ISO 45001 – Analyzing the text – Requirements of Subclause 4.1 (Part 1)


In a previous post I have analyzed the context of the ISO 45001: 2018 standard, based on the information with which the International Organization for Standardization (ISO) presents both the management system standards and this particular one on its website, passing by the introductory elements, such as the Foreword of the standard itself and its clauses: 0. Introduction, 1. Scope, 2. Normative references, 3. Terms and definitions, ending with the complementary elements, such as the Annex A (informative) and the Bibliography.

As I have mentioned, I am elaborating these posts in an equivalent way in different management system standards, so some of the information may be repeated in posts referring to other of those standards.

Now, in this post on the ISO 45001: 2018 standard, I am beginning the analysis of its text, that is, the normative elements that make up its technical body, and which are the ones that comprise Clauses 4 to 10 of this standard.

I must start by clarifying that you will most likely find requirements or paragraphs in this standard that you may not understand their application or usefulness in your Occupational health and safety (OH&S) management system, but it is important that we understand that each of the requirements established in this standard, should generate value for the organization that implements them correctly.

In order to carry out this analysis, we must remember something that I have already cited in the previous post and is mentioned in the Introduction Clause of the standard, which, although it does not establish any specific requirement, provides us with a large amount of information, which we should always take into account, among which stands out that in this standard the following verb forms are used:

Source: International Organization for Standardization (ISO)

In the same way, it clarifies that the information identified as "NOTE" is presented as a guide for the understanding or qualification of the corresponding requirement.

Let us, therefore, begin the analysis of the content of Clause 4: Context of the organization, of the ISO 45001: 2018 standard. It is important to clarify that in this Clause 4 no requirement is specifically established, but four sub-clauses are displayed from it, which are listed below, and those do contain requirements:

If you want to establish, implement, verify, audit, maintain and improve an occupational health and safety management system in compliance with ISO 45001: 2018, I recommend that you do not, even slightly, ignore any of the clauses, subclauses and requirements of the standard, and that whenever you read and analyze one of those requirements, you consider it within the context of the organization, its structure, its processes and its documented support.

After this introduction, this time I will start with the analysis of Subclause 4.1. Understanding of the organization and its context, which establishes, in its first paragraph, the following requirements:

Requirement No. 1: The organization shall determine external issues that are relevant to its purpose, and that affect its ability to achieve the intended results of its occupational health and safety management system (OHMS).

Requirement No. 2: The organization shall determine internal issues that are relevant to its purpose, and that affect its ability to achieve the intended results of its OH&S management system.

Here we have the two requirements derived from Subclause 4.1 and which are the first to be presented by the ISO 45001: 2018 standard. If you read these two requirements carefully, and from that reading you try to understand them and comply with them, you will surely have many doubts about what elements to develop and include in your OH&S management system, both to comply with each of these requirements, and to be able to demonstrate compliance.

As you can see, this information is clearly insufficient for anyone who intends to comply with this subclause. I do not know the reason why when preparing this standard, as with ISO 14001:2015, the corresponding ISO Technical Committees decided to present this subclause in both standards so incompletely, but the truth is that, considering only the information presented in them, it is practically impossible for anyone to properly meet these requirements. Perhaps they took it for granted that all the organizations that were going to apply these two standards would do so jointly with ISO 9001, because in the latter these requirements are presented much more clearly.

That is why I will recommend that when you feel that a certain clause, paragraph or requirement of a management system standard, which particularly interests you, does not provide you with enough information to be able to fully understand its text, consult other management system standards, mainly those of quality, even if it is not going to establish a system for that discipline, to look for some information or clarification on these texts.

In relation to these first requirements of ISO 45001, I suggest you complement them with the following information:

- The one contained in the ISO 9000: 2015 standard, Quality management systems — Fundamentals and vocabulary, which, although related to quality management, contains some definitions that are applicable to all management system standards. One of these definitions is as follows:

Source: ISO 9000:2015

- The information of that same Subclause 4.1, but of the ISO 9001:2015 standard which, unlike this ISO 45001, contains three explanatory notes, which I include below:

NOTE 1: Issues can include positive and negative factors or conditions for consideration.

NOTE 2: Understanding the external context can be facilitated by considering issues that arise from the legal, technological, competitive, market, cultural, social and economic environments, whether international, national, regional or local.

NOTE 3: Understanding the internal context can be facilitated by considering issues related to values, culture, knowledge and performance of the organization.

With this complementary information, both the definition of the organization's context and the explanatory notes, we can better understand the aforementioned requirements.

In addition to these notes, the ISO 9001 standard contains other requirements that are very important for the correct fulfillment of the two aforementioned requirements, but which are not included in this ISO 45001 standard, so I will identify them as elements, with progressive numbering, and which are the following:

Element No. 3: The organization shall determine the external issues that are relevant to its strategic direction, and that affect its ability to achieve the intended results of its management system.

Element No. 4: The organization shall determine the internal issues that are relevant to its strategic direction, and that affect its ability to achieve the intended results of its management system.

Element No. 5: The organization shall monitor information about these external issues.

Element No. 6: The organization shall monitor information about these internal issues.

Element No. 7: The organization shall review information about these external issues.

Element No. 8: The organization shall review information about these internal issues.

I must emphasize that the requirements of this subclause 4.1, which establishes the ISO 45001 standard, are the first two mentioned. However, if your management system is integrated with the quality system (ISO 9001), you should also comply with the other elements that I have mentioned here, since they are requirements for the ISO 9001: 2015 standard.

In the event that you are establishing or operating your occupational health and safety management system individually, or in an integrated manner with the ISO 14001:2015 standard, I would suggest that you include all the additional elements to the ISO 45001 standard, which is including the ISO 9001 standard, and which are the ones I previously listed. It would seem that this inclusion of so many additional elements requires more work and responsibilities for the organization, but believe me, in the end, it would make it easier for you to comply with the requirements of the standard, and it would greatly improve your OH&S management system.

I believe that it is important that we correctly visualize each one of the requirements, and where appropriate the additional elements, without being confused by the way they are written and without mixing or entangling them with each other.

In this way we will be able to establish the necessary elements in our OH&S management system, which will allow us to comply with each of these requirements.

Now, in order to understand the meaning of these first requirements of the standard, it is important that we remember the conceptual model of the OS&H management system presented by the ISO 45001 standard, which is as follows:

Considering the information presented in this conceptual model, we can see that the initial stage of the activities of the OH&S management system is the one that refers to planning, both for the OH&S management system and for the processes, so all Clause 4. The organization and its context, including its subclauses and requirements, refer to preparation activities to include those planning inputs.

It is important to understand this consideration with respect to the requirements of the aforementioned Clause 4, that if the requirements established in its corresponding sub-clauses are not properly met, the organization will surely have problems to carry out valuable planning.

As I have already mentioned in a previous post, something that I have observed in my professional experience is that this Clause 4 is, of all the clauses of management system standards, including this ISO 45001: 2018, the least understood by organizations that have established and even certified their management systems, and therefore, in which there are more non-compliances or true non-conformities, although both internal auditors, external auditors (on behalf of its customers), as well as the evaluators of the certifying bodies are not interested or do not have the knowledge to identify them correctly, and from what I have seen, this clause does not seem to be of much interest to the accrediting bodies either, in relation to their proper compliance, and that is why that there are many organizations with certified management systems, but without proper compliance with Clause 4, and specifically the Sub-clause 4.1 of this and other management systems standards.

I believe that a very important point is that, those of us who dedicate ourselves to these activities related to standardized management systems, must always keep in mind that the management of an organization, or in particular of any of its components or systems, is actually an art, which can be supported by scientific, technological, methodological and documentary elements. There are many people immersed in this field of management systems, especially those who have technological training, who see those management systems standards as if they were a kind of cooking recipe; that is, by combining some ingredients and applying some techniques, the organization will be managed appropriately. Nothing further from reality. Most of these people can perfectly understand how closed systems work, without fully understanding that management systems are open systems, so there are countless factors, including the human one, that can affect them. This is a personal appreciation.

The establishment of objectives is a basic element of any management system or of the organization in general, since all the other activities that are going to be carried out by the organization will be to fulfill and verify the fulfillment of those objectives. However, no auditor or certification body will be able to qualify whether these objectives are well or poorly established, since they are elements of the strategic direction of the organization itself. However if, on the one hand, those objectives are very lax, or low, very little effort will be required from the organization to meet them, but its stakeholders will most likely be unhappy with its performance. But on the other hand, if those objectives are too high and restrictive, it would most likely be that no matter how many resources and efforts the organization applied, it would not be able to meet them, which would be generating discomfort and frustration among managers and staff.

Each objective established by an organization for a management system, in this case for OH&S, represents a possible result that should be desirable and achievable. If any of these objectives turn out to be undesirable or not achievable, it would be to the detriment of the organization.

This is the importance of the requirements included in Clause 4, in general, and particularly in Sub-Clauses 4.1 and 4.2. If an organization complies with them, it will facilitate that the objectives, which would be established in the planning stage (Clause 6 of the standard), are more likely to meet both conditions, that they are desirable and achievable.

If we consider the part of the strategic planning of the organization, the so-called strategic management must carry out the set of activities that are required in an organization, based on its mission, taking into account the vision and, where appropriate, the values ​​that have been recognized, in order to identify and establish the general objectives and policies of occupational health and safety, collectively referred to as "OS&H Policy". Based on these general OS&H objectives, the organization's strategic direction must deploy its specific objectives (operational planning), in order to establish its operational plans and OS&H goals (tactical planning). And precisely that is what these requirements of the standard are about, to establish mechanisms so that organizations can identify all those factors that come to affect, favorably or unfavorably, their strategic planning, and can evaluate those possible positive or negative impacts, in order to achieve greater precision in setting their OS&H objectives.

We can visualize this as follows:

Source: Palomares Hilton, Ernesto

It is important that the organization has defined, and you were aware of, its organizational structure, composition of top management, basic elements of its strategic and operational planning, including its actual performance data as well as relevant references of the industrial sector in which the organization operates, and information of relevant aspects at the local, national and international level that have an impact on the activities, performance and competitiveness of this organization referring, in this case, mainly to the concept of occupational health and safety. These elements are essential in order to meet these first requirements.

When the organization carry on strategic planning, all these issues, both external and internal should be considered, since if the organization can appropriately identify all factors influencing, both positively and negatively, its performance, it will be able to establish in the best way those objectives of its OH&S management system.

In part 2 of this post, I will conclude this analysis of the requirements of Sub-clause 4.1 of ISO 45001:2018, as well as the additional elements that I consider should be included in this OH&S management system.



Ernesto Palomares Hilton