ISO 45001 · Step-by-step series · Article 5 of 7

ISO 45001 Clause 8: Operational Planning and Control for OH&S

Clause 8 of ISO 45001:2018 is where the management system stops being a set of policies and turns into everyday practice on the shop floor. It covers how you plan and control the operations that create occupational health and safety (OH&S) risk, how you eliminate hazards using the hierarchy of controls, how you manage change without introducing new risks, how you control contractors and procurement, and how you prepare for emergencies before they happen. This guide breaks down each subclause with practical explanations and the documentation an auditor will expect to see.

Structure of clause 8: the operational core of ISO 45001

Clause 8 is organized into two major subclauses that together form the operational backbone of the OH&S management system:

• 8.1 Operational planning and control: establishing and implementing the processes needed to meet OH&S requirements, applying the hierarchy of controls, managing change, procurement, contractors, and outsourcing.
• 8.2 Emergency preparedness and response: planning for foreseeable emergency situations, response actions, periodic testing, and post-incident evaluation.

Unlike ISO 9001's clause 8, which centers on product conformity, ISO 45001's clause 8 centers on protecting people. Every operational decision — a new machine, a subcontracted task, a temporary process change — has to be filtered through the question: does this create or change an OH&S risk, and have we controlled it before work starts?

8.1.1 General: planning operations that protect workers

Clause 8.1.1 requires the organization to plan, implement, control and maintain the processes needed to meet OH&S management system requirements — and to do so consistently with the actions determined in clause 6 (addressing risks and opportunities). This is where the risk register stops being a spreadsheet and becomes a set of working controls: permits to work, lockout-tagout procedures, safe systems of work, and competence requirements tied to specific tasks.

The minimum elements your operational planning should establish are:

• Criteria for the processes, and the acceptance criteria for the tasks or activities they cover.
• Control of the processes in accordance with the criteria, to reduce risks to as low as reasonably practicable.
• Documented information sufficient to have confidence that the processes have been carried out as planned.
• Adaptation of work to workers — matching task demands, pace and environment to the physical and mental capacities of the people doing the work, rather than the reverse.

8.1.2 Eliminating hazards and reducing OH&S risks: the hierarchy of controls

This is the technical heart of clause 8 and one of the most auditable requirements in the entire standard. ISO 45001 mandates that the organization establish, implement and maintain a process for eliminating hazards and reducing OH&S risks using the following hierarchy of controls, applied in this order of preference:

• a) Elimination: remove the hazard entirely — stop using a hazardous substance, redesign a process so a fall risk no longer exists.
• b) Substitution: replace the hazard with something less hazardous — a lower-toxicity solvent, a lighter-weight component to reduce manual handling load.
• c) Engineering controls / reorganization of work: isolate people from the hazard — machine guarding, local exhaust ventilation, or reorganizing the work so exposure time is reduced.
• d) Administrative controls, including training: procedures, signage, permits, competence and awareness training.
• e) Personal protective equipment (PPE): the last line of defense, used in combination with — never as a substitute for — the higher-level controls.

The order matters because it reflects reliability, not convenience. PPE depends on correct selection, fit, maintenance and consistent use by the worker — it is the least reliable control because it depends entirely on human behavior under real working conditions. An auditor reviewing a risk assessment that jumps straight to "wear gloves" without first documenting why elimination, substitution or engineering controls were not reasonably practicable will raise a nonconformity almost every time.

8.1.3 Management of change: controlling what happens when things change

Clause 8.1.3 requires the organization to establish a process for the implementation and control of planned temporary and permanent changes that impact OH&S performance. This is one of the clauses most frequently missing or weakly implemented in smaller organizations, yet it is precisely where serious incidents tend to originate — a new piece of equipment installed without re-assessing risk, a process modified to speed up output, a substitute raw material introduced without checking its safety data sheet.

Management of change must address, before the change is implemented:

• New products, services and processes, or changes to existing ones, including workplace locations and surroundings.
• Changes to legal requirements and other requirements.
• Changes in knowledge or information about hazards and OH&S risks.
• Developments in knowledge and technology that could affect existing controls.

A common gap in practice: organizational changes are overlooked. Clause 8.1.3 is not limited to physical or process changes — restructuring a shift pattern, changing supervisory responsibilities, or reducing staffing levels on a line all count as changes that must be risk-assessed before implementation, because they alter who is exposed to what, and who is available to respond if something goes wrong.

8.1.4 Procurement: controlling risk before it enters the site

Clause 8.1.4 splits procurement-related OH&S control into three distinct areas, each with its own expectations:

8.2 Emergency preparedness and response: planning before the alarm sounds

Clause 8.2 requires the organization to establish, implement and maintain a process needed to prepare for and respond to potential emergency situations, as identified in clause 6.1.2.1. The intent is straightforward: an emergency is the wrong moment to improvise a response for the first time.

The process required by 8.2 must include:

• Planning a response, including provision of first aid, based on the identified needs and risks of the organization.
• Providing training for the planned response, appropriate to the roles workers will need to play.
• Periodically testing and exercising the planned response capability — drills, simulations, tabletop exercises.
• Evaluating performance and, as necessary, revising the planned response, including after testing and, in particular, after the occurrence of emergency situations.
• Communicating and providing relevant information to all workers on their duties and responsibilities, to contractors, visitors, emergency response services, government authorities and, as appropriate, the local community.
• Taking into account the needs and capabilities of all relevant interested parties and ensuring their involvement, as appropriate, in the development of the planned response.

A well-built emergency plan is proportional to the risks the organization actually faces — a warehouse with forklift traffic and racking has a different emergency profile than a chemical processing plant, and the level of detail, drill frequency, and external coordination should reflect that difference rather than following a generic template.

Most common audit findings on clause 8

Reviewing recurring findings from ISO 45001 audits across manufacturing and industrial sites, these are the gaps that come up most often against clause 8:

• 8.1.2 — PPE used as the first control, not the last: risk assessments that list PPE without first documenting whether elimination, substitution or engineering controls were considered and ruled out.
• 8.1.3 — Management of change not applied to organizational changes: equipment changes get a risk review, but staffing reductions, shift restructuring or supervisory changes do not.
• 8.1.4.2 — Contractor coordination gaps: contractors working on site without a documented induction, or without a clear record of who is responsible for supervising them when their work overlaps with internal operations.
• 8.2 — Emergency drills not evidenced: an emergency plan exists on paper but there is no record that it has ever actually been tested, or the last drill predates the last major site change.
• 8.2 — Plan not updated after a real event: an incident occurs, the immediate emergency is resolved, but the emergency response plan itself is never reviewed or revised in light of what was learned.

Frequently asked questions about ISO 45001 clause 8

What is the hierarchy of controls and why is the order important?

The hierarchy of controls in clause 8.1.2 ranks control measures from most to least reliable: elimination, substitution, engineering controls, administrative controls, and PPE. The order matters because it reflects how much the control depends on correct human behavior to work. Elimination removes the hazard so there is nothing left to fail; PPE depends on correct selection, fit, maintenance and consistent use every single time — the most failure-prone option. ISO 45001 expects organizations to document why higher-level controls were not reasonably practicable before relying on lower-level ones, not to jump straight to PPE or training.

Does management of change (8.1.3) apply to temporary changes, or only permanent ones?

Both. Clause 8.1.3 explicitly requires control of planned temporary and permanent changes that impact OH&S performance. A temporary process modification during a maintenance shutdown, a short-term staffing change, or a piece of rental equipment brought in for a specific job all require the same discipline: identify the change, assess the risk it introduces, implement controls, and communicate before work starts — not after.

How does clause 8.1.4.2 differ for contractors versus the organization's own employees?

Clause 8.1.4.2 requires coordination specifically because contractors are not under the same day-to-day management as internal employees, yet their activities can create risk for internal staff and vice versa. This means the organization must actively identify hazards arising from the interaction between contractor work and its own operations — not simply assume the contractor's own safety management is sufficient. Site induction, permit coordination and clearly defined supervisory responsibility are the typical mechanisms used to close this gap.

How often should emergency drills be conducted under ISO 45001?

ISO 45001 does not fix a specific frequency for emergency drills; clause 8.2 only requires that the response capability be tested periodically. The appropriate frequency depends on the risk profile of the site — many organizations run fire evacuation drills annually as a baseline, with additional scenario-specific drills (chemical spill, confined space rescue) at a frequency proportional to how often those hazards are present and how severe the consequences would be. What auditors look for is evidence that drills actually happen and that the findings feed back into plan revisions.

Do procurement requirements under 8.1.4.1 apply to every purchase, however small?

The requirement is to control procurement in a way proportional to the OH&S risk the purchased product or service could introduce. In practice, this means the process should be scaled: a new production machine, a hazardous chemical or a piece of lifting equipment warrants a documented conformity check before it goes into service, while low-risk consumables typically do not need the same level of scrutiny. The organization defines these thresholds itself, but the definition and its rationale should be documented and consistently applied.

What is the link between clause 8 and the risk assessment done under clause 6?

Clause 8 is where the risk assessment from clause 6.1.2 gets translated into working controls. Clause 6 identifies hazards and evaluates OH&S risk; clause 8.1.1 and 8.1.2 require that the controls determined during that assessment are actually implemented, maintained and traceable to specific procedures. Similarly, the potential emergency situations identified in clause 6.1.2.1 are the direct input to the emergency preparedness process required in clause 8.2. Without a solid clause 6 process, clause 8 has nothing concrete to operationalize.

Expert ISO 45001 · Updated 2026-07-31 · ISO 45001 step-by-step series: Article 4 — Clause 7 · Article 6 — Clause 9