils all of the following:

a) it is within the scope of the OH&S management system;

b) it is integral to the organization’s functioning;

c) it is needed for the OH&S management system to achieve its intended outcome;

d) liability for conforming to requirements is retained by the organization;

e) the organization and the external provider have a relationship where the process is perceived by interested parties as being carried out by the organization.

A.8.4 Procurement  

Prior to procuring goods and services, the organization should identify appropriate procurement controls. The procurement controls should be used to identify and evaluate potential OH&S risks associated with e. g. products, hazardous materials or substances, raw materials, equipment, or services before their introduction into the workplace. Considerations could include requirements for supplies, equipment, raw materials, and other goods and related services purchased by the organization to conform to the organization’s OH&S objectives and its need for information, participation and communication (see 7.4).

The organization should verify that equipment, installations and materials are adequate before being released for use by its workers, e. g. that:

a) equipment is delivered according to specification and is tested to ensure it works as intended;

b) installations are commissioned to ensure they function as designed;

c) materials are delivered according to their specifications;

d) any usage requirements, precautions or other protective measures are communicated and made available.

A.8.5 Contractors  

The organization may delegate authority to those best capable of identifying, evaluating, and controlling OH&S risks, including to contractors. This recognizes that some contractors possess specialized knowledge, skills, methods, and means. However, this delegation does not eliminate the organization’s responsibility for the health and safety of its workers.

Contractors can be specialists in maintenance, construction, operations, security, landscaping, facility upkeep, janitorial, sanitation or clean-up of production processes, and a number of other functions. Contractors can also include consultants or specialists in administrative, accounting, and other functions.

An organization can achieve coordination of its contractors' activities through the use of contracts that clearly define the responsibilities of the parties involved. An organization can use a variety of tools for managing contractors' health and safety performance, including contract award mechanisms or pre-qualification criteria which consider past health and safety performance, safety training, or health and safety capabilities, as well as direct contract requirements.

The relationships between an organization and its contractors can be both diverse and complex, and involve very different types and levels of OH&S risks. How an organization manages these relationships can vary, depending on the nature of the services provided and the risks identified. The degree of coordination should depend on factors such as the terms of the contract, the nature of the hazards and risks, the type and size of the operations, and the duration of the work on the site. When defining how it will coordinate, the organization should give consideration to the reporting of hazards between itself and its contractors, controlling worker access to hazardous areas, and procedures to follow in emergencies.

If a contractor does not have an OH&S management system, then the organization should specify how the contractor will coordinate its activities with the organization's own OH&S management system processes (such as those used for confined space entry, lockout/tagout, exposure assessment, and process safety management), and for the reporting of work-related injuries and ill health.

The organization should verify that contractors are capable of performing their tasks before being allowed to proceed with their work, e.g. by verifying that:

a)       OH&S performance records are satisfactory;

b)       qualification, experience and competence criteria for workers are specified;

c)       training and other worker requirements were undertaken;

d)       resources, equipment and work preparations are adequate and ready for the work to proceed.

A.8.6 Emergency preparedness and response  

The organization should identify foreseeable emergencies applicable to its operations and plan its response; such emergencies can occur both during and beyond normal working hours, and can arise due to both natural and man-made causes. Identified emergencies should be assessed based on their OH&S risks. The organization should focus on proactive control measures (e.g. the reduction of ignition sources) not only on reactive risk controls, such as fire-fighting equipment and evacuation.

A.9 Performance evaluation

A.9.1 Monitoring, measurement, analysis and evaluation  

A.9.1.1 General  

Monitoring, measurement, analysis and evaluation should be appropriate to the size and nature of the organization and to its OH&S performance.

Monitoring and measuring results are used by an organization during its evaluations of OH&S performance.

a) Examples of what could be monitored and measured to meet the requirements of this International Standard can include, but are not limited to:

1) progress on meeting policy commitments, achieving objectives, and continual improvement;

2) occupational health complaints, health surveillance of workers and work environment monitoring;

3) work related incidents, injuries and ill health, and complaints, including trends;

4) the effectiveness of operational controls and emergency exercises, or to evaluate the need to modify or introduce new controls (see 8.1);

5) proactive and reactive actions affecting the organization’s OH&S performance;

6) performance of the OH&S management system;

7) competence (7.2);

b) Examples of what could be monitored and measured to evaluate the fulfilment of legal requirements can include, but are not limited to:

1) identified legal requirements ( have all applicable legal requirements been determined, and are the organization’s records of them kept up-to-date);

2) the status of identified gaps in compliance;

c) Examples of what could be monitored and measured to evaluate the fulfilment of other requirements can include, but are not limited to:

1) union-employer agreements;

2) standards and codes;

3) corporate and other policies, rules and regulations;

4) insurance requirements;

d) Criteria are what the organization should compare its performance against:

1)  Examples are benchmarks against:

i) other organizations;

ii)  standards and codes;

iii) the organization’s own codes and objectives;

2) The organization should use the criteria to set its internal objectives for monitoring and measurement;

3) To measure criteria, indicators are typically used, for example:

i) If the criterion is a comparison of incidents, the organization may choose to look at frequency, type, severity, or number of incidents; then the indicator could be the determined rate within each one of these criteria;

ii) If the criterion is a comparison of completions of corrective actions, then the indicator could be the percentage completed on time.

Methods include:

— Monitoring can involve continual checking, supervising, critically observing or determining the status in order to identify change from the performance level required or expected. Monitoring can be applied to the OH&S management system, to processes or to controls. Examples include the use of interviews, reviews of documented information and observations of work being performed;

— Measurement generally involves the assignment of numbers to objects or events. It is the basis for quantitative data and is generally associated with the evaluation of safety programmes and health surveillance. Examples include the use of calibrated or verified equipment to measure exposure to a hazardous substance or the counting of the required safe distance from a hazard;

— Analysis is the process of examining data to reveal relationships, patterns and trends. This can mean the use of statistical operations, including information from other similar organizations, to help draw conclusions from the data. This process is most often associated with measurement activities;

— Evaluation is an activity undertaken to determine the suitability, adequacy and effectiveness of the subject matter to achieve the established objectives of the OH&S management system. This activity is most often associated with monitoring activities.

Occupational health complaints, health surveillance of workers and work environment monitoring are important elements. Where this is appropriate, suitable medical monitoring or follow-up of workers can be required. This can assist in the early detection of signs and symptoms of harm to health and to assess the effectiveness of prevention and control measures.

The frequency of monitoring and measurement should be appropriate to the size and nature of the organization and its OH&S performance, and to changes in OH&S risk.

The organization should ensure that frequencies of monitoring and measurement are in alignment with analysis and evaluation of its OH&S risks, risks, OH&S opportunities, and opportunities.

A.9.1.2 Evaluation of compliance with legal requirements and other requirements  

The organization should prioritize its actions based on the identified compliance gaps.

A.9.2 Internal audit

A.9.2.1 Internal audit objectives  

An organization’s own requirements for its OH&S management system audits may be additional to those required by this International standard.

Internal audit objectives can be based on:

a) an organization’s own policies, requirements and top management’s OH&S priorities;

b) standards;

c) results of both OH&S risk and risk assessments ;

d) results of previous audits, including contractor audits;

e) incidents, corrective actions and nonconformities;

f) worker participation;

g) needs and expectations of interested parties;

h) level of maturity of the management system;

i) performance evaluation results.

A.9.2.2 Internal audit process  

When planning its internal audits the organization should take into consideration the importance of the processes concerned to the OH&S management system. This can include items such as the impact the processes have on risk assessment outcomes.

The extent of the audit programme should be based on the size and nature of the organization, as well as the complexity and level of maturity of the OH&S management system.

Small and medium enterprises (SMEs) can establish objectivity and impartiality of the internal auditor by creating processes that separate their role as an internal auditor from their normal assigned duties. SMEs can also use external organizations in this role.

A.9.3 Management review  

Clarifying the terms used in relation to management review:

a) Suitability: The extent to which the management system fits and is right for the organization‘s purpose, operations, culture and business systems;

b) Adequacy: The extent to which the management system is sufficient in meeting the applicable requirements;

c) Effectiveness: The extent to which planned activities are realised and planned results achieved.

The management review topics listed in 9.3 a) to g) need not be addressed all at once; the organization should determine when and how the management review topics are addressed.

Management reviews are a critical part of the continual improvement of the management system. The purpose of these reviews is for top management to undertake a strategic and critical evaluation of the performance of the management system, and to recommend improvements.

This review should not be just a presentation of information, but should focus on assessing OH&S performance and identifying opportunities for continual improvement. It is up to the organization to determine appropriate measures for the effectiveness of the OH&S management system.

Management reviews should include an evaluation of how well the OH&S management system is integrated with other business processes and the strategic direction of the organization. Management reviews can include information about, for example, suppliers and contractors, internal changes in the organization, and security concerns.

Reviews can present information in a manner (for example a scorecard) that focuses on the management system elements most in need of the attention of top management. Reviews may be scheduled to coincide with other management reviews, or to meet other business or management system needs.

The adequacy of resources in item 9.3 g) includes the training and competency of workers.

A.10 Improvement

A.10.1 Incident, nonconformity and corrective action  

Separate processes may exist for incident investigations and nonconformities depending on the organization's requirements.

Examples of incidents, nonconformities and corrective actions include but are not limited to:

a) incidents: work related near-miss events, injuries and ill health, exposures to health hazards, occupational diseases, property and equipment damage where it can lead to OH&S risks, and vehicle accidents;

b) nonconformities: protective equipment not functioning properly, failure to apply legal requirements, or prescribed procedures not being followed;

c) corrective actions: (as indicated by the hierarchy of controls; see 8.1.2) elimination of hazards, substitution to safe materials, design or modification to equipment or tools, development of procedures, improving the competence of affected workers, changes in frequency of use, or use of personal protective equipment.

Root cause analysis refers to the practice of exploring all the possible factors associated with an incident by asking what happened and why it happened, to provide the input for what can be done to prevent it from happening again.

When determining the root cause of an incident or nonconformity, the organization should use methods appropriate to the nature of the incident or nonconformity being analysed. This analysis can identify multiple system failures including factors related to communication, competence, fatigue, equipment or procedures.

Root cause analysis should be focused on prevention and not on blame or punishment.

Actions, including corrective actions, (see 10.1d)) should be based on the nature of the incident or nonconformity and should be implemented in a timely manner.

Reviewing the effectiveness of corrective actions (see 10.1e)) refers to the extent the implemented corrective actions adequately control the root cause(s).

A.10.2 Continual improvement  

Continual improvement is a step by step approach to improve the OH&S management system over time. The objectives in 10.2.1 are intended as the minimum an organization needs to consider.

The following is a list of clauses and subclauses in this International Standard which can provide inputs into continual improvement:

a) Clause 4 ‘Context of the organization’;

b) 5.4 ‘Participation, consultation and representation’;

c) 6.1 ‘Actions to address risks and opportunities’;

d) 6.2 ‘OH&S Objectives and plans to achieve them’ ;

e) 7.4 ‘Information and communication’;

f) 9.1 ‘Monitoring, measurement, analysis and evaluation’;

g) 9.2 ‘Internal audit’;

h) 9.3 ‘Management review’;

i) 10.1 Incident, nonconformity and corrective action.

Additional examples of issues to identify opportunities include, but are not limited to:

— new technology;

— good practices, both internal and external to the organization’s;

— suggestions and recommendations from interested parties;

— new knowledge and understanding of health and safety related issues;

— new or improved materials;

— changes in worker capabilities or competence;

— achieving improved performance with fewer resources (i.e. simplification, streamlining etc.).

Bibliography  

[1]   ISO 9001, Quality management systems — Requirements

[2]   ISO 14001, Environmental management systems — Requirements with guidance for use

[3]   ISO 19011, Guidelines for auditing management systems

[4]   ISO 31000, Risk management — Principles and guidelines

[5]   ISO 37500, Guidance on outsourcing

[6]   ISO 39001, Road traffic safety (RTS) management systems – Requirements with guidance for use

[7]   ISO Guide 73, Risk management — Vocabulary

[8]   ILO Guidelines on Occupational Safety and Health Management Systems (ILO-OSH 2001); International Labour Office, Geneva, http://www.ilo.org/safework/info/standards-and-instruments/lang--en/index.htm

[9]   ILO International Labour Standards (including those on occupational safety and health) http://www.ilo.org/normlex (click on "instruments", then "Conventions and Recommendations by subject")

[10]         OHSAS 18001 Occupational health ans safety management systems – Requirements; OHSAS Project Group; July 2007, 2nd ed., 34p.; London; ISBN 978 0 580 50802 8

[11] OHSAS 18002 Occupational health and safety management systems – Guidelines for the implementation of OHSAS 18001:2007; OHSAS Project Group; Nov 2008, 2nd ed., 88p.; London; ISBN 978 0 580 61674 7

Alphabetical index of terms  

audit 3.32

competence 3.23

conformity 3.33

consultation 3.5

continual improvement 3.37

contractor 3.7

corrective action 3.36

documented information 2.24

effectiveness 3.13

hazard 3.19

incident 3.35

injury and ill health 3.18

interested party 3.2

legal requirements and other requirements 3.9

management system 3.10

measurement 3.31

monitoring 3.30

nonconformity 3.34

objective 3.16

occupational health and safety management system 3.11
OH&S management system

occupational health and safety objective 3.17
OH&S objective

occupational health and safety opportunity 3.22
OH&S opportunity

occupational health and safety performance 3.38
OH&S performance

occupational health and safety policy 3.15
OH&S policy

occupational health and safety risk 3.21
OH&S risk

organization 3.1

outsource (verb) 3.29

participation 3.4

performance 3.27

policy 3.14

procedure 3.26

process 3.25

requirement 3.8

risk 3.20

top management 3.12

worker 3.3

workplace 3.6

 <<<< Back