A health and safety management system is a set of connected policies, responsibilities, procedures and checks that an organization uses to control its health and safety risks and keep improving. It turns safety from a list of separate tasks into one routine: plan the work, control the risks, check what happens and fix what fails.
No single design is required. The UK Health and Safety Executive says employers are not required by law to implement a formal management system, though one can give a useful structure. Three frameworks are widely used: ISO 45001, OSHA’s recommended practices for safety and health programs, and HSE’s Plan, Do, Check, Act approach. They differ in wording but share the same core. If the basic terms are new, start with what is health and safety.
What a management system does
A management system answers four questions in writing and in practice: who is responsible for what, how hazards are found, how they are controlled and how anyone knows the controls work. It sits above individual documents such as permits and checklists and ties them together, so a hazard found on a site visit reaches a person who can fix it and is checked again afterward.
Three frameworks compared
| Framework | What it is | Structure | Certification |
|---|---|---|---|
| ISO 45001:2018 | International standard with requirements and guidance for use | Context, leadership and worker participation, planning, support, operation, performance evaluation and improvement, built on Plan, Do, Check, Act | Yes, by an accredited body, but organizations can also use it without certification |
| OSHA Recommended Practices (OSHA 3885) | US guidance for safety and health programs, not a regulation | Seven core elements, listed below | No |
| HSE (UK) Plan, Do, Check, Act (HSG65) | UK guidance on managing for health and safety | Plan, Do, Check, Act, treated as part of normal management, not a stand-alone system | No |
ISO states that ISO 45001:2018 was last reviewed and confirmed in 2024, that an amendment on climate action was issued in 2024, and that a revision is under development. Check the ISO page for the current edition before you build to it.
OSHA’s seven core elements
OSHA’s recommended practices describe seven interrelated elements. OSHA says a program needs three at its foundation: management leadership, worker participation and a systematic way to find and fix hazards.
- Management leadership: top management sets expectations, goals and resources and makes safety a core value.
- Worker participation: workers help set goals, report hazards, investigate incidents and track progress, without fear of retaliation.
- Hazard identification and assessment: procedures to find hazards and evaluate risks, including routine, nonroutine and emergency work, with incidents investigated for root causes.
- Hazard prevention and control: controls chosen in order, starting with engineering solutions, then safe work practices, administrative controls and finally personal protective equipment.
- Education and training: all workers learn how the program works and how to recognize hazards and controls; supervisors learn their responsibilities.
- Program evaluation and improvement: controls and the program are checked and improved.
- Communication and coordination for host employers, contractors and staffing agencies: everyone on a shared site knows the hazards and who does what.
Plan, Do, Check, Act in practice
HSE (UK) describes health and safety management as an ongoing process, not a one-off task. Its Plan, Do, Check, Act cycle runs like this.
| Stage | What happens | Example output |
|---|---|---|
| Plan | Set the policy, decide priorities, appoint people and prepare for emergencies | Written policy, responsibilities, action plan |
| Do | Assess risks, put controls in place, train and supervise, report incidents | Risk assessments, procedures, training records |
| Check | Measure performance, inspect, maintain, investigate incidents and near misses | Inspection reports, audit findings, incident reports |
| Act | Review results and update the plan, policy and risk assessments | Management review minutes, revised procedures |
HSE also warns that paperwork on its own is not a good performance measure. The point of the system is that risks are controlled, not that documents exist.
Key components of a working system
Policy and leadership
A short written policy states the commitment, who is responsible and how risks will be managed. It only matters if managers act on it: they set goals, provide resources and take part in reviews. See the HSE policy template.
Hazard identification and risk assessment
Understand dangers and exposures by doing a good risk analysis for the work environment. Cover routine tasks, unusual tasks and emergencies, and record the results. Where a task is high risk, use a specific assessment such as risk assessment for work at height. Worker input at this stage finds hazards that managers miss.
Controls and procedures
Choose controls in the order of preference above, write procedures for high-risk and repeated work, and set up permits where the hazard needs authorization. See HSE documents for the full range of documents, and lifting and rigging procedures for one worked example.
Training and competence
People need to know the hazards and the controls for their own job. Keep a record of who has been trained in what. A safety training matrix shows gaps at a glance, and health and safety training covers delivery.
Emergency preparedness
Plan for fire, injury, spills and other foreseeable emergencies, and practice the plan. See fire drill safety and fire safety risk assessment.
Incident investigation and learning
Investigate incidents and near misses to find root causes, then fix them. See the incident investigation guide and near miss reporting.
Health surveillance and records
Where workers are exposed to hazardous substances or agents, health surveillance and exposure records may be required. See occupational health records.
Monitoring, audit and review
Measure leading indicators such as inspections completed and actions closed, as well as lagging ones such as TRIR. Audit the system against its own rules and write findings clearly; see audit nonconformity examples. Management then reviews the results and decides what to change.
Documents a management system usually contains
| Document | Purpose |
|---|---|
| Policy | States commitment, roles and direction |
| Roles and responsibilities | Says who does what, including contractors |
| Risk register or assessments | Records hazards, risks and controls |
| Procedures and work instructions | Control repeated and high-risk tasks |
| Permits and checklists | Authorize and check specific work |
| Training and competence records | Show who is able to do what |
| Emergency plans and drill records | Prepare for and check emergency response |
| Inspection, audit and incident records | Show whether controls work |
| Management review minutes | Show decisions and actions at the top |
ISO 45001 calls these documented information and expects them to be created, updated and controlled. The health and safety handbook template and HSE management system documents are starting points.
How to build a management system
- Check where you are. List what you already do, what the law requires and what clients ask for.
- Get leadership commitment. Name an accountable manager and set the resources.
- Write the policy and assign roles. Keep it short.
- Assess the risks. Start with the highest-risk work.
- Set objectives and controls. Each objective should be measurable.
- Train people and communicate. Involve workers and contractors.
- Operate and keep records. Use the forms the procedures call for.
- Check, audit and review. Fix what fails and update the documents.
Is a management system worth it?
ISO lists the benefits it expects from ISO 45001 as a systematic way to manage risk, fewer incidents and injuries, demonstrated commitment, legal compliance and continual improvement. Whether you need certification depends on your clients and sector; many organizations use the standard’s structure without it. HSE says a small or low-risk business can usually show effective risk management with a simpler approach. See also how a safety program affects employee retention.
Common mistakes
- Treating the system as a document project and not a way of working.
- Copying a template manual that does not match the site.
- Leaving workers out of hazard finding and reviews.
- Measuring only after harm occurs.
- No review, so the system drifts away from the work.
- Building a heavy system for a small low-risk business.
Questions about health and safety management systems
What is a health and safety management system?
A structured set of policies, responsibilities, procedures and checks used to manage workplace risks and improve them over time.
Is a health and safety management system required by law?
In Great Britain a formal system is not required, though employers must have arrangements for planning, organizing, controlling, monitoring and reviewing protective measures. In other countries and for some contracts or industries, a system may be required. Check your own rules and contracts.
What is the difference between ISO 45001 and OSHA’s recommended practices?
ISO 45001 is a certifiable international standard with requirements. OSHA’s recommended practices are voluntary US guidance with seven core elements. Both aim at the same outcome and many organizations use ideas from each.
Do small businesses need a management system?
They need to manage their risks, but a simple approach can be enough. HSE says small or low-risk businesses can usually show effective risk management without a formal system.
What is Plan, Do, Check, Act?
A four-stage cycle used in management systems: plan what to do, do it, check how it is working and act on what you find, then repeat.
Related guides
- HSE study guide
- EHS meaning
- Safety officer vs HSE officer
- 10 essential HSE documents
- Health and safety documentation
- Safety compliance records
- Management of HSE documentation in construction
- Safety observation report examples
- Monthly HSE statistical report
- Construction site safety induction checklist
- Subcontractor safety prequalification checklist
- Incident investigation report
Sources (checked 1 November 2026)
- ISO 45001:2018, Occupational health and safety management systems
- OSHA, Recommended Practices for Safety and Health Programs (OSHA 3885)
- OSHA, Safety and Health Programs Step-by-Step Guide
- HSE (UK), Health and safety management systems
- HSE (UK), Introduction to managing health and safety
- HSE (UK), Managing for health and safety (HSG65)
The components list, document table and eight build steps are general good practice, not legal requirements. Framework facts come from the sources above.