On this page
The short version
- Clause 10.2 establishes distinct requirements for investigating workplace incidents compared to reviewing management system nonconformities.
- Organisations must evaluate the need for corrective action with non-managerial worker participation under Clause 5.4 e) 7).
- Root cause evaluations must assess existing occupational health and safety risk assessments and determine if similar nonconformities exist.
- Corrective actions must follow the hierarchy of controls under Clause 8.1.2 and management of change principles under Clause 8.1.3.
Background, Regulatory Context, and Affected Roles
ISO 45001 establishes an active operational framework requiring organisations to react promptly to workplace disruptions and prevent their recurrence. Management systems frequently fail when organisations treat workplace injuries and audit nonconformities as identical occurrences using superficial administrative forms. Consequently, Clause 10.2 establishes structured requirements for investigating incidents, reviewing nonconformities, and executing root cause corrective actions. Quality managers, compliance leads, and internal auditors must evaluate whether incident investigation and nonconformity review processes effectively drive continual improvement.
This operational scope impacts top management, line supervisors, safety representatives, internal auditors, and non-managerial workers. Treating incident investigations purely as fault-finding exercises isolates operational staff and obscures systemic management failures. ISO 45001 addresses this vulnerability by requiring active worker participation throughout root cause evaluations and corrective action selection. Internal auditors must verify that incident investigations and nonconformity reviews engage operational personnel rather than relying solely on safety managers.
Technical Nuances: Incidents Versus Nonconformities
Understanding the distinction between incidents and nonconformities relies on standard definitions and operational triggers. Clause 3.35 defines an incident as an occurrence arising out of, or in the course of, work that could or does result in injury and ill health. Incidents encompass actual injuries, ill health events, and near-misses where no harm occurred but potential harm existed. Conversely, Clause 3.34 defines a nonconformity as a non-fulfilment of a requirement, encompassing systemic failures to comply with legal requirements, internal procedures, or management system standards.
Under Clause 10.2 a), when an incident or nonconformity occurs, the organisation must react in a timely manner to control and correct it while dealing with consequences. Under Clause 10.2 b), organisations must evaluate the need for corrective action to eliminate root causes, specifically by investigating incidents or reviewing nonconformities. Furthermore, Clause 5.4 e) 7) mandates that organisations must emphasise the participation of non-managerial workers in determining incident investigations, nonconformity reviews, and corrective actions. Non-managerial workers must contribute direct operational knowledge during root cause determinations to identify genuine systemic weaknesses.
Clause 10.2 c) through Clause 10.2 g) details mandatory follow-up actions required during evaluations. Organisations must review existing assessments of OH&S risks under Clause 6.1 and determine if similar nonconformities exist or could potentially occur. When determining corrective actions, organisations must apply the hierarchy of controls under Clause 8.1.2 and management of change principles under Clause 8.1.3. Additionally, organisations must assess OH&S risks relating to new or changed hazards prior to implementing corrective measures and evaluate the effectiveness of any action taken.
| System Activity | Clause Reference | Operational Definition | Mandatory Execution Mechanism |
|---|---|---|---|
| Incident Investigation | Clause 3.35, Clause 10.2 b) 1) | Occurrence resulting in, or with potential for, injury and ill health | Investigation with non-managerial worker participation to determine root causes |
| Nonconformity Review | Clause 3.34, Clause 10.2 b) 1) | Failure to fulfil management system or legal requirements | Systemic review to identify root causes and evaluate potential recurrence |
| Immediate Action | Clause 10.2 a) | Prompt response to control, correct, and manage immediate consequences | Timely operational containment prior to root cause evaluation |
| Corrective Action Selection | Clause 10.2 d) | Elimination of root causes to prevent recurrence across operations | Application of hierarchy of controls and management of change rules |
Audit Evidence and Verification Methods
Internal auditors must gather multi-faceted evidence when auditing compliance with Clause 10.2. To verify timely reaction and containment under Clause 10.2 a), auditors must inspect initial event logs, shift records, and containment action notes. Auditors must review investigation files to verify that root cause analyses identify underlying management system deficiencies rather than assigning individual human error. Furthermore, auditors must inspect documented information retained under Clause 10.2 to confirm records detail the nature of nonconformities, actions taken, and effectiveness results.
Auditors must evaluate whether non-managerial worker participation occurred during investigation stages as mandated by Clause 5.4 e) 7). Direct interviews with operators, maintenance personnel, and safety representatives verify whether workers actively contributed to root cause determinations and solution selection. Finally, auditors must review effectiveness evaluations conducted after corrective actions were implemented. Organisations may use follow-up internal audits, workplace inspections, or safety committee reviews to demonstrate that corrective actions successfully prevented recurrence.
| Audit Focus Area | Clause Reference | Mandatory Requirement | Core Audit Evidence |
|---|---|---|---|
| Timely Containment | Clause 10.2 a) | React in a timely manner to control and correct the event | Incident notification logs, immediate containment records |
| Worker Participation | Clause 5.4 e) 7), Clause 10.2 b) | Evaluate corrective action needs with worker participation | Investigation team rosters, worker interview records |
| Systemic Risk Review | Clause 10.2 c), Clause 10.2 e) | Review existing risk assessments and assess new hazards | Updated risk registers, pre-change risk assessments |
| Corrective Effectiveness | Clause 10.2 f) | Review effectiveness of implemented corrective actions | Post-implementation audit records, follow-up inspection logs |
What to do now
- Review incident investigation and nonconformity procedures to ensure root cause analysis methodologies are explicitly defined.
- Update investigation forms to mandate non-managerial worker participation in root cause determinations and corrective action selection.
- Audit completed incident files to verify that corrective actions were selected in accordance with the hierarchy of controls under Clause 8.1.2.
- Inspect risk assessment registers under Clause 6.1 to confirm that existing risk assessments are updated following incidents or nonconformities.
- Conduct interviews with operational personnel to confirm that corrective action effectiveness reviews are performed in daily operations.
Reference documents
- BS ISO 45001:2018 Occupational health and safety management systems — Requirements with guidance for use
Manage this work in 4Auditee
Keep audit plans, problems, corrective actions and document versions in one place. See the records behind each change and decision.
Book a demo