ISO45001 and the Occupational Health & Safety Management System and Processes

 ISO 45001:2018 Clause 4.4 is an interesting one, it's classed as a 'general clause' as it's pretty all encompassing, it says:

The organisation shall establish, implement, maintain and continually improve an OH&S management system, including the processes needed and their interactions, in accordance with the requirements of this document

ISO 45001 Clause 4.4

That's it, that's the entire clause.

What it is basically saying is that it's your job to determine the processes that are needed to meet the standard. Yes, the standard has a set of mandatory elements but after that, you figure it out. Why would it do this!? Simple, your business is your business, it's not the same as the last one you worked for, and it's not the same as Peter up the street's business. That means your processes and procedures are different, your risks are different, your controls are different, so your system should be different.

It doesn't say anywhere that you actually have a hard copy manual, actually for that matter it doesn't say you even have to write anything down! However, let's face it, you are a bit mad if you don't. What happens when that institutional knowledge leaves for a new job or retires? Of course, you are going to document it you just need to decide how, follow the old tree consumption method and print it all out (then try and keep track of where everything is) or get a more integrated system that's online that helps manage things for you (I know what I prefer). 

What to Include in Your OHSMS

What processes should you cover in your Occupational Health & Safety Management System? Well as we mentioned, the answer is that's almost up to you. You need to decide which parts of your business will fall under your Occupational Health & Safety Management System for ISO45001:2018. You may for instance decide to exclude an area that you completely outsource, you may decide you will only cover the processes involved in your core manufacturing area, it's up to you. However, you should have a really good reason why you are not including some areas or processes into your ISO45001:2018 set up.

Once you have decided what's in and what's not, you need to think how you will demonstrate you understand the processes that are involved in your Occupational Health & Safety Management System. Since ISO45001:2018 is focused on the process approach and is really all about managing and eliminating hazards and risks, the expectation is there that you will do this in a structured way. You need to review the following things for your processes:

1. What inputs & outputs are required for each process?
2. What is the sequence of these processes and how do they interact?
3. Understand how you will ensure that they operate safely, effectively and are in control (hint... you need a PDCA cycle here)
4. Understand what resources you need for each process to ensure their availability - think broadly here so People, Equipment, Power, Space, Raw materials, Documentation, Training, Support groups and so on
5. Assign the responsibilities and authorities for the processes, i.e. who is going to do the process, who has control, can make decisions, what decisions can they make? These may well be defined within your Job Descriptions
6. Understand and address the risks & opportunities for your processes and business, this involves working with the team to understand what the real safety issues are and how you can eliminate or manage them. Moreover, how can you make that process as simple as possible for your team?
7. Evaluate the process and controls you have put in place to ensure that you are getting the outcomes you expect from it, if not implement the fix required (again Plan, Do, Check, Act)
8. Improve the Processes and the Occupational Health & Safety Management System - again that whole pesky continuous improvement thing.

There are many ways to do all the above, you could document everything with pages and pages and pages of words virtually no one will read (other than your auditor) or you could create a flow chart of your business processes with additional notes, risk registers, SOP's, Safe work method statements and so forth, it's up to you to consider the best way of getting the message over to your employees. Here's a key point – you need to actually plan to involve your employees in all of this!

As we talk through the clauses, we'll talk more about how to do these elements at each stage and who should be involved. However, having many people weigh in is exactly what you want for your ISO45001 Occupational Health & Safety Management System.

Needless to say, all the items you talk about end up in your ISO45001 scope, which defines the boundaries of your Occupational Health & Safety System.

As part of the process, you should decide what resources are needed to fulfil items 1-7 above, item 8 you fulfil by setting up an audit / review cycle or a monthly management meeting which discusses the processes and reviews non-conformances, risks, H&S events and so on.

What does ISO mean by Establish and Implement?

 A question we get asked a lot is what does ISO mean when they say establish or implement?

I tend to think that it's easier to just refer back to dictionary here, establish is simply the process of getting your system in place, you have the documentation and the systems available, it's established.

Implemented is a whole other thing. That's taking all the items you have established and actually making them part of the organisational fabric. People are being trained on them and they are being used.

How Much Documentation Do You Need?

The business needs to decide to what extent it believes it's necessary to keep documentation to both support the operation of its processes and to have confidence that the processes are being carried out in line with your newly minted ISO45001:2018 certification. Go on, say it, "But you said we didn't have to document an OHSMS"... That's right, you don't (again you are mad if you don't). What it's talking about here are the process documents that tell you how your organisation safely runs manufacturing or finance. How you decide on things like health monitoring, when a SWMS (Safe Work Method Statement) is required, what training needs to be in place for what role. By having these in place and then auditing against these documents on a regular basis, you have clause 4.4 sorted out.

So, in summary, to meet ISO45001:2018 Clause 4.4 you need to

1. Decide What the Occupational Health & Safety Management System will look like, how will you document it.
2. Understand the processes in your organisation you are going to include.
3. Make sure you have mapped the hazards, risks, opportunities & resources required per process. These are best done in a risk register
4. Document how you will carry out that process safely.
5. Audit against your documents on a regular basis.
6. Raise Improvement notices where there is an opportunity to improve or correct something within the process which would improve the output of that process.