ISO 45001 clause 7.5.3: protect and control OH&S information
ISO 45001:2018 clause 7.5.3 requires documented information to be available and suitable where and when needed, and adequately protected. Protection includes confidentiality, integrity and prevention of improper use. Applicable controls address distribution, access, retrieval, use, storage, preservation, changes, retention and disposition.
What clause 7.5.3 requires in practice
Clause 7.5.3 asks the organisation to control the documented information the system and the standard require. Control has two aims: the information can be found and used where and when it is needed, and it is properly safeguarded, for example from leaks, misuse or damage to its integrity.
To achieve this, the organisation addresses, as applicable, how information is distributed, accessed, retrieved and used; how it is stored and preserved, including legibility; how changes are controlled, such as through version control; and how long it is retained and how it is disposed of. Documented information of external origin that the organisation determines is necessary for planning and operation is identified and controlled as appropriate. Two notes add that access can mean permission to view only or to view and change, and that access includes workers and their representatives where they exist.
Balance access with protection
Relevant workers and representatives need information they can use to understand arrangements and participate effectively. At the same time, some records contain information that should not be widely disclosed or freely altered. Decide who needs access and who is authorised to change information according to its purpose.
Consider the actual work setting. Temporary sites, remote work and system interruptions can affect availability. A current document in a central repository is not sufficient if the people doing the work cannot obtain it when needed. Conversely, uncontrolled local copies can undermine confidence that users have the right version.
Why control protects both use and evidence
Information that cannot be found, or that exists in several conflicting versions, leads to work being done on the wrong basis. Information that anyone can alter loses its value as evidence after an incident. Good control balances these risks: it puts the right version in front of workers and protects sensitive or evidential records. It also reduces legal exposure, since retention and disposal are handled deliberately. Control of external information, such as equipment instructions, prevents reliance on an obsolete source. Auditors often trace one document to see whether this balance holds.
How to implement clause 7.5.3
One practical approach is to apply control according to how each kind of information is used. Protection matters as much as access: some records involve personal or evidential content that should not be freely circulated or altered.
- Classify information by use: guidance for work, evidence of events, sensitive personal data and external sources.
- Decide who needs to read, who may change and who must be able to reach it, including workers and representatives.
- Make current versions available at the point of work, including temporary sites, and remove or mark uncontrolled copies.
- Define how changes are identified and how older versions are retired or kept.
- Set retention and disposal by applicable requirements and organisational need, not by one period for everything.
- Define how external information is identified and how users learn of changes, and use correction methods that keep history.
- Test the arrangements by asking a worker at a remote or temporary site to find and use the current instruction without help.
Control versions and preserve evidence
Establish how changes are identified and how current information replaces or distinguishes older versions. Keep stored information legible and usable. Determine retention and disposition based on applicable requirements and organisational needs rather than applying one arbitrary period to every record.
Completed evidence should not be overwritten in a way that conceals what occurred. Where a correction is needed, use an appropriate method that preserves the meaning and relevant history. A record’s usefulness depends on its integrity as well as its presence in a folder.
Manage necessary external information
External information determined necessary for planning and operation must be identified and controlled as appropriate. This may include relevant equipment instructions, technical information or requirement sources. Clarify how users access the applicable information and how relevant changes are recognised.
Control does not mean rewriting a supplier’s instruction or taking ownership of an external publication. It means managing the organisation’s use of necessary information so that work does not rely on an obsolete or unidentified source.
Two illustrative control arrangements
A construction project updates a coordination plan as work interfaces change. The team controls distribution to relevant supervisors and contractors and checks which version is being used in the field. Older copies retained for evidence are clearly distinguished from current instructions. A master-file update alone would not resolve obsolete information still used by a work team.
A software company retains records of work-related concern assessments and actions. It provides appropriate access to responsible people while protecting unnecessary personal details from broad circulation. Changes to a record remain understandable, and retention follows the organisation’s actual requirements. The arrangement supports learning without turning sensitive information into a general announcement.
Evidence and common mistakes
Evidence may include access arrangements, current-version identification, change history, retrieval tests and actual retained records. The standard does not require a particular platform or paper master list. A simple system can work if it provides reliable control suited to the information.
Common weaknesses include uncontrolled downloads, unreadable archived formats, access restrictions that obstruct work and automatic deletion that ignores evidence needs. Another is assuming backups alone provide a complete retention and retrieval process. Test whether authorised users can find and interpret the required information.
Frequently asked questions
Must all OH&S information be confidential?
No. Apply appropriate protection while ensuring relevant access, communication and participation needs are met.
Can obsolete versions be retained?
Yes, where needed, with controls that prevent unintended use and distinguish them from current information.
Is a shared drive sufficient?
It may be if the necessary access, version, protection, retention and retrieval arrangements are effective.
Check current use and reliable retrieval
Ask Sterling to review an OH&S information-control sample from issue to retention. The Documented Information Management course supports practical improvement. Effivity ISO & GRC automation software can be scoped to agreed documentation and audit needs. Return to documented information and the directory.