13.1 Health and Safety Management Systems: ISO 45001 and the Plan-Do-Check-Act Cycle
Key Takeaways
- ISO 45001:2018 replaced OHSAS 18001 and is structured on the ISO Harmonized Structure across ten clauses, with clauses 4-6 forming Plan, 7-8 Do, 9 Check and 10 Act.
- Certification to ISO 45001 is voluntary in South African law; it may be imposed as a tender condition but never substitutes for compliance with the OHS Act and Construction Regulations 2014.
- Construction Regulation 7(1)(a) embeds the Act stage of PDCA in South African law by requiring the principal contractor's health and safety plan to be reviewed and updated as work progresses.
- ISO 45001 clause 8.1.3 (management of change) and clause 8.1.4 (procurement) map directly onto CR 12(3) temporary works revision control and CR 5(1)(h) / CR 7(1)(c)(iii) contractor competency duties.
- System weight must be proportionate: a Regulation 3 permit project justifies a full documented system with an audit programme, while a short Regulation 4 project needs the same logic carried by far fewer documents.
13.1 Health and Safety Management Systems: ISO 45001 and the Plan-Do-Check-Act Cycle
[!NOTE] SACPCMP Blueprint Context: "Health and Safety Management Systems" is item 3 of the Construction Health and Safety core knowledge list in Annexure B of the SACPCMP Rules for Registration (Version 3 Revision 2, effective 1 August 2025), and "Health and Safety Management applications" is the first Initial Professional Development Module listed for the Construction Health and Safety Officer in Annexure C. Everything you have studied so far — legal appointments, risk assessments, safety files, registers — is a component. This chapter is about the machine those components run inside.
A South African construction site can hold a perfect set of legal appointment letters, a fully indexed health and safety file, and a shelf of signed registers, and still kill someone. Compliance artefacts prove that a duty was discharged on a date; they do not prove that hazards are being found, controlled and re-checked as the works change. A health and safety management system (HSMS) is the deliberate arrangement that closes that gap: a defined set of interacting elements — policy, objectives, processes, responsibilities and records — that an organisation uses to establish and achieve occupational health and safety results.
1. Why a Management System, Not Just a Compliance File
Consider two contractors on the same Gauteng high-rise. Contractor A produces a baseline risk assessment, files it in Divider 4, and never revisits it. Contractor B produces the same baseline assessment, converts each significant risk into a control, assigns an owner and a verification frequency, samples those controls weekly, tracks failures as non-conformances, and reviews the pattern monthly with the construction manager. Both are technically compliant with Construction Regulation 9. Only Contractor B has a system.
The legal hook for this in South Africa is section 8(2)(d) of the OHS Act, which requires the employer to "establish, as far as is reasonably practicable, what hazards to the health or safety of persons are attached to any work which is performed … and to establish precautionary measures as are reasonably practicable", and section 8(2)(i), which requires the employer to "cause all employees to be informed regarding the scope of their authority". Read together with section 16(1)'s non-delegable chief-executive-officer duty, these provisions describe a management system in everything but name.
2. ISO 45001:2018 — The International Reference Model
ISO 45001:2018, Occupational health and safety management systems — Requirements with guidance for use, replaced the older OHSAS 18001 specification (the migration period ended in September 2021). It is written in the ISO Harmonized Structure (formerly Annex SL), so its ten clauses align with ISO 9001 quality and ISO 14001 environmental systems, which is why integrated SHEQ systems are common on large South African contracts.
| Clause | Title | What it demands on a construction project |
|---|---|---|
| 4 | Context of the organisation | Identify internal and external issues and the needs of "interested parties" — for a principal contractor that means the client, subcontractors, the Department of Employment and Labour, unions, and neighbouring property owners |
| 5 | Leadership and worker participation | Top management accountability, the OH&S policy, defined roles, and — uniquely to ISO 45001 — consultation and participation of workers, which maps directly onto sections 17–20 of the OHS Act |
| 6 | Planning | Hazard identification, risk and opportunity assessment, determination of legal requirements, and OH&S objectives with plans to achieve them |
| 7 | Support | Resources, competence, awareness, communication and documented information |
| 8 | Operation | Operational planning and control, the hierarchy of controls, management of change, procurement (including contractors and outsourcing), and emergency preparedness and response |
| 9 | Performance evaluation | Monitoring, measurement, analysis and evaluation; evaluation of compliance; internal audit; management review |
| 10 | Improvement | Incident and non-conformity handling, corrective action, and continual improvement |
Two clauses deserve a CHSO's particular attention because they are where South African sites most often fail an external audit. Clause 8.1.4 (procurement) requires the organisation to control the procurement of products and services, including contractors and outsourced functions — the system equivalent of CR 5(1)(h) and CR 7(1)(c)(iii). Clause 8.1.3 (management of change) requires changes to be planned before they happen; on site this is the difference between a design revision arriving with a re-issued temporary works drawing and an issue-based risk assessment, and the same revision arriving as a verbal instruction to the foreman.
3. The PDCA Engine
ISO 45001 is built on Plan–Do–Check–Act, and the standard maps its own clauses onto that cycle. On a construction project the cycle turns at several nested speeds simultaneously.
| PDCA stage | Clause range | Project-level cadence | Daily site-level cadence |
|---|---|---|---|
| Plan | 4, 5, 6 | Client H&S specification, baseline risk assessment, PC health and safety plan | Daily safe task instruction, issue-based risk assessment before a new activity |
| Do | 7, 8 | Appointments, competency, safe work procedures, permits | Task execution against the method statement |
| Check | 9 | Monthly CR 5(1)(o) audits, KPI reporting, internal audit programme | Statutory inspections and registers, supervisor observations |
| Act | 10 | Management review, revision of the H&S plan under CR 7(1)(a) | Corrective action notices, toolbox talk on the failure mode |
[!IMPORTANT] CR 7(1)(a) is a PDCA clause hiding in South African law. It requires the principal contractor's health and safety plan to be "applied from the date of commencement of and for the duration of the construction work" and to be "reviewed and updated by the principal contractor as work progresses". A plan produced at tender and never revised is not merely poor practice; it is a direct contravention.
4. Certification, Legal Compliance, and the Limits of Both
Certification to ISO 45001 is voluntary in South Africa. No provision of the OHS Act, the Construction Regulations or the SACPCMP registration rules requires it. Clients increasingly demand it in tender documents, which is a commercial requirement, not a statutory one. A CHSO must be able to state this distinction cleanly in an examination and in a site meeting.
Equally, certification does not confer legal compliance. Clause 9.1.2 requires an organisation to evaluate compliance with its legal requirements, but an auditor sampling a management system will not read every appointment letter. The reverse is also true: full legal compliance does not deliver a system. The professional position is that the two are complementary — the OHS Act and Construction Regulations set the floor, and the management system is how a contractor demonstrates that it stays above that floor as conditions change.
Older South African schemes remain in circulation and candidates should recognise them: the NOSA integrated five-star system (CMB 253 and its successors) and, in construction specifically, client-run grading systems that score a contractor's system maturity. These are audit protocols layered on top of the same PDCA logic, not alternatives to it.
5. Sizing the System to the Project
A management system that is heavier than the project it serves will be ignored, and an ignored system is a liability in a section 24 investigation because it documents intentions the contractor did not honour. The professional judgement a CHSO brings is proportionality:
- A Regulation 3 permit project (exceeding 180 days, 1 800 person-days, or R13 million / CIDB grading level 6) justifies a full documented system with an internal audit programme and scheduled management reviews.
- A Regulation 4 notification project of a few weeks needs the same logic — hazards found, controls assigned, checks scheduled, failures fed back — carried by far fewer documents.
In both cases the test the CHSO should apply is a single question: if the site changed tomorrow, would the system find out?
A client's tender document states that the successful principal contractor must hold ISO 45001:2018 certification. A subcontractor argues that this is unlawful because South African legislation does not require certification. How should the CHSO characterise the position?
Halfway through a structural frame, the engineer issues a revised slab design that increases the propping load. The foreman is told verbally and continues. Which ISO 45001 clause has most directly failed, and what is the South African statutory consequence?
Which pairing correctly maps a South African statutory duty onto its Plan-Do-Check-Act stage?