Curriculum
- 2 Sections
- 36 Lessons
- 26 Weeks
- ISO 4500111
- 1.1Introduction to ISO 45001 and Occupational Health & Safety Management Systems (OH&S)
- 1.2Key Terms and Definitions in ISO 45001
- 1.3Context of the Organization (Clause 4 of ISO 45001)
- 1.4Leadership and Worker Participation (Clause 5 of ISO 45001)
- 1.5Planning (Clause 6 of ISO 45001)
- 1.6Support (Clause 7 of ISO 45001)
- 1.7Operation (Clause 8 of ISO 45001)
- 1.8Performance Evaluation (Clause 9 of ISO 45001)
- 1.9Improvement (Clause 10 of ISO 45001)
- 1.10Integrating ISO 45001 with Other Management Systems
- 1.11Risk-Based Thinking and Continuous Improvement in ISO 45001
- ISO 19011: Guidelines for auditing management systems26
- 2.1Introduction to ISO19011
- 2.2Principles of Auditing
- 2.3Managing an Audit Program
- 2.4Establishing Audit Program Objectives
- 2.5Determining Audit Program Risks and Opportunities
- 2.6Establishing the Audit Program
- 2.7Implementing the Audit Program
- 2.8Monitoring the Audit Program
- 2.9Reviewing and Improving the Audit Program
- 2.10Initiating the Audit
- 2.11Determining Audit Feasibility
- 2.12Preparing Audit Activities
- 2.13Reviewing Documented Information
- 2.14Preparing the Audit Plan
- 2.15Assigning Work to the Audit Team
- 2.16Preparing Working Documents
- 2.17Opening Meeting
- 2.18Communication During the Audit
- 2.19Collecting and Verifying Information
- 2.20Generating Audit Findings
- 2.21Preparing Audit Conclusions
- 2.22Closing Meeting
- 2.23Preparing the Audit Report
- 2.24Completing the Audit
- 2.25Follow-Up Activities
- 2.26ISO45001 Exam120 Minutes40 Questions
Operation (Clause 8 of ISO 45001)
Overview of Operational Control
Clause 8 of ISO 45001 focuses on the operational aspects of an Occupational Health and Safety Management System (OH&SMS). This clause ensures that organizations establish, implement, and control the processes needed to meet OH&S requirements and achieve intended outcomes. Operational control bridges the gap between planning, resources, and actual workplace activities, making it a critical area for Lead Auditors to evaluate.
Operational controls involve both routine and non-routine activities, emergency preparedness, outsourcing, and management of change. Auditors must examine whether processes are not only designed but also implemented effectively, consistently, and in alignment with risk assessments and OH&S objectives.
Organizations are required to plan, implement, and control processes that are essential for managing occupational health and safety risks. Operational planning involves defining procedures, assigning responsibilities, determining criteria for operation, and establishing methods to monitor and measure performance. This ensures that processes operate safely and predictably.
Auditors should verify that operational controls are documented and communicated to workers. Evidence may include standard operating procedures (SOPs), work instructions, checklists, permits to work, and monitoring records. Observing actual practices is equally important to confirm that documented procedures are followed consistently.
ISO 45001 emphasizes a hierarchy of controls to manage hazards. Organizations should prioritize eliminating hazards where possible. When elimination is not feasible, substitution, engineering controls, administrative controls, and personal protective equipment (PPE) must be applied in sequence according to risk severity.
Lead Auditors must evaluate whether the organization applies this hierarchy effectively. For example, using machine guards or automated processes reduces reliance on human behavior, which is more prone to error. Auditors should review risk assessments and control measures to confirm that the most effective controls are implemented first, and that less effective measures, such as PPE, are used only when higher-level controls are not feasible.
Management of Change
Operational activities often evolve due to changes in technology, processes, personnel, or regulations. Clause 8 requires organizations to establish procedures to manage these changes, ensuring that new or modified processes do not introduce unacceptable risks.
Auditors should assess how changes are evaluated, communicated, and implemented. Evidence may include revised risk assessments, updated work instructions, change approval records, and training for affected personnel. Failure to manage change effectively is a common source of incidents and nonconformities.
Outsourcing and Contractor Management
Many organizations rely on contractors or outsourced services for specific activities. ISO 45001 requires organizations to ensure that outsourced processes and contractors comply with OH&S requirements. This includes verifying competence, defining responsibilities, and monitoring performance.
Auditors should review contracts, prequalification records, safety performance data, and supervision arrangements. They should also evaluate whether contractors are integrated into the organization’s OH&SMS, including access to risk assessments, emergency procedures, and reporting mechanisms.
Emergency Preparedness and Response
Operational control includes planning and implementing procedures for potential emergency situations. Organizations must identify possible emergencies, assess associated risks, establish response plans, allocate resources, and communicate responsibilities to workers. Preparedness also involves drills, training, and coordination with external emergency services if necessary.
Lead Auditors should examine whether emergency plans are tested regularly and whether lessons learned are integrated into future planning. Evidence may include drill records, incident reports, and communication logs.
Clause 8 requires organizations to monitor and measure operational performance against OH&S objectives and operational controls. This includes inspecting workplaces, measuring exposure to hazards, recording incidents, and reviewing compliance with procedures.
Auditors should verify that monitoring is systematic and effective. Observations, sampling, and review of records provide evidence of operational performance. Where deficiencies are identified, corrective actions should be implemented and documented.
Operations that deviate from planned requirements must be controlled to prevent harm. ISO 45001 requires organizations to detect, correct, and, where necessary, isolate nonconforming operations. Lead Auditors should assess procedures for identifying deviations, documenting them, and implementing corrective actions.
Nonconformities may include unsafe practices, defective equipment, or failure to follow procedures. Auditors must verify that controls prevent recurrence and that responsible personnel are accountable for corrective actions.
When auditing Clause 8, Lead Auditors should focus on the real implementation of operational controls. This involves a combination of document review, observations, interviews, and performance measurement. Key points include verifying hazard elimination, effectiveness of controls, contractor management, emergency preparedness, and the management of change.
Common findings in this clause include inconsistencies between documented procedures and actual practices, ineffective controls, lack of worker involvement, inadequate monitoring, and poor emergency readiness. Identifying these issues helps the organization strengthen operational control and improve overall OH&S performance.
Clause 8 is where planning and support translate into practical, on-the-ground actions. For auditors, this is often the most observable and evidence-rich section of the OH&SMS, providing critical insight into the system’s effectiveness.