Clause 8 forms the heart of the ISO 45001 standard and addresses the program content necessary to have a successful OH&S management system that meets the intent of the standard. The specific topics discussed in this section include:

  1. General provisions: such as the means for creating and managing documentation.
  2. Hierarchy of controls: to utilize the most effective means of risk reduction within the organization.
  3. Management of change: to ensure that when planned changes occur they are managed to control risk.
  4. Outsourcing: to make certain risk controls are adequate for all outsourced processes.
  5. Procurement: to validate all incoming materials and services conform to the system requirements.
  6. Contractors: to communicate and control internal risks to third parties and evaluate risks they may introduce into the workplace.
  7. Emergency preparedness and response: to identify potential emerging risks and develop specific and customized plans with key stakeholders to minimize these risks

This clause requires:

  • Operational planning and control on multi-employer workplaces; whereby the organization shall implement a process for coordinating the relevant parts of the OH&S management system with other organizations. This clause includes the requirement to reduce risks by implementing a “Hierarchy of Control” approach as used by the European Union Legislation. In that regard, this is a system of prioritization which ranks hazard elimination as the preferred control down through a series of controls which are less effective.
  • Eliminating hazards and reducing OH&S risks requires the organization to establish, implement and maintain a process(es) for the elimination of hazards and reduction of OH&S risks. In order to ensure that this is done properly, the organization shall use appropriate controls.
  • Management of Change requires the organization to establish a process for the implementation and control of planned changes so that the introduction of new products, processes, services or work practices do not bring with them any new hazards.
  • Procurement requires the organization to establish, implement and maintain a process for the control of procurement services so as to ensure that they conform to the requirements of the standard. In addition, the standard requires the organization to coordinate the procurement processes with its contractors and to identify the risks that arise from the contractors’ activities. Furthermore, the organization should ensure that outsourced processes which have an impact on its health and safety management system are appropriately controlled.
  • Emergency preparedness and response requires the organization to identify emergency situations and maintain a process to prevent or minimize OH&S risks from potential emergencies.

8.1 Operational control and planning

While the standard acknowledges that operational control will greatly depend on the size, nature, compliance obligations, and occupational health & safety hazards of an organization, the scope are given to the individual organization to plan and ensure the desired results are achieved. The methods suggested by the standard are that processes should be designed in such a way that consistency is guaranteed and error eliminated, technology is used to improve control, and it is ensured that personnel is trained and competent. Processes should be performed in an agreed and prescribed manner; those processes should be measurable, and the documented information should match the requirements to ensure operational control. An essential part of operational control lies in eliminating hazards and reducing OH&S risks. This can be carried out through a hierarchy of controls, from the elimination of the hazard to the use of personal protective equipment. Change in the OH&S Management System also needs to be managed in order to maintain the integrity of the OH&S performance. Procurement, including contractors and outsourcing of functions and processes, must also be considered and controlled. Appropriate measures must be taken to define and control the competency of outsourced service suppliers, including their effect on the OH&S Management System processes. As ever, opportunities for improvement must always be considered and identified. The standard also recognizes that the degree of control the organization has over an outsourced product or service can vary from absolute, if taking place onsite, to very little, if the activity takes place remotely. However, it is suggested that there are factors that, nonetheless, should be considered. As expected, compliance obligations should be considered and controlled, all direct and associated occupational health & safety risks should be evaluated and controlled, as should risks and opportunities associated with the provision of the service itself.

8.1.1. General

During Operation Planning and Control, the organization must

  • Establishing criteria for processes
  • Implementing control defined in criteria
  • Keeping documented information as the absence of documented information could lead to deviations
  • Adapting work to workers including induction of new workers

8.1.2 Eliminating hazards and reducing OH&S risks

The Organization must establish a process and determine controls for achieving the reduction in OH&S risks using the following hierarchy of Controls;

  • Eliminate
  • Substitute
  • Engineering controls
  • Administrative controls
  • Provide and ensure the safe use of PPE

Provision of PPE  should be at no extra cost to workers

8.1.3 Management of Change

The Organization must establish a process for the implementation and control of planned changes. Changes may include:

  • Work processes
  • Legalization
  • Knowledge and information about hazards and related OH&S risk
  • Developments in knowledge and technology

Changes must be controlled to mitigate against adverse impact on OH&S

8.1.4 Procurement Procurement

The organization must establish a process to control the procurement of products and services to ensure conformity with its OH&S Management System Contractors

  • The organization must establish a process to coordinate with contractors for hazard identification and access controls to OH&S risks from contractor activities
  • The requirements of the OH&S management system must be met by contractors and their workers
  • The organization must establish the OH&S criteria for selection of contractors Outsourcing

The organization must ensure outsourced functions and process are controlled. The Outsourced arrangements must be consistent with legal requirements. It should be integral to the organization’s ability to operate. There must be controls to achieve the intended outcome of the OH&S management system

8.2 Emergency preparedness and response

Emergency preparedness and response is a key element in the mitigation of occupational health & safety risk. The standard informs us that it is the responsibility of the organization to be prepared, and a number of elements should be considered and planned for. Actions to mitigate incidents must be developed, as well as internal and external communication methods and appropriate methods for emergency response. Consideration of varying types of occupational health & safety incidents needs to be made, as do root cause analysis and corrective action procedures to respond to incidents after they occur. Regular emergency response testing and relevant training need to be considered and undertaken, and assembly routes and evacuation procedures defined and communicated. Lists of key personnel and emergency agencies (think clean-up agencies, local emergency services, and local occupational health & safety offices or agencies) should be established and made available, and it is often good practice to form partnerships with similar neighboring organizations with whom you can share mutual services and provide help in the event of an occupational health & safety incident. To establish an Emergency  preparedness and response process the organization must

  • Identify potential emergency situations
  • Assess OH&S risks associated with these
  • Establish Preventative controls
  • Plan response to emergency situations including the provision of first aid
  • Conduct periodic testing and exercise of emergency response capabilities
  • Evaluate and revise plans
  • Communicate information relevant to their duties
  • Conduct Training
  • Identity Needs and capabilities of interested parties
  • Maintain and retain documented information