OSHAS

Section 4 - OH&S Management System Elements4.1. General Requirements

4.1.1. Written Procedure

4.1.2. Implementation 4.2. OH&S Policy

4.2.1. Written Procedure and Arrangements

4.2.2. Written OH&S Policy

4.2.3. Other OH&S Policy Matters 4.3. Planning

4.3.1. Planning for Hazard Identification, Risk Assessment & Control

4.3.2. Legal and Other OH&S Requirements

4.3.3. OH&S Objectives

4.3.4. OH&S Management Programme(s) 4.4. Implementation and Operation

4.4.1. Structure and Responsibility

4.4.2. Training, Awareness and Competence

4.4.3. Consultation and Communication

4.4.4. Documentation - Implementation

4.4.5. Document and Data Control

4.4.6. Operational Control

4.4.7. Emergency Preparedness and Response 4.5. Checking and Corrective Action

4.5.1. Performance Measuring and Monitoring

4.5.2. Accidents etc and Corrective and Preventive Action

4.5.3. Records and Record Management

4.5.4. Audit 4.6. Management Review

4.6.1. Written Procedure

http://www.isoims.com/ohsas18001-4.6.1.html





















4.6.2. Last Management Review

4.1. General Requirements

4.1.1. General Requirements - Written Procedure

Is there a written procedure describing how the organisation will identify and record

the boundaries of its OH&S management system?

Guidance: OHSAS 18001 allows an organisation to define the boundaries for its OH&S management system. For example, the boundary may be the whole organisation, or specific operating units, or particular activities. However, whatever boundaries are chosen, they must be identified accurately and recorded.

Verification guidance: Answer "Yes" to this question if there is a document which

purports to be the organisation's procedure for identifying and recording the

boundaries of its OH&S management system. The adequacy of the procedure is

tested by the other questions in this section of the evaluation.

Question 1.1.1

Is continuing identification of the OH&S management system boundaries dealt with

adequately in the written procedure on OH&S management system boundaries?

Guidance: Organisationsmust have some procedure in place to ensure that changes in the organization which affect the OH&S management system boundaries are identified. Such changes include, for example, acquisitions of new assets and disposals of existing assets.

Verification guidance: Answer "No" to this question if the continuing identification of

the OH&S management system boundaries is not dealt with, OR the range of issues

dealt with is inadequate given the nature and extent of the organisation's assets, OR

one or more of the issues is dealt with inadequately, OR the description is

inadequate in any other way.

Question 1.1.2

Is maintaining an up to date record of the OH&S management system boundaries

dealt with adequately in the written procedure on OH&S management system

boundaries?


Guidance: Organisationsmust have some procedure in place to ensure that

changes in the organization which affect the OH&S management system boundaries

are identified and recorded in an effective and timely manner. Such changes include,

for example, acquisitions of new assets and disposals of existing assets.

Verification guidance: Answer "No" to this question if maintaining an up to date

record of the OH&S management system boundaries is not dealt with in the written

procedure on OH&S management system boundaries, OR the range of issues dealt

with is inadequate given the nature and extent of the organisation's assets, OR one

or more of the issues is dealt with inadequately, OR the description is inadequate in

any other way.

4.1.2. General Requirements - Implementation

Question 1.2.1

Has the organisation accurately identified, and recorded, the boundaries of its OH&S

management system?

Guidance: OHSAS 18001 allows an organisation to define the boundaries for its OH&S management system. For example, the boundary may be the whole organisation, or specific operating units, or particular activities. However, whatever boundaries are chosen, they must be identified accurately and recorded.

Verification guidance: Answer "No" to this question if there is no written record of

the boundaries of the OH&S management system, OR the definition of the

boundaries is unclear, OR the written record is inadequate in any other way.

Question 1.2.2

Overall operation. Has the organisation excluded from the OH&S management

system any activity required for its overall operation?

Guidance: Although OHSAS 18001 allows an organisation to define the boundaries of its OH&S management system, the organisation is not allowed to exclude activities which are required for its overall operation. What constitutes such activities will be arguable and organizations should take great care to establish, and record, the rationale for exclusions. Where there is doubt, the activity should be included in the OH&S management system.

Verification guidance: Answer "Yes" to this question if there is no written record of

the boundaries of the OH&S management system, OR the definition of the

boundaries is unclear, OR the written record is inadequate in any other way. Where

the organisation has excluded one or more activities, check the rationale for the

exclusion of each activity. Answer "No" to this question only if there are no

reasonable grounds for supposing that any excluded activity is required for the

overall operation of the organisation.

4.2. OH&S Policy

4.2.1. Written Procedure and Arrangements

Question 2.1.1

Is there a written procedure describing how the organisation will review, and revise

as necessary, its OH&S Policy?

Guidance: The organisation's OH&S Policy must be reviewed periodically and revised as necessary to take into account relevant changes. The timing of, and responsibility for, these reviews should be recorded in a written procedure.

Verification guidance: Answer "No" to this question if there is no written procedure

describing how the organization will review, and revise as necessary, its OH&S

Policy, OR the procedure does not deal with the timing of the reviews, OR the

procedure does not deal with responsibility for the reviews, OR the procedure is

inadequate in any other way. Note. The relevant material may be included in the

review procedure, there is no need for a separate document.

4.2.2. Written OH&S Policy

Is there a written OH&S Policy?

Guidance: OHSAS 18001 requires that an organisation has a written OH&S Policy which establishes an overall sense of direction for the organisation. The written Policy must meet certain criteria in order to satisfy the OHSAS 18001 requirements and these criteria are set out in the questions in the remainder of this section of the evaluation.


purports to be the organisation's OH&S Policy. The adequacy of the Policy is tested

by the other questions in this section of the evaluation.

Question 2.2.1

Does the OH&S Policy clearly state the organisation's overall OH&S objectives?

Guidance: The objectives set out in the OH&S Policy need only be general statements of overall objectives, or broad areas for action. More detailed OH&S objectives are required but these are dealt with in section 3.3.

Verification guidance: Answer "No" to this question if the OH&S Policy does not

include a description of the organisation's overall OH&S objectives, OR the

objectives as recorded are inadequate in any way.

Question 2.2.2

Does the OH&S Policy contain a commitment to improving OH&S performance?

Guidance: The organisation could commit itself to reducing the risk of accidents, illness and incidents in the workplace. However, other measures of OH&S performance could be used.

Verification guidance: Answer "No" to this question if the OH&S Policy does not

include a commitment to improving

OH&S performance, OR the statement of commitment as recorded is inadequate in

any way.

4.2.3. Other OH&S Policy Matters

Question 2.3.1

Is the OH&S Policy reviewed periodically?

Guidance: OHSAS 18001 does not specify a review period but OHSAS 18002 suggests an annual review and this should be considered as the minimum requirement. It is good practice to include the date of review on the OH&S Policy even when the review has not resulted in any changes.

Verification guidance: Answer "No" to this question unless there is clear evidence

that the OH&S Policy has been reviewed in the twelve months prior to the

evaluation.

4.3. Planning

4.3.1. Planning for Hazard Identification, Risk Assessment & Control

Section 3.1.1 Hazard Identification and Risk Assessment - Written Procedure

Is there a written procedure describing how the organisation will identify hazards and

assess risks?

Guidance: Effective hazard identification and risk assessment are essential if OH&S management is to be successful. Organisations must decide how they will carry out these activities and record their decisions in a written procedure. This procedure must meet certain requirements and these requirements are dealt with in this section of the evaluation.


purports to be the organisation's hazard identification and risk assessment

procedure. The adequacy of the procedure is tested by the other questions in this

section of the evaluation.

Question 3.1.1.1

Is the scope of the organisation's hazard identification and risk assessment dealt

with adequately in the written procedure on hazard identification and risk

assessment?

Guidance: Organisations must identify all of their OH&S hazards and assess any OH&S risks associated with these hazards. This will require organisations to identify and record all possible sources of OH&S hazards including, as a minimum, the following.…

Routine and non-routine activities.

The activities of employees who have access to the workplace.

The activities of others who have access to the workplace, for example, contractors and

visitors.

Workplace facilities provided by the organisation.

Workplace facilities provided by others.

However, where necessary, consideration may also have to be given to hazards

arising from

abnormal conditions

emergency conditions, and

the effects of degradation over time on materials, plant and equipment.

Verification guidance: Answer "Yes" to this question only if the written statement

on scope deals adequately with all relevant sources of hazards. A "Yes" answer can

be given for a global statement, for example "we will identify all sources of OH&S

hazards".

Question 3.1.1.8

Are the uses of hazard identification and risk assessment results dealt with

adequately in the written procedure on hazard identification and risk assessment?

Guidance: It is important that the various elements of the OH&S management system are interlinked and the results from hazard identification and risk assessment should be used elsewhere in the OH&S management system. As a minimum, these uses should include the following.…

The setting of OH&S objectives.

Determination of facility requirements.

Identification of training needs.

Development of operational controls.

As an input to the management reviews.

Organisations should decide how these uses of hazard identification and risk

assessment results will be implemented and record the relevant mechanisms in

writing.

Verification guidance: Answer "No" to this question if the use of results is not dealt

with, OR the range of uses dealt with does not include all of those listed in the

guidance to this question, OR one or more of the uses is dealt with inadequately, OR

the description is inadequate in any other way.Section 3.1.2 Risk Control Measures - Written Procedure

Is there a written procedure describing how the organisation will deal with risk control

measures?

Guidance: OHSAS 18001 requires that organisations have in place arrangements

for such matters as the specification, implementation and monitoring of risk control

measures and that these arrangements are documented. This question tests

whether the organisation has a written risk control measures procedure. The

adequacy of this procedure is tested by the rest of the questions in this section.


purports to be the organisation's risk control measures procedure. The adequacy of

the procedure is tested by the other questions in this section of the evaluation.

Question 3.1.2.1

Is the specification of risk control measures dealt with adequately in the written

procedure on risk control measures?

Guidance: For any given risk, there are usually a number of alternative risk control measures which could be used. However, when factors such as risk reduction, cost and reliability are taken into account, there is normally an optimum measure. Selecting optimum measures will require certain competences and organisations should specify how these competences will be provided.

Verification guidance: Answer "No" to this question if the written procedure on risk

control measures does not deal with the specification of risk control measures, OR

the selection of optimum risk control measures is not dealt with, OR the provision of

relevant competences is not dealt with, OR the specification of risk control measures

is dealt with inadequately in any other way.

Question 3.1.2.2

Is the specification of monitoring requirements for risk control measures dealt with

adequately in the written procedure on risk control measures?

Guidance: Risk control measures will only remain effective if they remain in place and this will require that they are monitored and corrective action taken when failures to maintain the risk control measure are identified. However, different types of risk control measure have different monitoring requirements and the correct specification of these requirement will require certain competences and organisations should specify how these competences will be provided.

Verification guidance: Answer "No" to this question if the written procedure on risk

control measures does not deal with the monitoring requirements for risk control

measures, OR the selection of appropriate monitoring requirements for risk control

measures is not dealt with, OR the provision of relevant competences is not dealt

with, OR the specification of monitoring requirements is dealt with inadequately in

any other way.

4.3.2. Legal and Other OH&S Requirements

Section 4.3.2.1 Legal and Other OH&S Requirements - Procedure and Arrangements

Is there a written procedure describing how the organisation will identify and access

the legal and other OH&S requirements which apply to its activities?

Guidance: OHSAS 18001 requires that organisations comply with all relevant legal and other OH&S requirements. Organisations will, therefore, require a procedure which sets out how such requirements will be identified and accessed. This question tests whether such a procedure exists, the adequacy of the procedure is tested in the remaining questions in this section.

Note. This section does not test whether the organisation complies with legal and

other OH&S requirements. These tests will be found in the SMi evaluation.


purports to be the organisation's legal and other OH&S requirements procedure. The

adequacy of the procedure is tested by the other questions in this section of the

evaluation.

Question 4.3.2.1.1

Are the means used to identify relevant OH&S legal requirements dealt with

adequately in the written procedure on legal and other OH&S requirements?

Guidance: This aspect of the procedure should describe how the organisation will identify the OH&S legal requirements currently in force, how it will identify its own activities, and how it will establish which OH&S legislation applies to its activities.

Verification guidance: Answer "No" to this question if the identification of relevant

OH&S legal requirements is not dealt with in the procedure, OR the statement does

not cover one or more of the issues described in the guidance to this question, OR

the statement is inadequate in any other way.

Question 4.3.2.1.5

Employees - OH&S legislation. Are there written arrangements for communicating

appropriate information on OH&S legal requirements to all employees who require

such information?

Guidance: Employees must know what they have to do in order to ensure that the organisation meets its commitment to comply with relevant OH&S legislation. There should be written arrangements which describe how this information will be communicated and how checks will be made that the information has been understood.

Verification guidance: Answer "No" to this question if there are no written

arrangements describing communication to employees of information on OH&S legal

requirements, OR the written arrangements do not include checks on understanding,

OR the written arrangements are inadequate in any other way.

Section 4.3.2.2 OH&S Legal Requirements - Implementation

Question 4.3.2.2.1

Is there a list of the OH&S legal requirements which apply to the organisation?

Guidance: If there is no list of the OH&S legal requirements which apply to the organisation it will not be possible to demonstrate what legislation has been taken into account and, more importantly, that all relevant OH&S legislation has been taken into account. This question tests whether a list exists, the adequacy of the list is tested by the remainder of the questions in this section.


purports to be the list of OH&S legal requirements which apply to the organisation.

The adequacy of the list is tested by the other questions in this section of the

evaluation. Where the answer to this question is "No", answer "No" to the rest of the

questions in this section unless the organisation requires individual locations to

maintain lists, and there is no centrally held list, in which case answer "Not

Applicable" to all the questions in this section.

Section 4.3.2.3 Other OH&S Requirements - Implementation

Question 4.3.2.3.1

Is there a list of other OH&S requirements which apply to the organisation?

Guidance: If there is no list of the other OH&S requirements which apply to the organisation it will not be possible to demonstrate which requirements have been taken into account and, more importantly, that all relevant other OH&S requirements have been taken into account. This question tests whether a list exists, the adequacy of the list is tested by the remainder of the questions in this section.


purports to be the list of other OH&S requirements which apply to the organisation.

The adequacy of the list is tested by the other questions in this section of the

evaluation. Where the answer to this question is "No", answer "No" to the rest of the

questions in this section unless the organisation requires individual locations to

maintain lists, and there is no centrally held list, in which case answer "Not

Applicable" to all the questions in this section.

4.3.3. OH&S Objectives

Guidance: OHSAS 18001 requires that organisations have documented OH&S

objectives for each relevant function and level. The minimum requirement if for one

set of objectives which apply to all functions and levels and where this is the case,

organisations should base their answers to the questions in sections 3.3.2 and 3.3.3

on this set of objectives.

Verification guidance: In addition to answering the questions in these sections,

auditors should assess whether organisations which do not set OH&S objectives for

functions and levels are doing so appropriately.

Section 4.3.3.1 OH&S Objectives - Written Procedure

Is there a written procedure dealing with OH&S objectives?

Guidance: OHSAS 18001 requires that organisations have documented OH&S objectives and how this requirement will be met should be the subject of a written procedure. This question tests whether such a procedure exits, its adequacy is tested by the other questions in this section.


purports to be the organisation's OH&S objectives procedure. The adequacy of the

written procedure is tested by the other questions in this section of the evaluation.

Question 4.3.3.1.1

Is the allocation of OH&S objectives to functions dealt with adequately in the written

procedure on OH&S objectives?

Guidance: Typical functions include manufacturing, transport, maintenance and administration. Organisations must give consideration to the need for separate OH&S objectives for individual functions.

Verification guidance: Answer "No" to this question if the allocation of OH&S

objectives to functions is not dealt with in the written procedure on OH&S objectives,

OR the statement on the allocation of OH&S objectives to functions is inadequate in

any way.

Question 4.3.3.1.2

Is the allocation of OH&S objectives to levels dealt with adequately in the written

procedure on OH&S objectives?

Guidance: Typical levels include top management, middle management, first line management and operatives. Organisations must give consideration to the need for separate OH&S objectives for individual levels.

Verification guidance: Answer "No" to this question if the allocation of OH&S

objectives to levels is not dealt with in the written procedure on OH&S objectives, OR

the statement on the allocation of OH&S objectives to levels is inadequate in any

way.

Question 4.3.3.1.3

Is the quantification of OH&S objectives dealt with adequately in the written

procedure on OH&S objectives

Guidance: OHSAS 18001 requires that OH&S objectives should be quantified where practicable. For example the objective should be a percentage increase in audit scores, not just an increase in audit scores. Quantifying OH&S objectives may require creative thought,

particularly for objectives such as "improve the quality of OH&S training". However, it is possible to devise appropriate measures which allow for quantified objectives.

Verification guidance: Answer "No" to this question if the quantification of OH&S

objectives is not dealt with in the written procedure on OH&S objectives, OR the

statement on quantification of OH&S objectives is inadequate in any way.

Section 4.3.3.2 Objectives for Functions - Implementation

Question 4.3.3.2.1

Is there an adequate written specification of the functions within the organisation

which will have separate OH&S objectives?

Guidance: Organisations must give consideration to the need for separate OH&S

objectives for individual functions. Each function must be identified and recorded with

a statement on whether it will have its own OH&S objectives.

Verification guidance: Answer "No" to this question if there is no written

specification of the functions, OR the specification of functions is inadequate, OR

there is no statement for one or more functions on whether it will have separate

OH&S objectives.

Question 4.3.3.2.2

Do all relevant functions have written OH&S objectives?

Guidance: Functions which might require separate OH&S objectives include those managing high levels of risk, those whose risks are such that they pose a major threat to the continuing function of the organisation, and those managing risks which do not occur elsewhere in the organisation. Organisations should consider each function in turn, decide whether separate OH&S objectives are appropriate, and record the results of these decisions.

Verification guidance: Answer "No" to this question if, given the nature of the

organisation and its activities, one or more functions which should have separate

OH&S objectives does not have such objectives.Section 4.3.3.3 Objectives for Levels - Implementation

Guidance: OHSAS 18001 requires that organisations have documented OH&S objectives for each relevant function and level. The minimum requirement if for one set of objectives

which apply to all functions and levels and where this is the case, the questions in this section should be answered on the basis of this set of OH&S objectives.

Question 4.3.3.3.1

Is there an adequate written specification of the levels within the organisation which

will have separate OH&S objectives?

Guidance: Organisations must give consideration to the need for separate OH&S

objectives for individual levels within the organisation. Each level must be identified

and recorded with a statement on whether it will have its own OH&S objectives.


specification of the levels, OR the specification of levels is inadequate, OR there is

no statement for one or more levels on whether it will have separate OH&S

objectives.

Question 4.3.3.3.2

Do all relevant levels have written OH&S objectives?

Guidance: Levels which commonly require separate OH&S objectives include top management and first line management. Organisations should consider each level in turn, decide whether separate OH&S objectives are appropriate, and record the results of these decisions.

Verification guidance: Answer "No" to this question if, given the nature of the

organisation and its activities, one or more levels which should have separate OH&S

objectives does not have such objectives.

Question 4.3.3.3.3

Are all of the OH&S objectives at all levels quantified where practicable?

Guidance: OHSAS 18001 requires that OH&S objectives should be quantified where practicable. For example the objective should be a percentage increase in audit scores, not just an increase in audit scores. Quantifying OH&S objectives may require creative thought, particularly for objectives such as improve the quality of OH&S training. However, it is possible to devise appropriate measures which allow for quantified objectives.

Verification guidance: Answer "No" to this question if one or more of the OH&S

objectives is not quantified when it would have been practicable to produce a

quantified version.

4.3.4. OH&S Management Programme(s)

Section 4.3.4.1 OH&S Management Programme(s) - Written Procedure

Is there a written procedure dealing with how management programme(s) will be

established and documented?

Guidance: OHSAS 18001 requires that an organisation has a documented management programme (or, if necessary, management programmes) for achieving its OH&S objectives. Management programmes, and their maintenance, must be the subject of a written procedure and this question tests whether such a procedure exists. The adequacy of the procedure is tested by the rest of the questions in this section.


purports to be the organisation's OH&S management programme(s) procedure. The


evaluation.

Question 4.3.4.1.1

Is ensuring that all OH&S objectives are included in a management programme dealt

with adequately in the written procedure on management programme(s)?

Guidance: OH&S objectives which are not included in the management programme may be given insufficient attention and as a result fail to be achieved. Where they are used, OH&S objectives for functions and levels should all be included in the management programme(s).

Verification guidance: Answer "No" to this question if the inclusion of all OH&S

objectives in a management programme is not dealt with in the written procedure on

management programme(s), OR the statement on the inclusion of all OH&S

objectives is inadequate in any way.

Question 4.3.4.1.2

Is the allocation of responsibility and authority for achieving OH&S objectives dealt

with adequately in the written procedure on management programme(s)?

Guidance: OHSAS 18001 requires that details of the designated responsibility and

authority for the achievement of each OH&S objective be included in the

management programmes(s).

Verification guidance: Answer "No" to this question if responsibility or authority for

achieving one or more of the OH&S objectives is not dealt with in the written

procedure on management programme(s), OR the statement on responsibility or

authority is inadequate in any way.

Section 4.3.4.2 Management Programme(s) - Implementation

Is there a written management programme (or programmes) for achieving OH&S

objectives?

Guidance: OHSAS 18001 requires that an organisation has a documented management programme (or, if necessary, management programmes) for achieving its OH&S objectives. Management programmes, and their maintenance, must meet certain criteria and these are dealt with in the questions in this section of the evaluation.

Verification guidance: Answer "Yes" to this question if there is a document (or

documents) which purports to be the organisation's management programme(s). The

adequacy of the programme(s) is tested by the other questions in this section of the

evaluation. Where there is more than one management programme, the questions in

this section should be answered on the basis of one of these, selected as follows.

Where there is a hierarchy of management programmes, select the management

programme for the highest level of management.

Note. Management programmes for lower levels are tested in the SMi evaluation.

Where there is no hierarchy of management programmes, select the management

programme which covers the location at which the SMS is being audited and answer

"No" to this question if there is no management programme covering this location.

Question 4.3.4.2.1

Are all OH&S objectives for all functions dealt with adequately in the management

programme?

Guidance: OH&S objectives which are not included in the management programme may be given insufficient attention and as a result fail to be achieved.

Verification guidance: Answer "No" to this question if one or more of the relevant

OH&S objectives is not included in the management programme.

Question 4.3.4.2.2

Are all OH&S objectives for all levels dealt with adequately in the management

programme?

Guidance: OH&S objectives which are not included in the management programme may be given insufficient attention and as a result fail to be achieved.

Verification guidance: Answer "No" to this question if one or more of the relevant

OH&S objectives is not included in the management programme.

4.4. Implementation and Operation

4.4.1. Structure and Responsibility

Section 4.4.1.1 Structure and Responsibility - Written Procedure

Is there a written procedure describing how the organisation will maintain the

structure for OH&S management and allocate responsibility for OH&S management?

Guidance: If OH&S management is to be effective, there must be an appropriate management structure which facilitates communication on OH&S matters and allows for the clear allocation of OH&S responsibilities. Organisations must decide how they will maintain their OH&S management structure, and how they will allocate OH&S responsibilities, and record the relevant details in a written procedure. This question tests whether there is a written procedure, and the adequacy of the procedure is tested by the remainder of the questions in this section.


purports to be the organisation's structure and responsibility procedure. The


evaluation.

Question 4.4.1.1.1

Is the maintenance of an appropriate management structure dealt with adequately in

the written procedure on structure and responsibility?

Guidance: Organisations must implement and document an appropriate OH&S

management structure, and the documentation must be kept up to date. The written

procedure on structure and responsibility should describe how the organisation will

maintain an appropriate OH&S management structure and how the record of the

OH&S management structure will be kept up to date.

Verification guidance: Answer "No" to this question if OH&S management structure

is not dealt with in the written procedure on structure and responsibility, OR the

statement on structure does not deal with one or more of the issues raised in the

guidance to this question, OR the statement on structure is inadequate in any other

way.

Question 4.4.1.1.2

Are the methods to be used by managers for demonstrating personal commitment to

the continual improvement of OH&S performance dealt with adequately in the written

procedure on structure and responsibility?

Guidance: Managers must not only discharge their OH&S responsibilities effectively, the must also demonstrate to each other, to employees and to other interested parties that they are committed to continual improvement in OH&S performance. Commitment can be demonstrated in a variety of ways, including attendance at OH&S meetings, raising OH&S matters during discussions on operational issues, taking part in investigations and personally complying with all of the organisation's OH&S requirements. The written procedure on structure and responsibility should describe an appropriate range of methods.

Verification guidance: Answer "No" to this question if the methods to be used for

demonstrating personal commitment are not dealt with in the written procedure on

structure and responsibility, OR any of the methods listed is inappropriate, OR the

statement on demonstrating commitment is inadequate in any other way.

Question 4.4.1.1.10

Is the provision of resources dealt with adequately in the written procedure on

structure and responsibility?

Guidance: Management must provide resources for the implementation, control and

improvement of the OH&S management system and organisations must document

how this resource provision will be carried out.

Verification guidance: Answer "No" to this question if resource provision is not

dealt with in the written procedure on structure and responsibility, OR one or more of

the categories of resources described in the guidance to this question is not dealt

with, OR the statement on resource provision is inadequate in any other way.

Section 4.4.1.2 Demonstrated Commitment – Implementation

Question 4.4.1.2.1

Do all those with management responsibility demonstrate their commitment to the

continual improvement of OH&S performance?

Guidance: Managers must not only discharge their OH&S responsibilities effectively, the must also demonstrate to each other, to employees and to other interested parties that they are committed to continual improvement in OH&S performance. Commitment can be demonstrated in a variety of ways, including attendance at OH&S meetings, raising OH&S matters during discussions on operational issues, taking part in investigations and personally complying with all of the organisation's OH&S requirements. Check with a representative sample of managers what they do to demonstrate their personal commitment. Check with a representative sample of employees and other interested parties what their views are on the demonstrated commitment of managers.

Verification guidance: Answer "No" to this question if there is any credible

evidence that one or more managers does not demonstrate commitment to continual

improvement in OH&S performance.

Section 4.4.1.3 Roles etc - Definition, Documentation and Communication

Guidance: The questions in this section check the definition, documentation and

communication of roles, responsibilities and authorities. Other aspects of roles,

responsibilities and authorities are checked in the SMi evaluation.

Question 4.4.1.3.1

Manage - defined. Are the roles, responsibilities and authorities of those who

manage activities having an effect on the organisation's OH&S risks defined and

documented?

Guidance: The effective management of the organisation's OH&S risks, which

include the risks arising from the organisation's activities, facilities and processes, is

essential for good OH&S performance. Important first steps in ensuring this are the

definition and documentation of the management roles, responsibilities and

authorities involved. Organisations should identify all of the relevant roles,

responsibilities and authorities of managers and record these in a suitable format.

Verification guidance: Answer "No" to this question if any of a representative

sample of OH&S management roles, responsibilities or authorities is not defined, OR

any of a representative sample of OH&S management roles, responsibilities or

authorities is not documented, OR the definition or documentation of any of a

representative sample of OH&S management roles, responsibilities or authorities is


Question 4.4.1.3.2

Manage - communicated. Are the roles, responsibilities and authorities of those who

manage activities having an effect on the organisation's OH&S risks communicated

to them?

Guidance: It is unlikely that roles and responsibilities will be discharged effectively,

or authority exercised effectively, unless the appropriate information is

communicated to the relevant managers. This is best done by having the relevant

managers agree the documented version of their roles, responsibilities and

authorities and retaining a written record of this agreement.

Verification guidance: Answer "No" to this question if any of a representative

sample of OH&S management roles, responsibilities or authorities is not

documented, OR if any of a representative sample of OH&S managers has not

agreed his or her roles, responsibilities or authorities, OR the communication of

OH&S management roles, responsibilities or authorities is inadequate in any other

way.

Section 4.4.1.4 Management Appointee - Implementation

Has a member of top management been allocated particular responsibility for

ensuring that the OH&S management system is properly implemented and

performing to requirements?

Guidance: OHSAS 18001 requires that a member of the organisation's top management is given special responsibilities with respect to OH&S. This person is known as the management appointee and this person's OH&S role must cover all locations and spheres of operation within the organisation. The activities of the management appointee have to meet certain criteria and these criteria form the basis of the questions in the remainder of this section. The present question merely checks that there is a designated management appointee.

Verification guidance: Answer "No" to this question if there is no management

appointee, OR there is no written record of the allocation of responsibilities to the

management appointee, OR the written record is inadequate in any way.

Question 4.4.1.4.1

Is the OH&S system established, implemented and maintained?

Guidance: If the OH&S management system is not established, implemented and maintained, then the management appointee is not meeting adequately this requirement of OHSAS 18001.

Verification guidance: Answer "No" to this question if the results from other

sections of the evaluation provide credible evidence that parts of the OH&S

management system have not been established, OR parts have not been

implemented, OR there are failures to maintain the OH&S management system.

Section 4.4.1.5 Resources - Implementation

Question 4.4.1.5.1

Implementation. Does management provide the resources essential for the

implementation of the OH&S management system?

Guidance: The resources required to implement an OH&S management system will vary from organisation to organisation, depending on, for example, the size of the organisation and the state of development of any existing OH&S management system. However, in most organisations, full implementation will take months or years and during the implementation period the management must provide the necessary resources. Required resources include human resources and specialised skills, technology and financial resources.

Verification guidance: Answer "NA" to this question if the OH&S management

system is fully implemented. Answer "No" to this question if there is credible

evidence that management are not providing any relevant resource, OR any relevant

resource is not provided at a sufficient level.

4.4.2. Training, Awareness and Competence

Guidance: Training, awareness and competence are related issues but training is

different from awareness and competence in that it is a technique. A person can be

trained and/or aware and/or competent and these are states of the individual.

However, training is a technique which can be used to deliver one or more of these

states. For this reason, the written procedure for competence and awareness is dealt

with in this evaluation as a separate document from the written procedure on

training. Organisations may, however, combine the documents if they wish. Note that

the order in the OHSAS 18001 title is training, awareness and competence but in the

sub clause these issues are dealt with in the order competence, awareness and

training. The sub clause order is used in this evaluation.

Section 4.4.2.1 Competence and Awareness - Written Procedure

Is there a written procedure, or procedures, dealing with competence and

awareness?

Guidance: OHSAS 18001 requires that all personnel are competent in those tasks they carry out which may impact on OH&S in the workplace. Organisations will, therefore, have to address issues such as competence needs analysis, how competences will be provided, and how competences will be measured. OHSAS 18001 also requires that personnel have the necessary awareness of OH&S issues so that OH&S awareness needs analysis and OH&S awareness provision will have to be addressed. The organisation's decisions on these matters will then have to be recorded in a written procedure.

Verification guidance: This question is a document check. Give a "Yes" answer if

there is a document which purports to be the organisation's OH&S competence and

awareness procedure. The adequacy of this document is tested by the remainder of

the questions in this section.

Question 4.4.2.1.1

Is the identification of tasks which may impact on OH&S in the workplace dealt with

adequately in the written procedure on competence and awareness?

Guidance: If organisations do not know which tasks may impact on OH&S in the

workplace then they will be unable to satisfy the requirement to ensure that

personnel are competent to carry out these tasks. However, the identification and

recording of relevant tasks may be carried out as part of another procedure, for

example, the risk assessment procedure.

Verification guidance: Answer "No" to this question if the identification of tasks

which may impact on OH&S in the workplace is not dealt with in the written

procedure on competence and awareness, OR the identification of relevant tasks is

dealt with inadequately. Note. Where this requirement is met by reference to another

procedure, a "Yes" answer can be given if the referenced procedure meets the

relevant criteria.

Question 4.4.2.1.11

Is the maintenance of OH&S awareness dealt with adequately in the written

procedure on competence and awareness?

Guidance: Awareness may deteriorate over time if there is no rehearsal or other method of maintaining awareness. Organisations must, therefore, have in place procedures for the periodic measurement of OH&S awareness to check that the required knowledge is still in place and still at an appropriate level of detail. The written procedure should set out the organisation's commitment to effective OH&S awareness maintenance and how this commitment will be met

Verification guidance: Answer "No" to this question if the maintenance of OH&S

awareness is not dealt with in the written procedure on competence and awareness,

OR the maintenance of OH&S awareness is dealt with inadequately.

Section 4.4.2.2 Competence - Impementation

Question 4.4.2.2.1

Is there an up to date record of all tasks which may impact on OH&S in the

workplace?

Guidance: OHSAS 18001 requires that employees are competent in all tasks which

may impact of OH&S in the workplace. It follows, therefore, that organisations have

to have identified all such tasks as a preliminary to assessing their competence

requirements.

Verification guidance: Answer "No" to this question if there is no list of tasks which

may impact on OH&S in the workplace, OR there is credible evidence that the list is

incomplete or out of date, OR the list is inadequate in any other way.

Question 4.4.2.2.2

Have the required competences been identified and recorded for all tasks which may

impact on OH&S in the workplace?

Guidance: OHSAS 18001 requires that employees are competent in all tasks which

may impact on OH&S in the workplace. It follows, therefore, that organisations have

to have identified all such tasks and assessed their competence requirements.

Adequate records must also have been made of the results of this work.

Verification guidance: Answer "No" to this question if there is no list of tasks which

may impact on OH&S in the workplace, OR there is credible evidence that the list is

incomplete or out of date, OR the list is inadequate in any other way, OR for one or

more tasks, there are no competence requirements described, OR the description of

competence requirements is inadequate in any way.

Section 4.4.2.3 Awareness - Implementation

Question 4.4.2.3.1

Is there an adequate list of OH&S awareness requirements for all employees?

Guidance: If there is not an adequate list of employees which includes details of the OH&S awareness requirements then it will be difficult for an organisation to manage its OH&S awareness provision or demonstrate to others that it is being managed effectively.

Verification guidance: Answer "No" to this question if there is no list of employees,

OR the list of employees is incomplete or out of date, OR the list does not include

details of OH&S awareness requirements, OR the specification of awareness

requirements is incomplete or out of date, OR the list is inadequate in any other way.

Section 4.4.2.4 Training - Written Procedure

Is there a written procedure dealing with OH&S training?

Guidance: For most organisations, training is the principal method used to provide OH&S competences and awareness and for this reason there should be a written procedure which sets out how the organisation will deal with OH&S training. This may be a separate document or it may form part of a more general training, awareness and competence procedure.


there is a document which purports to be the organisation's OH&S training

procedure. The adequacy of this document is tested by the remainder of the

questions in this section. Note, where there is no separate training procedure answer

the questions in this section by reference to the organisation's training, awareness

and competence procedure.

Question 4.4.2.4.1

Is the identification of which employees should receive OH&S training, and the

nature of the OH&S training to be received, dealt with adequately in the written

procedure on OH&S training?

Guidance: If there is not an adequate list of employees which includes details of the OH&S training they should receive then it will be difficult for an organisation to manage its OH&S training provision or demonstrate to others that they it is being managed effectively. Details of how these requirements will be met should be included in the written procedure on OH&S training.

Verification guidance: Answer "No" to this question if identifying which employees

should receive OH&S training is not dealt with in the written procedure on OH&S

training, OR the OH&S training employees should receive is not dealt with in the

written procedure on OH&S training, OR the statement on identification is


Section 4.4.2.5 Training - Implementation

Question 4.4.2.5.1

Is there an adequate list of which employees should receive OH&S training, and the

nature of the OH&S training to be received?

Guidance: If there is not an adequate list of employees which includes details of the OH&S training they should receive then it will be difficult for an organisation to manage its OH&S training provision or demonstrate to others that it is being managed effectively.

Verification guidance: Answer "No" to this question if there is no list of employees,

OR the list of employees is incomplete or out of date, OR the list does not include

details of required OH&S training, OR the specification of required training is

incomplete or out of date, OR the list is inadequate in any other way.

Question 4.4.2.5.2

Have all employees received appropriate OH&S training?

Guidance: Having specified the requirements for OH&S training, organisations must ensure that the required training is delivered in a timely and effective manner. Organisations must also ensure that adequate records are kept of all OH&S training delivered to employees.

Verification guidance: Answer "No" to this question if there is no adequate

specification of OH&S training requirements for employees, OR one or more of a

representative sample of employees has not received the required training, OR for

one or more of a representative sample of employees, training received has not

been recorded, or recorded inadequately, OR one or more of a representative

sample of employees has not received appropriate training for any other reason.

4.4.3. Consultation and Communication

Section 4.4.3.1 Consultation and Communication - Written Procedure

Is there a written procedure dealing with consultation and communication on OH&S

issues?

Guidance: OHSAS 18001 requires that organisations have procedures for ensuring that pertinent OH&S information is communicated to and from employees and other interested parties. This question checks whether there is a written procedure dealing with these issues. Whether the written procedure meets the OHSAS 18001 detailed requirements is tested by the remainder of the questions in this section.


there is a document which purports to be the organisation's consultation and

communication procedure. The adequacy of this document is tested by the

remainder of the questions in this section.

Question 4.4.3.1.1

Is communication with all relevant employees dealt with adequately in the written

procedure on consultation and communication?

Guidance: Communication to and from employees is required by OHSAS 18001 and the written procedure should deal with the arrangements for communication in both directions. The procedure should also specify what will be considered pertinent OH&S information.

Verification guidance: Answer "No" to this question if the written procedure on

communication and consultation does not deal with communication to and from

employees, OR it does not specify what will be pertinent OH&S information, OR if

the statement on communication with employees is inadequate in any other way.

Section 4.4.3.2 Consultation and Communication - Implementation

Question 4.4.3.2.1

Is communication with all relevant employees implemented adequately?

Guidance: Communication to and from employees is required by OHSAS 18001and these communications should cover all pertinent OH&S information.

Verification guidance: Answer "No" to this question if there is credible evidence

that communication to or from employees is not adequate, OR these

communications do not cover all pertinent OH&S information.

4.4.4. Documentation - Implementation

Question 4.4.4.1

Is there documentation which adequately describes the core elements of the OH&S

management system?

Guidance: Core elements of the OH&S management system include policy, objectives,

management programmes and procedures such as those for risk assessment and emergency preparedness. Note that OHSAS 18001 emphasises that documentation should be kept to the minimum required for effectiveness and efficiency.

Verification guidance: Answer "No" to this question if any of the core elements of

the OH&S management system is not documented, OR the documentation for one

or more elements is inadequate.

4.4.5. Document and Data Control

Section 4.4.5.1 Document and Data Control - Written Procedure

Is there a written procedure dealing with the control of the documents and data

required by OHSAS 18001 and the OH&S management system?

Guidance: OHSAS 18001 requires that organisations maintain certain documents and data and these documents and data are dealt with elsewhere in the evaluation. However, OHSAS 18001 also requires that organisations have procedures for controlling these documents and data and it is these procedures which are the subject of the present section.


there is a document which purports to be the organisation's document and data

control procedure. The adequacy of this document is tested by the remainder of the

questions in this section.

Question 4.4.5.1.1

Are the arrangements for keeping documents and data up to date dealt with

adequately in the written procedure on document and data control?

Guidance: The procedure for keeping documents and data up to date should include, as a minimum, their periodic review, with revisions as necessary, and their approval for adequacy by authorized personnel.


document control does not deal with keeping documents and data up to date, OR the

statement on keeping documents and data up to date does not cover adequately one

or more of the issues given in the guidance to this question, OR the statement on

keeping documents and data up to date is inadequate in any other way.

Section 4.4.5.2 Document and Data Control - Implementation

Question 4.4.5.2.1

Is there an adequate list of the OH&S documents required by the OH&S

management system?

Guidance: Unless the organisation maintains a list of the documents required by its OH&S management system it will be difficult to ensure that these documents are effectively managed, and to demonstrate effective management to others. To be adequate, the list of documents must be up to date.

Verification guidance: Answer "No" to this question if there is no list of the

documents required by the OH&S management system, OR the list is incomplete,

OR the list is not up to date, OR the list is inadequate in any other way.

Question 4.4.5.2.2

Is there an adequate list of the OH&S data required by the OH&S management

system?

Guidance: Unless the organisation maintains a list of the data required by its OH&S management system it will be difficult to ensure that these data are effectively managed, and to demonstrate effective management to others. To be adequate, the list of data must be up to date.

Verification guidance: Answer "No" to this question if there is no list of the data

required by the OH&S management system, OR the list is incomplete, OR the list is

not up to date, OR the list is inadequate in any other way.

4.4.6. Operational Control

Section 4.4.6.1 Design - Written Procedure

Is there a written procedure dealing with design intended to eliminate or reduce risks

at their source?

Guidance: The elimination or reduction of risks at their source is the preferred OH&S strategy and OHSAS 18001 requires that organisations have documented design procedures which are intended to achieve these aims. This question tests whether the organisation has a written procedure, its adequacy is tested by the other questions in this section.


there is a document which purports to be the organisation's design procedure. The

adequacy of this document is tested by the remainder of the questions in this

section.

Question 4.4.6.1.1

Is the elimination or reduction of OH&S risks at their source dealt with adequately in

the written procedure on design?

Guidance: The overall aim of the design procedure should be to ensure that methods of elimination or reduction of risk are given adequate consideration during the design process. Organisations should decide how they will ensure that this happens and record details in their design procedure.

Verification guidance: Answer "No" to this question if the written design procedure

does not deal with the elimination or reduction of risk at source, OR the statement on

the elimination or reduction of risk at source is inadequate in any way.

Question 4.4.6.1.2

Are OH&S risks associated with the workplace dealt with adequately in the written

design procedure?

Guidance: OHSAS 18001 requires that the organisation's written design procedure deals adequately with the elimination or reduction at source of OH&S risks arising from the workplace.

Verification guidance: Answer "No" to this question if the written procedure does

not deal with OH&S risks arising from the workplace, OR the statement on these

risks is inadequate in any way.

Section 4.4.6.2 Preparation of Work Procedures - Written Procedure

Is there a written procedure dealing with the preparation of work procedures?

Guidance: OHSAS 18001 requires that organisations identify those situations where the absence of an appropriate procedure could lead to deviations from the OH&S policy or from OH&S objectives. In effect, organisations have to have a procedure for identifying the need for, and preparing, work procedures. This question tests for the existence of such a procedure, its adequacy is tested by the other questions in this section.


there is a document which purports to be the organisation's procedure for the

preparation of work procedures. The adequacy of this document is tested by the


Question 4.4.6.2.1

Is identification of required work procedures dealt with adequately in the written

procedure on the preparation of work procedures?

Guidance: All tasks which require written work procedures as part of the organisation's OH&S risk control arrangements must be identified, although this may be done as part of the hazard identification and risk assessment procedure. Whatever approach to identification the organisation takes, details should be recorded, or referenced, in the written procedure on preparing work procedures.

Verification guidance: Answer "No" to this question if the identification of tasks

requiring work procedures is not dealt with in the written procedure on preparing

work procedures, OR the statement on task identification (in the document or

referenced) is inadequate in any way.

Section 4.4.6.3 "Imported" Risks - Written Procedure

Is there a written procedure dealing with risks arising from "imported" risks?

Guidance: OHSAS 18001 requires that organisations identify any risks associated with goods, equipment and services which the organisation purchases and/or uses. For brevity these are referred to in this evaluation as "imported" risks. This question checks whether the organisation has a written procedure, its adequacy is checked by the remainder of the questions in this section.


there is a document which purports to be the organisation's procedure on "imported"

risks. The adequacy of this document is tested by the remainder of the questions in

this section.

Question 4.4.6.3.1

Is the identification of "imported" goods, services etc dealt with adequately in the

written procedure on "imported" risks?

Guidance: Organisations will have to have in place arrangements for identifying

goods, services etc which come into the organisation. If this is not the case then it

will be difficult for the organisation to manage any risks associated with these goods

and services. Details of how entry into the organisation will be controlled should be

included in the written procedure.

Verification guidance: Answer "No" to this question if the identification of goods

and services is not dealt with in the written procedure on "imported" risks, OR the

statement does not cover all relevant goods, services etc, OR the statement is


4.4.7. Emergency Preparedness and Response

Section 4.4.7.1. Written procedure

Is there a written procedure dealing with emergency preparedness and response?

Guidance: Organisations must have in place arrangements for identifying the requirements for emergency responses and for planning and testing required emergency responses. These arrangements should be recorded in a written procedure. This question tests whether there is such a procedure, its adequacy is tested by the other questions in this section.


there is a document which purports to be the organisation's procedure on emergency

preparedness and response. The adequacy of this document is tested by the


Question 4.4.7.1.1

Is the identification requirements for an emergency response dealt with adequately in

the written procedure on emergency preparedness and response?

Guidance: If organisations have not identified all foreseeable requirements for an emergency response then they will not have had the opportunity to plan their responses. Details of how requirements for an emergency response will be identified should be included in the written procedure on emergency preparedness and response.

Verification guidance: Answer "No" to this question if the identification of

requirements for an emergency response is not dealt with in the written procedure on

emergency preparedness and response, OR the statement is inadequate in any way.

Section 4.4.7.2 Emergency Preparedness and Response – Implementation

Is an up to date copy of the written procedure on emergency preparedness and

response available at the location?

Guidance: Organisations must have in place arrangements for identifying the

requirements for emergency responses and for planning and testing required

emergency responses. These arrangements should be recorded in a written

procedure and a copy of the procedure made available at every relevant location.

Answer "No" to this question if there is no copy of the hazard emergency

preparedness and response procedure at the location, OR the copy available is out

of date.

Question 4.4.7.2.1

Is the location complying with all of the requirements of the written procedure on

emergency preparedness and response?

Guidance: The location must comply fully with all of the requirements of the emergency preparedness and response procedure.

Verification guidance: Answer "No" to this question if there is credible evidence

that the location is not complying with one or more of the requirements of the written

emergency preparedness and response procedure. Note. It will normally only be

possible to answer this question after completing the second part of this evaluation.

4.5. Checking and Corrective Action

4.5.1 Performance Measuring and Monitoring

Guidance: Measuring and monitoring are two related processes and in this

evaluation they are given the following meanings.

Measuring. The collection of quantified data on any aspect of OH&S performance.

Monitoring. The checking of OH&S performance against a standard and taking

corrective action when non-conformances are identified.

Monitoring can include measuring by, for example, recording the number of non-

conformances identified during a workplace inspection and, in general, this type of

monitoring is to be preferred.

Section 4.5.1.1 Performance Measuring and Monitoring - Written Procedure

Is there a written procedure dealing with the measurement and monitoring of OH&S

performance in the organisation?

Guidance: OHSAS 18001 requires that organisations measure and monitor OH&S performance on a regular basis and organisations should have a written procedure describing how they will meet these requirements. This question checks that there is such a procedure, its adequacy is tested by the remainder of the questions in this section.


there is a document which purports to be the organisation's measuring and

monitoring procedure. The adequacy of this document is tested by the remainder of


Question 4.5.1.1.1

Is the allocation of responsibilities for measuring and monitoring dealt with

adequately in the written procedure on measuring and monitoring?

Guidance: If responsibility is not clearly allocated then aspects of measuring and monitoring may not be dealt with effectively.

Verification guidance: Answer "No" to this question if the allocation of

responsibilities is not dealt with in the written procedure on measuring and

monitoring, OR the allocation of responsibilities is not appropriate to the

organisation, OR the statement on responsibilities is inadequate in any other way.Section 4.5.1.2 Monitoring Performance - Implementation

Question 4.5.1.2.1

OH&S objectives. Are there effective arrangements for monitoring the extent to

which the organisation meets its OH&S objectives?

Guidance: Effective arrangements will include the collection of relevant data,

checking that the data are complete and accurate, and appropriate statistical

analyses. Separate procedures may be required for quantitative and qualitative

OH&S objectives.

Verification guidance: Answer "No" to this question if there is any credible

evidence that the organisation is not monitoring the extent to which it meets its

OH&S objectives, OR this monitoring is inadequate in any way.

Question 4.5.1.2.2

OH&S management programme(s). Are there effective arrangements for monitoring

the extent to which the organisation meets its OH&S management programme(s)?

Guidance: Effective arrangements will include the collection of relevant data,

checking that the data are complete and accurate, and appropriate statistical

analyses. Separate procedures may be required for quantitative and qualitative

aspects of the management programme(s).

Answer "No" to this question if there is any credible evidence that the organisation is

not monitoring the extent to which it meets its OH&S management programme(s),

OR this monitoring is inadequate in any way.

Section 4.5.1.3 OH&S Monitoring Equipment - Written Procedure

Is there a written procedure dealing with equipment required for OH&S monitoring?

Guidance: OH&S monitoring equipment includes, for example, noise meters, light meters and air sampling equipment. Organisations should have a written procedure dealing with OH&S monitoring equipment and this question tests for the existence of such a procedure. The adequacy of the procedure is tested by the other questions in this section.


there is a document which purports to be the organisation's OH&S monitoring

equipment procedure. The adequacy of this document is tested by the remainder of


Question 4.5.1.3.1

Is the identification of the need for OH&S monitoring equipment dealt with

adequately in the written procedure on the equipment required for OH&S

monitoring?

Guidance: Organisations must have effective arrangements for identifying its requirements with respect to OH&S monitoring equipment and record details of these arrangements in the written procedure.

Verification guidance: Answer "No" to this question if the identification of

requirements for OH&S monitoring equipment is not dealt with in the written

procedure on OH&S monitoring equipment, OR the statement on identification is

inadequate in any way.

4.5.2. Accidents etc and Corrective and Preventive Action

Guidance: The full title of this sub-clause is "Accidents, incidents, non-

conformances and corrective and preventive action".

Section 4.5.2.1 Accidents, Incidents and Non-conformances - Written Procedure

Is there a written procedure dealing with accidents, incidents and non-

conformances?

Guidance: OHSAS 18001 requires organisations to deal effectively with accidents, incidents and non-conformances. In addition, accidents, incidents and non-conformances must be investigated. Organisations must, therefore, have a written procedure setting out how they will manage these aspects of the OH&S management system.


there is a document which purports to be the organisation's OH&S accident, incident

and non-conformance procedure. The adequacy of this document is tested by the


Question 4.5.2.1.1

Is responsibility for the handling of accidents, incidents and non-conformances dealt

with adequately in the written procedure dealing with accidents, incidents and non-

conformances?

Guidance: When an accident or incident occurs, or a non-conformance is identified, certain

actions will be required, including immediate mitigation of consequences, subsequent investigation of the causes, and the recording of relevant information. Organisations must identify the particular actions to be included in the term "handling" and set these out in the written procedure. Responsibility for these actions should then be allocated in writing, either to specific individuals or to categories of personnel such as "managers" or "supervisors".


accidents, incidents and non-conformances does not deal with the handling of

accidents, incidents and non-conformances OR there is no list of activities which

constitute handling, OR the statement on the handling of accidents, incidents and

non-conformances is inadequate in any other way.

Section 4.5.2.2 Corrective and Preventive Action - Written Procedure

Is there a written procedure dealing with corrective and preventive action?

Guidance: OHSAS 18001 requires that organisations take appropriate corrective and preventive actions following an accident, incident or non-conformance and that the effectiveness of these actions is monitored. Organisations will require a written procedure setting out how they will meet these requirements.


there is a document which purports to be the organisation's OH&S corrective and

preventive action procedure. The adequacy of this document is tested by the


Question 4.5.2.2.1

Is responsibility for the installation and completion of actions dealt with adequately in

the written procedure on corrective and preventive action?

Guidance: Recommendations for preventive and corrective actions arising from the

investigation of accidents, incidents and non-conformances will only be effective if

they are installed or completed, as appropriate. In order to ensure that this is done,

organisations must clearly allocate responsibility for the actions required and record

this allocation in writing.


corrective and preventive action does not deal with the installation and completion of

corrective and preventive actions, OR there is no list of responsibilities for carrying

out these actions, OR the statement on the installation and completion of corrective

and preventive actions is inadequate in any other way.

4.5.3. Records and Record Management Action

Section 4.5.3.1 Records and Record Management - Written Procedure

Is there a written procedure dealing with records and record management?

Guidance: OHSAS 18001 requires organisations to establish and maintain procedures for dealing with OH&S records and their management and these procedures should be documented. The written procedure dealing with records and their management must meet certain criteria and these are the subject of the questions in this section.


there is a document which purports to be the organisation's OH&S record and record

management procedure. The adequacy of this document is tested by the remainder

of the questions in this section.

Question 4.5.3.1.1

Is the identification of required records dealt with adequately in the written procedure

on records and record management?

Guidance: Organisations must, initially, identify their requirements for OH&S records and write down details of the records which are to be kept. In addition, there must be written arrangements for monitoring the need for additional types of OH&S records.


records and record management does not deal with the ongoing identification of

needs for OH&S records, OR there is no list of OH&S records given or referenced,

OR the statement on the identification of required OH&S records is inadequate in

any other way.

Question 4.5.3.1.2

Is the maintenance of records dealt with adequately in the written procedure on

records and record management?

Guidance: Records must be maintained in ways which enable the organisation to

demonstrate that the OH&S management system is operating effectively. This will

include ensuring that the records are stored in ways which avoid damage or loss,

which ensure confidentiality when this is necessary, and which enable retention for

time periods sufficient to meet legal and other OH&S requirements on document

retention. Where records are stored electronically, any legal issues, or technical

issues, associated with such storage must be addressed. Records, whether on

paper or on electronic media, must be readily retrievable.


records and record management does not deal with the maintenance of OH&S

records, OR one or more of the issues listed in the guidance to this question is not

addressed, OR the statement on the maintenance of required OH&S records is


Section 4.5.3.2 Records and Record Management - Implementation

Question 4.5.3.2.1

How adequate is the organisation's range of OH&S records?

Guidance: Organisations should have a range of OH&S records which is appropriate to the organization and its OH&S management, system, and which enables the organisation, to demonstrate conformance to the OHSAS 18001 specification. Typical requirements for OH&S records include the following.

- Accident and incident reports and reports on the follow up to accidents and

incidents.

- Reports from audits, management reviews and OH&S meetings.

- Medical test results and health surveillance results.

- OH&S training records.

- Hazard identification, risk assessment and risk control records.

- The results of OH&S inspections.

Award 100% for this question only if the range of OH&S records in use in the

organisation is commensurate with the organisation's activities and its OH&S

management system. Deduct 10% for each type of record which should be in use

and is not. Note. Where one or more types of record is not in use, auditors should

reduce the percentage scores for the remainder of the questions in this section. See

the relevant verification guidance for details.

Question 4.5.3.2.2

What percentage of OH&S records are legible?

Guidance: Illegible records are of limited value, and may be of no value at all. Where documents are signed, it should be possible to identify the name of the signatory.

Verification guidance: Inspect a representative sample of the organisation's OH&S

records. Award percentage score depending on the proportion of records containing

one or more illegible items.

Note. Where the organisation does not have a complete range of OH&S records, the

starting percentage for this question should be reduced. For example, if 80% was

awarded for the question on the organisation's range of records, then the present

question should have a maximum score of 80%.

4.5.4. Audit

Section 4.5.4.1 Audit - Written Procedure

Is there a written procedure dealing with audits of the organisation?

Guidance: OHSAS 18001 requires that organisations carry out periodic OH&S management system audits and, as with all elements of the OH&S management system, organisations should have a written procedure for audit. This written procedure must meet certain criteria and these are dealt with in the questions in this section.


there is a document which purports to be the organisation's OH&S audit procedure.

The adequacy of this document is tested by the remainder of the questions in this

section.

Question 4.5.4.1.1

Is the scope of the audit(s) dealt with adequately in the written procedure on audits?

Guidance: Audits should be used to check all aspects of an organisation's OH&S

management system, and all of the organisation's activities. Organisations will have

to consider how they will meet these requirements and record the results of their

decisions.

Verification guidance: Answer "No" to this question if there is no clear statement of

the scope of the organisation's OH&S audits, OR the stated scope does not cover all

of the OH&S management system, OR the stated scope does not cover all relevant

activities, locations etc.

Question 4.5.4.1.2

Is the frequency of the audit(s) dealt with adequately in the written procedure on

audits?

Guidance: Although there is no specified frequency for audits in OHSAS 18001,

OHSAS 18002 recommends an annual plan of audits which will cover all elements of

the OH&S management system and the whole organisation covered by the OH&S

management system. All aspects of compliance with OHSAS 18001 have to be

audited and organisations should decide on the frequency with which this will be

done on the basis of risk assessment results and the results of previous audits.

However, note the following.

- Some elements of the OH&S management system and some of the organisation's

activities may be more critical than others and organisations may decide to audit

these more frequently.

- Audit frequencies may change on the basis of OH&S performance with, for

example, audit frequencies being increased following poor audit results or accidents.

Verification guidance: Answer "No" to this question if there is no statement on audit

frequencies, OR the frequency specified for audits of the whole OH&&S

management system is inappropriate, OR no account is taken of the possible need

for more frequent audits, OR the statement on frequency is inadequate in any other

way.

Section 4.5.4.2 Audit Programme

Is there a written programme of audits?

Guidance: OHSAS 18001 requires organisation to establish and maintain an audit programme. This should describe what audits will be carried out, and where and when they will be carried out. Where an organisation will be using both internal and external audits, both types should be covered in the audit programme. This question checks that an organisation has a written audit programme, the adequacy of the programme is tested by the other questions in this section.


there is a document which purports to be the organisation's OH&S audit programme.

The adequacy of this document is tested by the remainder of the questions in this

section.

Question 4.5.4.2.1

Is the audit programme based on the results of risk assessments of the

organisation's activities?

Guidance: Factors which may be identified during a risk assessment which can influence the appropriate frequency for audits include the absolute level of risk, the reliability of the risk control measures in use, and the rate of change in activities. While organisations with a limited range of activities may find it appropriate to audit all of these activities at the same frequency, this is unlikely to be the case in organisations with a wide range of activities of varying levels of risk.


programme of audits, OR there is no clear evidence that the results of risk

assessments have been taken into account in drawing up the audit programme, OR

the account taken of risk assessments is inadequate in any other way.

Section 4.5.4.3 Last Audit

Has the organisation's headquarters' function been audited?

Guidance: This section contains questions which test whether the last audit of the organisation's headquarters' function met the OHSAS 18001 requirements for OH&S audits. The adequacy of audits at other locations and of other functions should be tested using the 18001 SMi Evaluation. If the organisation's headquarters' function has not been audited for a valid reason, for example, implementation of OHSAS 18001 is in its early stages, then answer "Yes" to this question and "NA" to the rest of the questions in this section.

Answer "No" to this question if organisation's headquarters' function has not been

audited, OR the audit did not take place within the time period specified for this audit.

If the answer is "No" to this question then give "No" answers to the rest of the


Question 4.5.4.3.1

Planned arrangements. Did the last audit include an adequate determination of

whether the OH&S management system conformed with planned arrangements?

Guidance: Organisations have to assure themselves that what they have planned is in fact being carried out, and effective audit is one way of obtaining this assurance. Planned arrangements of relevance to OH&S include safe work procedures, the provision of personal protective equipment, machinery guarding, and so on.

Verification guidance: Answer "No" to this question if the written report of the last

audit did not refer to conformance with planned arrangements, OR the sample of

planned arrangements audited was not representative, OR the recommendations on

planned arrangements were inadequate, OR planned arrangements were dealt with

inadequately in any other way.

Question 4.5.4.3.2

OHSAS 18001 requirements. Did the last audit include an adequate determination of

whether the OH&S management system conformed with OHSAS 18001

requirements?

Guidance: While OHSAS 18001 allows for a wide range of variation in OH&S management systems, they must all comply with certain key requirements. This question tests whether the last audit included an adequate check that the organisation's OH&S management system complied with OHSAS 18001 requirements. Whether the OH&S management system implementation and maintenance were audited is tested elsewhere in this evaluation.

Verification guidance: Answer "No" to this question if the written report of the last

audit did not refer to conformance with OHSAS 18001 requirements, OR the sample

of OHSAS 18001 requirements audited was not representative, OR the

recommendations on OHSAS 18001 requirements were inadequate, OR OHSAS

18001 requirements were dealt with inadequately in any other way.

4.6. Management Review

4.6.1. Management Review - Written Procedure

Is there a written procedure dealing with the requirements for management review?

Guidance: One of the required OH&S management system elements is management review and the organisation's procedure for management review should be documented. The management review must meet certain criteria and these are dealt with in the remainder of the questions in this section.


there is a document which purports to be the organisation's management review

procedure. The adequacy of this document is tested by the remainder of the


Question 4.6.1.1

Are the requirements for top management to take part in management reviews dealt

with adequately in the written procedure on management reviews?

Guidance: The OHSAS 18001 requirement is for the "top management" to carry out the management review but it is up to the organisation to decide, and record, who will be involved. In larger organisations, there may be more than one review team. For example, there may be a top management review team for the organisation as a whole and other teams at individual locations or for particular functions.

Verification guidance: Answer "No" to this question if the personnel to be involved

in management reviews are not specified in the written procedure, OR the number of

managers specified is not adequate, OR the level of managers specified is not

appropriate, OR this aspect of the written procedure is inadequate in any other way.

Question 4.6.1.2

Is the interval between management reviews specified adequately in the written

procedure on management reviews?

Guidance: OHSAS 18001 does not impose a frequency for management reviews but OHSAS 18002 suggests annual reviews, with more frequent partial reviews if these are required. However, where risks are high, there is rapid change, or the risk control measures in use are of low reliability, more frequent reviews may be necessary.

Answer "Yes" to this question only if the time period between reviews is clearly

specified. A "No" answer should be given if the time period is clearly specified but

the interval between management reviews is too long given the nature of the

organisation's OH&S risks, its rate of change, and the reliability of the risk control

measures in use.

4.6.2. Last Management Review

Was the last management review carried out within the specified time period?

Guidance: Organisations must specify a time period for their management reviews and ensure that the reviews are carried out within this time period. The questions in this section test the adequacy of the organisation's last management review but no marks can be awarded for this section if the organisation has not specified its review time period, or it has not conducted the last management review within the specified time period.

Verification guidance: Answer "No" to this question if the organisation has not

specified a time period for management reviews, OR the last management review

was not carried out within the specified time period. Note that a "No" answer to this

question means that a "No" answer must be given to all of the questions in this

section.

Question 4.6.2.1

Did an appropriate range of top management take part in the last management

review?

Guidance: Organisations should minute who took part in each management review and, if necessary, the roles each person played. What constitutes an appropriate range of top management will vary from organisation to organisation but the OH&S management review should be conducted by the people who are the "controlling mind" of the organisation.


who took part in the last management review, OR those who took part did not

adequately represent the "controlling mind" of the organisation, OR attendance at

the last management review was deficient in any other way.

Question 4.6.2.2

Was an adequate range of data considered at the last management review?

Guidance: The range of data appropriate to management review will vary from

organisation to organisation and is likely to change over time in any given

organisation. However, the following should be considered the minimum

requirements.

- Data on accidents, ill health and incidents.

- Data on emergencies, both actual and exercises.

- Data on the effectiveness of the individual elements of the OH&S management

system, for example, hazard identification, risk assessment and risk control.

- Data on the overall adequacy of the OH&S management system. These data, and,

if appropriate, the data on individual OH&S management system elements, should

be included in the management appointee's report.

- Data on the local effectiveness of the OH&S management system. These data

should be provided in the form of reports from individual local managers.

However, this list is not exhaustive. the management review team require an

accurate and detailed picture of current OH&S performance and the current level of

suitability, adequacy and effectiveness of the OH&S management system. The data

collected for, and used during, management reviews should be sufficient to achieve

these requirements.


the data considered at the last management review, OR the recorded list of data

omits one or more of the items described in the guidance to this question, OR there

is evidence to suggest that the range of data considered was inadequate in any

other way.

Benefits of OHSAS 18001Operational benefits to your organization:

Identify hazards, assess risks and implement the necessary risk control

measures

Measure and monitor achievement of your performance objectives

Establish clear roles, responsibilities and authorities for personnel who manage,

perform and verify activities having an effect on the OH&S risks of the

organization’s activities, facilities and processes

Ensure that personnel are competent to perform tasks that may impact OH&S in

the workplace

Ensure active monitoring of regulations and legal requirements

Ensure that OH&S information is communicated to and from employees and

other stakeholders effectively

Ensure the necessary measures and specified conditions are in place to control

identified risks

Define plans and procedures to identify the potential for and response to

emergency situations

Formalize incident investigation process

Monitor and measure OH&S performance on a regular basis

Reduce insurance costs through demonstrating better risk management.

Lead to a better public perception of your organization and you could also gain a

competitive advantage, leading to improved sales opportunities.

understanding how statutory and regulatory requirements impact on the

organization and your customers

Customer Confidence, Satisfaction and Trust

Ability to Differentiate Organisation for Competitive Advantage

Organisational Credibility & Reputation

The Elements of OHSAS 18001 Include:

Policy and commitment

Hazard identification, risk assessment & risk controls

Legal requirements

Objectives and Programs

Organization and personnel

Training, Communication and Consultation

Documentation and records

Operational Controls

Emergency Readiness

Measurement and monitoring

Accident and incident investigation, corrective and preventive action

Audit and Review

Application and Relevance in the Industry

Implementing OHSAS ensures:

Conformity to a specific OH&S policy

Implementation, maintenance and continuous improvement of the OH&S

management system

Reduced work-related accidents and illness

Reduced costs associated with accidents and illness

Improved performance through policies and procedures

Compliance to the latest legislation

Reduced risk of citations/penalties

Improved company image by demonstrating a commitment to manage and

minimize risks to employees and customers

The Steps to Registration

Decision on implementation and registration

Identify management and personnel for implementation

Preliminary review to determine existing programs and systems

Provide training and awareness

Identifying hazards and applicable laws and regulations

Established procedures to comply with OHSAS 18001

Train personnel on procedures

Implement procedures

Conduct audit and review