ISO 45001 Clause 6: Plan Around Hazards, Duties and Objectives
ISO 45001:2018 clause 6 requires planning that addresses hazards, risks, opportunities, applicable requirements and OH&S objectives. The result should influence how work is organised and controlled. A completed assessment is a starting point for action, not evidence by itself that people are protected or obligations fulfilled.
What clause 6 requires in practice
Clause 6 is the planning clause. Subclause 6.1 asks the organisation to consider context, interested-party requirements and scope, and decide which risks and opportunities need to be addressed so the system can reach its outcomes, prevent or reduce undesired effects and improve. It breaks into hazard identification, assessing OH&S risks along with other risks, assessing opportunities, determining legal and other requirements, and planning action, including for emergencies, with the hierarchy of controls taken into account. Planned changes, temporary or permanent, are assessed before they are made.
Subclause 6.2 requires objectives at relevant functions and levels that fit the policy, are measurable where practicable or capable of evaluation, and reflect requirements, assessment results and worker consultation. Plans state what will be done, resources, owners, timing, evaluation and integration. Documented information is required for risks and opportunities, the planning processes, risk-assessment methodology and criteria, legal requirements, and objectives with their plans.
6.1.1: connect planning with context and change
Consider context, interested-party requirements and system scope when determining what needs attention. Planning addresses hazards, OH&S risks, other risks to the system, opportunities and legal or other requirements. Assess relevant risks and opportunities associated with planned changes before they are implemented, including temporary changes.
Maintain the required information on risks, opportunities and the processes and actions used to address them. Choose an approach that is systematic and understandable. A copied register with no connection to the organisation's activities will not reliably guide operational decisions.
6.1.2.1: identify hazards proactively
Hazard identification is ongoing and includes how work is organised, social factors, routine and non-routine activities, human factors, relevant past incidents, emergencies and changing knowledge. Consider workers, contractors, visitors, people nearby and workers in locations outside direct control. Examine actual work, rather than assume the written method describes every condition.
Involve relevant workers and consider the needs and capabilities of the people performing activities. Workload and work hours are part of the source text's social factors; hazard identification is not restricted to visible machinery or substances. A concern may need specialist evaluation without waiting for an injury to make it credible.
Why planning around hazards and duties matters
Planning is where the organisation decides, before harm occurs, what needs attention and who will act. Poor planning shows up as surprises: an incident from a temporary change nobody assessed, a legal duty discovered after a visit by an inspector, or an objective with no budget behind it. Good planning concentrates effort on the work that matters most and provides a basis for explaining decisions to customers, insurers and regulators. It also links the earlier clauses to operations, ensuring that what leaders say and what workers report turn into controls. Because planning outputs drive resources, they have direct cost consequences, and weak ones tend to be paid for later, with interest.
How to implement clause 6
The standard fixes the questions that planning must answer, not the tools. One order of work that Sterling teams use is described below. Keep each step connected to the next, so that planning outputs reach people who run the work. Record only what helps people act, and review it with the workers affected.
- Pull together the context, requirements and scope findings from clause 4 as the starting inputs.
- Establish hazard identification with workers, then choose and define risk-assessment criteria that suit the nature of the work.
- Set up a route for determining legal and other requirements and for passing them to those who run the work.
- Plan actions for significant risks, opportunities, obligations and emergencies, applying the hierarchy of controls and naming owners.
- Decide how planned changes are caught early enough to be assessed before they happen.
- Develop objectives with workers, then record the resources, owners, timing and evaluation for each, and connect them to business planning.
Evidence an auditor expects for clause 6
An auditor typically follows a thread from a hazard or requirement through assessment and action to result. Expect to be shown the documented methodology and criteria, the information held on risks and opportunities, legal and other requirements, and the objectives with their plans. Observations and interviews matter as much: do workers recognise the hazards described, was a recent change assessed before it was introduced, and can a manager explain why an action was chosen. Records of consultation on objectives, resource decisions and progress reviews help show that planning is alive. No register format is mandated, but the information needs to be sufficient to give confidence that planned processes are carried out.
Common nonconformities with clause 6
Findings often appear where planning is separate from real work.
- Hazard identification confined to physical conditions, ignoring work organisation and social factors.
- Risk-assessment criteria not defined, or applied differently between sites without explanation, and no separate view of risks to the system itself.
- Legal and other requirements recorded but not linked to any process or owner.
- Temporary changes introduced without prior assessment, or emergency actions listed in plans with no owner and no way of judging whether they work.
- Objectives without resources, owners or evaluation, or set without worker consultation.
Illustrative software example: release-period work organisation
A hypothetical software company repeatedly extends working hours before releases. Workers describe fatigue and difficulty raising concerns when deadlines approach. The assessment examines work organisation and existing controls, using worker participation and appropriate expertise rather than assuming office work has negligible OH&S risk.
The team evaluates possible changes to planning and resources, assigns responsibility and reviews whether the arrangements work after introduction. Evidence might include the assessment basis, worker input, authorised decisions and follow-up. The example does not diagnose individual health conditions or prescribe a universal safe working-hours limit.
6.1.2.2 and 6.1.2.3: distinguish risks and opportunities
Assess OH&S risks from identified hazards while considering existing controls. Also assess other risks to establishing, operating and maintaining the system, such as unreliable access to necessary expertise. Define and preserve the OH&S risk-assessment methods and criteria so their scope, nature and timing support proactive, consistent use.
Opportunities include adapting work and the working environment to workers, eliminating hazards and reducing risks. Other opportunities can improve the system itself. They are not simply a reversed risk score. Evaluate a proposed improvement on its own merits, including any new hazards or dependencies it could introduce.
6.1.3 and 6.1.4: turn obligations into action
Determine and access current legal and other requirements, understand how they apply and what must be communicated, and incorporate them into the system. Maintain and retain the required information and update it when requirements change. A register is a possible method; its title and layout are not the requirement.
Plan actions for risks, opportunities, obligations and emergencies, including how they enter business processes and how effectiveness will be evaluated. Take account of the hierarchy of controls and system outputs. Relevant options and operational constraints inform planning, but a business preference does not remove an applicable legal duty.
Illustrative construction example: a new subcontracted activity
A fictional contractor introduces a new type of subcontracted work. Before mobilisation, the team identifies the activity and interfaces, obtains competent advice on applicable obligations and assesses relevant hazards with those involved. It defines who controls each interface and how required information reaches the site.
Useful evidence includes the assessed change, the requirement-to-process connection, the agreed responsibilities and later evaluation. Merely collecting the subcontractor's policy would not demonstrate that the project-specific arrangements were planned or implemented.
6.2: objectives need a workable plan
Objectives support the policy and improvement, taking account of requirements, assessed risks and opportunities and worker consultation. They are measurable where practicable, or capable of performance evaluation. Monitor, communicate and update them as appropriate. The standard does not require every objective to use the same numerical formula.
Plans identify actions, resources, responsibility, timing, evaluation and integration into business processes. Maintain and retain the objectives and plans. Avoid an objective that rewards fewer reports without evaluating whether reporting remains reliable. An auditor may trace an objective from its rationale to resources, action and evidence of progress.
Explore each numbered part
6.1 · connect hazards, requirements and action
OH&S planning needs to connect hazards with risk assessment, opportunities, applicable requirements and effective action. Clause 6.1 brings these processes together while also addressing risks to the management system itself. This guide explains the relationships and shows how worker knowledge and change planning prevent isolated risk registers from becoming substitutes for practical control decisions.
6.2 · connect OH&S objectives with practical plans
OH&S objectives should direct effort towards meaningful results and have a credible plan for delivery. Clause 6.2 connects objective selection with resources, responsibilities, timing and evaluation. This guide explains how worker consultation and risk information shape priorities, and why activity counts or low reported incident numbers alone are weak evidence of successful prevention.
Frequently asked questions
Does ISO 45001 prescribe a risk matrix?
No. Define suitable methods and criteria, use them systematically and preserve the required information. The method should support competent decisions.
Is a legal register proof of compliance?
No. Determining requirements and evaluating fulfilment are distinct activities. Clause 9.1.2 addresses evaluation of compliance and its results.
Must all objectives be numerical?
They must be measurable where practicable or capable of performance evaluation. The evaluation basis should still make progress and results understandable.
Connect assessment with implementation
Discuss OH&S planning support with Sterling, including documentation, employee learning and agreed Effivity ISO & GRC automation software. Independent bodies decide certification; legal duties remain with the organisation. Enrol in ISO 45001 Awareness for foundational learning, alongside role-specific development where needed.
Explore hazard identification and assessment in depth. Revisit clause 5 worker participation, return to the overview, or continue to clause 7 support.