ISO 45001 implementation plan: phases, owners, deliverables and the worker participation that makes it real

Why an ISO 45001 project needs its own plan

ISO 45001 does not ask for a project plan. You need one because the system touches every supervisor, shift and contractor, and without owners the work drifts to the safety officer's desk.

Three things fix the pace. Risk assessments must exist for every activity before controls can be judged. The certification body wants records of the system operating: inspections, drills, consultation minutes, incident investigations and a completed internal audit. And its Stage 2 includes a tour of the workplaces, booked weeks ahead. A good plan fits on a page, runs backwards from that evidence and is checked weekly.

The phases: weeks, deliverables, owners and decisions

Ranges run from a low-hazard single site to a multi-site or high-risk operation; your plan puts one date on each row.

Phases 3 to 5 overlap on purpose: an area whose assessments are approved starts producing records while others are still being assessed. The gap analysis itself is covered in ISO 45001 gap analysis: what it covers and what you get, and calendar ranges with the body's lead times in ISO 45001 timeline: how long certification takes, stage by stage. Methods for phase 3 sit in ISO 45001 hazard identification and risk assessment and ISO 45001 legal register and evaluation of compliance.

Who does the work: the roles and the workers

The standard prescribes no project team. Its Leadership and worker participation clause makes top management accountable for preventing injury and ill health, requires roles to be assigned, and in 5.4 requires consultation and participation of workers. Performance evaluation adds the internal audit (9.2) and management review (9.3).

• Sponsor. A member of top management who owns the target date, releases supervisors' time, funds the controls and takes each decision in the phase table.
• Coordinator. Runs the weekly session, chases overdue actions, keeps documented information controlled and prepares the audits. Often the HSE lead, but the role coordinates; it does not own every hazard. Agree the project time in writing.
• Line managers and supervisors. They own the risk assessments, controls, permits and contractor arrangements for their areas and answer for them when the auditor walks the floor.
• Internal auditors. At least two trained people from different areas, so nobody audits their own work, able to cover every site and shift. Method sits in ISO 45001 internal audit: planning, conduct and reporting.
• Workers and their representatives. Not a project role, a requirement: non-managerial workers take part in hazard identification, risk assessment, deciding controls and investigating incidents. Put the safety committee or worker representatives on the plan with their own dates.

Design™ or Drive™: who carries the work

Sterling OS™, the method behind Sterling engagements, maps onto the plan. Design™ and Drive™ are two alternative routes through phases 1 to 7, and you choose one. Under Design™ your team implements, and Sterling provides structure, templates, workshops and coaching. Under Drive™ Sterling's consultants take on the agreed share of the consulting and documentation work alongside your managers. Automate™, the system running in Effivity, supports every phase, Sustain™ is phase 8, and Revise™ handles later changes of edition, scope or sites.

Design™ fits a capable HSE lead with time to spare. Drive™ fits a client prequalification deadline, thinly staffed sites or several locations to align. Neither shortens the operating period: drills, inspections and incident records build up only as fast as the work happens.

Mistakes that stall ISO 45001 projects

• Safety handed to one officer. The HSE lead appears against every row and the line never takes ownership. Share out the owner column at kick-off.
• Generic risk assessments. Assessments copied from a template do not describe the task, and the auditor notices on the tour.
• Contractors planned last. Agency staff and contractors count as workers and add to audit time, yet prequalification and inductions are often left until the end. Start them in phase 4.
• Sites treated as copies. Where sites differ in activities or risks, the certification body will not accept one sampled site as proof for the rest, so each needs its own place in the plan.
• Drills and the internal audit left to the fortnight before Stage 1. No time remains to act on what they reveal. Schedule the first drill in phase 5 and audit the earliest areas first.

See also ISO 45001 contractor management: prequalification to permits.

How Effivity holds the plan and the evidence

In a Sterling engagement the plan and the records are held together in Effivity, the group's ISO and GRC platform, used in 50+ countries and included with the engagement, at no additional cost.

• The plan: actions and milestones with owners and due dates.
• The system: hazard and risk assessments, compliance obligations, controlled documents, objectives and training records.
• The evidence: incident reporting from the field, work permits, nonconformities, internal audits and management review, recorded as the work happens.

Module detail is in Effivity for ISO 45001: the guide.

ISO 45001 implementation plan: questions buyers ask