Occupational health and safety management systems
What this domain tests
This domain - OHS management systems - tests process thinking: how an organisation sets objectives, controls risk, checks performance and improves. Expect questions on ISO 45001 clause structure, the PDCA cycle, worker participation, contractors and management review.
Core rules
- PDCA. Plan sets context, legal requirements, risks and objectives; Do implements operational controls; Check monitors, audits and reviews; Act corrects nonconformity and improves.
- Context and scope. The organisation must identify external and internal issues, interested parties, and the scope of the system before designing controls.
- Leadership and participation. Top management remains accountable. Worker participation is not optional: workers must be consulted and have channels to report hazards without fear.
- Planning. The system must address hazards, legal and other requirements, risks and opportunities, and set measurable OSH objectives with plans, resources, responsibilities and timelines.
- Operational control. Controls follow the hierarchy, cover contractors, procurement, outsourcing, change and emergency situations, and are supported by competent people and documented information.
- Performance evaluation. Monitoring, internal audit and management review are separate activities. Management review considers performance, incidents, audit results, legal compliance and improvement actions.
Worked example
An internal audit finds that three of five planned monthly inspections were not completed and that the management review has not met for 14 months. The auditor should raise a nonconformity against monitoring and against management review, not simply a documentation gap. The organisation must correct the missed inspections, investigate why they were skipped, assess whether uninspected equipment created risk, assign corrective actions with owners and dates, and verify effectiveness. The management review must be reinstated with the required inputs and outputs. The audit finding is closed only when the process is working, not when a form is filed.
Traps that cost marks
- Confusing ISO 45001 with ISO 14001 or ISO 9001 and importing wrong clauses.
- Treating the system as a document set rather than a control process.
- Assuming certification proves legal compliance.
- Leaving workers out of consultation and incident reporting.
- Forgetting contractors, temporary workers and change management.
- Accepting a management review that has no decisions or actions.