Scope and initiation pressure on a seven-month deadline

Clause 4.3 requires the scope to be determined by considering the 4.1 context, the 4.2 interested-party requirements and the work-related activities performed, and the resulting management system must cover the activities, products and services within the organisation's control or influence. Scope is a statement of what the system genuinely covers; it is not a filter for removing the difficult parts.

The two exclusions are materially different:

• Excluding demolition is defensible only if it is a genuinely separate legal entity with its own management, its own workers, its own legal duties and no shared control of the activities. If group staff, group procedures, group procurement or group insurance govern that work, the exclusion is a misrepresentation and the certification body will challenge it. Excluding a division precisely because it produces a third of the injuries is the strongest possible evidence that the scope was chosen to protect the certificate, not to manage risk.
• Excluding labour supply on client-controlled sites is harder to sustain. Northgate's own workers perform the activity, Northgate controls how the work is done, and the client site is merely the location. The activity is within the organisation's control and belongs in scope regardless of who owns the site.

Consequences: a scope that omits the highest-risk activity leaves those workers outside the system's protection and undermines 6.1.2 and 8.1.4. Either include all three divisions, or restructure so a genuinely separate entity is certified separately, with interfaces, shared services and group influence described explicitly rather than hidden.

Initiation should establish foundations, not documents. Sequence:

1. Governance and leadership (5.1, 5.3). A steering group chaired by the CEO with each divisional MD, a worker representative and a finance representative, meeting monthly with decisions and resources recorded. Appoint an OH&S lead with authority across all three divisions and ring-fenced time, reporting to the CEO, not to Finance on a 0.5 FTE basis.
2. Context (4.1) and interested parties (4.2). Structured analysis of the group's legal duties, regulatory history, client prequalification demands, subcontractor dependency, labour supply model, skills shortages and incident history, plus the needs of workers, clients, principal contractors, unions and the regulator.
3. Gap analysis against ISO 45001 clause by clause, using existing 9001/14001 processes as a baseline but testing OH&S-specific gaps: 5.4 participation, 6.1.2 hazard identification, 8.1.2 hierarchy of controls, 8.1.3 management of change, 8.1.4 contractors, 8.2 emergency response, 10.2 incident investigation.
4. Scope decision on the demolition entity, documented with rationale.
5. Plan, budget and competence. Milestones, owners, resource allocation, training and communication plan.

On feasibility: seven months is achievable only if the 9001/14001 core processes (document control, audit, nonconformity, management review) are genuinely mature and can be extended. Two audit and review cycles will be needed before certification, at least one full internal audit, and evidence of corrective action effectiveness. Tell the board the truth: if the demolition entity is in scope and no dedicated resource is funded, seven months is not realistic, and an early stage 1 audit is the cheapest way to test that.

Turning a 14001 manual into an OH&S manual recycles content whose logic is environmental, not injury and ill-health prevention. Aspect and impact registers do not become hazard registers; environmental controls do not address the hierarchy in 8.1.2. It also produces parallel documents for objectives, audits, nonconformities and management review, which is exactly how organisations end up with duplications and conflicting ownership.

Note one factual trap: ISO 45001 does not require a 'management representative'. Clause 5.3 requires relevant roles to be assigned responsibility and authority for the OH&S system and for reporting performance to top management. Reusing a named individual is fine if competence and authority fit, but the title carries no status in the standard.

The better approach is a single integrated management system: one context analysis and one interested-party register serving quality, environment and OH&S; one set of documented information under 7.5 with discipline-specific content inside it; one audit programme under 9.2 covering all three standards; one management review under 9.3 with OH&S inputs and outputs explicitly present. Integration should also reconcile risk methodologies so a single risk register can serve the business rather than three incompatible matrices.

Above all, 7.5 should be applied with restraint: document what is needed to control risk and demonstrate conformity, not what the consultant finds easiest to copy.