ISO 45001 · Step-by-step series · Article 4 of 7

ISO 45001 Clause 7: Support — Resources, Competence and Communication

Clause 7 of ISO 45001:2018 is where the OH&S management system stops being a set of policies on paper and becomes something the workforce can actually use. It covers the resources the organization must provide, the competence and awareness workers need, how information flows internally and externally, and how documented information is created and controlled. Get clause 7 wrong and every other clause — risk assessment, operational controls, incident investigation — collapses, because none of it works without trained people, working equipment and information that reaches the right person at the right time.

Structure of clause 7: five building blocks of support

Clause 7 follows the same Annex SL high-level structure shared with ISO 9001 and ISO 14001, but its content is entirely OH&S-specific. It breaks down into five subclauses:

• 7.1 Resources: determining and providing what the OH&S management system needs to function — people, infrastructure, equipment, budget.
• 7.2 Competence: ensuring workers have the education, training or experience needed to perform their tasks safely.
• 7.3 Awareness: making sure workers understand the OH&S policy, their contribution to it, and the consequences of not following procedures.
• 7.4 Communication: the internal and external processes for OH&S-relevant communication, including what, when, with whom and how.
• 7.5 Documented information: creating, updating and controlling the documents and records the standard and the organization require.

7.1 Resources: what top management must actually provide

Clause 7.1 is short in wording but broad in scope: the organization must determine and provide the resources needed for the establishment, implementation, maintenance and continual improvement of the OH&S management system. This is a direct extension of the leadership commitment required in clause 5 — a management team that signs an ambitious OH&S policy but doesn't fund the resources to deliver it will fail this clause in audit.

Resources under 7.1 typically fall into four categories:

• Human resources: enough qualified people to manage the system — safety officers, first aiders, fire wardens, health and safety committee members.
• Infrastructure: safe buildings, machine guarding, ventilation, emergency equipment, personal protective equipment (PPE).
• Technology and tools: incident reporting software, permit-to-work systems, monitoring instruments (noise, dust, gas detection).
• Financial resources: budget for training, PPE replacement, equipment maintenance, and corrective actions arising from incidents.

7.2 Competence: matching people to hazards

Clause 7.2 requires the organization to determine the necessary competence of workers whose work affects, or can affect, its OH&S performance, and to ensure they are competent on the basis of appropriate education, training or experience. This applies not only to production staff but to anyone whose actions influence risk — supervisors, contractors, maintenance technicians, and even senior managers who make decisions affecting worker safety.

A defensible competence process under 7.2 includes:

• Determining competence requirements per role, tied to the hazards identified for that role in the clause 6 risk assessment.
• Providing training or other actions to acquire the necessary competence, and evaluating the effectiveness of the training taken — not just attendance, but demonstrated understanding.
• Retaining documented information as evidence of competence — certificates, training records, sign-off sheets, refresher schedules.
• Addressing competence gaps proactively when new equipment, processes or legal requirements change what workers need to know.

A common failure point: an organization trains a worker on general safety induction but never provides task-specific competence for high-risk activities such as working at height, confined space entry, or operating mobile equipment. Generic training satisfies awareness (7.3), not competence (7.2) — the two are related but distinct requirements.

7.3 Awareness: every worker understands their role

Clause 7.3 requires workers to be made aware of the OH&S policy and objectives, their contribution to the effectiveness of the OH&S management system including the benefits of improved performance, the implications of not conforming with the system's requirements, incidents and the outcomes of investigations relevant to them, and — critically — the fact that they have the right to remove themselves from work situations they consider present an imminent and serious danger to their life or health, and the arrangements for protecting them from undue consequences of doing so.

This last point is one of the clearest OH&S-specific requirements in the standard and has no equivalent in ISO 9001 or ISO 14001. Auditors will often interview workers directly to check whether they know they can stop work in the face of imminent danger without fear of retaliation. If workers cannot articulate this right in their own words, it is a strong signal that clause 7.3 has not been effectively implemented, regardless of what the training records say.

7.4 Communication: internal, external, and both directions

Clause 7.4 requires the organization to establish, implement and maintain processes needed for internal and external communication relevant to the OH&S management system, determining what it will communicate, when, with whom (internally, across levels and functions, and externally), and how.

The standard breaks this into two flows:

• 7.4.2 Internal communication: communicating OH&S information among the various levels and functions of the organization, including changes to the OH&S management system as relevant, and ensuring the communication process enables workers to contribute to continual improvement.
• 7.4.3 External communication: communicating externally as required by legal and other requirements and as established by the organization's communication process — this covers regulators, contractors, visitors, neighbouring communities, and in some cases the families of workers involved in serious incidents.

A well-designed communication process takes into account diversity aspects such as language, literacy level, and any disability that could affect a worker's ability to receive and understand safety-critical information — this is an explicit consideration under 7.4.1 and one auditors frequently probe on multilingual or largely subcontracted sites.

7.5 Documented information: creating and controlling the record

Clause 7.5 sets out what documented information the OH&S management system must include — that required by ISO 45001 itself, plus whatever documented information the organization determines is necessary for the effectiveness of the system. It then defines how that information must be created, updated and controlled.

• 7.5.2 Creating and updating: appropriate identification and description (title, date, author, reference number), an appropriate format (language, software version, graphics) and media (paper, electronic), and appropriate review and approval for suitability and adequacy.
• 7.5.3 Control of documented information: ensuring it is available and suitable for use where and when needed, and adequately protected — from loss of confidentiality, improper use, or loss of integrity. This includes distribution, access, retrieval, storage, preservation, control of changes, and retention and disposition.

Typical documented information expected under an ISO 45001 system includes: the OH&S policy and objectives, the scope of the OH&S management system, records of hazard identification and risk assessment, competence and training records, communication records (toolbox talks, consultation meeting minutes), incident investigation reports, and evidence of management review outcomes.

Common audit findings on clause 7

The most frequent nonconformities raised against clause 7 in OH&S audits include:

• 7.2 — Training records not tied to actual role hazards: a generic safety induction certificate is kept on file, but there is no record of task-specific competence for high-risk work such as lockout-tagout or confined space entry.
• 7.3 — Workers unaware of their right to stop unsafe work: the policy states it, but interviews reveal workers fear reprisal or simply were never told in practice.
• 7.4 — No defined process for external communication in emergencies: the organization has an internal alarm system but no documented process for notifying neighbouring facilities, emergency services, or regulators.
• 7.5 — Uncontrolled document versions in circulation: outdated risk assessments or work instructions are still posted on the shop floor after a revision was approved.
• 7.1 — Resources approved on paper but never delivered: a management review action item requests new PPE or additional safety staff, but no budget line or delivery date is tracked afterward.

Frequently asked questions about ISO 45001 clause 7

What is the difference between competence (7.2) and awareness (7.3) in ISO 45001?

Competence (7.2) is about whether a worker has the specific education, training or experience to safely perform their assigned tasks — for example, being certified to operate a forklift. Awareness (7.3) is broader: it's about whether every worker, regardless of role, understands the OH&S policy, their own contribution to it, the consequences of non-conformance, and their right to stop unsafe work. A worker can be fully competent in their trade but still fail an awareness check if they don't know how to report a near miss or don't know they can refuse unsafe work.

Does clause 7.4 require a written communication plan?

ISO 45001 does not mandate a single named document called a "communication plan," but it does require the organization to have established, documented processes for internal and external communication that define what is communicated, when, with whom and how. In practice, most organizations formalize this in a communication procedure or matrix because it is the most efficient way to demonstrate the requirement is systematically applied rather than ad hoc.

How often should competence records be reviewed under clause 7.2?

ISO 45001 does not set a fixed review frequency for competence records. It requires the organization to determine necessary competence and take action to acquire and maintain it, which in practice means competence needs to be reassessed whenever the associated hazard, equipment, process or legal requirement changes, and at whatever interval the organization's own procedures define for refresher training — commonly annually for high-risk tasks such as working at height or confined space entry, and less frequently for lower-risk general awareness training.

Does clause 7.5 require all OH&S documents to be digital?

No. Clause 7.5.2 explicitly allows for any appropriate media, whether paper or electronic. What matters is that the chosen format and media are appropriate for the intended use and that the document control requirements of 7.5.3 — availability, protection, version control, retention — are met regardless of format. Many organizations use a mix: paper-based permits at the point of work and electronic systems for training records and incident reports.

Who is covered by the competence requirements of clause 7.2 — only employees?

Clause 7.2 applies to any worker whose work affects, or can affect, the organization's OH&S performance, which explicitly includes contractors and subcontractors carrying out work under the organization's control, not just direct employees. This is consistent with the broader scope of ISO 45001, which considers the organization responsible for the health and safety of everyone working under its direction, regardless of employment status.

What documented information is mandatory under clause 7.5 versus optional?

ISO 45001 explicitly requires certain documented information — such as the scope of the OH&S management system, the OH&S policy, objectives, and evidence of competence — while leaving the organization free to determine additional documented information it considers necessary for the effectiveness of its own system. A small organization with low-risk activities may need relatively little beyond the mandatory minimum, while a high-hazard industrial site will typically need to document far more — detailed work instructions, permits-to-work, and hazard-specific procedures — to demonstrate effective control.

Expert ISO 45001 · Updated 2026-07-31 · ISO 45001 step-by-step series: Article 3 — Clause 6 · Article 5 — Clause 8