The short version
The law does not generally tell you to have a management system. It tells you to manage risk so far as is reasonably practicable, to consult the people doing the work, and, under the model laws, for officers to be able to show due diligence.
A management system is the machinery for doing those things consistently and being able to demonstrate it afterwards.
Which is why a system bought as a template, given a company name and never touched again satisfies nobody. It passes a desktop review and falls over at the first incident, because nothing in it matches the site.
The parts it needs
A policy that says what the business commits to, signed by someone with the authority to commit it.
Roles, responsibilities and authority, including who can stop work.
Consultation arrangements: how workers are involved, how representatives operate, how issues get raised and resolved.
Hazard identification and a risk register that is alive rather than a snapshot from the year it was written.
Risk assessments and safe work procedures for the tasks that carry the risk. Not for every task. The ones that matter.
Training, competency and verification records, so you can show who is authorised to do what.
Contractor and visitor management, including inductions and the agreements that sit behind them.
A plant and equipment register with pre start checks, maintenance and isolation procedures.
A chemical register with safety data sheets people can get to.
Emergency preparedness: plans specific to the site, and drills that are run rather than scheduled.
Incident reporting, investigation and corrective actions, with a method behind the investigation rather than a form.
Inspection and monitoring, internal audit, and a management review that changes something.
Document control, so the version on the wall is the current one.
What makes one people follow
It is written with the people who do the work. A procedure produced in an office and issued downward gets read once.
It is short and specific. If a safe work procedure runs to six pages for a twenty minute task, it will be signed and not read.
It is available where the work happens. A folder in the site office is not available to someone at the far end of a shed.
It describes what people do. If following the procedure is slower or harder than the workaround everyone uses, the workaround wins, and you have a system that documents a job nobody performs.
The loop closes. Somebody reports a hazard and sees something happen. Nothing kills reporting faster than the sense that it disappears.
Supervisors use it visibly. If the people running the shift treat it as an overhead, so will everyone else.
And it is reviewed when something changes, not only when a date comes up. New plant, a new task, an incident, or a control that has stopped working are all triggers.
ISO 45001 and certification
ISO 45001 is the current international standard for occupational health and safety management systems. AS/NZS 4801 was the earlier Australian standard, and you will still find systems and auditors working to it.
Certification is a commercial decision more than a legal one. Sometimes a customer or a tender requires it. It is evidence that a system meets a standard. It is not evidence that a site is safe, and it is not a defence on its own.
A system can be certified and still not be followed on the floor. I have seen that combination more than once, and it is a worse position than an uncertified system that people use, because it comes with a false sense of having dealt with the problem.
How to tell whether yours is working
Ask a worker to find the procedure for a task they do. Time how long it takes and watch whether they go to the system or to a colleague.
Ask when a risk assessment last changed, and why. If the answer is that it is reviewed annually and nothing has changed, either the site is unusually static or the review is a signature.
Ask what happened to the last hazard someone reported. If nobody can tell you, reporting has already stopped mattering.
Look at whether corrective actions close, and whether the ones that close stay closed.
Ask a supervisor what they would do if a contractor turned up without the right competency, and see whether the answer matches the procedure.
None of that needs an auditor. It is the same handful of questions I ask when I walk onto a site for the first time, and it tells you more than the size of the document set.
Where to check the current position
Safe Work Australia publishes model codes of practice covering risk management, consultation and incident response, and each regulator publishes the versions or equivalents that apply in its jurisdiction.
ISO 45001 is available through Standards Australia.
If you want a view on what your system is missing rather than a template to fill in, that is the sort of work I do.
This is general information about the documented position, not advice about your situation, and the detail varies between jurisdictions. Check the current instrument for the state you are working in, or ask me and I will help you work out which one applies.
Written by
Jim Rimmer · WHS Specialist
I'm Jim Rimmer, a WHS specialist with more than 32 years leading safety across agriculture, food processing, manufacturing, mining and logistics.
More about Jim Rimmer and his background