with the OH&S policy (50).” ISO 45001:2018 (§6.2.1) requires that an organization “establish OH&S objectives at relevant functions and levels in order to maintain and continually improve the OH&S management system and OH&S performance (10.3) (59).” The standard provides a number of requirements associated with “planning how to achieve [the] OH&S objectives” (§6.2.2); these include: “what will be done; what resources will be required; who will be responsible; when will it be completed; how will the results be evaluated, including indicators for monitoring; and how the actions to achieve OH&S objectives will be integrated into the organization's business processes” (59). As indicated earlier, the explicit mention of integration “into the organization's business processes” is a significant evolution with 45001:2018. While developing procedures associated with OH&S objectives and plans is not required, the standard does require that “documented information” associated with them be maintained and retained.
5.6 Support (§7)
Elements that support an OHSMS's operation are found in ISO 45001 section 7. These include the following:
Resources (§7.1) “needed for the establishment, implementation, maintenance, and continual improvement” of the OHSMS;
Competence (§7.2) of personnel (workers);
Awareness (§7.3) by workers of aspects of the OHSMS, consequences of actions, and hazards/risks;
Communication (§7.4) process(es); and
Documented information (§7.5).
Aspects of each of these elements are found in OHSMSs since the earliest approaches.
5.6.1 Resources
The standard does not include requirements for specific resources, rather these need to be determined by the organization. Annex A (A.7.1) provides examples of common resources, these include “human, natural, infrastructure, technology, and financial” resources, to name a few (60).
5.6.2 Competence
Concepts related to worker competence have been part of standard IH/OHS management practices for decades but more so, in reference to required education and training. ISO 45001:2018 goes deeper where competence is defined as (3.23) the “ability to apply knowledge and skills to achieve intended results” (61). As with earlier OHSMSs, ISO 45001 provides guidance on this, where it requires (§7.2) that the organization:
“…determine the necessary competence of workers that affects or can affect its OH&S performance; ensure that workers are competent (including the ability to identify hazards) on the basis of appropriate education, training or experience; where applicable, take actions to acquire and maintain the necessary competence, and evaluate the effectiveness of the actions taken; and, retain appropriate documented information as evidence of competence” (62).
An important point here is “maintain[ing] the necessary competence, and evaluat[ion] of the effectiveness of the actions taken.”
5.6.3 Awareness
Closely related to competence is awareness of the items, issues, etc. associated with competency. Awareness leads to recognition where competence relates to the application of knowledge and skills in managing risks. Understanding and knowledge of workplace hazards and risks is the historical focus here. ISO 45001:2018, as do earlier approaches, provides additional requirements regarding understanding and knowledge (awareness) of the OH&S policy and its objectives; the worker's impact to OHSMS effectiveness; consequences of not conforming with OHSMS requirements; to name a few. As well, the standard requires that workers are aware of “the ability to remove themselves from work situations that they consider present an imminent and serious danger to their life or health, as well as the arrangements for protecting them from undue consequences for doing so” (62).
5.6.4 Communication
The presence of a robust communication system, within an OHSMS is essential for a well‐functioning OHSMS, and a defining feature that differentiates it from pre‐OHSMS approaches of OH&S management. Communication recommendations and requirements are found in all OHSMS approaches. ISO 45001:2018 requires that the organization “establish, implement and maintain the process(es) needed for the internal and external communications relevant to the OH&S management system, including determining: on what it will communicate; when to communicate; with whom to communicate; how to communicate.” The “with whom” to communicate includes “internally among the various levels and functions of the organization; among contractors and visitors to the workplace; and, among other interested parties” (62). When determining communication needs associated OH&S, “diversity aspects” need to be considered, including gender, language, culture, literacy, and disability. As well, as part of its communication system, the organization needs to “respond to relevant communications” related to the OHSMS.
5.6.5 Documented Information
Documentation and “controlled” document guidance and requirements are found in all OHSMS approaches. In ISO 45001:2018, documented information (§3.24) is defined as “information required to be controlled and maintained by an organization and the medium on which it is contained” (61). Prior OHSMS standards referred to documents and records, both of which are covered under the term, documented information. Document management is an historical aspect of IH/OH&S management and is familiar to industrial hygienists and OH&S professionals. ISO 45001:2018 contains criteria for “creating and updating” (§7.5.2) and for the “control of documented information” (§7.5.3). Actions in these two sections are aimed at ensuring that documented information is up to date, reviewed and approved for suitability and adequacy, and adequately protected. A key aspect of this section's requirements is “preventing unintended use of obsolete documented information” (§A.7.5).
5.7 Operation (§8)
All OHSMS approaches address aspects of the system relative to the organization's operations. In ISO 45001:2018, the “operation” (§8) section contains two subsections – operational planning and control (§8.1), and emergency preparedness and response (§8.2). Concepts and ideas contained in these subsections are familiar to historic IH/OH&S program management. Subsection §8.1 contains important topics, that include the following: eliminating hazards and reducing OH&S risks (§8.1.2), MOC (§8.1.3), and procurement (§8.1.4).
A new concept in ISO 45001, and all ISO management system standards, is the requirement for maintaining and controlling “processes” and not just the hazard itself. An example would be how well the process for planning works to make improvements in the management of risks. This is an important distinction when conducting internal audits of the management system. Traditional industrial hygiene (and safety) focus on the direct control of hazards based on the hierarchy of controls is also a part of operational requirements.
5.7.1 Eliminating Hazards and Reducing OH&S Risks
ISO 45001:2018 contains requirements for the elimination of hazards and reduction of OH&S risks. The standard states (§8.1.2) that
“…the organization shall establish, implement and maintain a process(es) for the elimination of hazards and reduction of OH&S risks using the following hierarchy of controls: eliminate the hazard; substitute with less hazardous processes, operations, materials or equipment; use engineering controls and reorganization of work; use administrative controls,