5.1 Clause 8.1.1–8.1.2: Operational Controls & The Hierarchy of Controls

5.1 Clause 8.1.1–8.1.2: Operational Controls & The Hierarchy of Controls

Operational planning and control under Clause 8.1 bridges strategic planning (Clause 6) and shop-floor execution. While Clause 6 identifies hazards, assesses risks, and sets OH&S objectives, Clause 8 operationalizes these decisions into daily workplace practices. For a lead auditor, assessing operational controls requires verifying whether physical and procedural safeguards actually control risks during routine and non-routine work, and whether the organization systematically prioritizes inherently reliable controls over administrative workarounds.

---

1. Operational Planning and Control Architecture (Clause 8.1.1)

Clause 8.1.1 mandates that an organization plan, implement, control, and maintain the processes needed to satisfy OH&S requirements and execute the actions determined in Clause 6. The standard establishes four foundational operational mechanisms:

a) Establishing Criteria for the Processes

Operating criteria define the boundaries and safe operating limits (SOL) within which processes must function to prevent injury and ill health. These criteria cannot remain vague intentions; they must be quantified and auditable:

• Safe Operating Limits: Maximum allowable working pressures, temperature cut-offs, vessel fill levels, and speed limits on conveyors or rotating equipment.
• Environmental and Exposure Thresholds: Occupational exposure limits (OELs) for airborne chemical contaminants, permissible noise doses (e.g., 85 dBA 8-hour TWA), lighting lux levels, and ergonomic lifting thresholds.
• Maintenance and Inspection Frequencies: Statutory pressure vessel inspections, daily forklift pre-use checklists, and quarterly interlock function tests.
• Permit Criteria: Atmospheric testing thresholds (e.g., oxygen levels between 19.5% and 23.5%, flammable vapors < 10% LEL, toxic gas limits) required before entering a confined space.

b) Implementing Process Controls

Once criteria are established, the organization must implement controls to maintain operations within those boundaries. Controls include automated programmable logic controller (PLC) shutdowns, pressure relief valves, local exhaust ventilation (LEV), interlocked perimeter guarding, standard operating procedures (SOPs), and work permits.

c) Maintaining and Retaining Documented Information

Clause 8.1.1 requires documented information to the extent necessary to have confidence that processes have been carried out as planned. A lead auditor must distinguish between two types of documentation:

• Maintaining Documented Information: Keeping procedures, operating manuals, safe systems of work, and inspection protocols current and accessible (Clause 7.5).
• Retaining Documented Information: Preserving objective evidence (records) demonstrating compliance with operating criteria, such as signed permits-to-work, instrument calibration logs, air monitoring data, and maintenance records.

d) Adapting Work to Workers

Clause 8.1.1(d) establishes an explicit normative obligation to adapt work to workers. Rather than forcing human operators to adapt to dangerous or ergonomically flawed machinery, the organization must design workplaces, work processes, workstations, equipment, and work organization around human capabilities:

• Physical Ergonomics: Adjusting working heights, providing mechanical lifting aids (e.g., vacuum lifters, scissor tables), designing reach envelopes within comfortable ranges, and mitigating repetitive movements to eliminate musculoskeletal disorders (MSDs).
• Cognitive Ergonomics: Designing intuitive human-machine interfaces (HMIs), rationalizing control room alarm systems to prevent alarm fatigue, and simplifying complex data displays.
• Psychosocial Work Organization: Structuring shift patterns, regulating overtime hours, scheduling adequate rest breaks, and balancing workload distribution to alleviate chronic physical and mental fatigue.

Multi-Employer Workplaces (Clause 8.1.1)

At workplaces where multiple employers share facilities (e.g., construction sites, industrial parks, multi-tenant distribution warehouses, oil refineries during turnaround), Clause 8.1.1 explicitly dictates that the organization must coordinate the relevant parts of its OH&S management system with the other organizations. This coordination requires joint traffic management plans, harmonized emergency evacuation protocols, shared hazard communication regarding toxic chemical releases, and unified site access controls.

---

2. The Five-Tier Hierarchy of Controls (Clause 8.1.2)

Clause 8.1.2 mandates that the organization establish, implement, and maintain a process for the elimination of hazards and reduction of OH&S risks using a strict five-tier Hierarchy of Controls. The hierarchy is structured strictly according to inherent reliability and effectiveness:

Tier 1: Elimination (Most Effective)

Elimination completely removes the hazard and its associated exposure at the source, reducing risk to absolute zero. Because the hazard no longer exists, it requires zero ongoing human behavior or maintenance to ensure protection.

• Industrial Examples: Redesigning an industrial reactor vessel to permit cleaning via automated high-pressure spray nozzles from the outside, completely eliminating the need for workers to enter a permit-required confined space; prefabricating structural steel trusses at ground level to eliminate working at heights; automating high-voltage electrical testing using robotic diagnostic probes.

Tier 2: Substitution

Substitution involves replacing hazardous materials, equipment, or processes with less hazardous or non-hazardous alternatives. While substitution significantly reduces risk, the lead auditor must verify that the organization evaluated secondary hazards introduced by the substitute.

• Industrial Examples: Replacing solvent-based paints containing volatile organic compounds (VOCs) and toluene with water-based acrylic coatings; substituting hexavalent chromium in metal plating with trivalent chromium; replacing high-vibration pneumatic jackhammers with hydraulic or diamond-wire cutting equipment; switching from 110V/230V corded power tools to 18V brushless cordless tools.

Tier 3: Engineering Controls and Reorganization of Work

Engineering controls physically isolate workers from the hazard or place a barrier between the worker and the hazardous energy. Reorganization of work restructures workflows to separate people from hazardous operations.

• Engineering Controls: Installing fixed perimeter machine guards with interlock switches (conforming to ISO 14119); deploying light curtains and pressure-sensitive safety mats; installing local exhaust ventilation (LEV) hoods at chemical transfer points; enclosing noisy air compressors within acoustic soundproof enclosures; fitting heavy machinery with physical rollover protective structures (ROPS).
• Reorganization of Work: Physically separating pedestrian paths from forklift traffic using crash-rated steel bollards and elevated walkways; scheduling high-noise maintenance operations exclusively during night shifts when adjacent administrative and assembly zones are unoccupied; implementing one-way traffic routing in logistics yards.

Tier 4: Administrative Controls

Administrative controls regulate how work is performed through formal procedures, instructions, training, and warnings. Administrative controls do not remove or physically isolate the hazard; they rely entirely on human compliance, worker vigilance, and continuous supervisory enforcement. As a result, they are inherently prone to human error and failure.

• Industrial Examples: Formal Lockout/Tagout (LOTO) energy isolation procedures; Permit-to-Work (PTW) systems for hot work, excavation, and confined space entry; job rotation schedules that limit worker exposure to hand-arm vibration or toxic fumes to two hours per day; pre-operational safety checklists; physical hazard warning signs, floor striping, and flashing safety beacons.

Tier 5: Personal Protective Equipment (PPE - Least Effective)

PPE places a wearable barrier on the individual worker's body. It is universally classified as the least effective control and must be utilized strictly as a last line of defense or as an interim safeguard while higher-level controls are being engineered. PPE relies entirely on correct fit, appropriate selection, continuous wear, proper maintenance, and human discipline. Furthermore, PPE protects only the individual wearing it and often introduces secondary physiological burdens such as heat strain, reduced dexterity, and restricted vision.

• Industrial Examples: Half-mask or full-face respirators with organic vapor/particulate cartridges; arc-flash protective suits; safety footwear with steel toes and puncture-resistant soles; fall arrest harnesses and lanyards; hearing protection (earmuffs and earplugs).
• Normative Cost Mandate: The Note to Clause 8.1.2 explicitly reinforces that PPE must be provided at no cost to workers.

---

3. Comparative Analysis of Control Tiers

---

4. Defense-in-Depth: Combining Controls & Verifying Residual Risk

In complex industrial operating environments, single controls are rarely sufficient. High-maturity organizations apply a defense-in-depth strategy, layering controls across multiple tiers:

• Example (Flammable Solvent Storage):
  1. Substitution: Switched to a solvent with a higher flashpoint (Tier 2).
  2. Engineering Controls: Installed explosion-proof ventilation, flame arrestors, and automated foam suppression (Tier 3).
  3. Administrative Controls: Implemented hot work permits, strict static grounding procedures, and daily vapor sniffing (Tier 4).
  4. PPE: Mandated anti-static coveralls, safety goggles, and nitrile gloves (Tier 5).

The Lead Auditor's Duty on Residual Risk: The auditor must verify whether the organization accurately assesses residual risk after controls are applied. If an organization rates a high-risk activity as 'Low Risk' purely because workers wear respirators or gloves, the auditor must challenge this assumption. The auditor must verify whether the failure modes of the lower-tier controls (e.g., respirator seal leakage, facial hair interference, glove degradation) were factored into the residual risk determination.

---

5. Lead Auditor Verification Strategies & Practical Field Techniques

When evaluating Clause 8.1.1 and Clause 8.1.2 during a Stage 2 audit, lead auditors should execute the following verification steps:

1. Challenge the 'PPE Fallback' Trap: Immature organizations routinely skip Tiers 1 through 3 and jump directly to issuing PPE (e.g., issuing earplugs for excessive machine noise or respirators for toxic vapor exposure). Auditors must examine the risk assessments for these tasks and demand documented engineering feasibility studies demonstrating why elimination, substitution, or engineering controls were technically impossible before accepting administrative controls or PPE.
2. Verify Operating Criteria on Gemba Walkthroughs: During the physical walkthrough, auditors must inspect whether operational parameters established under Clause 8.1.1 are actively measured and respected. For example, check differential pressure gauges on baghouse dust collectors, inspect calibration stickers on gas detectors, verify that machine guard interlocks cannot be defeated with standard bypass keys, and test emergency pull-cords.
3. Audit Work Adaptation (Clause 8.1.1d): Observe frontline workers in real time. Look for physical strain indicators: workers twisting while lifting 25kg bags, improvised wooden blocks used to adjust workstation heights, operators squinting in dim lighting, or repetitive manual tasks performed without rotation. Interview workers about physical fatigue and musculoskeletal aches.
4. Triangulate Operational Controls with Maintenance Records: Pull preventive maintenance (PM) work orders for safety-critical devices (e.g., ventilation exhaust fans, light curtains, emergency stop relays, eyewash stations). If safety equipment is overdue for maintenance or has been tagged out without interim controls, raise a nonconformity under Clause 8.1.1.

---

6. Real-World Audit Scenario: Chemical Decanting and Hierarchy Bypassing

Audit Context: During a Stage 2 certification audit of an industrial coating and paint manufacturing facility, the lead auditor conducts a Gemba walkthrough of the chemical blending building. The auditor observes two operators wearing half-mask respirators manually pouring 20-liter carboys of toluene and xylene into an open mixing vessel. Solvent fumes are clearly noticeable in the breathing zone, and liquid splashes are visible on the operators' aprons.

Investigation Trail:

1. The auditor requests the Job Safety Analysis (JSA) and risk assessment for the mixing operation. The risk assessment rates the inhalation and dermal toxicity hazard as High Risk. The documented control states: "Issue half-mask respirators with organic vapor cartridges, splash goggles, and neoprene gloves."
2. The auditor asks the safety manager whether engineering controls—such as a closed-loop vacuum transfer system, drum pumps, or a local exhaust ventilation (LEV) capture hood—were evaluated. The safety manager replies: "Closed-loop pumping was quoted at $45,000, which exceeded our departmental maintenance budget. Respirators provide adequate protection under our safety rules and cost less than $100 per worker."
3. The auditor interviews the operators. Both operators have full beards that break the respirator facepiece seal. Neither worker has ever undergone quantitative or qualitative respirator fit-testing. Furthermore, the cartridge replacement schedule is unmanaged: operators replace cartridges only when they begin to smell chemical vapors through the mask.

Lead Auditor Evaluation: The auditor issues a Major Nonconformity citing ISO 45001:2018 Clause 8.1.2 and Clause 8.1.1(a, b):

• The organization bypassed the mandatory Hierarchy of Controls, selecting the lowest tier (PPE) without technically demonstrating the unfeasibility of higher-tier controls (engineering isolation or LEV). Financial budget limits alone do not justify bypassing the hierarchy.
• The organization failed to establish and maintain operational criteria for the PPE control: fit-testing was omitted, facial hair policies were unenforced, and cartridge saturation limits were unmanaged, rendering the control ineffective.

---

7. Common Exam Traps & Pitfalls

• Trap 1: Confusing Warning Signs with Engineering Controls. Safety signage, flashing beacons, audible sirens, and painted yellow floor lines are administrative controls, not engineering controls. They do not physically isolate the hazard or place a barrier between the worker and danger; they rely entirely on human perception and obedience.
• Trap 2: Cost as the Sole Justification for Defaulting to PPE. Organizations cannot claim compliance with Clause 8.1.2 by asserting that engineering controls or chemical substitution are too expensive. The standard requires systematic evaluation based on technical feasibility and risk reduction. If capital investment is required, interim administrative/PPE controls may be deployed only while permanent engineering controls are planned under Clause 6.2 objectives.
• Trap 3: Overlooking 'Adapting Work to Workers'. Candidates frequently ignore Clause 8.1.1(d), assuming ergonomics is an optional HR consideration. Under ISO 45001, adapting workstations, equipment, and work organization to human physical and cognitive capabilities is a mandatory auditable operational control requirement.
• Trap 4: Assuming Free PPE Equals Standard Compliance. An organization that provides state-of-the-art PPE at zero cost to workers still violates Clause 8.1.2 if it failed to systematically evaluate elimination, substitution, and engineering controls first.