CHAPTER 17: OHSMS REVIEW

17.1 General

‘Management review’ is the final level and the highest platform at which the performance and adequacy of the OHSMS is reviewed in an organisation. It represents both the CHECK and the ACT aspects of the PDCA cycle. Management review, as the name suggests, involves a review of the OHSMS as well as actions and decisions for its continual improvement.

Three terms, also defined in Annex A.9.3, Guidance on the use of ISO 45001, are often used when discussing the management review process. These are:

1. Suitability: how well the OHSMS fits the organisation, its operations, culture and business.

2. Adequacy: whether the OHSMS is defined and implemented appropriately and adequately to cover all aspects and processes of an organisation.

3. Effectiveness: whether the OHSMS is achieving the intended outcomes for an organisation.

17.2 Requirements (ISO 45001, Clause 9.3)

ISO 45001 defines the task of reviewing the continued suitability, adequacy and effectiveness of an OHSMS as the responsibility of the senior management of an organisation. It further requires the review to be conducted at planned intervals. What exactly the duration of this planned interval is, is best defined by the organisation itself. It would normally not exceed one year and is often conducted at a frequency of three, four or six months, depending upon the size, spread and complexity of the organisation.

17.3 Inputs to the management review process

There are clearly two identifiable steps in an OHSMS review process: the inputs and the outputs. Inputs to the management review are the facts, data and performance results that should be presented to and reviewed by senior management. Outputs are the decisions and actions agreed by senior management to correct the existing inadequacies or to address further improvement of the OHSMS.

An organisation’s senior management must review the following aspects of its OHSMS performance (also termed as inputs to the management review) during the management review process:

•The extent to which decisions and actions of the previous management review were implemented. It is necessary for senior management to evaluate the adequacy and effectiveness of the actions taken on the previous management review decisions before proceeding with a fresh management review.

•Have there been any new OH&S-related issues, concerns or changes relating to the needs and expectations of the interested parties? If so, they must be considered along with the factors that have given rise to these concerns.

•It is absolutely vital for senior management to know the status of its compliance with OH&S-related regulatory requirements. This could include an input that identifies if the organisation is in complete compliance (or otherwise) of the legal and other requirements that it subscribes to. The input report under this head could also include if there are any changes in the laws and requirements that are applicable to the organisation.

•The OH&S risks and opportunities confronted by the organisation form an important input to the management review process. What may be the possible options for meeting these risks and opportunities?

•The extent to which the OH&S policy and objectives have been met. If not met, what were the reasons for the delay? What are the proposals for correcting the situation? Do the OH&S objectives need to be changed or their timeline redefined?

•How was the organisation’s performance on OH&S incidents, accidents, nonconformities and corrective actions? This input is normally supported by facts and figures of past performance so that management can evaluate improving or deteriorating trends.

•Information on corrective actions taken and their effectiveness forms an important input to the management review process. Were the corrective actions taken in a timely manner and did they succeed in preventing recurrence of the original shortcomings?

•Has the organisation been able to continually improve the performance of its OHSMS? This input can be meaningful only if it includes facts and figures on the KPIs against which the organisation measures its performance. Once again it may be appropriate to include the performance data for previous months or years so as to determine positive or negative performance trends.

•Results of measuring and monitoring activities provide a factual picture of the health of an OHSMS. They also confirm the effectiveness or the failure of measures adopted to control hazards and eliminate risks. Hence the input to the management review process must include the results of the measuring and monitoring activities carried out by the organisation, including inputs from health surveillance programmes.

•Audits provide a holistic picture of the extent to which an OHSMS complies with the requirements of ISO 45001, as well as the procedures and processes defined by an organisation for itself. Conducted by unbiased individuals, audits provide an excellent neutral input to senior management on the health of its OHSMS. Did the organisation conduct internal OH&S audits in a timely manner and what were the key audit findings? The results of the audits are therefore considered a mandatory input for consideration during the management review process.

•The consultation and participation processes with workers are a necessary requirement of ISO 45001. These processes could result in identifying OH&S concerns of the workers or bring out suggestions and opportunities for further improvement. In both cases, the results of the consultation and participation process would form an important input to the management review process.

•Senior management is required to review the adequacy of resources for effective, safe and healthy functioning of its OHSMS. Resources may be viewed not just in terms of finances, but also along their many other dimensions such as training, human resources, space, process equipment, furniture, measuring and monitoring equipment, engineering controls, PPE and time allocated for various tasks. It is not a good idea to wait for an incident and then come to the conclusion that it was caused by inadequate resources. ISO 45001 therefore requires that a proactive evaluation for adequacy of resources be carried out and included in the management review. This would become all the more important where the inadequacy of resources could have a negative impact on the OH&S system.

•Typically, there are two categories of interested parties, internal and external. Internal interested parties are the workers, unions and the employees, while the external interested parties may be community, customers, contractors, suppliers, regulators and various government or non-government organisations. ISO 45001 requires communication processes to be actively maintained for both internal and external interested parties, and the findings of these processes to be included as inputs to the management review process.

•Information regarding opportunities for continual improvement of the OHSMS is a vital input to the management review process. This could include possibilities of better operational controls, improved procedures, safer equipment, higher staff competence, better incident investigations, improved supervision, better communication with workers, proactive hazard identification and a host of other activities that could provide opportunities for continual improvement.

A sample of an input report prepared by an organisation for its forthcoming management review can be found in Appendix P.

17.4 Management review output

Inputs to the management review system form the first part of the review process. The second step is the actual review of these facts to evaluate the suitability, adequacy and effectiveness of the OHSMS. The review of an OHSMS requires a number of skills such as an in-depth understanding of the system, its intended outcomes, its processes and above all the ability to question and challenge the facts submitted for review. ISO 45001 requires that the output includes senior management’s decisions and actions on the health, adequacy, suitability and improvement of the OH&S system. This would include decisions and actions on:

•Shortcomings of the OHSMS to achieve its intended outcomes;

•Making new OH&S objectives and/or taking corrective measures for the objectives that could not be met;

•The root causes and corrective actions in situations when the performance showed no reduction in OH&S incidents and accidents;

•Provision of resources for ensuring a safe and healthy work environment;

•Determination of root causes and provision of resources where the OHSMS was found lacking in suitability, adequacy, effectiveness or delivering its intended outcomes;

•Determination of root causes and provision of resources where the OHSMS failed to show continual improvement;

•Decisions and actions in situations where lapses in regulatory compliance were identified;

•Decisions and actions on conduct and results of internal OH&S audits; and

•Resources and actions that may be needed as a result of concerns, consultation and participation of workers.

ISO 45001 makes it obligatory for senior management to communicate the relevant outputs of the management review to workers, their representatives and other concerned individuals. It also calls for documented information to be retained as evidence of conducting a management review. This could be information such as:

•Management review input report; and

•Output of management review, which includes issues discussed and decisions taken.