Management system guidance
6.1 Actions to Address Risks and Opportunities
ISO Navigator Pro™ is a free tool that provides practical, expert guidance for businesses wishing to interpret and better implement the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018.
Our range of ISO templates cover the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018, and offer an easy way to implement your next management system.
6.1.4 Planning action
Clause 6.1.4 turns the outputs of 6.1.2 and 6.1.3 into a plan. It ensures it is clear how your OH&S management system will deal with the risks and opportunities you have assessed, the legal requirements and other requirements that apply, and the emergency situations you could face. ISO 45001 requires you to plan:
- actions to:
- address the OH&S risks, other risks and opportunities you have assessed (6.1.2.2 and 6.1.2.3);
- address legal requirements and other requirements (6.1.3);
- prepare for and respond to emergency situations (8.2);
- how to:
- integrate and implement those actions into OH&S management system processes or other business processes;
- evaluate whether the actions have been effective.
When planning, you must take into account the hierarchy of controls (see 8.1.2) and the outputs from the OH&S management system, such as incident investigations, monitoring results, audit findings, worker consultation and management review. You must also consider best practice, the technological options available, and your financial, operational and business requirements.
Applying the hierarchy of controls
Each level of the hierarchy is generally less effective than the one above it, and it is usual to combine several controls to reduce a risk to as low as reasonably practicable. When choosing actions, work down the list:
- Eliminate the hazard, e.g. remove the need to work at height by assembling at ground level;
- Substitute less hazardous processes, operations, materials or equipment, e.g. water-based instead of solvent-based paint;
- Use engineering controls and reorganization of work, e.g. machine guarding, local exhaust ventilation, hoists, or job rotation to reduce exposure and workload;
- Use administrative controls, including training, e.g. safe systems of work, permits to work, signage, inspections, supervision and competence development;
- Provide adequate personal protective equipment as the last line of defence, properly selected, fitted, maintained and, where legally required, provided at no cost to workers.
Be ready to explain why a higher-level control was not chosen. ‘Cost’ alone is rarely a convincing reason where the risk is high.
Integrating actions into your processes
Planned actions should be managed mainly through the OH&S management system, but they work best when built into the processes people already use, including those for quality, environment, business continuity, risk, finance and human resources. Depending on the action, it might be implemented as:
- an operational control, such as a work instruction, safe system of work, permit or maintenance task (clause 8);
- a competence or awareness action, such as training, refresher courses or toolbox talks (7.2 and 7.3);
- a purchasing or contractor requirement (8.1.4 Procurement);
- a monitoring or measurement activity, such as air sampling, health surveillance or inspection checks (9.1);
- an OH&S objective with its own plan, for larger improvements that need resources and time (6.2);
- an emergency arrangement, such as a drill, equipment or a rescue plan (8.2).
Actions to address risks and opportunities should also pass through your management of change process (8.1.3), so that a new control does not introduce new hazards or other unintended consequences.
Building a practical action plan
A simple action plan or a set of columns added to your risk register is usually enough. For each action, record:
- The risk, opportunity, legal requirement or emergency scenario it addresses;
- The action, and where it sits in the hierarchy of controls;
- The process, procedure or document into which it will be integrated;
- The person responsible, the resources needed and the target date;
- How and when its effectiveness will be evaluated, and the result;
- The residual risk once the action is complete.
Evaluating effectiveness
Completing an action is not the same as it working. Decide in advance how you will judge effectiveness: for example, a re-assessed risk rating, exposure monitoring results, fewer incidents or near misses for that task, inspection findings, or feedback from the workers doing the job. Where an action has not worked, go back to the hierarchy of controls and plan again.
Worker participation
Clause 5.4 requires you to emphasize the participation of non-managerial workers in determining actions to eliminate hazards and reduce OH&S risks. The people who do the work are best placed to say whether a proposed control is practical and to spot problems it may create. Involve them through the safety committee, trials of new equipment or methods, and feedback on draft procedures (see 5.4 Consultation and participation of workers).
You should seek and record evidence that your organization has planned actions to address its assessed risks and opportunities, its legal requirements and other requirements, and its potential emergency situations; that the hierarchy of controls and outputs from the management system were taken into account; that best practice, technological options and financial, operational and business requirements were considered; that actions have been integrated into OH&S or other business processes with clear owners; that their effectiveness is evaluated; and that non-managerial workers have participated in determining the actions.
More information on PDCA
Planning
Context
Planning
Support
Doing
Support
Operations
Checking
Monitoring, measurement, analysis and evaluation
Acting
Improvement
Want to know more?
- Read our customer's feedback
- Client list - who's using our templates?
- How the templates are formatted and download examples
- Why we use turtle diagrams and process maps
- What's the difference between a process and a procedure?
- About documented information
SSL certification
A certificate guarantees the information your internet browser is receiving now originates from the expected domain - https://www.iso9001help.co.uk. It guarantees that when you make a purchase, sensitive data is encrypted and sent to the right place, and not to a malicious third-party.
Free PDCA guidance
ISO Navigator™ is our FREE online training tool that shows you how to apply the principles of PDCA to your operations. We also offer many helpful templates that get you on the road to documenting your management system, please visit the download page.