ISO 45001 clause 7.5: make OH&S information available and trustworthy
ISO 45001:2018 clause 7.5 requires documented information specified by the standard and information the organisation determines necessary for an effective OH&S management system. It also requires suitable creation, updating and control. Information should help people perform work and allow the organisation to demonstrate what its system achieved.
What clause 7.5 requires in practice
Clause 7.5 governs documented information, meaning the documents and records the OH&S management system relies on. It has three subclauses. Subclause 7.5.1 says the system includes the documented information the standard requires and whatever else the organisation decides is necessary for effectiveness. Subclause 7.5.2 covers creating and updating: suitable identification, format and media, and review and approval. Subclause 7.5.3 covers control: availability where and when needed, protection from loss of confidentiality, misuse or loss of integrity, and handling of distribution, access, storage, changes, retention and disposal.
The standard does not require a manual or a fixed set of procedures. The amount and form depend on the organisation, its work, its processes and the competence of its people, and must still show that the explicit requirements are met.
Connect the three documentation decisions
Clause 7.5.1 establishes the necessary information set. Clause 7.5.2 addresses identification, format, review and approval when information is created or updated. Clause 7.5.3 addresses availability, suitability, protection and control during use, storage, change, retention and disposition.
Different information serves different purposes. A current work instruction guides activity, while an incident record preserves evidence about an event and response. The controls should fit those purposes. Treating every record as a freely editable template can undermine the evidence it was meant to retain.
Design for workers and actual conditions
Consider who uses the information, where and when. Relevant workers and representatives need suitable access, while confidentiality and integrity also require protection. A document locked in a central office may not help a contractor working on a remote site.
Use existing business information where it is suitable and controlled. An organisation does not automatically need a separate OH&S manual or duplicate records for every management system. Integration should make responsibilities and evidence clearer, not conceal missing information.
Why trustworthy information supports safe work
People make safety decisions from the information in front of them. If instructions are out of date, records cannot be trusted or the right version cannot be found on a remote site, controls fail quietly. Good information control also gives the organisation something to rely on after an incident or a regulator's question, because it can show what was planned and what happened. Proportionate documentation avoids the cost of maintaining paperwork nobody uses. Auditors often sample a record back to its source to see whether the system's evidence is dependable.
How to implement clause 7.5
One way to apply the clause as a whole is to review information by purpose rather than by document type. Aim for the smallest set that gives reliable work and reliable evidence, and prefer existing controlled systems to creating parallel paperwork.
- List what the standard explicitly asks to be maintained or retained, then add what the organisation needs for consistent and safe work.
- Separate guiding information, such as work instructions, from evidence of what happened, such as records.
- Choose identification, format and review arrangements that suit each use and each user.
- Decide who may see and who may change each item, and where workers and contractors will reach it.
- Set rules for versions, corrections, storage, retention and disposal that preserve meaning and history.
- Check at the point of work that the current version is the one in use.
- Review the arrangements after changes of process, site, contractor or software so that information control keeps pace with the work.
Two illustrative information arrangements
A manufacturer controls instructions for a maintenance coordination process and retains records of completed work. The current instruction is available to the relevant team, changes receive suitable review and approval, and completed evidence is protected from unexplained alteration. The organisation checks what people actually use during the task, not only the master file’s approval status.
A software company records work-related concerns in an existing system. It defines what information is necessary, who can access it and how actions and outcomes are preserved. It avoids collecting or widely circulating unnecessary personal details. The information arrangement supports responsible assessment and learning without making every case visible to the entire workforce.
Include external information where necessary
External information needed for planning and operation must be identified and controlled as appropriate. Examples may include relevant supplier instructions, technical information or applicable requirement sources. Control should ensure that people can access the right information and recognise relevant changes.
The organisation does not need to control every publication anyone reads. Focus on information necessary for the system and the work. Clarify who is responsible for keeping that information suitable and for communicating changes affecting users.
Evidence and common mistakes
The required evidence is the actual documented information and its effective control. A master list, numbering scheme or document portal can help, but none is a universal substitute for suitability, availability and protection. The level of detail should reflect the organisation’s needs and complexity.
Common weaknesses include procedures that do not match practice, uncontrolled local copies, inaccessible records and retention rules that ignore applicable requirements. Another is restricting information so heavily that workers cannot understand relevant controls. Good documentation balances access and protection.
Explore each numbered part
7.5.1 · determine the documentation the system needs
A useful documentation set reflects requirements and the way work is performed. Clause 7.5.1 includes information required by ISO 45001 and information needed for system effectiveness. This guide explains proportionate decisions about procedures, instructions and records, helping organisations avoid both missing evidence and large template collections that people cannot use.
7.5.2 · create information people can trust and use
Information needs suitable identification, presentation and approval before people rely on it. Clause 7.5.2 addresses those controls during creation and updating. This guide explains how to make instructions and routine records clear and usable, with examples that show why technical review, worker understanding and appropriate approval matter more than a document number alone.
7.5.3 · protect and control OH&S information
Controlled OH&S information must be available where needed and protected against loss or improper use. Clause 7.5.3 addresses access, distribution, retrieval, storage, changes, retention and disposition, including necessary external information. This guide explains practical controls for instructions and records while recognising worker access, confidentiality and the need to preserve trustworthy evidence.
Frequently asked questions
Is an OH&S manual mandatory?
No particular manual is prescribed. The system needs the required and necessary documented information in suitable forms.
Can paper and digital records be combined?
Yes. Apply appropriate controls to each medium and preserve a clear relationship between relevant information.
Does software automatically make documents controlled?
No. The organisation still needs suitable content, responsibilities, access, approval and other relevant arrangements.
Review the information people rely on
Discuss OH&S documentation and records with Sterling, focused on usability and audit evidence. The Documented Information Management course develops practical control concepts. Effivity ISO & GRC automation software can be scoped to agreed needs. See support and the complete guide.