ISO 45001 Clause 7: Competence, Communication and Evidence

What clause 7 requires in practice

Clause 7 is the support clause. It asks the organisation to determine and provide the resources the system needs (7.1) and to establish the competence of workers who affect OH&S performance, including their ability to identify hazards (7.2). Workers must be aware of the policy, objectives, their contribution, relevant hazards, incidents and their right to withdraw from imminent serious danger without undue consequences (7.3).

It then covers communication: deciding what, when, with whom and how to communicate, internally and externally (7.4). Finally it covers documented information: what the system needs, how it is created and updated, and how it is protected and controlled (7.5). Taken together, the clause tests whether people have the capacity, skill, knowledge and information to do what the system expects of them.

7.1 and 7.2: provide resources and establish competence

Determine and provide resources for the system's operation and improvement. Establish the competence needed where workers affect OH&S performance, including hazard identification. Competence may be based on suitable education, training or experience. Where action is needed to develop or maintain it, evaluate that action's effectiveness and retain appropriate evidence.

A training attendance record confirms attendance. It does not necessarily show the person can make the required judgement or perform the task under actual conditions. Depending on the role, supervised practice, observed performance or another suitable evaluation may provide useful evidence. These are implementation options, not a universal assessment method.

Why support arrangements decide whether the system works

Controls designed on paper fail when a supervisor lacks time, a worker has never been shown the hazard, a night shift cannot reach anyone, or the current instruction is not where the work happens. Clause 7 is where those practical failures are prevented. Clients and insurers often judge an organisation by whether its people can explain their own risks and routes for raising concerns. Investment in competence and communication also reduces repeat incidents and avoids the cost of retraining after an event. For audit outcomes, weaknesses in support are among the most common reasons a well-written system is found not to operate in practice.

How to implement clause 7

One way to implement the clause as a whole is to follow a single role or process through all five subclauses. Pick a control where a failure would matter, so the review is proportionate, and involve the people who do the work as well as their managers.

1. Pick a critical control and ask what resources, time and authority its owner needs, then close any gap.
2. Define the competence needed for the roles around that control and compare it with what people can actually do.
3. Check what workers, contractors and visitors understand about the relevant hazards and about stopping unsafe work.
4. Map who needs which information, when and in what form, including shifts, languages and remote workers.
5. Decide which documents and records are necessary and check that people can reach the current version where they work.
6. Repeat with other controls, and feed what you learn into planning and management review.
7. Record the gaps found, assign owners and re-check the same control after the fix to confirm that people can now do what the system expects.

Illustrative manufacturing example: a changed inspection role

7.3: make awareness relevant to the person

Workers need awareness of policy, objectives, their contribution, relevant hazards and risks, consequences of not meeting system requirements, and relevant incidents and investigation outcomes. They also need to understand their ability to remove themselves from situations they consider an imminent and serious danger, and the arrangements protecting them from undue consequences.

Translate this into usable knowledge of local routes and responsibilities. Asking people to recite the policy is less informative than asking how they would raise a concern or obtain help when conditions differ from the plan. Ensure contractors and other relevant workers receive information appropriate to their work and the organisation's control.

7.4: communicate information people can use

Communication processes determine what, when, with whom and how to communicate. They take account of diversity, relevant external views and applicable requirements. Information should be reliable and consistent with the system, with appropriate response to relevant communications and retained evidence where appropriate.

Internal communication reaches relevant functions and levels, including changes, and enables workers to contribute to improvement. External communication follows the organisation's arrangements and applicable requirements. A message may need different formats or routes to reach shifts, visitors or contractors; distribution alone does not show understanding.

Illustrative BPO example: a concern raised on the night shift

A fictional BPO centre advertises a daytime office as the route for workplace concerns. Night-shift staff can send email, but do not receive a clear response and stop using the route. The review identifies a communication and participation gap, not simply a lack of awareness.

The centre establishes an accessible route, responsibilities for response and feedback suitable for affected workers. It checks a sample of concerns from submission to action and closure communication. Records can show whether the route operates, while worker explanations reveal whether people understand it and trust that their input is considered.

7.5: control information from creation to disposition

The system includes required information and information the organisation determines necessary. Creation and updating involve suitable identification, format, media, review and approval. Control makes information available and suitable when needed while protecting it from loss, misuse or compromised integrity.

Relevant controls address access, distribution, retrieval, storage, legibility, change, retention and disposition. Necessary external information also needs control. Workers and representatives need appropriate access to relevant information. Protecting confidential data and enabling useful access are both important; neither unrestricted disclosure nor blanket restriction is a complete solution.

What an auditor may examine

Explore each numbered part

Common nonconformities with clause 7

Findings under this clause usually show a gap between what the system says and what people can do or reach.

• Training attendance is retained, but nothing shows the worker can perform the task or identify the relevant hazards.
• Awareness is assumed from induction; workers cannot explain how to raise a concern or when they may withdraw from danger.
• Communication reaches managers but not night shifts, contractors, visitors or workers with language or access needs.
• Obsolete instructions are in use, or records can be altered without trace.
• Resources are named in plans but the responsible person has no time or authority to deliver.