ISO 45001 Clause 8: Control Work, Change and Emergencies
ISO 45001:2018 clause 8 requires the organisation to implement operational controls and emergency arrangements. It connects planning with what happens where work is done, including how change, procurement, contractors and outsourcing are managed. Controls must reflect actual hazards and responsibilities, not simply the existence of a procedure.
What clause 8 requires in practice
Clause 8 moves from planning to the work itself. Subclause 8.1.1 asks the organisation to plan, put into effect, control and maintain the processes required to meet system requirements and carry out the clause 6 actions, using operating criteria, control against those criteria, necessary documented information and fitting work to the workers. Where several employers share a workplace, it coordinates with the other organisations.
Subclause 8.1.2 sets a hierarchy of controls, running from elimination through substitution, engineering controls and reorganisation of work, administrative controls including training, and protective equipment. Subclause 8.1.3 requires a process for planned and unintended changes. Subclause 8.1.4 covers procurement, with separate expectations for general purchasing, contractors and outsourcing. Subclause 8.2 requires emergency preparedness and response, including planned response, first aid, training, testing, review and communication with relevant parties.
8.1.1: establish criteria and control the work
Plan, implement and maintain processes that meet OH&S requirements and carry out clause 6 actions. Establish criteria, operate the controls and preserve enough documented information to provide confidence that work occurred as planned. Adapt work to workers. At workplaces with several employers, coordinate the relevant parts of the system with the other organisations.
A useful implementation review follows one activity from planning to execution. Who establishes the conditions? Who confirms readiness? What happens when conditions differ? Which information demonstrates the agreed control? This examination often exposes gaps between procurement, scheduling and supervision that a procedure review alone misses.
8.1.2: use the hierarchy of controls
The hierarchy starts with eliminating the hazard, followed by substitution with less hazardous alternatives, engineering controls and reorganisation of work, administrative controls including training, and suitable personal protective equipment. Evaluate options in that order of preference. Several levels can be combined; selecting equipment worn by workers first can leave stronger options unexplored.
The choice depends on the work, potential consequences and applicable duties. Assess new hazards introduced by a proposed change and involve relevant workers. Training remains important but should support suitable work design and controls. A signed instruction does not establish that the underlying exposure has been adequately addressed.
Why operational control is where harm is prevented
Everything earlier in the system aims at this point: whether the work, the equipment, the contractors and the emergency arrangements are truly under control. Weak change management, uncontrolled procurement and untested emergency plans are among the typical contributors to serious events. A disciplined approach reduces injury and disruption, supports client confidence in contractor and outsourcing relationships and helps the organisation show that its decisions were reasoned. It also provides the strongest evidence for auditors, who tend to follow a real activity from plan to execution rather than rely on written procedures.
How to implement clause 8
A practical way to implement clause 8 is to take one activity and follow it through every subclause. Choosing an activity that crosses departments, such as maintenance by contractors, tends to reveal the most about how well the subclauses work together. Keep notes brief.
- Choose a representative activity, such as contractor maintenance or an operational change.
- Define the criteria for the work and confirm that the people involved can recognise when they are met.
- Apply the hierarchy of controls when selecting controls, involving workers and checking for new hazards.
- Check how the change and procurement processes would handle the activity, including the contractor and outsourcing interfaces.
- Test the related emergency arrangements, including first aid and communication with outside parties.
- Record what you found, fix the gaps and repeat for other activities.
- Summarise the lessons for management review and plan the next activity to examine, so that coverage widens over time.
Evidence an auditor expects for clause 8
An auditor will usually follow a real activity from planning to execution and look for proof that controls were applied as planned. Evidence tends to be a mix of records and observation.
- Records that operating criteria were applied and that planned controls were in place when work began.
- Evidence of how options were weighed against the hierarchy of controls for a specific change.
- Change and procurement records showing that contractor and outsourcing risks were considered before work.
- Records of emergency drills and the review of their results, plus first-aid arrangements.
- Interviews with workers and supervisors about how the controls operate day to day.
Common nonconformities with clause 8
Findings in operation usually show controls that exist on paper but not in the work.
- Operating criteria are too vague to apply, or conflicting instructions are both treated as current.
- Protective equipment or training is the first control chosen, without evidence that stronger options were considered.
- Changes to equipment, staffing or work organisation take effect without any review of their OH&S consequences.
- Contractors are approved on commercial terms with no check of their OH&S arrangements or coordination.
- Emergency plans exist but have not been tested, or lessons from drills are not recorded.
Illustrative manufacturing example: redesigning a work interface
A fictional manufacturer identifies repeated interaction between workers and material movement in a busy area. Before relying on reminders, the team examines whether the interaction can be removed or the work arrangement redesigned. Competent personnel assess appropriate options, including their effect on other activities and emergency access.
The selected arrangement is authorised, communicated and checked in use. Evidence could include the assessment, worker participation, the control decision and later observations. This example deliberately does not prescribe a layout or separation distance; those decisions require the actual conditions, technical expertise and applicable requirements.
8.1.3: assess temporary and permanent change
Management of change covers relevant new or altered products, services, processes, workplaces, work organisation, conditions, equipment and workforce. It also includes changed requirements and new knowledge about hazards, risks or technology. Review the consequences of unintended changes and take necessary action on adverse effects.
Temporary arrangements deserve particular attention because they can become normal without a planned decision. A useful approach identifies the intended duration, responsible owner and review point. These are practical controls, not prescribed form fields. The aim is to prevent the original assessment becoming disconnected from the way work now occurs.
8.1.4.1: specify OH&S needs in purchasing
Control procurement of products and services so it conforms to the OH&S system. Involve relevant operational and technical knowledge before the purchase becomes fixed. A low price or familiar supplier does not establish that the proposed item or service fits the workplace, workers and intended use.
8.1.4.2: coordinate contractor interfaces
Coordinate with contractors to identify hazards and assess and control risks arising from their activities affecting the organisation, the organisation affecting contractor workers, and contractor activities affecting others in the workplace. Define and apply OH&S selection criteria and ensure contractors and their workers meet relevant system requirements.
Selection, induction and supervision need to connect with the actual work. Documents supplied before appointment can inform the decision, but do not prove that a changing interface remains controlled. Decide how changes, concerns and incidents cross the organisational boundary without being lost between contract managers and site personnel.
8.1.4.3: define control of outsourced functions
Outsourced functions and processes remain controlled through defined arrangements. The type and degree of control must be clear within the system and consistent with applicable requirements and intended outcomes. Outsourcing the activity does not automatically transfer every OH&S responsibility to the provider.
Illustrative IT example: refurbishment in an occupied office
A hypothetical IT company commissions work in a building used by employees and visitors. Procurement checks the contractor's capability, while facilities and worker representatives examine how the work may affect occupied areas. The parties clarify interfaces, relevant information, authorised changes and escalation before work starts.
When the programme changes, the company reviews the consequences rather than assuming the original induction still covers everything. Evidence includes selection criteria, agreed responsibilities, relevant briefings and checks of actual arrangements. Any technical work methods or permits are established by competent parties according to the activity and applicable requirements.
8.2: prepare, practise and improve emergency response
Identify potential emergency situations through hazard assessment and establish planned responses, including first aid. Provide training, periodically test and exercise capability, evaluate performance and revise arrangements where necessary, particularly after emergencies. Consider relevant parties' needs and capabilities and involve them appropriately.
Communicate duties to workers and relevant information to contractors, visitors, emergency services, authorities and others as appropriate. Maintain and retain the required information on processes and response plans. A drill attendance sheet alone may not show whether the exercise revealed a gap or whether an identified action was resolved.
Explore each numbered part
8.1 · turn planning into controlled work
Operational control is where planning becomes the way work is performed. Clause 8.1 connects operating criteria, hazard elimination and risk reduction, management of change and procurement. This guide explains how those requirements work together across employees, contractors and outsourced processes, with examples that test whether the arrangement operates beyond its written description.
8.2 · prepare, test and improve emergency arrangements
Emergency preparedness connects foreseeable situations with a response that people can understand and practise. Clause 8.2 includes first-aid provision, training, periodic testing, evaluation and communication with relevant parties. This guide explains how to coordinate those elements and learn from exercises, without presenting a generic article as a site-specific emergency procedure or technical safety instruction.
Frequently asked questions
Does ISO 45001 prescribe every permit-to-work format?
No. Necessary controls depend on hazards, applicable duties and the organisation's arrangements. A permit may be required or useful in a particular context, but the standard does not supply a universal format.
Can outsourced work be excluded from review?
Not merely because a provider performs it. Determine the relevant control and influence, interfaces and obligations, then define appropriate control.
Is an emergency plan enough without exercises?
No. The clause includes training and periodic testing and exercising of capability, followed by evaluation and necessary revision.
Make operational arrangements easier to demonstrate
Discuss operational implementation and assessment preparation with Sterling, with documentation, employee learning and agreed Effivity ISO & GRC automation software. An independent body decides certification; the organisation retains workplace duties. Enrol in ISO 45001 Awareness as a foundation alongside job-specific competence development.
Explore the hierarchy of controls, management of change and procurement and external work. Revisit clause 7 support, return to the overview, or continue to clause 9 evaluation.