Management system guidance
4.0 Context of the Organization
ISO Navigator Pro™ is a free tool that provides practical, expert guidance for businesses wishing to interpret and better implement the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018.
Our range of ISO templates cover the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018, and offer an easy way to implement your next management system.
4.4 OH&S management system
Clause 4.4 of ISO 45001:2018 is short but underpins the whole standard. It requires your organization to set up an OH&S management system that meets the requirements of ISO 45001, put it into practice, keep it working and keep improving it. The system includes the processes you need and the way those processes interact.
Each of the four verbs has a practical meaning:
- Establish – design the system: decide which processes are needed, who owns them, how they link together and what documented information is required;
- Implement – put the processes into practice at every site and activity within the scope, so that what happens on the shop floor matches what is written down;
- Maintain – keep the system working and up to date as people, premises, equipment, work activities and legal requirements change;
- Continually improve – use the results of monitoring, audits, incident investigations and management review to improve OH&S performance over time (see 10.3).
Your organization decides how
ISO 45001 is not prescriptive about how an OH&S management system should be designed. Annex A.4.4 confirms that it is up to your organization to decide how it meets the requirements, and that it remains accountable for that choice, including how much detail to put into its processes and how far it integrates OH&S requirements into its other business processes. A small business with one site may need only a handful of simple processes; a multi-site group with high-risk activities will need more structure.
Where the system covers only part of an organization, policies and processes developed elsewhere in the organization, such as a corporate OH&S policy, group training and competence programmes or central procurement controls, can be used, provided they apply to the part concerned and conform to ISO 45001.
Identifying the processes
Although ISO 45001 does not use the term ‘process approach’ as ISO 9001 does, clause 4.4 clearly expects you to define your processes and how they interact. Typical OH&S processes and the clauses they address include:
- Context and interested parties (4.1, 4.2);
- Consultation and participation of workers (5.4);
- Hazard identification and risk assessment (6.1.2);
- Legal requirements and other requirements (6.1.3);
- OH&S objectives (6.2);
- Competence, awareness and communication (7.2, 7.3, 7.4);
- Control of documented information (7.5);
- Operational control, including the hierarchy of controls (8.1.1, 8.1.2);
- Management of change (8.1.3);
- Procurement, contractors and outsourcing (8.1.4);
- Emergency preparedness and response (8.2);
- Monitoring, measurement and evaluation of compliance (9.1.1, 9.1.2);
- Internal audit and management review (9.2, 9.3);
- Incident investigation, nonconformity and corrective action (10.2).
For each process, define the owner, inputs and outputs, the criteria for operating it, the resources and competence needed, the documented information it relies on, how its performance is monitored and how it links to other processes. Process maps, turtle diagrams or a process–clause matrix are useful ways of showing this. Map out which functions are responsible for each clause of the standard as it applies to each process, using a free copy of our ‘Process Clause Matrix’ template.
Integrating OH&S into business processes
Clause 5.1 requires top management to ensure that OH&S management system requirements are integrated into the organization’s business processes. In practice this means OH&S is built into everyday activities rather than run as a separate system, for example:
- Procurement includes OH&S criteria when selecting equipment, substances, suppliers and contractors;
- HR processes cover pre-placement health checks, induction, health surveillance and return to work;
- Design and engineering review hazards and ergonomics at the earliest stage of new or modified workplaces and equipment;
- Sales and estimating allow realistic time and cost for safe working;
- Planning and scheduling account for fatigue, shift patterns and lone working.
Involving workers
Worker consultation and participation run through the whole system, not just one procedure. When designing each process, decide how workers will be consulted and where non-managerial workers will take part in decisions, for example in identifying hazards, deciding on controls, investigating incidents and determining training needs (see 5.4).
Documented information
ISO 45001:2018 does not require an OH&S manual or process maps. Clause 7.5.1 requires the documented information the standard calls for, plus whatever your organization decides is needed for the system to be effective. Existing procedures, safe systems of work, risk assessments, permits, work instructions and forms are all valid evidence that processes are defined and operated as planned.
What auditors will look for
- Whether the processes needed for the OH&S management system have been identified, with their sequence and interactions;
- Whether process owners, criteria and performance indicators are defined and understood;
- Whether the system reflects the organization’s context, interested party requirements and scope;
- Whether what is written down matches what actually happens at the workplace;
- Whether the system is maintained when changes occur and is improving OH&S performance over time.
You should seek and record evidence that your organization has established, implemented and maintained the processes needed for its OH&S management system and their interactions, that OH&S requirements are integrated into its business processes, that workers are involved in the system, and that the system is being continually improved in line with ISO 45001.
More information on PDCA
Planning
Context
Planning
Support
Doing
Support
Operations
Checking
Monitoring, measurement, analysis and evaluation
Acting
Improvement
Want to know more?
- Read our customer's feedback
- Client list - who's using our templates?
- How the templates are formatted and download examples
- Why we use turtle diagrams and process maps
- What's the difference between a process and a procedure?
- About documented information
SSL certification
A certificate guarantees the information your internet browser is receiving now originates from the expected domain - https://www.iso9001help.co.uk. It guarantees that when you make a purchase, sensitive data is encrypted and sent to the right place, and not to a malicious third-party.
Free PDCA guidance
ISO Navigator™ is our FREE online training tool that shows you how to apply the principles of PDCA to your operations. We also offer many helpful templates that get you on the road to documenting your management system, please visit the download page.