ISO 45001 clause 8.1.4.3: retain control of outsourced functions

What clause 8.1.4.3 requires in practice

Clause 8.1.4.3 covers outsourcing, where an external organisation performs a function or process that would otherwise form part of the organisation's own activity. The organisation ensures such functions and processes are controlled. Its outsourcing arrangements must fit with legal and other requirements, and must support the results intended from the OH&S management system.

The standard does not fix the kind or level of control. The organisation defines them within its own system, according to the function and its consequences. A note observes that coordinating with external providers can help the organisation address how outsourcing affects its OH&S performance.

The expected output is a stated approach to each significant outsourced function: what the provider decides, what the organisation retains, how information passes between them, and how the organisation knows the arrangement still works.

Recognise what has been outsourced

An outsourced function or process is work another organisation performs as part of the organisation’s function or process. The provider is external, but the outsourced activity remains relevant to the management-system scope. This differs from assuming every purchased item creates the same outsourcing relationship.

Identify the function, its interfaces and its effect on OH&S outcomes. Consider what the provider controls, what the organisation still decides and where information or coordination is shared. The arrangement may also involve contractor requirements, so apply the relevant provisions together.

Define control from risk and responsibility

Determine suitable requirements, competence expectations, information exchange, monitoring and escalation. The degree of control should reflect the function and its consequences, rather than a universal checklist applied identically to every provider. Clarify how changes are assessed and who can authorise them.

Outsourcing does not automatically transfer away legal duties or top management accountability for the system. Obtain suitable advice where responsibilities require interpretation. A contract should make the arrangement clearer, but cannot be assumed to resolve every operational or legal question by itself.

Why clause 8.1.4.3 matters to the business

Outsourcing can make a function disappear from the organisation's view while its effects on workers remain. Support operations, maintenance, logistics and facilities services all shape working conditions, yet may be run to a contract that says little about health and safety. Without defined control, the organisation depends on provider assurances it cannot test, and discovers gaps only after an incident. Defining the right level of oversight protects the people doing the work, keeps the business aligned with the law where responsibilities remain with it, and gives customers a clear account of how outsourced work is managed. It also helps procurement teams negotiate service terms that support, rather than undermine, safe working arrangements.

How to implement clause 8.1.4.3

Approach outsourcing as a question of who controls what, and test the answer in operation. A practical route follows. Remember that outsourcing does not move away the organisation's accountability for its system, so oversight should be real, proportionate and written in terms that the people responsible can actually carry out.

1. Create a short list of functions and processes performed outside the organisation that fall within the scope of the OH&S system.
2. For each, describe the effect the function can have on OH&S outcomes and on the people involved.
3. Decide the type and degree of control that fits, such as requirements set, information received, visits, reviews or escalation arrangements.
4. Confirm that the arrangement is consistent with applicable legal and other requirements, taking advice where responsibility is unclear.
5. Agree how changes by the provider, including subcontracting, location or scope, will be notified and assessed.
6. Name who in the organisation receives provider information and what they do when it shows a problem.
7. Review the arrangement periodically against incidents, worker concerns and the provider's actual performance.

Two illustrative outsourcing arrangements

Evaluate the arrangement in operation

Check whether the agreed controls provide reliable information and appropriate action. Review relevant performance, incidents, worker concerns and changes in the service. If evidence is incomplete, determine what is needed rather than accepting a generic assurance statement.

Changes in provider personnel, subcontracting, location or service scope can alter the arrangement. Use change management and procurement processes to reassess relevant effects. Control should remain suitable throughout the relationship, not only during initial selection.

Evidence and common mistakes