Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
BS OHSAS — Occupational Health and Safety Management Systems Requirements (BS OHSAS 18001:2007)
BS OHSAS 18001:2007 — Requirements for Occupational Health and Safety Management Systems
📘 BS OHSAS 18001:2007 is the British Standards Institution (BSI) standard for occupational health and safety (OH&S) management systems, and the core document of the OHSAS (Occupational Health and Safety Assessment Series) family. It specifies requirements that enable an organization to establish, implement, maintain and continually improve an OH&S management system, systematically identifying hazards, assessing and controlling occupational health and safety risks, and reducing workplace injuries and occupational illnesses. Before the publication of ISO 45001, BS OHSAS 18001 was the most widely adopted certification standard for OH&S management across manufacturing, construction, energy, transport, services and public utilities.
💡 Worldwide, OHSAS 18001, together with ISO 14001 (environmental management) and ISO 9001 (quality management), forms the classic “quality – environment – safety” trio of integrated management system certification, and many organizations operate them in an integrated way.
1. Series Overview and Positioning 📌
This article is the summary review for the “BS OHSAS” prefix of the BSB223 batch. The standard in this batch is BS OHSAS 18001:2007 (Occupational health and safety management systems – Requirements). Published by BSI in July 2007 (ISBN 978 0 580 59404 5) as the official UK implementation of OHSAS 18001:2007, it supersedes OHSAS 18001:1999 and is maintained in line with changes to the international OHSAS 18001 document, under the oversight of BSI Technical Committee HS/1.
| Batch Prefix | Standard | Title | Status |
|---|---|---|---|
| BS OHSAS | BS OHSAS 18001:2007 | Occupational health and safety management systems – Requirements | Current (supersedes 1999 edition) |
In the UK and Europe generally, various legal requirements for occupational health and safety apply to the potentially harmful effects of work activities, extending beyond the workplace to those affected by workplace activities. The standard therefore requires the organization to take these legal requirements into account in establishing, implementing and maintaining its OH&S management system – particularly when identifying hazards, assessing risks and determining controls (clauses 4.3.1 and 4.3.2). It is recommended that the standard be read in conjunction with BS 8800 and HSG 65, which provide good-practice guidance on complying with such legal requirements.
⚠️ The standard states explicitly that compliance with a British Standard cannot confer immunity from legal obligations. Certification does not equate to exemption: the organization remains fully responsible for its statutory duties.
2. Document Structure and the Management System Model 🔧
BS OHSAS 18001:2007 follows the clause framework of ISO 14001:2004. Its body comprises four clauses: Scope, Reference publications, Terms and definitions, and OH&S management system requirements. Annex A (informative) sets out the correspondence between OHSAS 18001:2007, ISO 14001:2004 and ISO 9001:2000; Annex B (informative) gives the correspondence between the OHSAS documents and the ILO-OSH:2001 Guidelines, supporting integrated management.
| Clause | Content | Key Points |
|---|---|---|
| 1 Scope | Applicability | Applies to any organization irrespective of type or size |
| 2 Reference publications | Normative references | OHSAS 18002, BS 8800, etc. |
| 3 Terms and definitions | Core terminology | Risk, hazard, incident, OH&S, etc. |
| 4.1 General requirements | System framework | Plan-Do-Check-Act (PDCA) |
| 4.2 OH&S policy | Policy commitment | Commitment to continual improvement and legal compliance |
| 4.3 Planning | Risk control planning | Hazard identification, risk assessment, legal requirements, objectives |
| 4.4 Implementation and operation | Resources and controls | Roles, training, communication, operational control, emergency preparedness |
| 4.5 Checking | Monitoring and correction | Performance measurement, compliance evaluation, incident investigation, corrective action |
| 4.6 Management review | Continual improvement | Review of suitability, adequacy and effectiveness |
The OH&S management system model underlying the standard is a closed Plan-Do-Check-Act loop: the organization sets its OH&S policy and objectives, identifies hazards and assesses risks, determines and implements controls, and then applies monitoring, audit and management review to continually improve system performance.
3. Key Technical Requirements 🔥
3.1 Hazard Identification, Risk Assessment and Determining Controls
Clauses 4.3.1 and 4.3.2 are the operational heart of the standard. The organization shall establish and maintain procedures to:
- Identify hazards: covering routine and non-routine activities, all personnel entering the workplace (including contractors and visitors), and workplace infrastructure, equipment and materials provided by the organization.
- Assess risks: evaluating the likelihood and severity of injury or ill health arising from identified hazards, taking existing controls into account.
- Determine controls: following the hierarchy of elimination, substitution, engineering controls, signage/warnings/administrative controls and personal protective equipment.
- Ensure legal compliance: identifying and accessing applicable legal and other requirements and evaluating compliance (4.3.2 and 4.5.2).
🚨 Incomplete hazard identification is the most common cause of an ineffective OH&S management system. Identification must cover the potential impact of work activities on persons beyond the workplace itself (noise, dust, chemical release), not just direct in-house operations.
3.2 Objectives, Targets and Programmes
The organization shall establish measurable OH&S objectives and targets at relevant functions and levels, consistent with the policy and significant risks, and shall establish programme(s) defining responsibilities, timeframes and resources. Typical objectives include reducing lost-time injury rates, lowering occupational exposure levels and completing major hazard treatment projects.
3.3 Operational Control, Emergency Preparedness and Response
For operations and activities associated with significant risks, the organization shall implement operational controls, including maintenance, purchasing and contractor management. It shall also establish and maintain procedures to identify potential emergency situations (fire, chemical spills, natural disasters, etc.), periodically review and test them, and review the procedures after the occurrence of an emergency.
3.4 Incident Investigation, Nonconformity, Corrective and Preventive Action
The organization shall establish procedures to investigate incidents and nonconformities, determine root causes, and take corrective and preventive action to prevent recurrence, keeping records and closing the loop through management review. Performance measurement and monitoring (4.5.1) combine proactive monitoring (inspections, workplace checks) with reactive monitoring (incident statistics).
4. Certification and Application Practice 🛠️
- 📋 Certification path: build the system using the OHSAS 18002 implementation guide – internal audit and compliance evaluation – management review – third-party certification audit (document review plus stage 1 and stage 2 on-site audits) – periodic surveillance and recertification after award.
- 🔗 Integrated management: using the clause correspondence tables in Annex A, integrate the OH&S system with ISO 14001 environmental management (nearly identical structure) and ISO 9001 quality management to reduce duplicate documentation and audit costs.
- 🏭 Sector applications: work-at-height and lifting risk management in construction, chemical work-permit (PTW) systems in the process industry, machine guarding and noise control in manufacturing, and live-working safety in the power sector can all be implemented as dedicated procedures derived from the hazard identification and risk-control requirements of this standard.
- 📊 Performance improvement: use objective and target monitoring, incident statistics, internal audit results and management review inputs to enhance OH&S performance and demonstrate the effectiveness of the management system to all personnel.
✅ Around 2021, OHSAS 18001 certification has been progressively migrated to the international standard ISO 45001:2018. Organizations already operating under BS OHSAS 18001 should plan the transition, moving existing hazard identification, risk assessment and operational control elements smoothly into the ISO 45001 framework.
5. Frequently Asked Questions ❓
❓ Q: What is the relationship between BS OHSAS 18001 and ISO 45001?
A: BS OHSAS 18001:2007 is the requirements standard of the OHSAS series; ISO 45001:2018 is the international OH&S management system standard. Their structures are similar, but ISO 45001 adds high-level-structure elements such as context of the organization, needs of interested parties and leadership. Certified organizations should complete migration in accordance with their certification body’s arrangements.
A: BS OHSAS 18001:2007 is the requirements standard of the OHSAS series; ISO 45001:2018 is the international OH&S management system standard. Their structures are similar, but ISO 45001 adds high-level-structure elements such as context of the organization, needs of interested parties and leadership. Certified organizations should complete migration in accordance with their certification body’s arrangements.
❓ Q: How do BS OHSAS 18001 and OHSAS 18002 work together?
A: 18001 specifies what must be done (requirements), while 18002 explains how to do it (implementation guidance). The standard recommends using OHSAS 18002 to build the system; it includes hazard identification checklist examples and comparisons of risk assessment tools.
A: 18001 specifies what must be done (requirements), while 18002 explains how to do it (implementation guidance). The standard recommends using OHSAS 18002 to build the system; it includes hazard identification checklist examples and comparisons of risk assessment tools.
❓ Q: Must hazard identification cover contractors and visitors?
A: Yes. Clause 4.3.1 explicitly requires identification of risks faced by all personnel entering the workplace, including contractor personnel and visitors, and contractor activities should be managed through operational control.
A: Yes. Clause 4.3.1 explicitly requires identification of risks faced by all personnel entering the workplace, including contractor personnel and visitors, and contractor activities should be managed through operational control.
❓ Q: Does certification grant immunity from legal obligations?
A: No. The foreword states clearly that compliance with a British Standard cannot confer immunity from legal obligations. UK and EU health and safety law applies to all work-related activities; an effective management system is precisely a means of discharging such duties, not a substitute for them.
A: No. The foreword states clearly that compliance with a British Standard cannot confer immunity from legal obligations. UK and EU health and safety law applies to all work-related activities; an effective management system is precisely a means of discharging such duties, not a substitute for them.
🔍 Q: What is the minimum documentation set?
A: Typically you would have procedures for hazard identification and risk assessment, legal and other requirements, training, communication, operational control (as determined by risk), emergency preparedness and response, incident investigation, corrective and preventive action, records control and internal audit. The actual number depends on the size of the organization and the complexity of its risks.
A: Typically you would have procedures for hazard identification and risk assessment, legal and other requirements, training, communication, operational control (as determined by risk), emergency preparedness and response, incident investigation, corrective and preventive action, records control and internal audit. The actual number depends on the size of the organization and the complexity of its risks.