ISO 45001 Operational Controls: Managing Risks at the Source

Clause 8 is where ISO 45001 transitions from planning to action. Your HIRA identified risks. Your objectives set targets. Now Clause 8 is where you design and implement the specific measures that prevent those risks from becoming incidents.

This is also where I see the biggest disconnect between documentation and reality. Organisations have beautiful operational control procedures but workers bypass them daily. Machine guards are removed because they slow production. PPE is left off because it’s uncomfortable. Safe work procedures aren’t referenced on the job because they’re filed in a cabinet no one checks.

Effective operational controls are those embedded into how work actually happens—not just documented as theoretical guidance.

Clause 8.1: Operational Planning and Control

Clause 8.1 requires you to “plan, implement and control the processes needed to meet OH&S requirements.” This has several dimensions:

Identifying Hazards and Implementing Controls (8.1.1-8.1.2)

For each hazard identified in your HIRA, you must implement controls following the hierarchy of controls: elimination, substitution, engineering, administrative, PPE.

This means:

Elimination: Can you eliminate the hazard entirely? Instead of managing chemical hazard, switch to non-toxic alternative. Instead of working at height, redesign so work is done at ground level. If elimination is possible, it should be your default.

Substitution: If elimination isn’t possible, can you replace with something less hazardous? Quieter equipment, less toxic solvent, less physically demanding process design.

Engineering Controls: Machine guarding, ventilation systems, noise dampening, automated processes. These are more reliable than administrative controls because they don’t depend on human compliance.

Administrative Controls: Safe work procedures, training, supervision, job rotation. These are necessary but less effective because they depend on consistent human behaviour.

PPE: Hard hats, safety glasses, respirators, gloves. This is the least effective because it relies entirely on correct, consistent use.

Many organisations jump to PPE without adequately exploring higher-order controls. A HIRA identifies high-risk chemical exposure and the control is “provide respirators.” Why isn’t chemical substitution explored? Why isn’t ventilation designed? Document your reasoning: “Elimination: chemical is essential to process, no alternative exists. Substitution: alternatives evaluated; none meet technical requirements. Engineering: ventilation considered; cost-benefit shows additional cost wouldn’t substantially reduce risk given process design. Therefore, administrative controls (safe handling procedure, training) and PPE (supplied-air respirators) are primary controls.”

Management of Change (8.1.3)

Changes introduce risk. When you install new equipment, redesign a process, reorganise staff, or upgrade systems, you’re creating a window of vulnerability. Workers aren’t yet familiar with new procedures. Hazards might be disrupted and unpredictably manifest. Controls might not be in place until after the change is live.

Management of change (MOC) is your process for assessing and managing OH&S implications before changes are implemented.

What counts as a change?

—New or modified equipment or machinery

—Process redesign or significant procedure changes

—Staffing changes (new team composition, outsourcing)

—Layout or facility changes

—Regulatory or compliance changes

—New product lines or services

The MOC process:

1. Identify change: Someone proposes a change. This triggers MOC, not as an obstacle but as a structured assessment.

2. Impact assessment: What OH&S implications does this change have? New machinery introduces machinery hazards. Process redesign might eliminate some hazards but create others. Staffing changes might reduce experience or create training needs. Assess comprehensively.

3. Control design: What controls must be in place for the change to be safe? If new machinery is installed, it must be guarded. If process changes, workers must be trained on new procedures. If staff are new, they need induction and supervision. Design controls before the change occurs.

4. Implementation plan: When and how will the change occur? What’s the transition period? How will people be trained? What monitoring will occur during transition? Plan details, not just outcomes.

5. Approval: Who approves the change? Typically Operations Manager plus OH&S Manager. Both must sign off that OH&S implications have been addressed.

6. Implementation and monitoring: As change occurs, monitor that planned controls are actually in place. If transition reveals unexpected issues, adjust on the fly.

7. Review: After transition, review what worked and what didn’t. Did workers adapt quickly? Were controls effective? Document lessons.

The weakness I see is MOC that’s completed on paper but not in reality. Someone approves a change, controls are planned, then reality diverges. The new machinery installation is delayed. Workers aren’t trained on schedule. A control is deemed “too expensive” and removed without reassessment. Document and communicate the MOC throughout implementation, not just at approval stage.

Procurement and Contractor Management (8.1.4)

Procurement: When you purchase equipment, substances, or services with OH&S implications, define requirements upfront.

Equipment procurement: Specify safety standards (ISO standards for machinery, guarding requirements, ergonomic features). Supplier specifications should include: “Machinery must meet ISO 12100 safety standards. Guarding must prevent access to dangerous moving parts. Noise level not to exceed 85 dB(A).”

Chemical procurement: Require safety data sheets (SDS) before purchase. Specify handling and storage requirements. If you’re replacing a supplier, ensure new supplier’s chemical is compatible with your existing controls.

Service procurement: If you contract maintenance, cleaning, or other services, define OH&S requirements. “Maintenance contractors must follow lockout/tagout procedures. Cleaning contractors must use non-toxic cleaning agents. All contractors must be inducted on our hazards and emergency procedures.”

Contractor management: External contractors and outsourced processes present control challenges because they’re not part of your organisation but are part of your system.

Clause 8.1.4 requires:

1. Define requirements: Before engaging a contractor, define what OH&S requirements they must meet. “Scaffolding contractors must be certified and insured. Electricians must be licensed and follow electrical safety code.”

2. Verify capability: Assess whether contractors can meet requirements. Request certifications, insurance, references, safety records. Don’t just assume they’re safe because they’re external.

3. Communicate hazards: Contractors need to know your workplace hazards so they can work safely. “The facility uses compressed gas cylinders. Forklift traffic is frequent. There are overhead power lines. Here are our hazard maps.”

4. Define responsibilities: Make clear who is responsible for what. “We provide the work area and hazard information. You are responsible for safe work method for your specific task. We will inspect your work periodically.”

5. Monitor performance: Don’t assume contractors work safely because they’re supervised. Observe their work, check equipment, verify procedures. Document observations.

6. Performance feedback: If contractors don’t meet OH&S requirements, communicate issues immediately and expect remediation. Don’t continue with unsafe contractors.

Examples of Operational Controls Across Hazard Types

The specific operational controls you implement depend on your hazard profile. Here are examples:

Physical Hazards (Machinery, Noise)

Control 1 – Machinery Guarding: Procedure: “All machinery with moving parts must be guarded to prevent access. Guards must prevent access to dangerous moving parts while allowing safe operation and maintenance.” Implementation: Install guards on all identified machinery. Verify guards prevent access without requiring tool removal. Inspect monthly for wear/damage.

Control 2 – Lockout/Tagout: Procedure: “Before maintenance or repair of machinery, de-energise and lockout/tagout the machine. Only the person performing maintenance holds the key.” Implementation: Install lockout devices on all machinery. Train maintenance personnel on lockout procedure. Inspect lockout stations quarterly.

Control 3 – Noise Management: Procedure: “Employees working in >85 dB(A) areas are required to wear hearing protection.” Implementation: Measure noise levels. Install signs in high-noise areas. Provide hearing protection at entry points. Conduct annual hearing assessments. Replace protectors when damaged.

Chemical Hazards

Control 1 – Safe Handling Procedure: Procedure: “Chemicals are stored in secondary containment. Spill kit is located at [location]. If spill occurs, evacuate area, contain spill with absorbent, place in hazardous waste container, notify supervisor.” Implementation: Maintain secondary containment. Stock spill kits. Post laminated spill response card at chemical storage area. Train all users.

Control 2 – Ventilation: Procedure: “Fume hoods must be on when handling volatile chemicals. Ambient ventilation maintains airflow away from workers.” Implementation: Install/maintain ventilation systems. Verify airflow regularly. Train users on proper fume hood use. Monitor replacement filter schedule.

Psychosocial Hazards

Control 1 – Workload Management: Procedure: “Supervisors assess workload regularly. If excessive, work is redistributed or timeline extended. Workers can request workload assessment.” Implementation: Monthly supervisor check-ins. Workload metrics tracked (tasks completed vs. planned). Authority to adjust timelines without penalty. Accessible feedback mechanism.

Control 2 – Psychological Support: Procedure: “Employees have access to employee assistance programme for counselling. Information provided during induction.” Implementation: Contract EAP provider. Communicate access information (toll-free number, confidentiality). Include EAP information in onboarding. Management referral process in place (supportive, not punitive).

Ergonomic Hazards

Control 1 – Workstation Assessment: Procedure: “New employees complete ergonomic workstation assessment. Assessment is repeated annually or if employee reports discomfort.” Implementation: Train assessors. Document assessments. Implement recommendations (chair adjustment, monitor height, keyboard/mouse position). Follow up after changes.

Control 2 – Manual Handling Training: Procedure: “All employees involved in manual handling complete training within first month. Training is refreshed annually.” Implementation: Deliver training covering proper lifting technique, load assessment, use of mechanical aids. Include practical demonstration. Document attendance and competence assessment.

Embedding Controls into Daily Operations

Documentation is necessary but insufficient. Controls must be embedded into how work actually happens.

Step 1: Make controls visible. Signage, posters, laminated cards at point-of-work reminding people of the control. “Hearing protection required in this area.” “Wash hands before eating.” “Report hazards to supervisor.” Visual reminders work better than manuals filed away.

Step 2: Explain the ‘why,’ not just the ‘how.’ “Wear hearing protection because noise >85 dB damages hearing permanently, not because it’s a rule.” When people understand why controls exist, they’re more likely to follow them.

Step 3: Make controls non-negotiable but comfortable. If PPE is required but uncomfortable, people skip it. Invest in good quality, comfortable PPE. If a safe work procedure is cumbersome, people shortcut it. Streamline procedures so they’re efficient. Resistance often means the control needs refinement, not that the control should be abandoned.

Step 4: Observe and provide feedback. When you observe someone not following a control, address it immediately (in non-punitive way). “I noticed you’re not wearing gloves when handling that chemical. What’s the barrier? Is the glove size wrong? Are they uncomfortable? Let’s solve this.” Observation + feedback is how you build habit compliance.

Step 5: Measure compliance and act on data. Randomly sample observation of control compliance. “Are guards in place on this machinery? 90% compliance.” “Are employees wearing hearing protection in high-noise areas? 75% compliance.” Use data to target improvements. If compliance is low, investigate why and address root causes (uncomfortable PPE, unclear procedure, lack of supervision).

Clause 8.2: Emergency Preparedness and Response

Emergency preparedness isn’t just about procedures; it’s about readiness.

Credible emergency scenarios for your operation might include: fire, chemical spill, medical emergency, natural disaster, power outage. For each, you need:

Documented procedures: What’s the immediate response? Who is notified? What’s the evacuation procedure? Where’s the muster point? How’s accountability confirmed?

Designated roles: Who is the emergency coordinator? Who oversees evacuation? Who ensures all workers are accounted for? Who communicates with external agencies? Roles should have alternates if the primary person isn’t available.

Equipment and resources: Fire extinguishers, first aid kits, emergency contact numbers, spill kits, emergency lighting. Maintain and test regularly.

Training and drills: All workers should know emergency procedures. Conduct regular drills (at minimum annually, ideally twice yearly). Evaluate what worked and what didn’t. Update procedures based on drill insights.

Communication and coordination: Can you communicate with external emergency services? Do they know your facility layout and hazards? Is there a chain-of-command if normal communication fails?

Audit finding I frequently see: emergency procedures exist on paper but workers don’t know them because no drills are conducted. Result: when a real emergency occurs, people panic rather than follow procedure. Commit to regular drills and evaluation.

Common Operational Control Audit Findings

Finding 1: Controls exist on paper but not in practice. Procedure says machinery is guarded. Auditor observes guard is removed for “production speed.” Control is not actually controlling the risk.

Fix: Investigate why control is bypassed. Is it uncomfortable? Inefficient? Unclear? Address the barrier, not just the symptom. Make the control practical, not theoretical.

Finding 2: Controls aren’t aligned with identified hazards. HIRA identifies high-risk chemical exposure, but operational controls don’t specifically address chemical hazards (substitution options not explored, ventilation not verified, training focused on generic safety not chemical-specific).

Fix: Link each control to specific HIRA findings. If HIRA identifies a hazard, there must be documented, implemented controls addressing it.

Finding 3: Contractor work isn’t controlled. Contractors are on-site without induction, working without your awareness, without safety verification.

Fix: Implement contractor management process. Before work begins: induction, hazard communication, procedure verification. During work: periodic observation. After work: performance feedback and documentation.

Finding 4: Management of change isn’t applied. New equipment is installed, process changes occur, without upfront OH&S assessment. Incidents happen during transition period.

Fix: Implement MOC procedure. Before any change, assess implications, design controls, plan implementation, monitor transition. Don’t treat MOC as paperwork—use it actively.

Frequently Asked Questions

Conclusion: Controls as Risk Management in Action

Operational controls are where your ISO 45001 system translates from intention to reality. Your HIRA identified risks. Your objectives set targets. Your controls are the specific measures that prevent those risks from becoming incidents.

The organisations that reap real value from ISO 45001 are those that implement controls rigorously, embed them into daily operations, monitor compliance, and continuously refine them based on what’s working and what isn’t. Controls are living tools, not static documentation.

If you’re designing operational controls or want to strengthen your control effectiveness, contact Anitech Group. We help organisations design controls that are both compliant and genuinely effective—that prevent risk while remaining practical and sustainable.

Contact Anitech Group to strengthen your operational controls.