ISO 45001 Clause 10: Incidents, Corrective Action and Improvement
ISO 45001:2018 clause 10 requires the organisation to identify improvement opportunities, respond to incidents and nonconformities, and continually improve its OH&S system. The purpose is to change the conditions or arrangements that need attention, then check the result. Closing an action in a register is only one administrative step.
What clause 10 requires in practice
Clause 10 has three parts. Clause 10.1 requires the organisation to determine opportunities for improvement, drawing on its performance evaluation, and to carry out the actions needed to achieve the intended outcomes of the system. Clause 10.2 requires a process for reporting, investigating and acting on incidents and nonconformities. It sets out reacting in good time, evaluating the need for corrective action with worker participation, reviewing risk assessments, acting in line with the hierarchy of controls and management of change, assessing risks from new or changed hazards before acting, and reviewing effectiveness. Clause 10.3 requires continual improvement of the system's suitability, adequacy and effectiveness, including better performance, a supportive culture, worker participation and communication of results. Evidence is retained for incidents, actions and improvement.
10.1: use evaluation to identify improvement
Improvement opportunities arise from performance evaluation, worker input and other system information. Determine what action is necessary to achieve the intended outcomes. Not every improvement starts with an incident: a review may reveal a better way to organise work, improve participation or make an existing control more reliable.
Choose actions for a clear purpose. Explain the intended effect and how it will be reviewed. A large list of improvement ideas with no ownership or resource decision can obscure the few issues that need meaningful attention. Prioritisation should remain consistent with obligations, hazards and the consequences involved.
10.2: respond and investigate with workers
The organisation establishes processes for reporting, investigating and acting on incidents and nonconformities. An incident includes a work-related occurrence with the potential for injury or ill health even when no harm results. A near miss therefore deserves appropriate attention. An incident and a nonconformity are related concepts, but an incident does not automatically prove a requirement was breached.
React promptly as appropriate to control and correct the situation and address consequences. Evaluate the need for corrective action with worker participation and relevant interested parties. Investigate or review the event, determine causes and examine whether similar events or weaknesses exist or could occur elsewhere.
Why clause 10 matters to the business
Clause 10 is where the system pays back. Incidents and near misses are costly, and the same cause often waits elsewhere in the business. A sound response process fixes the cause once and applies the lesson across sites, avoiding repeat harm, repeat downtime and repeat investigation cost. Improvement driven by evaluation lets the organisation tighten controls before something fails. Worker participation makes the changes more practical, and visible follow-up encourages reporting, which feeds better information back into the system. Customers and insurers pay attention to how a business learns, because a business that learns is less likely to repeat its failures. Poor handling, by contrast, quickly erodes trust inside and outside the organisation.
How to implement clause 10
Make clause 10 a set of routes that people actually use, each matched to the kind of problem. A practical outline follows. Keep the routes distinct but connected, so that an event can be corrected immediately, investigated for causes, and then used as input to wider improvement without the three activities being confused or labelled interchangeably.
- Define the routes: incident and nonconformity response, improvement from evaluation, and ongoing improvement of the system.
- Make reporting simple and safe, so workers can raise incidents and near misses without fear of blame.
- Set expectations for immediate response, then for investigation depth proportionate to actual and potential consequences.
- Involve workers in causal analysis, and look for similar weaknesses elsewhere before closing a case.
- Assess risk and change implications before introducing any corrective action.
- Check effectiveness against the intended result, and revise the action or the system where it falls short.
- Keep records of events, actions and results, and communicate relevant learning to workers and other parties.
Connect corrective action with risk and change
Review existing OH&S and other risk assessments as appropriate. Actions follow the hierarchy of controls and management-of-change requirements. Assess risks relating to new or changed hazards before introducing action, then review effectiveness and change the system where needed. A response that solves one problem can create another if introduced without assessment.
The action should be proportionate to the actual or potential effects. A minor immediate outcome may have serious potential consequences, while a simple isolated issue may not justify an elaborate investigation. Preserve a defensible basis for the chosen response rather than use injury severity alone as the decision rule.
Illustrative software example: repeated failure to respond to concerns
A fictional software company finds that workers' concerns about an altered work arrangement were logged but never assigned to an accountable owner. The nonconformity concerns the organisation's reporting and response process. Sending a reminder to the mailbox administrator would not necessarily address unclear authority.
The company clarifies responsibility, establishes a usable escalation route and checks later reports through to decision and feedback. Relevant workers participate in evaluating whether the new arrangement works. Evidence of timely acknowledgement alone is insufficient if concerns still fail to receive an appropriate decision.
10.3: make improvement recur through normal work
Continual improvement concerns suitability, adequacy and effectiveness, including better OH&S performance, a supportive culture and worker participation in improvement actions. Communicate relevant results to workers and representatives where they exist. Maintain and retain the required information as evidence of improvement.
Improvement need not occur everywhere simultaneously. It should be a recurring management activity informed by evidence. Share learning between sites where relevant, but check whether conditions match before transferring a solution. A control suitable for one activity may need adaptation elsewhere.
Evidence of a completed learning cycle
Required information covers the nature of incidents or nonconformities, subsequent actions and results, including effectiveness. Communicate it to relevant workers, representatives and other parties as applicable while respecting appropriate information protection. A reviewer should understand why the closure decision was made.
Common weaknesses include blaming individuals without examining the system, prescribing training for every cause, closing actions before meaningful evaluation and ignoring similar exposure elsewhere. Another is treating fewer reports as proof of improvement without considering whether reporting confidence has declined.
Explore each numbered part
10.1 · choose improvement from evaluation evidence
Improvement begins with deciding what the evidence says needs to change. Clause 10.1 connects performance evaluation with opportunities and necessary action. This guide explains how to select a proportionate response, distinguish improvement from immediate correction and assign practical ownership, using examples that show why launching an initiative is not the same as achieving a useful result.
10.2 · Investigate Incidents and Test Actions
Incident and nonconformity investigation should lead to proportionate action supported by evidence. Clause 10.2 connects prompt response, worker participation, causes, wider exposure, risk review and effectiveness. Manufacturing and construction examples show why immediate correction differs from recurrence prevention and why new actions must be assessed for the hazards they could introduce.
10.3 · sustain improvement with worker participation
Continual improvement needs to strengthen performance and the way the organisation learns about work. Clause 10.3 connects system suitability, adequacy and effectiveness with culture, worker participation and communication. This guide explains recurring improvement and useful evidence, showing why successful prevention is not demonstrated by an endless series of campaigns or an uninterrupted decline in every metric.
Common nonconformities with clause 10
Typical audit findings in this area point to loops that were opened but never closed.
- Investigations that stop at the last person involved, with no examination of the conditions that made the event likely.
- Corrective actions closed when the task was completed, with no check on whether the problem stopped.
- Training prescribed as the default response without evidence that lack of knowledge was the cause.
- Similar exposure at other shifts or sites ignored, so the same weakness reappears elsewhere.
- Few reports treated as proof of improvement, when the real reason is low confidence in the reporting route.
Frequently asked questions
Must every near miss receive the same investigation?
The response should suit its actual and potential effects. The reporting and evaluation process should ensure relevant events receive an appropriate, reasoned response.
Is correction the same as corrective action?
No. Correction addresses the detected situation. Corrective action addresses causes to prevent recurrence, with effectiveness checked against the intended result.
Does improvement end after certification?
No. Continued operation, evaluation and improvement are part of the system. Certification is an independent assessment outcome, not the end of management responsibility.
Build investigations that lead to useful change
Discuss improvement and certification-preparation support with Sterling, including agreed Effivity ISO & GRC automation software and employee learning. Independent bodies decide certification; no programme guarantees an incident-free workplace. Enrol in Root Cause Analysis & CAPA for related investigation skills.
Explore incident and corrective-action decisions in depth. Revisit clause 9 evaluation, return to the overview, or use the learning to review clause 4 context.