ISO 45001 clause 4.3: define a defensible OH&S system scope
ISO 45001:2018 clause 4.3 requires the organisation to determine the boundaries and applicability of its OH&S management system and make the scope available as documented information. The boundary must reflect relevant context, worker and interested-party requirements, and planned or performed work-related activities. A scope should describe responsibility clearly, not hide difficult work.
What clause 4.3 requires in practice
Clause 4.3 asks the organisation to determine the boundaries and applicability of its OH&S system, and from that to establish a scope. In reaching the scope, it considers the issues from 4.1, takes into account the requirements from 4.2 and looks at the work-related activities planned or actually performed.
Two further points give the clause its practical weight. The system has to include any activity, product or service that the organisation controls or influences and that can affect its OH&S performance, so ownership of a building or employment of a person is not the test. And the scope has to be available as documented information, so that anyone can read where the system applies. The scope may cover a defined part of an organisation, provided it is described accurately. A scope is not a risk assessment: hazards and risks are examined later, within the boundary the scope sets.
Examine the work before drafting the statement
Consider the organisation’s activities, products and services within its control or influence that can affect OH&S performance. Identify locations, functions and work arrangements relevant to the proposed boundary. The wording may be concise, but the underlying decision needs to account for how work actually happens.
A scope can cover a defined part of an organisation. It should not imply coverage of activities or sites that are not managed within that system. Public descriptions and any certification statement need to match the actual boundary and the independent certification body’s decision.
Address control and influence accurately
Shared premises, remote work, client sites and outsourced functions require careful consideration. The organisation may not control an entire building or another employer’s activities, but it can still influence work through contracts, coordination and its own decisions. Lack of ownership is not automatically lack of responsibility.
Discuss interfaces with people who manage the work and with workers who experience the arrangements. Clarify which decisions the organisation can make, which require coordination and how relevant requirements enter planning. Scope determination does not replace the detailed hazard and risk assessment.
Why a defensible scope protects the business
The scope is the statement outsiders rely on. Customers use it to judge whether the work they are commissioning is covered, and certificates and marketing material refer to it. If it implies more coverage than the system delivers, the organisation faces credibility damage after an incident and possible disputes with clients. If it excludes real activity to make an audit easier, workers doing that work receive no management system benefit while the organisation carries the legal responsibility anyway. A clear boundary also settles internal arguments about who is responsible for contractors, remote staff and shared sites, and makes it easier to plan resources accurately.
How to implement clause 4.3
The clause does not dictate a format, but a good scope usually comes from looking at real work first and drafting words second. One way Sterling teams proceed is shown below. Keep the wording accurate, because customers and certificates will rely on it.
- Collect information on sites, functions, contracts and work patterns, including temporary locations and activities at customer premises.
- For each activity, decide whether the organisation controls it, can influence it through contracts and coordination, or neither, and record the reason.
- Check the outcome against context issues and interested-party requirements so nothing relevant has been left out.
- Draft a short statement that names the activities, locations and organisational parts covered, in language a worker or customer can follow.
- Compare the draft with observed work, asking supervisors and workers whether it matches what happens.
- Make the final statement available as documented information and decide which events, such as acquisition or outsourcing, require review.
Two illustrative scope decisions
A construction contractor proposes a scope covering its project-delivery activities. It examines temporary sites, subcontracted work and shared-site coordination rather than describing only its administrative office. The system boundary identifies the work under its control or influence while recognising that other employers retain their own duties. This supports an accurate description of what the system manages.
A software company uses office-based and remote support teams. It considers work organisation, equipment arrangements and the degree of control over remote work. The scope does not assume that all work outside company premises is irrelevant. At the same time, it avoids claiming control of every condition in an employee’s home.
Keep the documented scope useful
The scope must be available as documented information. Supporting site lists, organisational descriptions or interface maps can make a complex boundary understandable, but no particular format is prescribed. Users should be able to connect the statement with real activities and responsibilities.
Review the boundary when the organisation changes. Acquisitions, new contracts, relocation, outsourcing or altered work arrangements can affect applicability. The change-management and evaluation processes should help keep the scope current rather than leaving it as a document prepared only for the first audit.
Evidence and common weaknesses
An auditor may compare the scope with contracts, organisational information, work observations and worker accounts. The documented statement is required; a separate elaborate scope report is not universally required. Evidence should support the boundary and the system’s treatment of relevant activities.
Common weaknesses include omitting temporary work, confusing ownership with control and using vague wording that overstates coverage. Another is excluding a hazardous process while continuing to claim that the system covers the wider operation containing it. The standard’s conformity claim requires its requirements to be incorporated and fulfilled without exclusion.
Frequently asked questions
Can the scope cover one business unit?
Yes, if the boundary is clear and the system fulfils the requirements within it. Claims must accurately describe that coverage.
Does remote work fall outside the scope automatically?
No. Consider the work arrangement and the organisation’s control or influence rather than location alone.
Is the scope required to be documented?
Yes. Clause 4.3 requires it to be available as documented information.
Check the boundary against real work
Discuss an OH&S scope review with Sterling before implementation or audit preparation. The ISO 45001 Awareness course helps owners understand the system. Effivity ISO & GRC automation software can be scoped to the agreed boundary. Continue to context and the complete guide.