Occupational Health and Safety Management Systems

A management system is a collection of processes, procedures, and other components coordinated to achieve its goals. In this case, the goal is to reduce occupational health and safety risks, prevent work-related injuries and illnesses, and protect workers’ well-being. A management system is typically made up of interconnected documents, such as:

• Policies: concise statements that set the foundation for the entire management system. They state the organization’s intentions and are approved by top management. Please refer to the OSH Answers fact sheet Health and Safety Policy - Development and Implementation to learn more.
• Procedures: provide guidance to workers according to organizational policies. Procedures are more detailed than policies and state how things should be done. For example, a risk assessment procedure may state how the organization identifies hazards, assesses risk, and when risk assessments need to be completed
• Records: forms, registers, and other documents used for gathering evidence that the management system is functioning

Common elements of an occupational health and safety management system are:

• Leadership commitment
• Policies, procedures, document control, and recordkeeping
• Objectives
• Roles and responsibilities
• Safe work procedures and instructions
• Supervison
• Worker participation
• Hazard identification and risk assessments
• Legal requirements and compliance
• Training, education, instruction, competence
• Management of change
• Contractor management
• Approval of suppliers and service providers
• Emergency preparedness and response
• Incident investigation
• Inspections and maintenance
• Audit
• Corrective and preventive actions
• Management review

Like the legally required health and safety program, the overall responsibility for a management system cannot be simply delegated. Top (or senior) management involvement is critical to the system’s successful implementation and maintenance. The roles and responsibilities critical to the functioning of the management system should be clearly defined and assigned. For example, in addition to top management being overall responsible for health and safety, key roles and responsibilities (supervisors, safety professionals, first aid attendants, etc.) need to be defined for each procedure in the management system.

Canadian health and safety legislation requires most employers to have a health and safety program in their workplace. An occupational health and safety management system can help meet this requirement. However, a certified management system is not legally required. 

A management system is a tool that can help achieve organizational health and safety objectives. It can improve health and safety, but it cannot guarantee an incident-free workplace. 

The primary purpose of an occupational health and safety management system is to protect workers' health and safety. It can help an organization meet the legal requirements for managing health and safety and implement good health and safety practices.

More benefits of implementing a management system include:

• Reduced downtime from workers getting injured or sick
• Reduced workers’ compensation premiums
• More opportunities for work from clients seeking suppliers with a strong health and safety culture
• Improved worker morale
• Positive company image

To implement a management system, the organization may need to invest resources in completing the required tasks, training, consulting, and certification.

It is possible to implement a management system by using the expertise of an organization’s existing staff. If the required knowledge and experience are not available, a consultant or consulting firm may offer assistance.

The time for implementation depends on a number of factors, such as:

• The maturity of the existing health and safety program
• The size of the organization (including the number of staff and the various workplace sites)
• The scope of the organization (the number of different activities performed by the organization adds to the complexity and potentially low long implementation can take)

A health and safety management system is typically based on a cyclical, continual improvement process. Implementation is one part of this cycle. A system based on the Plan-Do-Check-Act (PDCA) model has the following components:

• Plan: conduct hazard and risk assessments, develop objectives, policies, and procedures
• Do: implement processes and procedures based on the policies
• Check: assess objectives and health and safety performance, perform internal audits
• Act: make changes and improvements based on assessment and audit findings

A functional management system does not have a definitive end. It can take a few months to a year (or more) to demonstrate that it is functioning properly. Regular reviews will help determine whether the management system is functioning as planned or if changes are required. 

There are different standards the organization can choose to implement across the organization, such as:

• ISO 45001 (from the International Organization for Standardization – global standard)
• CSA Z45001 (from the CSA Group – Canadian standard)
• ANSI Z10 (from the American National Standards Institute – American standard)

ISO 45001 is suited to organizations that have implemented other ISO standards in their organization, have operations in different countries, or are seeking certification that can be recognized by clients and customers. CSA Z45001 is a Canadian adaptation of ISO 45001, sharing similarities while having Canadian deviations. ANSI Z10 is designed for American companies but is also aligned with ISO 45001. 

A Certificate of Recognition (COR) is a program that assesses and certifies a management system. It is similar to other occupational health and safety management system standards.

COR is a national accreditation program for health and safety from the Canadian Federation of Construction Safety Associations (CFCSA). It is granted by an authorized organization for the respective Canadian jurisdiction. While COR is not legally required, COR certification is sometimes required to qualify to work for participating organizations, particularly in the construction and energy sectors. 

A management system that passes a third-party certification audit from an accredited organization is considered to be certified. Certification typically lasts a few years before recertification is due.

An organization may choose to get its management system certified, but doing so is not mandatory. Some organizations pursue certification based on the benefits or to simply help meet the minimum legal requirements.  

If a certified occupational health and safety management system is a prerequisite for working with a client, the certification needs to be up-to-date and valid (that is, not expired or in the process of becoming certified for the first time).

Some organizations control the process for certification. For example, the Certificate of Recognition (COR) certification is delivered through a member association approved by the Canadian Federation of Construction Safety Associations. 

Some certificates of compliance with a standard are not issued or controlled by the organization that developed the standard. For example, the International Organization for Standardization (ISO) neither certifies nor controls who certifies companies to ISO standards. If pursuing ISO certification, select a provider who is accredited by a reputable organization such as the Standards Council of Canada (SCC) or the ANSI National Accreditation Board (ANAB).

The government departments responsible for health and safety do not certify management systems.

A management system is meant to be implemented and maintained by a company. An individual cannot be certified to a management system standard. For example, a person cannot be ISO 45001 certified. However, a person can be qualified to work with a management system. Continuing with the ISO 45001 example, a person can have ISO 45001 auditor qualifications, making them competent at ISO 45001 audits.

It should not be problematic to have unrelated management systems running simultaneously in the same organization. If different management systems overlap, it would be helpful to have compatible systems. ISO management systems have the advantage of being harmonious with each other, making it more straightforward to have multiple simultaneous systems. For example, some organizations choose to combine a health and safety management system (ISO 45001) with environmental (ISO 14001) and quality (ISO 9001) systems.

Multiple health and safety management systems may also be running simultaneously, but doing so can be complicated. An example may be a large organization that has an internal management system and an ISO management system certification at the same time. Two or more occupational health and safety management systems running simultaneously do not necessarily make the workplace safer. Redundancy can be complicated and potentially expensive.