Managing OH&S Risks and Opportunities Under ISO 45001
ISO 45001 Clause 6.1
Use the context, interested parties and hazards to plan actions that address risks and opportunities.
ISO 45001 Clause 6.1 - Actions to Address Risks and Opportunities
ISO 45001:2018 Clause 6.1 is the general planning clause. When planning the OH&S management system the organisation considers the issues identified at Clause 4.1, the requirements at Clause 4.2, the scope at Clause 4.3, and determines the risks and opportunities that need to be addressed.
The standard sets out three reasons for addressing risks and opportunities: to give the OH&S management system assurance that it can achieve its intended outcomes, to prevent or reduce undesired effects, and to achieve continual improvement. In determining risks and opportunities the organisation takes into account hazards, OH&S risks and other risks, OH&S opportunities and other opportunities, and legal and other requirements.
Clause 6.1 sits at the head of the planning sub-structure. The detail of how risks and opportunities are identified is in Clause 6.1.2 on hazards, Clause 6.1.3 on legal requirements, and Clause 6.1.4 on planning the actions themselves.
OH&S Risks and Other Risks
The standard distinguishes between OH&S risks - risks to workers' health and safety - and other risks. Other risks include risks to the OH&S management system itself, such as a key worker leaving, a regulatory change that creates new obligations, or a business decision that changes the activities the system has to control. Both kinds of risks need to be considered.
OH&S opportunities also have a counterpart - other opportunities. An OH&S opportunity might be a new technology that reduces manual handling. Another opportunity might be an integrated quality and safety procurement process that improves both contractor selection and supplier risk management.
What Documented Information is Required
The clause requires the organisation to retain documented information on the risks and opportunities, and on the processes and actions needed to determine and address them, to the extent necessary to have confidence they are being carried out as planned. In practice this is usually an opportunities and risks register, supported by a hazard and risk register and a legal register.
Start with the issues from clause 4.1, the interested parties from 4.2, and the scope from 4.3. They are the inputs. The output is a list of risks and opportunities the management system needs to act on.
Most organisations cover this with two registers - one for management system risks and opportunities at the strategic level, and one for hazards and OH&S risks at the operational level. Keep them separate because they serve different purposes.
Different registers help meet the requirements of this clause. The opportunities and risks register captures management system level risks and opportunities. The hazard and risk register captures the operational hazards and risk assessments. The legal register captures the legal and other requirements. Together these three documents cover the bulk of what Clause 6 needs.
I look for the link between context, interested parties and the actions planned. If the issues identified at 4.1 do not appear in the planning, I will ask why. If the legal requirements identified at 6.1.3 are not reflected in the actions at 6.1.4, that is a finding. The clauses are designed to flow into each other and that flow is what I check.
Practical Compliance Guidance
The IMS1 Manual sets out the planning approach for the integrated management system. Section 6 Planning covers the management system risks and opportunities and the OH&S planning process.
The following alphaZ documents support compliance with ISO 45001:2018 Clause 6.1.
| alphaZ document | How to use it |
|---|---|
| ISO 45001 Toolkit | The full set of documents needed for ISO 45001 compliance, including the registers used to record risks, opportunities and actions. |
| F-IMS23 Opportunities and Risks Register | Records the management system risks and opportunities identified through context review, alongside the actions planned to address them. |
| ER1 Issues Actions Register | Tracks the actions arising from risks and opportunities through to completion, with a category function to filter by management system area. |
| ER14 Hazard Risk Assessment Register | Lists the hazards identified across the organisation alongside the risk assessments that address them. |
Note - all the above files can be downloaded with an alphaZ subscription.
Frequently Asked Questions
UK Legislation
The following UK legislation establishes the requirement to assess and plan for OH&S risks. Organisations outside the UK should identify equivalent legislation in their jurisdiction.
