COSHEM cheat sheet

Hierarchy of legal sources in most common-law jurisdictions: statute (Act) → regulations made under the Act → approved codes of practice (admissible as evidence of expected standard) → consensus standards (ISO, EN, ANSI) incorporated by reference.

General duty clause pattern: employer must ensure health and safety 'so far as is reasonably practicable' (UK/AU/NZ) or 'so far as reasonably practicable' - a cost-benefit test weighing likelihood, severity and cost of control, not a zero-risk guarantee.

Strict liability offences: the prosecution proves the prohibited act and the status of the duty holder; due diligence is a defence the defendant must raise on the balance of probabilities (Canada OHS Acts, Australia model WHS Act s.27).

Officer due diligence test (model WHS Act s.27): knowledge of the hazard and risk, understanding of the operation, availability and use of resources, and actual steps taken to eliminate or minimise risk.

Personal liability of directors/officers exists in most regimes; penalties are typically higher for corporations than individuals, and industrial manslaughter provisions now exist in several Australian states and the UK (Corporate Manslaughter Act 2007).

Worker duties are reciprocal: comply with instructions and controls, use PPE as trained, report hazards and incidents; breach can itself be an offence and can reduce compensation.

Tripartite consultation is a statutory requirement: safety committees or elected health and safety representatives with defined powers (inspect, request information, issue provisional improvement notices) - thresholds often 5-20 workers.

Regulator powers typically include entry without warrant, seizure, improvement notices, prohibition notices (stop-work), infringement notices and prosecution; appeal routes and time limits are prescribed in the Act.

Record-keeping and notification duties: notify the regulator of serious incidents (fatality, serious injury, dangerous occurrence) immediately or within a short statutory window (commonly 24-48 hours), and retain records for prescribed periods (often 5-30 years for exposure records).

ISO 45001:2018 uses the Harmonized Structure (Annex SL): 4 Context, 5 Leadership and worker participation, 6 Planning, 7 Support, 8 Operation, 9 Performance evaluation, 10 Improvement - same clause numbering as ISO 9001 and ISO 14001.

PDCA mapping: Plan = clauses 4-7 (context, leadership, planning, support); Do = clause 8; Check = clause 9; Act = clause 10.

Clause 6.1.2 requires a documented process for hazard identification and assessment of OH&S risks and opportunities, considering routine/non-routine activities, emergency situations, human factors and changes.

Documented information (clause 7.5) replaces the old 'documented procedures' concept: must be created, updated, controlled for version, availability, protection and retention; extent is determined by the organisation.

Certification is by third-party audit to ISO 45001 (or ISO/IEC 17021-10 competence requirements for auditors); ISO 45001 replaced OHSAS 18001 and migration ended 30 September 2021.

Management review (clause 9.3) inputs include incident trends, nonconformity and corrective action status, monitoring results, compliance evaluation, audit results, worker consultation and changing external/internal issues.

Integration with ISO 9001 and ISO 14001 is expected: shared context analysis, shared risk methodology, combined audit programmes and one management review covering all three standards.

Key performance indicators should be both lagging (LTIFR, TRIFR, severity rate) and leading (hazard reports per worker, inspection completion, training currency, corrective action closure time).

Contractor and outsourced process control (clause 8.1.4) requires criteria for selection, communication of hazards, coordination of activities and monitoring of performance.

Risk score = likelihood × severity (or consequence); a 5×5 matrix yields scores 1-25 with typical bands: 1-4 low, 5-9 moderate, 10-15 high, 16-25 critical/extreme - bands are conventions, not law.

Hierarchy of control (most to least effective): elimination → substitution → engineering controls → administrative controls → PPE. PPE is the last line and depends on individual behaviour.

Hazard identification inputs: injury/incident data, near-miss reports, inspections, task analysis, SDS and exposure registers, worker consultation, change management and emergency scenarios.

Bow-tie model: threats on the left, top event in the centre, consequences on the right; preventive barriers on threat paths, mitigative barriers on consequence paths - barriers must be independent and auditable.

ALARP principle: risk must be reduced to as low as reasonably practicable; gross disproportion test - if cost is grossly disproportionate to risk reduction, further measures are not required.

Risk assessment validity depends on the exposed population and duration: assess by task, by group (similar exposure group) and by shift length, not only by machine or area.

Hierarchy application must be documented: if a lower-order control is chosen over a higher-order one, record the justification (feasibility, cost, residual risk).

Residual risk must be recorded and accepted by an authorised person; re-assessment triggers include incident, near miss, process change, new chemical, new worker or new legislation.

Dynamic assessment: take-5 / point-of-work checks are valid only for short-duration, low-complexity tasks and do not replace formal assessments for high-consequence work.

Safety Data Sheet (SDS) has 16 sections under GHS/CLP; Section 2 gives hazard classification and pictograms, Section 8 exposure controls and OELs, Section 9 physical properties, Section 10 stability and reactivity.

GHS pictograms: flame, flame over circle (oxidiser), exploding bomb, gas cylinder, corrosion, skull and crossbones (acute toxicity), exclamation mark, health hazard (carcinogen, respiratory sensitiser), environment, biohazard.

Exposure limits: TWA (8-hour time-weighted average), STEL (15-minute short-term exposure limit), and ceiling (never to be exceeded); mixtures require additive exposure calculation: sum(Ci/Li) must be < 1.

TWA calculation: TWA = (C1T1 + C2T2 + ... + CnTn) / 8, where C is concentration and T is hours exposed in an 8-hour shift; if exposure exceeds 8 hours, adjust using the brief-and-scala or OSHA equivalent model.

LEL/UEL define the flammable range; vapour density >1 means vapour accumulates at low points; flash point is the lowest temperature at which vapour ignites - a lower flash point means higher fire risk.

Hierarchy for chemicals: eliminate/substitute → engineering (local exhaust ventilation, enclosure, process isolation) → administrative (procedures, rotation, training) → PPE (respiratory protection with fit testing, gloves selected by chemical permeation data).

Biological hazards: chain of infection = infectious agent → reservoir → portal of exit → mode of transmission → portal of entry → susceptible host; control by breaking any link.

Biosafety levels: BSL-1 (basic), BSL-2 (moderate, biological safety cabinet for aerosols), BSL-3 (indigenous/exotic agents, directional airflow, respiratory protection), BSL-4 (dangerous/exotic, positive-pressure suit).

Health surveillance is required where exposure to a substance with a specific health effect is possible (e.g., lead, silica, isocyanates, noise, HAVS) and must be proportionate to risk, with results explained to the worker.

Noise: 3 dB exchange rate means halving exposure time for every 3 dB increase; 85 dB(A) 8-hour average is the common action level, 90 dB(A) the exposure limit in many jurisdictions (EU: 80/85 dB(A) action values, 87 dB(A) peak-adjusted limit).

Leq (equivalent continuous level) is the energy-average over a period; LEX,8h normalises exposure to 8 hours: LEX,8h = LAeq + 10 log10(T/8).

Peak noise limit (typically 135-140 dB(C)) protects against instantaneous hearing damage; hearing protection selection uses SNR or NRR minus a derating factor (SNR/4 or NRR × 0.5 in practice).

Hand-arm vibration: A(8) = ahv × √(T/8); EU action value 2.5 m/s² A(8), limit 5 m/s² A(8); symptoms: tingling, blanching (HAVS), loss of grip strength.

Whole-body vibration assessed per ISO 2631-1 using frequency-weighted RMS acceleration; health guidance caution zone begins at 0.5 m/s² A(8) for 8-hour exposure.

Heat stress: WBGT combines dry-bulb, natural wet-bulb and globe temperature (indoor/outdoor formula differs); use ISO 7243 WBGT reference values with acclimatisation and metabolic rate; heat strain indices include core temperature >38.5 °C and heart rate criteria.

Cold stress: wind chill accelerates heat loss; risk of hypothermia and non-freezing cold injury; controls include insulated clothing, warm shelters, dry clothing and scheduled breaks.

Radiation: absorbed dose in gray (Gy), equivalent dose in sievert (Sv) = Gy × radiation weighting factor; occupational dose limit commonly 20 mSv/year averaged over 5 years (ICRP), public 1 mSv/year.

Non-ionising radiation: UV (skin/eye damage, welding arc), IR (cataract risk), laser classes 1-4 (Class 4 requires engineering controls and eyewear), RF/microwave (thermal effects, exposure limits by frequency).

NIOSH lifting equation: RWL = LC × HM × VM × DM × AM × FM × CM; LI = load weight / RWL; LI > 1.0 indicates increased risk for the task; multipliers account for distance, height, asymmetry, frequency and coupling.

Manual handling risk factors: load weight and shape, horizontal and vertical distance, twisting, bending, reaching, carrying distance, frequency, duration, rest breaks and individual capacity.

RULA and REBA are observational postural screening tools producing action levels; RULA scores 1-2 acceptable, 3-4 investigate, 5-6 investigate and change soon, 7 immediate action.

Push/pull limits (Snook and Ciriello tables) depend on distance, frequency, handle height and gender; initial and sustained forces are assessed separately.

Repetition and force combine: task analysis (OCRA or similar) considers frequency of actions, force, posture, recovery periods and duration - repetition alone is not sufficient to assess risk.

Display screen equipment: workstation assessment covers seat height, screen distance (approximately 40-75 cm), top of screen at or below eye level, forearm support, foot support and glare control.

Anthropometric design uses 5th-95th percentile ranges (reach, clearance, height) and adjustability rather than average dimensions for critical interfaces.

Early reporting of musculoskeletal discomfort and participatory ergonomics (worker involvement in redesign) reduce chronic outcomes; DSE users are commonly entitled to eye test and corrective eyewear provision.

ISO 45003:2021 gives guidance on managing psychosocial risks within an ISO 45001 system; hazard categories include work demands, control, support, relationships, role clarity, change management, organisational justice and traumatic events.

Karasek demand-control model: high demands + low control = high strain (highest risk); high demands + high control = active (learning, engagement).

Effort-reward imbalance model: high effort with low reward (pay, esteem, career opportunity, security) predicts stress-related illness independent of demand-control.

Psychosocial hazard identification methods: anonymous surveys (e.g., COPSOQ), focus groups, incident and turnover data, absence patterns, exit interviews and grievance/ complaint analysis.

Bullying and harassment risk factors: power imbalance, role ambiguity, high competition, poor leadership, tolerance of incivility and lack of reporting channels.

Risk controls follow the hierarchy: work design (job crafting, workload planning, autonomy), then training and support (mental health first aid, EAP), then individual intervention - individual resilience training alone is not a substitute for work redesign.

Fatigue management: assess hazard from hours of work, shift pattern, time of day, task monotony and environmental conditions; controls include roster design, breaks, napping policy and journey management.

Trauma-exposed workers (emergency services, healthcare, justice) require peer support, psychological first aid, post-incident defusing and access to clinical pathways.

Incident ratio models (e.g., Bird's triangle) show a large base of near misses and minor incidents per serious injury; under-reporting of near misses weakens prevention.

Investigation sequence: secure the scene and preserve evidence → provide care and notify → gather facts (witness interviews, photos, documents, data) → establish timeline → identify immediate and root causes → recommend controls → verify implementation.

Root cause analysis methods: 5 Whys (simple, linear), Fishbone/Ishikawa (categorises contributing factors), Fault Tree Analysis (deductive, top-down, quantitative), Events and Causal Factors charting, and MORT.

Distinguish immediate causes (unsafe acts/conditions), contributing factors (training, design, supervision) and root/system causes (management system, culture, procurement, regulation).

Interviewing: separate witnesses, use open questions, avoid leading questions, record verbatim statements and re-interview after initial recall; memory decays quickly so interview within 24-48 hours.

Reporting thresholds: fatality, serious injury, dangerous occurrence, occupational disease and certain near misses must be notified to the regulator; internal reporting should be simple, blame-free and acknowledged.

Emergency plan content: hazard scenarios, alarm and communication systems, evacuation routes and assembly points, roles and wardens, accounting for people, first aid, spill/fire response, shutdown procedures and recovery.

Drills must be scheduled, scenario-based, evaluated against objectives and debriefed; findings feed back into the emergency plan and training - records of drills and debriefs are audit evidence.

Business continuity interface: emergency preparedness links to ISO 22301 continuity planning; critical functions, recovery time objectives and mutual aid arrangements should be documented.

Training needs analysis (TNA) has three levels: organisational (where training is needed), task/operational (what must be done), and individual (who needs what, at what level).

Competency = knowledge + skill + attitude demonstrated in the workplace; assessment methods include written test, observation, simulation and supervised practice.

Induction training must cover site hazards, emergency arrangements, PPE, reporting and consultation mechanisms before work starts; refresher intervals are risk-based, not arbitrary.

Adult learning principles (Knowles): relevance, experience-based, problem-centred, immediate application and self-direction - lecture-only delivery has low retention compared with demonstration and practice.

Kirkpatrick evaluation levels: reaction (satisfaction), learning (knowledge/skill test), behaviour (on-the-job observation), results (incident rates, compliance, quality).

Consultation vs communication: consultation is a two-way exchange before a decision (seeking views and considering them); communication is information transfer - both are required by law and by ISO 45001 clause 5.4.

Health and safety representatives' powers typically include inspecting the workplace, requesting information, being present at interviews with consent, issuing provisional improvement notices and requesting a committee.

Toolbox talks, pre-start briefings and safety alerts are communication channels; effectiveness is measured by worker knowledge checks and feedback loops, not by attendance records alone.

Active (leading) monitoring measures what is being done: inspections, audits, exposure monitoring, training completion, permit compliance; reactive (lagging) monitoring measures outcomes: incidents, injuries, claims, near misses.

LTIFR = (number of lost-time injuries × 1,000,000) / hours worked; TRIFR uses total recordable cases; severity rate = (days lost × 1,000,000) / hours worked.

Audit types: first-party (internal), second-party (supplier/contractor), third-party (certification body); audits assess conformity to a standard, inspections assess physical conditions, and both differ from hazard hunts.

Audit sampling: use a documented sampling plan, record objective evidence (documents, interviews, observation), classify findings as major nonconformity, minor nonconformity, observation or opportunity for improvement.

Corrective action must address root cause: containment → root cause analysis → action plan with owner and due date → verification of effectiveness → update risk assessment and documented information.

Compliance evaluation (ISO 45001 clause 9.1.2) requires a defined frequency, method and evaluation of legal and other requirements, with results retained as documented information.

Performance indicators should be balanced and reviewed for unintended consequences (e.g., near-miss reporting can fall if reporting is punished); normalise rates by exposure hours, not headcount.

Management review outputs feed the next planning cycle; trends across multiple periods are more informative than single-period snapshots, and benchmarking must account for industry and reporting definitions.