Management system guidance
8.1 Operational Planning and Control
ISO Navigator Pro™ is a free tool that provides practical, expert guidance for businesses wishing to interpret and better implement the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018.
Our range of ISO templates cover the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018, and offer an easy way to implement your next management system.
8.1.4 Procurement
Clause 8.1.4 covers everything your organization brings in from outside – products, services, contractors and outsourced functions – and has three parts: 8.1.4.1 General, 8.1.4.2 Contractors and 8.1.4.3 Outsourcing.
8.1.4.1 General
Your organization must establish, implement and maintain a process (or processes) to control the procurement of products and services so that they conform to its OH&S management system. The procurement stage is the best opportunity to keep hazards out of the workplace: it is far easier to specify a quieter machine or a less hazardous chemical than to control it after delivery. Within your existing purchasing process, establish controls that:
- Identify and assess hazards and OH&S risks associated with products, hazardous materials or substances, raw materials, equipment and services before they are introduced to the workplace;
- Specify OH&S requirements for supplies, equipment, raw materials, other goods and related services (e.g. noise levels, guarding, CE/UKCA marking, safety data sheets, ergonomic features);
- Address the need for worker consultation (see 5.4) and communication (see 7.4);
- Verify, before release for use, that equipment is delivered to specification and tested to confirm it works as intended, that installations are commissioned to confirm they function as designed, and that materials match their specifications;
- Ensure usage requirements, precautions and other protective measures are communicated and made available to the workers who need them.
8.1.4.2 Contractors
Your organization must coordinate its procurement process(es) with its contractors so that hazards are identified, and OH&S risks assessed and controlled, where they arise from:
- The contractors’ activities and operations that affect your organization;
- Your organization’s activities and operations that affect the contractors’ workers;
- The contractors’ activities and operations that affect other interested parties in the workplace.
The organization must ensure that contractors and their workers meet the requirements of its OH&S management system, and its procurement process(es) must define and apply OH&S criteria for selecting contractors. ISO 45001 suggests that including these criteria in contract documents can help.
Contractors include maintenance, construction, cleaning, security and catering providers, as well as consultants and specialists. Using a contractor does not remove your organization’s responsibility for the health and safety of workers. Practical contractor controls include:
- Pre-qualification – review past OH&S performance, accident records, insurance, safety training, competence and health and safety capabilities. Some contractors may not have a formal OH&S management system; that does not exclude them, but you may need to check their arrangements more closely, for example through an inspection or audit;
- Contracts – define the responsibilities of each party, OH&S requirements and how the contractor will work within your processes for site entry, permits, confined space entry, exposure assessment and incident reporting;
- Before work starts – verify that worker qualifications and competence have been met, that resources, equipment and work preparations are adequate, and that risk assessments and method statements have been reviewed;
- On site – site induction, control of access to hazardous areas, emergency procedures, supervision and periodic inspection of contractor work;
- Information sharing – agree how hazards, incidents and near misses are reported in both directions; regular meetings with key contractors work well;
- Review – evaluate contractor OH&S performance at the end of the job and use the results in future selection.
8.1.4.3 Outsourcing
Your organization must ensure that outsourced functions and processes are controlled, and that its outsourcing arrangements are in line with legal requirements and other requirements and support the intended outcomes of the OH&S management system. The OH&S management system must also set out how much control, and what kind, is applied to each outsourced function or process.
An outsourced function or process is one that falls within the scope of your OH&S management system but is performed by an external provider – for example occupational health services, fire risk assessment, equipment inspection and testing, or a production step carried out by another company. Responsibility for conforming to ISO 45001 stays with your organization. Decide the extent of control by considering:
- Whether the external provider can meet your OH&S management system requirements;
- Your own technical competence to define appropriate controls or judge whether the provider’s controls are adequate;
- How much the outsourced function could affect your ability to achieve the intended outcomes of the OH&S management system;
- The extent to which the function or process is shared between you and the provider;
- Whether your procurement process can deliver the necessary control;
- Opportunities for improvement.
Coordinating with external providers helps you manage any effect outsourcing has on OH&S performance. Note that in some countries legal requirements specifically address outsourced functions or processes.
You should seek and record evidence that OH&S requirements are specified and verified when products and services are purchased; that equipment, installations and materials are checked before use; that OH&S criteria are defined and applied when selecting contractors; that hazards and risks arising between the organization, its contractors and other parties are identified and controlled; that contractors and their workers meet OH&S management system requirements; and that the type and degree of control over each outsourced function or process is defined and applied.
More information on PDCA
Planning
Context
Planning
Support
Doing
Support
Operations
Checking
Monitoring, measurement, analysis and evaluation
Acting
Improvement
Want to know more?
- Read our customer's feedback
- Client list - who's using our templates?
- How the templates are formatted and download examples
- Why we use turtle diagrams and process maps
- What's the difference between a process and a procedure?
- About documented information
SSL certification
A certificate guarantees the information your internet browser is receiving now originates from the expected domain - https://www.iso9001help.co.uk. It guarantees that when you make a purchase, sensitive data is encrypted and sent to the right place, and not to a malicious third-party.
Free PDCA guidance
ISO Navigator™ is our FREE online training tool that shows you how to apply the principles of PDCA to your operations. We also offer many helpful templates that get you on the road to documenting your management system, please visit the download page.