On this page
- Technical Nuances: Operational Safety Risks Versus System Risks
- Example
- Audit Verification Procedure and Requirement Matrix
- Before your audit
- Questions people ask
- What is the difference between Clause 6.1.2.2 and Clause 6.1.2.3 in ISO 45001?
- Are organisations required to maintain documented information for Clause 6.1.2.3?
- Who must be involved when assessing management system risks under ISO 45001?
- How do management system risks connect to ISO 45001 management reviews?
- Reference documents
The short version
- Clause 6.1.2.2 requires assessing OH&S risks from hazards, whereas Clause 6.1.2.3 addresses management system operational risks.
- Organisations must evaluate risks arising from system design, resource allocation, structural changes, and operational management failures.
- Non-managerial workers must participate in identifying hazards and assessing risks in accordance with Clause 5.4 e) 2).
- Internal auditors must verify that system risk assessments directly inform action planning under Clause 6.1.4 and Clause 6.2.
ISO 45001 establishes a comprehensive planning framework that distinguishes between operational workplace hazards and broader systemic risks affecting management system performance. Under Clause 6.1.2.2, organisations must assess occupational health and safety risks arising from identified hazards, taking into account the effectiveness of existing controls. Under Clause 6.1.2.3, organisations must assess other risks to the establishment, implementation, operation, and maintenance of the OH&S management system. This critical distinction ensures that organisations address systemic management failures alongside direct physical workplace risks.
This dual risk framework applies across all management levels, including top management, compliance leads, facility managers, internal auditors, and non-managerial workers. Confusing operational safety risks with management system risks creates significant operational blind spots. Operational hazards directly cause work-related injury and ill health, whereas management system risks threaten the viability, resource provision, and performance of the safety system itself. Quality managers and compliance leads must establish structured processes that evaluate both risk categories to ensure management system effectiveness and audit readiness.
Technical Nuances: Operational Safety Risks Versus System Risks
Understanding the technical nuances between Clause 6.1.2.2 and Clause 6.1.2.3 relies on standard definitions and operational scopes outlined across Clause 6.1. Under Clause 6.1.1, the organisation must consider context issues from Clause 4.1, interested party requirements from Clause 4.2, and system scope from Clause 4.3 when determining risks and opportunities. Clause 6.1.2.2 focuses specifically on risks associated with physical, chemical, biological, psychosocial, and operational hazards. In contrast, Clause 6.1.2.3 focuses on systemic risks such as inadequate resource allocation, poor communication, ineffective leadership, structural restructuring, and software system failures.
Under Clause 6.1.2.3, organisations must evaluate risks that could impede management system implementation or prevent intended outcomes. Non-managerial workers must participate in identifying hazards and assessing associated risks under Clause 5.4 e) 2). Furthermore, under Clause 6.1.2.3, organisations may utilise qualitative or quantitative risk assessment methodologies adapted to their operational complexity. Annex A.6.1.2.3 notes that other risks to the management system include structural reorganisation, turnover of key personnel, supply chain failures, and ineffective training programmes.
Important: Retaining documented information on the methodologies and criteria used to assess management system risks is mandatory under Clause 6.1.2.2 and Clause 6.1.2.3.
Common finding: Internal auditors frequently cite nonconformities when organisations only assess physical machine hazards while completely omitting management system risks under Clause 6.1.2.3.
Example
A manufacturing facility plans a major migration to an automated maintenance scheduling platform. Under Clause 6.1.2.2, the safety team assesses physical risks to technicians servicing automated machinery, while the compliance lead assesses Clause 6.1.2.3 systemic software downtime risks. The facility consults non-managerial maintenance workers under Clause 5.4 e) 2) to establish manual backup procedures. During an internal audit, the auditor reviews system risk logs to confirm that software downtime risks were mitigated under Clause 6.1.4.
Audit Verification Procedure and Requirement Matrix
Auditing Clause 6.1.2.3 requires a structured, multi-step verification procedure that tests how systemic risk evaluations inform operational planning. Internal auditors must execute the following four-step procedure during internal audits to evaluate system risk controls.
- Review risk assessment procedures to confirm that methodologies explicitly distinguish operational safety risks from management system risks.
- Inspect management system risk registers under Clause 6.1.2.3 to verify evaluation of resource constraints, leadership changes, and system failures.
- Verify worker participation records under Clause 5.4 e) 2) to confirm non-managerial involvement in hazard identification and risk assessment.
- Cross-reference identified system risks with planning action under Clause 6.1.4 and management review outputs under Clause 9.3 b) 2).
| Requirement | What the Auditor Checks | Evidence to Have Ready |
|---|---|---|
| Clause 6.1.2.2 Assessment of OH&S Risks | Whether operational risks arising from physical, chemical, or psychosocial hazards are systematically evaluated | Operational risk registers, job hazard analyses, machine risk assessments |
| Clause 6.1.2.3 Assessment of System Risks | Whether systemic risks affecting management system operation, resources, and performance are formally assessed | System risk register, management change reviews, organisational risk logs |
| Clause 5.4 e) 2) Worker Participation | Whether non-managerial workers participated directly in hazard identification and risk assessment processes | Risk workshop sign-in sheets, health and safety committee records, worker logs |
| Clause 6.1.4 Action Planning | Whether actions to address identified system risks are integrated into system processes and safety objectives | Action plans, OH&S objectives registers under Clause 6.2, operational controls |
| Clause 6.1.1 Documented Information | Whether documented information on risk assessment methodologies and results is maintained and retained | Documented risk methodologies, risk registers, management review records |
Tip: Cross-examine management review minutes under Clause 9.3 to verify whether identified system risks match top management resource allocations.
Before your audit
- Verify that risk assessment procedures explicitly separate operational safety risks from management system risks.
- Confirm that management system risk registers account for resource constraints, software failures, and leadership changes.
- Check that non-managerial workers participated in hazard identification and risk assessment under Clause 5.4 e) 2).
- Inspect documented information defining the methodologies and criteria used to evaluate Clause 6.1.2.3 system risks.
- Verify that actions addressing management system risks are integrated into Clause 6.1.4 action plans and Clause 6.2 objectives.
- Confirm that top management reviews management system risks and opportunities during management reviews under Clause 9.3 b) 2).
- Ensure that system risk assessments are updated following organisational changes under Clause 8.1.3 or incidents under Clause 10.2.
Questions people ask
What is the difference between Clause 6.1.2.2 and Clause 6.1.2.3 in ISO 45001?
Clause 6.1.2.2 focuses on assessing occupational health and safety risks arising from workplace hazards, taking into account existing controls. Clause 6.1.2.3 focuses on assessing other risks to the establishment, implementation, operation, and maintenance of the management system itself. Both are required to ensure comprehensive risk management.
Are organisations required to maintain documented information for Clause 6.1.2.3?
Under Clause 6.1.1, organisations must maintain documented information on risks and opportunities, as well as the processes and methodologies used to assess them. Retaining documented information ensures that internal auditors and certification bodies can verify compliance status.
Who must be involved when assessing management system risks under ISO 45001?
Under Clause 5.4 e) 2), organisations must emphasize the consultation of non-managerial workers in identifying hazards and assessing risks and opportunities. Operational personnel provide valuable direct insight into practical system limitations and resource constraints.
How do management system risks connect to ISO 45001 management reviews?
Under Clause 9.3 b) 2), top management must review changes in risks and opportunities during management reviews. System risks identified under Clause 6.1.2.3 directly inform executive decisions regarding resource provision, policy updates, and continual improvement actions.
Reference documents
- BS ISO 45001:2018 Occupational health and safety management systems — Requirements with guidance for use
Manage this work in 4Auditee
Keep audit plans, problems, corrective actions and document versions in one place. See the records behind each change and decision.
Book a demo