Clause 6 describes the actions necessary to address risk and opportunity. Activity planning must take place within the context of the organization. The planning process must ensure that the OH&S management system is designed to achieve its intended outcomes and continually improve. Worker participation is cited as being a critical component in the planning phase. Additional considerations include operational risk, legal requirements, and other opportunities to improve the OH&S management system. This section outlines the need for hazard identification by the organization for both routine and non-routine activities, emergency situations, people and behavior, work area design, work environment under the control of the organization, and situations not under organizational control. Additional points of assessment include changes to process and operations, past incidents and their causes, and social/economic factors. The major sub-sections in Clause 6 include:
- Hazard Identification
- Assessment of OH&S Risks
- Identification of OH&S Opportunities
- Determination of Legal Requirements
- Planning to Take Action
- The setting of OH&S Objectives
- Planning to Achieve Objectives
The planning phase is a comprehensive part of the ISO 45001 standard, requiring a detailed understanding of operations. By following this section, the organization can create a very deliberate and effective set-up to sustain the OH&S management system and ensure it continually improves. This is one of the most critical clauses since it is related to the establishment of strategic objectives and guiding principles for the Occupational Health and Safety Management System as a whole. The OH&S objectives, which can be integrated with other business functions, are the expression of the intent of the organization to treat the risks identified. When determining the risks and opportunities that need to be addressed, the organization shall take into account:
- OH&S hazards and their associated risks, and opportunities for improvement;
- Applicable legal requirements and other requirements;
- Risks and opportunities related to the operation of the OH&S Management System that can affect the achievement of the intended outcomes.
6.1 Actions to address risks and opportunities
This clause replaced “preventive action” in the previous OHSAS 18001 standard. The current standard states that the organization should establish, implement, and maintain the processes needed to address the requirements of the whole of the planning section itself. When planning the OH&S Management System, considerations need to be made regarding the context of the organization (section 4.1) and the needs and expectations of interested parties (section 4.2), as well as the scope of the OH&S Management System. Risk and opportunity must be considered with respect to these elements, as well as legal and regulatory issues, and the organization’s Occupational Health & Safety hazards themselves. This outcome needs to ensure that the OH&S Management System can meet its intended outcomes and objectives, that any external factors that may affect performance are avoided, and that continual improvement can be achieved.
In terms of emergency situations, the organization is required to determine any situations that may occur and have a resulting occupational health & safety risk. Again, it is vital that documented information is retained concerning the risks and opportunities considered and addressed in the planning phase in order to satisfy the terms of the clause. While planning for actions to address risks and opportunities, the organization must
- take into consideration the Organizational Context (4.1), needs and expectations of Interested parties (4.2) and Organizational Scope (4.3)
- Prevent or reduce undesired effects.
- Achieve its intended outcome.
- make the assessment of risk and opportunities arising out of changes in Organization. (whether planned or unplanned).
- Maintain documented information – risks, opportunities, and processes needed to have confidence in risk management.
6.1.2 Hazard identification and assessment of risks and opportunities
ISO 45001:2018 asks organizations to consider, in a proactive manner, all occupational health & safety hazards within the organization’s control. Changes or planned future changes to services also have to be taken into account, as do any abnormal situations that may arise that are reasonable for the organization to predict–for example, if you are about to launch a new product that needs radically new production processes or materials. Again, the organization needs to maintain documented information on this clause and its elements, and communication to the appropriate levels with effective frequency needs to be planned and undertaken. In terms of documented information, if you ensure that all actual and associated risks, the criteria you use to define them, and your significant occupational health & safety risks are documented, then you will satisfy the terms of this clause. It has following Sub-clauses
220.127.116.11 hazard identification
18.104.22.168 assessment of OH&S risk and other risks to the OH&S management system
22.214.171.124 assessment of OH&S opportunities and other opportunities
126.96.36.199 Hazard identification:
While identifying the hazards in a proactive manner the organization must consider:
- Past incidents, emerging trends
- Routine & non-routine activities and situations
- Emergency Situations
- Human factors
- Other issues – design, situations in the vicinity of the workplace, situations not controlled by organizations
- Changes or proposed changes
- Change in knowledge
- How work is organized, social factors, workload, work hours, leadership and culture
188.8.131.52 Assessment of OH&S risk and other risks to the OH&S management system
The organization must assess OH&S risks from hazards identified. While Assessing the OH&S risks the Organization must take into account the issues from context 4.1 & needs and expectations of interested parties 4.2. It must define the methodology and criteria for Assessing OH&S risks. The Methodologies and criteria must be maintained and retained as documented information
184.108.40.206 assessment of OH&S opportunities and other opportunities
The Organization must identify OH&S Opportunities to enhance OH&S performance. While identifying OH&S opportunities the Organization must take into account:
- Planned changes
- Opportunities to eliminate or reduce risk
- Opportunities to adapt work, work organization and work environment to workers
- Opportunities for improving the OH&S management system
6.1.3 Determination of legal and other requirements
This is a relatively straightforward, but obviously vital part of the ISO 45001:2018 standard. The organization must decide what legal and other requirements are related to its occupational health & safety hazards and how to best access them, decide how they apply to the organization, and take them into consideration when establishing, operating, and delivering continual improvement through the OH&S Management System. Documented evidence needs to be recorded for these obligations, also. The Organization must
- Determine and have access to up to date legal requirements
- Determine how these applications and will be communicated
- Take into account when establishing, implementing
- Maintain and retain documented information
6.1.4 Planning Actions
In this clause, the standard states that the organization shall plan to take actions to address its occupational health & safety hazards, risks, and opportunities, and compliance obligations, all of which we have discussed above. These also need to be implemented into the organization’s OH&S Management System and associated business processes. The task of evaluating the effectiveness of these actions also must be considered, with technological, financial, and operational considerations all taken into account. In this clause the organization is expected to:
- Address risk and opportunities (220.127.116.11 & 18.104.22.168)
- Address applicable legal requirements (6.1.3)
- Emergency preparedness emergency situation (8.2)
- Integrate actions to other business processes – Business Continuity,
- Financial or HR
- Eliminating hazards and reducing OH&S risk (8.1.2)
- Consider the Best practice into the action
6.2 Occupational health & safety objectives and planning to achieve them
6.2.1 Occupational health & safety objectives
The standard advises that occupational health & safety objectives should be established at appropriate levels and intervals, having considered the identified occupational health & safety hazards, risks and opportunities, and compliance obligations. The characteristics of the set objectives are important, too: they need to be consistent with the organization’s Occupational Health & Safety Policy, measurable where possible, able to be monitored, communicated effectively, and be such that they can be updated when circumstances require. Once more, it is mandatory that documented information is kept outlining this process and its outputs.To maintain and improve OH&S management system and OH&S performance, while establishing OH&S objective the Organization must
- Take into account the results of the assessment of OH&S risk and opportunities and other risks and opportunities.
- Take into account outputs of consultation with workers and workers representative.
- Objectives are measurable or capable of evaluation.
- Objectives are clearly communicated
6.2.2 Planning to achieve occupational health & safety objectives
The standard advises on the elements that need to be determined to ensure that objectives can be achieved. This can be thought of in terms of what needs to be done, when it needs to be done by, what resources are required to achieve it, who is responsible for the objectives being achieved, how results are to be measured and progress ensured, and consideration on how these objectives can be implemented within existing business systems. While Planning to achieve OH&S objectives the organization must consider the following:
- What will be done?
- What resources will be required?
- Who will be responsible?
- When completed?
- How measured through indicators if practicable, monitored and frequency?
- How actions will be integrated into overall business processes?
- Maintain and retain documented information?