12.1 Health and Safety Management Systems & ISO 45001

1. What a Management System Is and Why the CHSM Needs One

The OHS Act and the Construction Regulations tell employers what must be achieved: risk assessments, safe work procedures, appointments, inspections, audits, training and records. A health and safety management system (HSMS) is how an organisation achieves those duties consistently on every project, rather than relying on individual effort. It is the organised set of policy, responsibilities, procedures, resources and records that makes safe work routine.

The SACPCMP Scope of Services (GN 1181 of 2019) describes the Construction Health and Safety Manager as a competent person "appointed by an employer to manage the planning and implementation of construction health and safety systems". Managing systems, not only inspecting sites, is therefore a defining part of the CHSM role and a core knowledge area in the SACPCMP registration rules.

A good system answers five practical questions:

1. What must we comply with? A legal register listing the Act, the Construction Regulations, the General Safety, Driven Machinery, Electrical Installation, HCA, Noise Exposure and Physical Agents Regulations, and client requirements.
2. Who is responsible? Section 16 accountability, CR 8 appointments and written job descriptions.
3. How is risk controlled? CR 9 risk assessments, safe work procedures, permits and inspections.
4. How do we know it works? Inspections, audits under CR 5(1)(o) and CR 7(1)(c)(vii), incident data and leading indicators.
5. How do we improve? Investigations, corrective actions and management review.

2. The Plan-Do-Check-Act Cycle

Most management system standards use the Plan-Do-Check-Act (PDCA) cycle:

• Plan: understand the organisation and its legal duties, set the policy and objectives, identify hazards and assess risks, and plan the controls.
• Do: provide resources, competence, communication and documented information, and run the operational controls (safe work procedures, permits, contractor management, emergency arrangements).
• Check: monitor and measure performance, evaluate legal compliance, audit, and investigate incidents.
• Act: correct nonconformities, review the system at management level and improve it.

On a construction project the cycle runs at several speeds: daily (task instructions and pre-use checks), monthly (the 30-day audit cycle of CR 5(1)(o) and CR 7(1)(c)(vii)) and annually (corporate management review).

3. ISO 45001 Clause Structure with Construction Examples

ISO 45001:2018, Occupational health and safety management systems — Requirements with guidance for use, is the international standard for an HSMS. It replaced OHSAS 18001, whose certificates lapsed when the migration period ended in 2021. South Africa adopted it as SANS 45001.

Clause 8.1.2 sets the same order of controls taught throughout this guide: eliminate the hazard, substitute less hazardous processes or materials, use engineering controls and reorganise work, apply administrative controls including training, and use personal protective equipment.

4. Current Status of the Standard

The current edition is ISO 45001:2018, together with Amendment 1:2024, which requires organisations to consider whether climate change is a relevant issue in their context. ISO is revising the standard: the draft international standard (DIS) ballot closed on 9 August 2026, and a new edition is expected in 2027, followed by a transition period for certified organisations. Until the new edition is published, certification audits use the 2018 edition. A CHSM should track the revision but must not describe draft clauses as requirements.

5. Certification Is Voluntary; the Law Is Not

ISO 45001 certification is a voluntary third-party attestation that a system meets the standard. A client may require it in tender documents, and it is useful evidence of competence and resources under CR 5(1)(h) and CR 7(1)(c)(iii). It is not a legal requirement of the OHS Act or the Construction Regulations, and it never replaces them:

• An inspector judges whether the Act and regulations are complied with on site, and can issue contravention or prohibition notices to a certified contractor.
• A certificate does not prove that a particular excavation is shored or a particular scaffold is safe; it proves that a system existed when the certification body sampled it.
• Many smaller contractors have no certification but can still operate a lawful and effective system.

6. From Corporate System to Project Plans

A contractor's corporate system is generic. On a project it must be translated into site-specific documents:

• The client's health and safety specification (CR 5(1)(b)), based on the client's baseline risk assessment;
• The principal contractor's health and safety plan (CR 7(1)(a)), based on that specification and approved by the client under CR 5(1)(l);
• Each contractor's health and safety plan (CR 7(2)(a)), approved by the principal contractor; and
• The health and safety file (CR 7(1)(b)), which holds the records that show the system is working.

The CHSM checks that the corporate procedures actually appear in these plans: that the project's risk assessments use the corporate method, that site inspections follow the corporate checklists, and that site findings flow back into corporate management review.

7. Integrated Management Systems

Many contractors combine quality (ISO 9001), environmental (ISO 14001) and health and safety (ISO 45001) systems into one integrated management system, because the standards share the same high-level clause structure. Integration reduces duplicated procedures and audits, but the CHSM must make sure that health and safety requirements, especially worker consultation and the hierarchy of controls, are not diluted by a quality-led format.