IMPLICATIONS OF CHANGES TO OHSAS 18001 FOR CLIENTS

OHSAS 18001 - 1999 OHSAS 18001 - 2007 Implications for Clients

4.1 General The organisation shall establish and maintain The organization shall establish, document, Explanation of how it will fulfil the
requirements an OH&S management system, the implement, maintain and continually improve requirements of OHSAS 18001:2007
requirements of which are set out in clause 4 an OH&S management system in
accordance with the requirements of this Scope of OH&S management system
OHSAS standard and determine how it will required.
fulfil these requirements.

The organization shall define and document

the scope of its OH&S management system.

4.2 OH&S Policy There shall be an occupational health and Top management shall define and authorise Not just authorised – active definition /
safety policy authorised by the organisations the organization's OH&S policy and ensure involvement in the establishment of policy.
top management that clearly states overall that within the defined scope of its OH&S
health and safety objectives and a management system it: Establish a clear link to the scope. The
commitment to improving health and safety definition of the scope must be accurate.
performance. a) is appropriate to the nature and scale
This policy shall: of the organization’s OH&S risks; All specific commitments to be included e.g.
a) be appropriate to the nature and scale b) includes a commitment to prevention of ill heath.
of the organisations OH&S risks injury and ill health and continual
b) include a commitment to continual improvement in OH&S management Review and change the policy to have a
improvement and OH&S performance clear commitment within the documented
c) include a commitment to at least c) includes a commitment to at least policy as defined within the Standard (a – e).
comply with current applicable OH&S comply with applicable legal
legislation and with other requirements requirements and with other Key requirements being prevention of injury
to which the organisation subscribes requirements to which the organization and a commitment to at least comply with
d) be documented, implemented and subscribes that relate to its OH&S legislation and other requirements.
maintained hazards
e) be communicated to all employees with d) provides the framework for setting and a) Must ensure that there policy is
the intent that employees are made reviewing OH&S objectives, appropriate to their scope.
aware of their individual OH&S e) is documented, implemented and b) Policy must demonstrate commitment to
obligations maintained; injury & ill-health
f) be available to interested parties; and f) is communicated to all persons working c) The method of OH&S C.I. Performance
g) be reviewed periodically to ensure that under the control of the organization must be measurable
it remains relevant and appropriate to with the intent that they are made d) The policy must provide a framework for
the organisation aware of their individual OH&S setting objectives
obligations;

1
 IMPLICATIONS OF CHANGES TO OHSAS 18001 FOR CLIENTS

OHSAS 18001 - 1999 OHSAS 18001 - 2007 Implications for Clients

g) is available to interested parties; and Relationship of legal to hazards will have to

h) is reviewed periodically to ensure that it be demonstrated.
remains relevant and appropriate to the
organization. Policy review to be triggered by what
changes needs to be identified.

Review the process for communication of the

policy to include all those who are under the
control of the organisation (wherever that
may be or they are working) including
contractors.

4.3.1 Planning The organisation shall establish and maintain The organization shall establish, implement Prioritisation and documentation - This is
for hazard procedures for the ongoing identification of and maintain a procedure(s) for the ongoing now explicit – although good clients are
identification, hazards, the assessment of risks, and the hazard identification, risk assessment, and already doing this – methodology needs to
risk assessment implementation of control measures. These determination of necessary controls. be defined.
and risk control shall include: The procedure(s) for hazard identification
• Routine and non-routine activities; and risk assessment shall take into account: Reiterating the hierarchy of controls- makes
• Activities of all personnel having access to a) routine and non-routine activités; the requirement more explicit.
the workplace (including subcontractors b) activities of all persons having access
and visitors); to the workplace (including contractors The organisation must have a change
• Facilities at the workplace, whether and visitors); management process which includes hazard
provided by the organisation or others c) human behaviour, capabilities and identification and assessment of OHS risks
other human factors; related to the change.
The organisation shall ensure that the results d) identified hazards originating outside
of these assessments and the effects of the workplace capable of adversely Thorough review of all risk assessments to
these controls are considered when setting affecting the health and safety of ensure the new clauses are addressed.
its OH&S objectives. The organisation shall persons under the control of the
document and keep this information up to organization within the workplace (c) Explicit requirement to consider
date. e) hazards created in the vicinity of the behaviour safety & human factors e.g.
workplace by work-related activities mentality, personal appropriateness.
The organisation’s methodology for hazard under the control of the organization;
identification and risk assessment shall: f) Note It may be more appropriate for (d) Consideration of how this links into
• be defined with respect to its scope, such hazards to be assessed as an Emergency Preparedness & particularly the
nature and timing to ensure it is proactive environmental aspect. foreseeable (4.4.7)
rather than reactive

2
IMPLICATIONS OF CHANGES TO OHSAS 18001 FOR CLIENTS

OHSAS 18001 - 1999 OHSAS 18001 - 2007 Implications for Clients

• provide for the classification of risks and
identification of those that are to be g) infrastructure, equipment and materials Identification of hazards outside the
eliminated or controlled by measures as at the workplace, whether provided by workplace will need to be identified
defined in 4.3.3 and 4.3.4 the organization or others; communicated and assessed where
h) changes or proposed changes in the applicable, for example meteorological,
• be consistent with operating experience
organization, its activities, or materials; geological events, neighbours incidents;
and the capabilities of risk control
i) modifications to the OH&S transportation incidents; external societal
measures employed
management system, including actions.
• provide input into the determination of temporary changes, and their impacts
facility requirements, identification of on operations, processes, and (e) Must be aware of foreseeable significant
training needs and/or development of activities. hazards beyond their boundary of their
operational controls; j) any applicable legal obligations relating making are assessed
• provide for the monitoring of required to risk assessment and implementation
actions to ensure both the effectiveness of necessary controls (see also the (g) Must be able demonstrate a current
and timeliness of heir implementation Note to 3.12) status quo in regard to risk assessment
k) the design of work areas, processes,
installations, machinery/equipment, (h) as (g) must more systemic
Note. For further guidance on hazard operating procedures and work
identification, risk assessment and risk organization, including their adaptation (j) Against your hazards are their any specific
control see OHSAS 18002. to human capabilities legal obligations and have these been
The organization’s methodology for hazard assessed using required RA methodology
identification and risk assessment shall:
a) be defined with respect to its scope,
nature and timing to ensure it is Risk should be classified in prioritized
proactive rather than reactive; and method & be documented
b) provide for the identification,
prioritization and documentation of a) Must be able to demonstrate links
risks; the application of controls, as between Assessments & controls
appropriate.
For the management of change, the ‘establish’ =
organization shall identify the OH&S hazards process capability, repeatable
and OH&S risks associated with changes in defined capability.
the organization, the OH&S management
system, or its activities, prior to the
introduction of such changes.

3
 IMPLICATIONS OF CHANGES TO OHSAS 18001 FOR CLIENTS

OHSAS 18001 - 1999 OHSAS 18001 - 2007 Implications for Clients

The organization shall ensure that the results

of these assessments are considered when
determining controls.

When determining controls, or considering

changes to existing controls, consideration
shall be given to reducing the risks according
to the following hierarchy:

a) elimination
b) substitution
c) engineering controls
d) signage/warnings and/or administrative
controls
e) personal protective equipment.

The organization shall document and keep

the results of identification of hazards, risk
assessments and determined controls up to
date.

The organization shall ensure that the OH&S

risks and determined controls are taken into
account when establishing, implementing
and maintaining its OH&S management
system.

NOTE For further guidance on hazard

identification, risk assessment and risk
control, see OHSAS 18002.

4.3.2 Legal and The organisation shall establish and maintain The organization shall establish, implement Need to see visible links with H/S legal
other a procedure for identifying and accessing the and maintain a procedure(s) for identifying framework
requirements legal and other OH&S requirements that are and accessing the legal and other OH&S
applicable to it. requirements that are applicable to it. Duty expanded to persons under Client’s
control (contractors, visitors etc)

4
 IMPLICATIONS OF CHANGES TO OHSAS 18001 FOR CLIENTS

OHSAS 18001 - 1999 OHSAS 18001 - 2007 Implications for Clients

The organisation shall keep this information The organization shall ensure that these
up–to-date. It shall communicate relevant applicable legal requirements and other
information on legal and other requirements requirements to which the organization
to its employees and other interested parties. subscribes are taken into account in
establishing, implementing and maintaining
its OH&S management system.

The organization shall keep this information

up-to-date.
It shall communicate relevant information on
legal and other requirements to persons
working under the control of the organization,
and other relevant interested parties.

4.3.3 Objectives The organisation shall establish and maintain The organization shall establish, implement No new requirements of objectives, although
and documented occupational health and safety and maintain documented OH&S objectives, more clearly defined, practical.
programme(s) objectives, at each relevant function and at relevant functions and levels within the
level within the organisation. organization. Note the use of the word implement
Note objectives should be quantified
wherever practicable The objectives shall be measurable, where Measurable where possible.
When establishing and reviewing its practicable, and consistent with the OH&S
objectives, an organisation shall consider its policy, including the commitments to the Wider context for these Objectives to be
legal and other requirements, its OH&S prevention of injury and ill health, to linked back to Policy - Focus on Ill-health
hazards and risks, its technological options, compliance with applicable legal
its financial, operational and business requirements and with other requirements to There is now a defined requirement for
requirements, and the views of interested which the organization subscribes, and to adjustment of programmes.
parties. The objectives shall be consistent continual improvement.
with the OH&S policy, including the
commitment to continual improvement. When establishing and reviewing its Objectives should be related to the policy
objectives, an organization shall take into commitments including compliance with
account the legal requirements and other *legal & other requirements and
requirements to which the organization *the prevention of injury & ill health
subscribes, and its OH&S risks. It shall also *delivery of Continual improvement
consider its technological options, its
financial, operational and business
requirements, and the views of relevant

5
IMPLICATIONS OF CHANGES TO OHSAS 18001 FOR CLIENTS

OHSAS 18001 - 1999 OHSAS 18001 - 2007 Implications for Clients

interested parties.

The organization shall establish, implement

and maintain a programme(s) for achieving
its objectives. Programme(s) shall include as
a minimum

a) designation of responsibility and authority

for achieving objectives at relevant functions
and levels of the organization, and

b) the means and time-frame by which the

objectives are to be achieved.

The programme(s) shall be reviewed at

regular and planned intervals, and adjusted
as necessary, to ensure that the objectives
are achieved.

6
 IMPLICATIONS OF CHANGES TO OHSAS 18001 FOR CLIENTS

OHSAS 18001 - 1999 OHSAS 18001 - 2007 Implications for Clients

4.3.4 OH&S The organization shall establish and maintain 4.3.4 is Not in 14001:2004, as it is now
management (an) OH&S management programme(s) for merged into clause 4.3.3. The same
programme(s) achieving its objectives. This shall include treatment has been applied here.
documentation of:
a) The designated responsibility and
authority for achievement of the
objectives at relevant functions and
levels of the organization; and
b) The means and time-scale by which
objectives are to be achieved.

The OH&S management programme(s) shall

be reviewed at regular and planned intervals.
Where necessary the OH&S management
programme(s) shall be amended to address
changes to the activities, products, services,
or operating conditions of the organization.

4.4.1 The roles responsibilities and authorities of Top management shall take ultimate Specific requirement for defined
Structure and personnel, who manage, perform and verify responsibility for OH&S and the OH&S accountability holders to be defined (this new
responsibility activities having an effect on the OH&S risks management system. term and needs to be clarified).
of the organization’s activities, facilities and Accountable person is the person who has
(4.4.1 Resources, processes, shall be defined, documented Top management shall demonstrate its been charged by management to undertake
roles, and communicated in order to facilitate commitment by the described activities, but may have
responsibility, OH&S management. delegated the responsibility to a subordinate
accountability Ultimate responsibility for occupational health a) ensuring the availability of resources whilst retaining the accountability to top
and authority) and safety rests with top management. The essential to establish, implement, management.
organization shall appoint a member of top maintain and improve the OH&S
management (e.g. in a large organization, a management system. • Reference to accountabilities.
Board or executive committee member) with
• All persons effected by the
particular responsibility for ensuring that the NOTE 1 Resources include human
organisation’s. undertakings must be
OH&S management system is properly resources and specialized skills,
made aware of the designated
implemented and performing to requirements b) organizational infrastructure, technology
appointee.
in all locations and spheres of operation and financial resources.
within the organization.
Ensure that personnel are aware that they
Management shall provide resources c) defining roles, allocating responsibilities
have responsibilities appropriate to their
essential to the implementation, control and and accountabilities, and delegating
activities at all levels.

7
IMPLICATIONS OF CHANGES TO OHSAS 18001 FOR CLIENTS

OHSAS 18001 - 1999 OHSAS 18001 - 2007 Implications for Clients

improvement of the OH&S management authorities, to facilitate effective OH&S
system. management; roles, responsibilities, Requirement for communicating the identity
accountabilities, and authorities shall be of the top management appointee(s) and
NOTE Resources include human resources documented and communicated their responsibilities so that they can be
and specialized skills, technology and contacted.
financial resources. The organization shall appoint a member(s)
of top management with specific Clear communication needed.
The organization’s management appointee responsibility for OH&S, irrespective of other
shall have defined roles, responsibilities and responsibilities, and with defined roles and
authority for: authority for:
a) Ensuring that OH&S management a) ensuring that the OH&S management
system requirements are established, system is established, implemented and
implemented and maintained in maintained in accordance with this
accordance with this OHSAS OHSAS standard;
specification; b) ensuring that reports on the performance
b) Ensuring that reports on the of the OH&S management system are
performance of the OH&S management presented to top management for review
system are presented to top and used as a basis for improvement of
management for review and as a basis the OH&S management system.
for improvement of the OH&S NOTE 2 The top management appointee
management system. (e.g. in a large organization, a Board or
executive committee member) may delegate
All those with management responsibility some of their duties to a subordinate
shall demonstrate their commitment to the management representative(s) while still
continual improvement of OH&S retaining accountability.
performance.
The identity of the top management
appointee shall be made available to all
persons working under the control of the
organization.

All those with management responsibility

shall demonstrate their commitment to the
continual improvement of OH&S
performance.

8
IMPLICATIONS OF CHANGES TO OHSAS 18001 FOR CLIENTS

OHSAS 18001 - 1999 OHSAS 18001 - 2007 Implications for Clients

The organization shall ensure that persons in

the workplace take responsibility for aspects
of OH&S over which they have control,
including adherence to the organization’s
applicable OH&S requirements.

9
 IMPLICATIONS OF CHANGES TO OHSAS 18001 FOR CLIENTS

OHSAS 18001 - 1999 OHSAS 18001 - 2007 Implications for Clients

4.4.2 Training, Personnel shall be competent to perform The organization shall ensure that any Competency needs to be determined and
awareness and tasks that may impact on OH&S in the person(s) under its control performing tasks recorded.
competence workplace. Competence shall be defined in that may impact on OH&S is (are) competent
terms of appropriate education, training on the basis of appropriate education, More explicit in terms of best practice –
(4.4.2 and/or experience. training or experience, and shall retain Training needs analysis (TNA), evaluation of
Competence, associated records. effectiveness of training given
training and It shall establish and maintain procedures to
awareness) ensure that its employees working at each The organization shall identify training needs Extends to all persons working under its
relevant function and level are aware of: associated with its OH&S risks and its OH&S control (contractors, visitors etc)
a) the importance of conformance to the management system. It shall provide training
OH&S policy and procedures, and to the or take other action to meet these needs, More explicit requirements to be met, need
requirements of the OH&S management evaluate the effectiveness of the training or to consider training effectiveness and
system; action taken, and retain associated records. formalise training records.
b) the OH&S consequences, actual or
potential, of their work activities and the The organization shall establish, implement Human factors more explicit.
OH&S benefits of improved personal and maintain a procedure(s) to make
performance; persons working under its control aware of
c) their roles and responsibilities in a) the OH&S consequences, actual or
achieving conformance to the OH&S potential, of their work activities, their
policy and procedures and to the behaviour, and the OH&S benefits of
requirements of the OH&S management improved personal performance;
system, including emergency b) their roles and responsibilities and
preparedness and response importance in achieving conformity to
requirements (see 4.4.7); the OH&S policy and procedures and to
d) The potential consequences of the requirements of the OH&S
departure from specified operating management system, including
procedures. emergency preparedness and response
e) Training procedures shall take into requirements (see 4.4.7);
account differing levels of: c) the potential consequences of departure
f) Responsibility, ability and literacy; and from specified procedures.
g) Risk. d) Training procedures shall take into
account differing levels of:
e) responsibility, ability, language skills and
literacy; and
f) risk.

10
 IMPLICATIONS OF CHANGES TO OHSAS 18001 FOR CLIENTS

OHSAS 18001 - 1999 OHSAS 18001 - 2007 Implications for Clients

4.4.3 The organization shall have procedures for 4.4.3.1 Communication Clear and more focussed
Consultation and ensuring that pertinent OH&S information is
communication communicated to and from employees and With regard to its OH&S hazards and OH&S
other interested parties. management system, the organization shall
Employee involvement and consultation establish, implement and maintain a
(4.4.3
arrangements shall be documented and procedure(s) for Explicitly mentions communications with
Communication,
interested parties informed. visitors and contractors
participation and
Employees shall be: a) internal communication among the Contractors communications need to be
consultation)
a) Involved in the development and review various levels and functions of the documented also what happens to the
of policies and procedures to manage organization, results of the communication
risks; b) communication with contractors and
b) Consulted where there are any changes other visitors to the workplace Define process for receiving & responding to
that affect workplace health and safety; c) receiving, documenting and responding communications from external interested
c) Represented on health and safety to relevant communications from parties.
matters; and external interested parties.
d) Informed as to who is their employee
OH&S representative(s) and specified
management appointee (see 4.4.1).

11
 IMPLICATIONS OF CHANGES TO OHSAS 18001 FOR CLIENTS

OHSAS 18001 - 1999 OHSAS 18001 - 2007 Implications for Clients

4.4.3.2 Participation and consultation Specific requirements for the involvement
and participation of the workforce in
The organization shall establish, implement
and maintain a procedure(s) for: Risk Assessment
a) the participation of workers by their :
• appropriate involvement in hazard Investigation process
identification, risk assessments and Developing Policies & objectives
determination of controls,
More prescriptive in regard to associates
• appropriate involvement in incident
involvement in HIRARC & Investigation
investigation;
• involvement in the development and
review of OH&S policies and objectives;
• consultation where there are any changes
that affect their OH&S;
• representation on OH&S matters.
Workers shall be informed about their
participation arrangements, including who is
their representative(s) on OH&S matters.
b) consultation with contractors where there
are changes that affect their OH&S

The organization shall ensure that, when

appropriate, relevant external interested
parties are consulted about pertinent OH&S
issues.

4.4.4 The organization shall establish and maintain The OH&S management system More explicit in regard to particular OH&S
Documentation information, in a suitable medium such as documentation shall include Documented requirements
paper or electronic form, that: a) the OH&S policy and objectives,
a) Describes the core elements of the b) description of the scope of the OH&S
management system and their management system,
interaction; and c) description of the main elements of the
b) Provides direction to related OH&S management system and their
documentation. interaction, and reference to related
documents,
d) documents, including records, required

12
IMPLICATIONS OF CHANGES TO OHSAS 18001 FOR CLIENTS

OHSAS 18001 - 1999 OHSAS 18001 - 2007 Implications for Clients

by this OHSAS standard, and
NOTE It is important that documentation is e) documents, including records,
kept to the minimum required for determined by the organization to be
effectiveness and efficiency. necessary to ensure the effective
planning, operation and control of
processes that relate to the
management of its OH&S risks.

NOTE It is important that documentation is

proportional to the level of complexity,
hazards and risks concerned and is kept to
the minimum required for effectiveness and
efficiency.

13
 IMPLICATIONS OF CHANGES TO OHSAS 18001 FOR CLIENTS

OHSAS 18001 - 1999 OHSAS 18001 - 2007 Implications for Clients

4.4.5 The organization shall establish and maintain Documents required by the OH&S Now covers documents of external
Document and procedures for controlling all documents and management system and by this OHSAS origin.
data control data required by this OHSAS specification to standard shall be controlled. Records are a
ensure that: special type of document and shall be
a) they can be located; controlled in accordance with the
(4.4.5 Control of
b) they are periodically reviewed, revised requirements given in 4.5.4.
documents)
as necessary and approved for
adequacy by authorized personnel; The organization shall establish, implement
c) current versions of relevant documents and maintain a procedure(s) to
and data are available at all locations a) approve documents for adequacy prior
where operations essential to the to issue,
effective functioning of the OH&S b) review and update as necessary and re-
system are performed; approve documents,
d) obsolete documents and data are c) ensure that changes and the current
promptly removed from all points of revision status of documents are
issue and points of use or otherwise identified,
assured against unintended use; and d) ensure that relevant versions of
e) Archival documents and data retained applicable documents are available at
for legal or knowledge preservation points of use,
purposes or both, are suitably identified. e) ensure that documents remain legible
and readily identifiable,
f) ensure that documents of external origin
determined by the organization to be
necessary for the planning and operation
of the OH&S management system are
identified and their distribution
controlled, and
g) prevent the unintended use of obsolete
documents and apply suitable
identification to them if they are retained
for any purpose.

4.4.6 The organization shall identify those The organization shall determine those
Operational operations and activities that are associated operations and activities that are associated Includes other visitors.
control with identified risks where control measures with the identified hazard(s) where the
need to be applied. The organization shall implementation of controls is necessary to
plan these activities, including maintenance, manage the OH&S risk(s). This shall include Consider how this refers to the management

14
IMPLICATIONS OF CHANGES TO OHSAS 18001 FOR CLIENTS

OHSAS 18001 - 1999 OHSAS 18001 - 2007 Implications for Clients

in order to ensure that they are carried out the management of change (see 4.3.1) of change & associated control in the
under specified conditions by: organisation.
a) establishing and maintaining For those operations and activities, the
documented procedures to cover organization shall implement and maintain: Link processes to OHSAS systems.
situations where their absence could a) operational controls, as applicable to the
lead to deviations from the OH&S policy organization and its activities; the
and the objectives; organization shall integrate those
b) stipulating operating criteria in the operational controls into its overall
procedures; OH&S management system.
c) establishing and maintaining b) controls related to purchased goods,
procedures related to the identified equipment and services
OH&S risks of goods, equipment and c) controls related to contractors and other
services purchased and/or used by the visitors to the workplace
organization and communicating d) documented procedures, to cover
relevant procedures and requirements situations where their absence could
to suppliers and contractors; lead to deviations from the OH&S policy
d) Establishing and maintaining and the objectives.
procedures for the design of workplace, e) stipulated operating criteria where their
process, installations, machinery, absence could lead to deviations from
operating procedures and work the OH&S policy and objectives
organization, including their adaptation
to human capabilities, in order to
eliminate or reduce OH&S risks at their
source.

15
 IMPLICATIONS OF CHANGES TO OHSAS 18001 FOR CLIENTS

OHSAS 18001 - 1999 OHSAS 18001 - 2007 Implications for Clients

4.4.7 The organization shall establish and maintain The organization shall establish, implement Must respond to emergency situations.
Emergency plans and procedures to identify the potential and maintain a procedure(s):
preparedness for, and responses to, incidents and a) to identify the potential for emergency Consider the needs of external parties in the
and response emergency situations, and for preventing and situations, planning process.
mitigating the likely illness and injury that b) to respond to such emergency
may be associated with them. situations. Requirement to review results is now explicit.

The organization shall review its emergency The organization shall respond to actual Wider requirement to involve those
preparedness and response plans and emergency situations and prevent or mitigate interested parties in the periodic test
procedures, in particular, after the associated adverse OH&S consequences. activities.
occurrence of incidents or emergency
situations. In planning its emergency response the More explicit to reference Emergency
The organization shall also periodically test organization shall take account of the needs Services & Neighbours
such procedures where practicable. of relevant interested parties, e.g. emergency
services and neighbours. “where practicable” applies to Testing

The organization shall also periodically test

its procedure(s) to respond to emergency
situations, where practicable, involving
relevant interested parties as appropriate.

The organization shall periodically review

and, where necessary, revise its emergency
preparedness and response procedure(s), in
particular, after periodical testing and after
the occurrence of emergency situations (see
4.5.3).

4.5.1 The organization shall establish and maintain The organization shall establish, implement Inclusion of health as well as safety
Performance procedures to monitor and measure OH&S and maintain a procedure(s) to monitor and monitoring.
measurement performance on a regular basis. These measure OH&S performance on a regular
and monitoring procedures shall provide for: basis. This procedure(s) shall provide for: New requirements for the monitoring of
a) both qualitative and quantitative a) both qualitative and quantitative controls (health & safety).
measures, appropriate to the needs of measures, appropriate to the needs of
the organization; the organization; More explicit to pre-emptive inspection in
b) monitoring of the extent to which the b) monitoring of the extent to which the measuring the effectiveness of controls
organization’s OH&S objectives are organization’s OH&S objectives are met;

16
 IMPLICATIONS OF CHANGES TO OHSAS 18001 FOR CLIENTS

OHSAS 18001 - 1999 OHSAS 18001 - 2007 Implications for Clients

met; c) monitoring the effectiveness of controls
c) proactive measures of performance that (for health as well as for safety)
monitor compliance with the OH&S d) proactive measures of performance that
management programme, operational monitor conformance with the OH&S
criteria and applicable legislation and programme(s), controls and operational
regulatory requirements; criteria;
d) reactive measures of performance to e) reactive measures of performance that
monitor accidents, ill health, incidents monitor ill health, incidents (including
(including near-misses) and other accidents, near-misses, etc.), and other
historical evidence of deficient OH&S historical evidence of deficient OH&S
performance; performance;
e) Recording of data and results of
monitoring and measurement sufficient f) recording of data and results of
to facilitate subsequent corrective and monitoring and measurement sufficient
preventative action analysis. to facilitate subsequent corrective action
and preventive action analysis.
If monitoring equipment is required for If equipment is required to monitor or
performance measurement and monitoring, measure performance, the organization shall
the organization shall establish and maintain establish and maintain procedures for the
procedures for the calibration and calibration and maintenance of such
maintenance of such equipment. Records of equipment, as appropriate. Records of
calibration and maintenance activities and calibration and maintenance activities and
results shall be retained. results shall be retained.

4.5.2 Moved to 4.5.3

Accidents,
incidents, non-
conformances
and corrective
and preventive
action

New clause 4.5.2.1 Consistent with its commitment to New procedure for periodic evaluation of
compliance (see 4.2c)), the organization compliance in line with ISO 14001
(4.5.2 Evaluation
shall establish, implement and maintain a requirements.
of compliance)
procedure(s) for periodically evaluating
compliance with applicable legal The records of the outputs need to be
17
IMPLICATIONS OF CHANGES TO OHSAS 18001 FOR CLIENTS

OHSAS 18001 - 1999 OHSAS 18001 - 2007 Implications for Clients

requirements (see 4.3.2). appropriate to the risks and controls being
managed
The organization shall keep records of the
results of the periodic evaluations.

Note The frequency of periodic evaluation

may vary for differing legal requirements

New clause 4.5.2.2 The organization shall evaluate New procedure for periodic evaluation of
compliance with other requirements to which compliance in line with ISO 14001
it subscribes (see 4.3.2). The organization requirements.
may wish to combine this evaluation with the
evaluation of legal compliance referred to in The records of the outputs need to be
4.5.2.1 or to establish a separate appropriate to the risks and controls being
procedure(s). managed

The organization shall keep records of the Must now evaluate the compliance with the
results of the periodic evaluations. other requirements

Note The frequency of periodic evaluation

may vary for differing other requirements to
which the organization subscribes

18
 IMPLICATIONS OF CHANGES TO OHSAS 18001 FOR CLIENTS

OHSAS 18001 - 1999 OHSAS 18001 - 2007 Implications for Clients

4.5.3 Records 4.5.2 The organization shall establish and 4.5.3.1 Incident investigation Focus upon preventive measures relating to
and records maintain procedures for defining maintenance of equipment as fit for purpose
management responsibility and authority for: The organization shall establish, implement not liable to cause explosions etc, think BP &
a) the handling and investigation of: and maintain a procedure(s) to record, Exxon, Lessons Learnt from previous
(4.5.3 Incident • accidents; investigate and analyze incidents in order to incidents! Use of incident investigation.
investigation, • incidents;
a) determine underlying OH&S deficiencies Specific reference to determine root cause &
nonconformity, • non-conformances; and other factors that may be causing or assignment of appropriate corrective action
corrective action b) taking action to mitigate any contributing to the occurrence of
and preventive consequences arising from accidents, incidents. Requirement to record and analyse
action) incidents or non-conformances; b) identify the need for corrective action
c) the initiation and completion of corrective c) identify opportunities for preventive Timely manner – new
and preventive actions; action
d) Confirmation of the effectiveness of d) identify opportunities for continual Procedures to specifically a) – e) for incident
corrective and preventive actions taken. improvement management
These procedures shall require that all e) communicate the results of such
proposed corrective and preventive actions investigations
shall be reviewed through the risk
assessment process prior to implementation. The investigations shall be performed in a
Any corrective or preventive action taken to timely manner.
eliminate the causes of actual and potential
non-conformances shall be appropriate to Any identified need for corrective action or
the magnitude of problems and opportunities for preventive action shall be
commensurate with the OH&S risk dealt with in accordance with the relevant
encountered. parts of 4.5.3.2.
The organization shall implement and record
any changes in the documented procedures The results of incident investigations shall be
resulting from corrective and preventive documented and maintained.
action.

19
IMPLICATIONS OF CHANGES TO OHSAS 18001 FOR CLIENTS

OHSAS 18001 - 1999 OHSAS 18001 - 2007 Implications for Clients

4.5.3.2 Nonconformity, corrective action and Procedure to identify and to correct
preventive action nonconformity then manage nonconformities
in line with requirements b) – e)
The organization shall establish, implement
and maintain a procedure(s) for dealing with
actual and potential nonconformity(ies) and
for taking corrective action and preventive
action. The procedure(s) shall define
requirements for

a) identifying and correcting

nonconformity(ies) and taking action(s)
to mitigate their OH&S consequences,
b) investigating nonconformity(ies),
determining their cause(s) and taking
actions in order to avoid their
recurrence,
c) evaluating the need for action(s) to
prevent nonconformity(ies) and
implementing appropriate actions
designed to avoid their occurrence,
d) recording and communicating the results
of corrective action(s) and preventive
action(s) taken, and
e) reviewing the effectiveness of corrective
action(s) and preventive action(s) taken.

Where the corrective action and preventive

action identifies new or changed hazards or
the need for new or changed controls, the
procedure shall require that the proposed
actions shall be taken through a risk
assessment prior to implementation.

Any corrective action or preventive action

taken to eliminate the causes of actual and
potential nonconformity(ies) shall be

20
 IMPLICATIONS OF CHANGES TO OHSAS 18001 FOR CLIENTS

OHSAS 18001 - 1999 OHSAS 18001 - 2007 Implications for Clients

appropriate to the magnitude of problems
and commensurate with the OH&S risk(s)
encountered.

The organization shall ensure that any

necessary changes arising from corrective
action and preventive action are made to the
OH&S management system documentation.
4.5.4 Audit 4.5.3 The organization shall establish and
maintain procedures for the identification, The organization shall establish and maintain Ensure necessary records identified retained
(4.5.4 Control of maintenance and disposition of OH&S records as necessary to demonstrate retrievable legible identifiable & traceable.
records) records, as well as the results of audits and conformity to the requirements of its OH&S That they, collectively, demonstrate
reviews. management system and of this OHSAS conformity to the OH&S MS
OH&S records shall be legible, identifiable standard, and the results achieved.
and traceable to the activities involved.
OH&S records shall be stored and The organization shall establish, implement
maintained in such a way that they are and maintain a procedure(s) for the
readily retrievable and protected against identification, storage, protection, retrieval,
damage, deterioration or loss. Their retention retention and disposal of records.
times shall be established and recorded.
Records shall be maintained, as appropriate Records shall be and remain legible,
to the system and to the organization, to identifiable and traceable.
demonstrate conformance to this OHSAS
specification.

4.5.5 Internal 4.5.4 Audit The organization shall establish The organization shall ensure that internal Procedures to include competency;
audit and maintain an audit programme and audits of the OH&S management system are requirements & responsibility of the persons
procedures for periodic OH&S management conducted at planned intervals to undertaking the planning of audits and
system audits to be carried out, in order to: record retention
a) determine whether or not the OH&S a) determine whether the OH&S
management system: management system Procedures to address the determination of
1) conforms to planned arrangements the audit criteria, scope, frequency and
for OH&S management including 1) conforms to planned arrangements for methods.
the requirements of this OHSAS OH&S management including the
specification; requirements of this OHSAS standard, and
2) has been properly implemented and
maintained; and 2) has been properly implemented and is

21
IMPLICATIONS OF CHANGES TO OHSAS 18001 FOR CLIENTS

OHSAS 18001 - 1999 OHSAS 18001 - 2007 Implications for Clients

3) is effective in meeting the maintained, and
organization’s policy and objectives;
b) review the results of previous audits; 3) is effective in meeting the organization’s
c) Provide information on the results of policy and objectives;
audits to management.
The audit programme, including any b) provide information on the results of
schedule, shall be based on the results of audits to management.
risk assessments of the organization’s
activities, and the results of previous audits. Audit programme(s) shall be planned,
The audit procedures shall cover the scope, established, implemented and maintained by
frequency, methodologies and the organization, based on the results of risk
competencies, as well as the responsibilities assessments of the organization’s activities,
and requirements for conducting audits and and the results of previous audits.
reporting results.
Wherever possible, audits shall be Audit procedure(s) shall be established,
conducted by personnel independent of implemented and maintained that address
those having direct responsibility for the a) the responsibilities, competencies, and
activity being examined. requirements for planning and
NOTE The word “independent” here does not conducting audits, reporting results and
necessarily mean external to the retaining associated records,
organization. b) the determination of audit criteria, scope,
frequency and methods.

Selection of auditors and conduct of audits

shall ensure objectivity and the impartiality of
the audit process.

22
 IMPLICATIONS OF CHANGES TO OHSAS 18001 FOR CLIENTS

OHSAS 18001 - 1999 OHSAS 18001 - 2007 Implications for Clients

4.6 Management The organization’s top management shall, at Top management shall review the Now includes more specific elements to be
review intervals that it determines, review the OH&S organization's OH&S management system, considered in the review.
management system, to ensure its at
continuing suitability, adequacy and planned intervals, to ensure its continuing
effectiveness. The management review suitability, adequacy and effectiveness. Clearer output requirements to be met.
process shall ensure that the necessary Reviews shall include assessing
information is collected to allow management opportunities for improvement and the need
to carry out this evaluation. This review shall for changes to the OH&S management Requirement for outputs to be made
be documented. system, including the OH&S policy and available to consult and communicate with
OH&S objectives. Records of the workers contractors and external interested
The management review shall address the management reviews shall be retained. parties.
possible need for changes to policy,
objectives and other elements of the OH&S Input to management reviews shall include
management system, in the light of OH&S a) results of internal audits and evaluations
management system audit results, changing of compliance with applicable legal
circumstances and the commitment to requirements and with other
continual improvement. requirements to which the organization
subscribes,
b) the results of participation and
consultation (see 4.4.3)
c) relevant communication(s) from external
interested parties, including complaints,
d) the OH&S performance of the
organization,
e) the extent to which objectives have been
met,
f) status of incident investigations,
corrective actions and preventive
actions,
g) follow-up actions from previous
management reviews,
h) changing circumstances, including
developments in legal and other
requirements related to OH&S, and
i) recommendations for improvement.

The outputs from management reviews shall

23
IMPLICATIONS OF CHANGES TO OHSAS 18001 FOR CLIENTS

OHSAS 18001 - 1999 OHSAS 18001 - 2007 Implications for Clients

be consistent with the organization's
commitment to continual improvement and
shall include any decisions and actions
related to possible changes
a) to OH&S performance
b) to OH&S policy and objectives
c) to resources, and
d) to other elements of the OH&S
management system.

Relevant outputs from management review

shall be made available for communication
and consultation (see 4.4.3)

24