Developing a risk-based safety management system programme

At an OSHAfrica conference, speakers raised the topics of ‘Health & Safety Management Systems’ and ‘Safety Risk Management Systems’ which many people think of as vastly separated from each other.
The proposed Occupational Health & Safety Amendment Act (OHSAct) (not promulgated yet) is expected to require safety management systems and risk management to be performed at workplaces in the future.
As H&S practitioners, we have seen the publication of the 2018 ISO 45001 Occupational Health & Safety Management System that replaces the SANS OHSAS 18001 Health & Safety Management System, but how can we develop a risk-based H&S management system programme to manage Health & Safety (H&S) in the workplace?
The ISO 45001 Standard only gives us part of the process, as it only presents the framework for an H&S management system. To see the whole process, we must consider the SANS/ISO 31000 Risk Management – Principles & Guidelines Standard (of 2009 and now 2018), as it presents the relationship between the risk management principles, the risk management framework, and the risk management process. The 2009 and 2018 ISO 31000 Risk Management Standard documents present these relationships as follows:

The ISO 45001 H&S Management System standard only illustrates the framework for the H&S Management System Programme, but the Principles & Risk Management Process involving the risk assessment process are not shown in the published standard.

Let’s consider the 2018 guidelines edition of the 31000 Principles, which provides a statement of 8 risk management principles, as follows:
1. The risk management framework and processes should be customised and proportionate for the organisation and its objectives.
2. The risk management system requires the appropriate and timely involvement of its stakeholders.
3. Risk management requires a structured and comprehensive approach to be applied.
4. Risk management is an integral part of all organisational activities.
5. Risk management anticipates, detects, acknowledges, and responds to changes.
6. Risk management explicitly considers any limitations of available information.
7. Human and cultural factors influence all aspects of risk management.
8. Risk management is continually improved through learning and experience.
For developing a health & safety management system, the risk management principles above can be adopted and made applicable as the principles of a health & safety management system by purely replacing the word ‘Risk’ in the risk management principles, cited above, by ‘Health & Safety’.
Then use the health & safety management framework illustrated in the ISO 450001 standard, with the addition of ‘worker participation’ contributing to the leadership.

Part of the “PLAN activity” above is to identify the health & safety risks (hazards & exposures) of the organisation or the workplace/s so operational and support management function can be established and implemented. Part of this process involves using the 2018 ISO 31000’s Risk Management Process, shown below, which is also suitably title adapted to the Health & Safety Management Process.

The Scope of the Management Process is about deciding the boundaries and the applicability of the management system which could involve the whole organisation or just parts of or a specific part of the organisation in terms of the health & safety of the health & safety management system or range to a full enterprise-wide business risk boundary scope for establishing an enterprise-wide risk management system.

References:
ISO 31000:2009/2018: Risk Management – Principles & guidelines standards
ISO 45001:2018: OHS Management Systems standard.
L Bennett, Risk Assessment – guide to understanding the basics, Safety First Association, published 2006, 2nd edition 2022. (www.safety1st.co.za)
7/2023 -10/2019