PART 3 - AUDITING AGAINST BS OHSAS18001:2007

Section 3.5 - Checking and corrective action

It is necessary for the organization to put in place procedures that measure and monitor
the system the organization has in place. Without this it is impossible for the organization
to determine if the arrangements are working and delivering what is required.

“If you can’t measure it you can’t manage it!”

Measurement and monitoring (Clause 4.5.1)

The BS OHSAS 18001 standard specifies six areas in which procedures should be
created to provide for measurement and monitoring of performance:

z Qualitative and quantitative measures.

z Monitoring the achievement of objectives.

z Monitoring effectiveness of controls.

z Measures that monitor conformance with programme, controls and operation.

z Reactive measures monitoring areas such as ill health, incidents etc.

z Recording data so that it can be used effectively to put things right and/or prevent further
incidents.

This measurement is important to enable the organization to review its overall OH&S
performance. It will often be the tangible evidence which demonstrates that agreed
objectives have been achieved. There are other reason for monitoring and measuring
such as:

z Monitoring exposure to determine whether legal requirements have been met.

z To evaluate the effectiveness of controls.

z To evaluate if it is necessary to modify or introduce new controls.

z Evaluate competence of workers etc.

There are two basic types of measurement that an organization could put in place –
proactive measures and reactive measures. Whilst it is better to use a combination of
measures that best reflect the organizations needs, a greater emphasis upon the
proactive measures it likely to enhance OH&S performance. Examples of measures that
may be appropriate:

PROACTIVE MEASURES
z Results of staff attitude surveys.

z Number of personnel trained in OH&S.

z Evaluation of the effectiveness of OH&S training.

© 2009 RMS v1.0 Section 3.5 1

 PART 3 - AUDITING AGAINST BS OHSAS18001:2007

z Effectiveness of employee participation process.

z Staff understanding of risk control.

z Monitoring of compliance with statutory requirements.

z Use of behavior based observations.

z Number and effectiveness of OH&S tours and inspections.

z Results of OH&S audits.

z Health screening.

z Benchmarking against good practice either in industry or generally.

REACTIVE MEASURES
z Monitoring of near misses, lost time, ill health rates.
z Reportable accidents involving absence from work.
z Health surveillance.
z Accidents requiring first aid.
z Criticisms made by regulatory authorities.
Evaluation of compliance (Clause 4.5.2)
The environment in which the business operates will be constantly changing and there is
a need to keep compliance under review. Whilst there are no fixed rules, the need to
examine compliance can arise from a number of factors – changes to legislation, non-
conformity to legal, regulatory or customer requirement, changes to the business,
adverse events or reports etc. Alternatively, review periods may reflect the activity or risk
- where risk is greater more frequent review may be required. This evaluation can take
many forms such as:
z Audits.

z Reviews of documents.

z Inspections.

z Tours and observation.

z Regulatory inspections.

z Monitoring.

What ever form this evaluation take the organization should record the results of this
periodic evaluation.

This activity very much supports the commitments made in the policy statement.

It should be noted that there is a requirement to demonstrate ongoing compliance to legal

and other requirements, such as customer's specifications or those specified by the
insurer or trade association.

© 2009 RMS v1.0 Section 3.5 2

 PART 3 - AUDITING AGAINST BS OHSAS18001:2007

Incident investigation, non-conformity, corrective action and

preventive action (Clause 4.5.3)
Investigation of incidents is important from two aspects – the prevention of re-occurrence
and the opportunity for improvement. There is often a tendency for organization to
investigate accidents more thoroughly than other incidents. However, the requirement of
the BS OHSAS 18001 standard is that all incidents are investigated, whether or not an
accident arose from them. As much can be learned from the “near misses” that occur.
There should be a procedure for undertaking investigations and it should be designed to
ensure that all types of incident are considered as well as meeting any legal requirements
for recording and reporting.

The investigation of the incident should be in a structured format and whilst maintaining
impartiality must focus upon determining the causal factors, gathering facts and evidence
in a timely manner, communicating the needs for any action to be taken and providing
feed back for the purposes of risk assessment, emergency response and OH&S
performance measurement.

Involvement of a worker in any investigation can help ensure the root cause is
determined rather than apportioning the blame to the person actually involved and
recording it as "human error". Often the failure is more deep rooted with 80-90% of
accidents attributable to management and systems failures rather than the individual who
is injured. (see Clause 4.4.3.2. a)

It is important that the investigation should reflect the significance of the event and be
proportionate to the harm caused or potential harm that may have been caused. The aim
of the investigation is to get to the root causes and identify corrective and preventive
action.

If the reporting and investigation of trivial incidents, such as a cut finger from handling
paper, become burdensome then under reporting will occur. For instance, a simple
record in a supervisor's diary recording a minor incident and any action taken may be
sufficient. Clause 4.5.3.2 b - If corrective actions have not been implemented or the
actions taken have not been effective then a nonconformity could be assigned against
this clause.

Control of records (Clause 4.5.4)

Organizations need to recognise the need to keep records that are necessary and it is
good practice to implement a system of document controls that enables it to demonstrate
the manner in which information is disseminated and controlled through the organization.
The organizations needs to:

z Demonstrate the requirements of the OHSAS 18001 standard are being met.

z Conformity with the organization’s OH&S management system.

z Implement a system of document control (4.4.5) for implementing and maintaining

procedures for identification, storage, protection, retrieval, retention and disposal of
records.

Additionally, there is sometimes a legislative requirement to keep records for a stipulated

period (in the UK some records are required to be kept for the life of the employee - 40
years - for e.g. occupational exposure) and the systems must be effective for this. The
© 2009 RMS v1.0 Section 3.5 3
 PART 3 - AUDITING AGAINST BS OHSAS18001:2007

maintenance of good records can also be of benefit to the organization where they need
to satisfy the enquiries of visiting regulators or insurers as well, in the event of claims
against them. It is often useful for an auditor to ask how long records have been kept and
to establish whether the response is appropriate and in line with the policy and good
practice.
Internal audit (Clause 4.5.5)
This is the process of looking at the management systems to see if it delivers what the
organization requires. This includes proper maintenance of the systems and that policy
and objectives are being delivered. Outputs from internal audits should be provided to
management and utilised as one of the inputs to the management review process (4.6).

When auditing the clause 4.5 ‘Checking and corrective action’ the internal auditor should
consider:

z Is there measurement of OH&S performance?

z Has the organisation selected a range of measures including both pro-active and re-active
measures of performance?

z Are regular inspections carried out on equipment and working practices?

z Where performance levels are below expectations is there evidence of investigations to

establish the root cause of the failures?

z Is there evidence of full incident investigations, proportionate to the nature of the

harm/potential and size of the organization?

z Does the reporting system capture all types of incident?

z Is there clear allocation of responsibility and authority for reporting of incidents and
subsequent investigation?

z Are satisfactory records maintained – particularly those relating to compliance with legal
issues, results of audits and review?

© 2009 RMS v1.0 Section 3.5 4