ISO 45001 clause 7.4.3: manage external OH&S communication
ISO 45001:2018 clause 7.4.3 requires external communication of information relevant to the OH&S management system according to the established communication processes and taking legal and other requirements into account. The right message depends on the party, purpose and applicable duty. The clause does not impose universal public disclosure of every internal record.
What clause 7.4.3 requires in practice
Clause 7.4.3 is the shortest of the communication subclauses. The organisation communicates externally the information relevant to its OH&S management system. It does this as set out by its own communication processes under clause 7.4.1, and with its legal requirements and other requirements in mind.
External parties might include clients, contractors, regulators, emergency services, neighbours and other employers who share a workplace. The clause does not call for public disclosure of every internal record. What it expects is that the organisation decides who needs what, communicates accurately and in line with applicable duties, and keeps the message consistent with what the system actually shows. Where a regulator, client or emergency service asks for information, the process should have a route for a timely and reliable answer.
Identify the external interface
External parties can include contractors, clients, authorities, emergency services, neighbours or other relevant organisations. Determine what information supports their role or a required response. A contractor needs usable coordination information; a customer may need an accurate description of system arrangements; an authority request may involve specific duties.
Establish responsibility for checking and communicating the information. Where a question requires legal or technical interpretation, obtain suitable advice. Do not substitute a generic statement of ISO conformity for the specific information or action required.
Why accurate external messages protect trust
Clients, authorities and neighbours form their view of an organisation's safety from what it tells them. An exaggerated claim, an incident figure without context or the suggestion that certification guarantees safe work can mislead and damage trust when reality emerges. Clear external communication also protects people on shared sites, where another employer's workers may depend on your notice of a changed activity. For tenders and client audits, a consistent and substantiated account of the system is stronger than a general declaration of conformity.
How to implement clause 7.4.3
One way to put the clause into practice is to list the external interfaces and agree how each is handled. Avoid reflex statements of conformity and instead give each party the specific information that supports its role or its decision.
- List the external parties with an interest in the system, including clients, contractors, other employers on site, authorities and emergency services.
- For each, decide what information they need and what applicable duties govern it, taking advice where interpretation is needed.
- Name who prepares, checks and releases external communications, and who may speak for the organisation.
- Make sure statements about performance or certification state their scope and basis.
- Agree how incoming requests are received, logged and answered, including urgent ones.
- Check that responses from external parties, such as a conflicting activity on site, are reviewed and acted on.
- Review external messages after incidents, client audits or authority requests, and correct anything that no longer matches the system.
Keep the message within the evidence
Apply the general requirement for reliable information consistent with the OH&S system. Describe the scope and basis of performance data or assurance statements. An incident figure without context or a claim that certification guarantees safe work can mislead the recipient.
Certification is an independent decision about a defined management system. It does not authorise every activity, approve a product or remove legal duties. External communication should preserve those boundaries and avoid promises that the organisation cannot substantiate.
Two illustrative communications
A construction contractor changes a work sequence that affects another employer on site. It communicates relevant information through the agreed coordination route before the affected work occurs and checks that responsibilities are understood. The response from the other employer identifies a conflicting activity, which is resolved through competent planning. Merely issuing a notice would not complete the coordination.
A software provider supplies staff to work at a client’s premises. The provider and client clarify relevant site information, reporting arrangements and responsibilities for changes. The provider communicates accurately about its own system without implying control over all client-site conditions. Worker feedback can then identify whether the agreed interface works in practice.
Handle reports and requests appropriately
Some external communications may have defined content or timing under applicable requirements. Determine those through the legal-and-other-requirements process and apply them to the actual event or activity. This guide does not prescribe a jurisdiction-specific incident-reporting deadline.
Relevant incoming communications need an appropriate response through the general communication process. A contractor’s question, client concern or authority request may also require action in planning, operational control or improvement. Keep the message connected with the responsible process owner.
Evidence and common mistakes
Retain documented communication evidence as appropriate. Depending on significance, useful records can include the request, checked information, response and resulting action. The standard does not require a universal public safety report or a separate register for every external exchange.
Common weaknesses include allowing commercial promises to outrun actual capability, failing to communicate changes to affected contractors and presenting incomplete investigation findings as final conclusions. Another is assuming that a contract clause proves the recipient received and understood the operational information needed for the work.
Frequently asked questions
Must all incident information be published?
No universal publication duty is created here. Determine actual communication requirements and handle relevant information appropriately.
Can a certification claim replace specific client evidence?
No. Provide information relevant to the request and supported by the system’s actual scope and records.
Who decides reporting deadlines?
Applicable legal and other requirements may establish them. Determine the duties for the actual location and circumstances.
Clarify a contractor or client information exchange
Ask Sterling to review an external OH&S communication interface, with specialist advice scoped where needed. The ISO 45001 Awareness course develops relevant understanding. Effivity ISO & GRC automation software can be considered for agreed documentation and audit needs. See communication and the guide.