Management system guidance
7.0 Support
ISO Navigator Pro™ is a free tool that provides practical, expert guidance for businesses wishing to interpret and better implement the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018.
Our range of ISO templates cover the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018, and offer an easy way to implement your next management system.
7.5 Documented information
Clause 7.5 sets out what documented information your OH&S management system must contain and how it must be controlled. Documented information means information that has to be controlled and maintained, together with the medium holding it. It can be in any format or media and from any source – procedures, risk assessments, permits, signs, labels, photographs, videos, databases and electronic forms all count. ISO 45001:2018 uses two phrases: to maintain documented information means keeping documents up to date (e.g. procedures, plans, registers), while to retain documented information as evidence means keeping records.
7.5.1 General
Your OH&S management system must include the documented information required by ISO 45001 plus whatever your organization decides is necessary for the system to be effective. The amount will vary depending on the size of the organization and its activities, the need to demonstrate that legal requirements and other requirements are fulfilled, the complexity of processes and the competence of workers. Keep it as simple as possible: a short, well-used safe system of work is better than a long procedure nobody reads. Consult workers on the documented information they need (see 5.4).
Documented information required by ISO 45001:2018
The following checklist shows the documented information the standard explicitly requires, by clause:
- 4.3 – the scope of the OH&S management system (available as documented information);
- 5.2 – the OH&S policy (available as documented information);
- 5.3 – responsibilities and authorities for relevant roles within the OH&S management system (maintained);
- 6.1.1 – risks and opportunities, and the process(es) and actions needed to determine and address them (6.1.2 to 6.1.4), to the extent needed for confidence that they are carried out as planned (maintained);
- 6.1.2.2 – the methodology(ies) and criteria for assessing OH&S risks (maintained and retained);
- 6.1.3 – legal requirements and other requirements, kept up to date when they change (maintained and retained);
- 6.2.2 – OH&S objectives and the plans to achieve them (maintained and retained);
- 7.2 – evidence of competence (retained);
- 7.4.1 – evidence of communications, as appropriate (retained);
- 7.5.1 – documented information the organization determines is necessary for an effective OH&S management system;
- 7.5.3 – documented information of external origin needed for planning and operating the system, identified and controlled;
- 8.1.1 – operational planning and control information, to the extent needed for confidence that processes have been carried out as planned (maintained and retained);
- 8.2 – the process(es) and plans for responding to potential emergency situations (maintained and retained);
- 9.1.1 – results of monitoring, measurement, analysis and performance evaluation, and records of maintenance, calibration or verification of measuring equipment (retained);
- 9.1.2 – results of the evaluation of compliance (retained);
- 9.2.2 – evidence that the audit programme has been implemented, and the audit results (retained);
- 9.3 – results of management reviews (retained);
- 10.2 – the nature of incidents or nonconformities and actions taken, and the results of action and corrective action including their effectiveness (retained; also communicated to relevant workers, workers’ representatives and other relevant interested parties);
- 10.3 – evidence of continual improvement (maintained and retained).
Many organizations also keep documented information that the standard does not demand but which is useful, such as the results of the context and interested party analyses (4.1 and 4.2), records of worker consultation and participation, hazard identification records, contractor approval records, permits to work, inspection checklists and health surveillance records. Remember that national legislation may require additional records and set minimum retention periods.
7.5.2 Creating and updating
When documented information is created or updated, your organization must ensure that it has appropriate:
- identification and description – e.g. title, date, author or reference number;
- format and media – e.g. language, software version, graphics, paper or electronic;
- review and approval for suitability and adequacy before issue.
Format matters in OH&S: instructions should be in a language and style that the people using them understand, and pictorial work instructions or safety signs may work better than text on the shop floor.
7.5.3 Control of documented information
Documented information required by ISO 45001 and by your OH&S management system must be controlled so that it is available and suitable for use where and when needed, and adequately protected from loss of confidentiality, improper use or loss of integrity. As applicable, your process should address:
- distribution, access, retrieval and use – e.g. risk assessments and emergency plans accessible at the point of work, read-only versus edit rights;
- storage and preservation, including keeping records legible – e.g. back-ups, protection from damage in harsh environments;
- control of changes – e.g. version control, revision history and withdrawal of obsolete copies so out-of-date safe systems of work cannot be used;
- retention and disposition – e.g. retention periods based on legal requirements (some exposure and health surveillance records must be kept for decades), archiving and secure disposal.
External documents your organization needs, such as legislation, approved codes of practice, manufacturers’ instructions and safety data sheets, must be identified and controlled. ISO 45001 also makes clear that workers, and any workers’ representatives, should be able to access the documented information relevant to them. Treat personal and medical information as confidential and limit access accordingly. Our health and safety management system templates include procedures and forms to help control documents and records.
You should seek and record evidence that your OH&S management system includes all the documented information required by ISO 45001:2018 and that your organization has determined is necessary; that documents are identified, reviewed and approved before issue; that current versions are available at the point of use and obsolete versions are withdrawn; that records are protected, legible, retrievable and kept for defined periods; that external documents are controlled; and that workers and their representatives can access the information relevant to them.
More information on PDCA
Planning
Context
Planning
Support
Doing
Support
Operations
Checking
Monitoring, measurement, analysis and evaluation
Acting
Improvement
Want to know more?
- Read our customer's feedback
- Client list - who's using our templates?
- How the templates are formatted and download examples
- Why we use turtle diagrams and process maps
- What's the difference between a process and a procedure?
- About documented information
SSL certification
A certificate guarantees the information your internet browser is receiving now originates from the expected domain - https://www.iso9001help.co.uk. It guarantees that when you make a purchase, sensitive data is encrypted and sent to the right place, and not to a malicious third-party.
Free PDCA guidance
ISO Navigator™ is our FREE online training tool that shows you how to apply the principles of PDCA to your operations. We also offer many helpful templates that get you on the road to documenting your management system, please visit the download page.