WHS Management System: What It Contains and How to Build One

The WHS Act does not say that a business must have a document called a WHS management system. What it requires is the result a system produces. A person conducting a business or undertaking must ensure, so far as is reasonably practicable, the health and safety of workers: safe systems of work, safe plant and structures, information, training, instruction and supervision, and monitoring of health and conditions. Officers must exercise due diligence, which the Act defines to include ensuring the business has appropriate resources and processes to eliminate or minimise risks, and verifying that they are used.

A business that can show a working system has the evidence that those duties are being met. A business that cannot is left to argue, after an incident, that it was managing safety without any record of doing so.

In some settings the system is required outright: builders working on Australian Government funded projects above the scheme thresholds must be accredited under the Work Health and Safety Accreditation Scheme, which audits their WHS management system; many principal contractors and government agencies require one for prequalification; and certification to ISO 45001 requires one by definition. Victoria's Occupational Health and Safety Act 2004 imposes equivalent general duties on employers.

Whatever the size of the business, a system has the same parts. ISO 45001 arranges them in a plan, do, check, act cycle:

1. Leadership and policy. A health and safety policy signed by the most senior person, and defined responsibilities and authority at every level.
2. Worker consultation and participation. How workers and their health and safety representatives are consulted on hazards, changes and decisions.
3. Planning. Identifying hazards, assessing risks, keeping a legal and other requirements register, and setting measurable objectives.
4. Support. Resources, competence and training, induction, communication and control of documents and records.
5. Operation. The procedures that control the work: risk controls, safe work procedures and SWMS, permits to work, contractor management, purchasing, management of change and emergency preparedness.
6. Performance evaluation. Workplace inspections, health monitoring, incident investigation, internal audits and management review.
7. Improvement. Corrective actions, and learning from incidents and audits.

A system that has the first five parts and not the last two is a set of documents. The checking is what makes it a system.

For a small or medium business, a complete system is a manual and a set of procedures, registers and forms:

• WHS policy and a statement of responsibilities.
• WHS management system manual describing how each element is met.
• Risk management procedure and a hazard and risk register.
• Legal requirements register.
• Consultation procedure, with toolbox talk and committee records.
• Training and induction procedure, a training matrix and competency records.
• Incident reporting and investigation procedure, with forms and a register.
• Emergency plan and first aid arrangements.
• Contractor management procedure.
• Plant and equipment register, with inspection and maintenance records.
• Hazardous chemicals register and safety data sheets.
• Safe work procedures, and SWMS for high risk construction work.
• Workplace inspection checklists and a schedule.
• Corrective action register.
• Internal audit and management review procedure.

Higher-risk industries add their own: permits to work, asbestos and silica management, traffic management, fatigue, and health monitoring.

ISO 45001:2018 is the international standard for occupational health and safety management systems, adopted in Australia as AS/NZS ISO 45001:2018. It superseded AS/NZS 4801:2001, the standard many Australian systems and tender documents were written to, and certification to AS/NZS 4801 is no longer available. Tender schedules still sometimes ask for 'AS/NZS 4801 or equivalent'; a system built to ISO 45001 answers that.

Certification is optional. A business can build its system to the ISO 45001 structure, which is what most clients' prequalification questionnaires follow, without paying for third-party certification. Certification becomes worthwhile when a client or a tender requires it.

The two are often confused because the names are close. A WHS management system belongs to the business and is permanent: it describes how the business manages safety in everything it does. A WHS management plan belongs to a project or a site: on a construction project worth $250,000 or more, the principal contractor must prepare one, and it describes how safety will be managed on that project. The plan applies the system to one job. A builder has one system and a plan for each project.

For businesses outside construction the word plan is often used for a shorter, single-document version of the system written for one workplace. The WHS management plan guide covers both uses, and the construction site safety management plan guide covers the project plan.

Systems fail in the same way: a manual is bought or written, placed on a shelf, and the business carries on as before. A system that is used has a few characteristics.

• It is sized to the business. A ten-person workshop does not need the document set of a tier-one builder. Fewer procedures that are followed are worth more than many that are not.
• It is written for the industry. The hazard register, procedures and forms name the plant, substances and tasks the business has. Generic text is the first thing an auditor notices.
• Named people own each part. Every procedure says who does what, by position, and those people know.
• The checks are scheduled. Inspections, training refreshers, plant servicing, insurance expiries and reviews have dates and someone responsible.
• It is reviewed. At least annually, and after any serious incident or significant change, management asks whether the system is working and records the answer.

WHS management software stores registers, sends reminders and collects forms from phones. It does not supply the policy, the procedures or the decisions about how hazards are controlled; those have to exist first. For most small and medium businesses the practical order is to establish the system in documents, run it for a period, and move the registers and forms into software when volume justifies it.