Implementing and Operating an OHSMS: 4 Steps to Getting It Right

Implementing and Operating an OHSMSIn this article, we’re going to return to and continue our look at occupational health and safety management systems. An occupational health and safety management system is often known as an OHSMS, and this is now the fifth article in the series. (We’ll list them all for you, and include links, at the bottom of this article.) This series of articles is based on information drawn from ANSI Z10, Occupational Health and Safety Management Systems.

As we’ve mentioned in the previous articles, the entire series of articles is based on information from ANSI Z10, Occupational Health and Safety Management Systems. We really recommend that you buy a copy of the Z10 standard for yourself. It’s only $105, and there’s a ton of useful information in it, including a large collection of helpful appendices at the end. Actually, the appendices at the end are worth the cost of the standard alone. And when does it hurt to get expert guidance and helpful resources from the experts at ANSI and ASSE.

This particular article will be about implementing and operating an occupational health and safety management system, or OHSMS.

If you’ve been reading the earlier articles in this series, welcome back. If you’re new to the series, we’re happy to have you.

Either way, know that in addition to this series of articles, we’ve also written a series of articles you may find interesting about another ANSI standard-ANSI Z490.1, the standard for Safety, Health, and Environmental Training, and we ultimately used those articles to create a free 60-page Guide to Effective Safety, Health, and Environmental Training that you’re welcome to download.

So, with all those introductions and prefaces, let’s look at implementing and operating an OHSMS.

To implement and operate an OHSMS program, you’ll have to put (or already have) a set of operational elements in place. As Z10 puts it in section 5.0, these operational elements

“provide the backbone of an OHSMS and the means to pursue the objects from the planning process.”

Source: ANSI Z10, Section 5.0

This article will focus those operational elements and three other things. In total, here’s what we’ll look at:

  1. Operational elements
  2. Training
  3. Communication
  4. Document and record control processes

With the four items above in mind, let’s walk you through the process.

Step 1. Operational Elements of an OHSMS

The operational elements of an OHSMS include:

  • Risk assessment
  • Hierarchy of controls
  • Design review and management of change processes
  • Applicable life cycle phases
  • Process verification
  • Procurement
  • Contractors
  • Emergency preparedness

Let’s look at each in more detail.

1A. Risk Assessment

One operational element is a risk assessment process(es).

Risk assessment involves identifying hazards and classifying them by the level of risk. This is often done by considering the chances the hazard will contribute to an incident and the potential severity of the incident. As Z10 notes, you can assess risk in a numeric manner (quantitative) or a descriptive manner (qualitative).

There are many methods of risk assessment. Z10 suggests using methods that are most appropriate to the hazards and processes at your workplace.

Appendix F of Z10 provides a lot of helpful information about risk assessment, and describes four different techniques:

  • Brainstorming
  • Checklists
  • Consequence/Probability Matrix
  • Risk Assessment Matrix

Here’s a sample risk assessment matrix to give you the idea.

Minor Serious Major Catastrophic/Critical
Very Likely

In addition to the materials in the helpful Appendix of Z10, you may find our article on Risk Management and Safety helpful here. That’s where that risk assessment matrix sample came from.

1B. Hierarchy of Controls

Another operational element of an OHSMS is the use of the hierarchy of controls.

The basic idea behind the hierarchy of control is that you begin with an identified hazard. Here are some examples of potential hazards:

Type of Hazard Description Example
Safety Hazards Common hazards that cause immediate injuries and illnesses, and may lead to death Slip, trip, and fall hazards; working from heights; electrical hazards; moving machines; mobile equipment
Biological Hazards Other life forms that can cause injury or illnesses Viruses, bacteria, mold, fungi, animal bites/stings, toxic plants, blood and other bodily fluids
Chemical and other Exposure Hazards Things that can cause harm to you when you are exposed Radiation, temperature (high or low), noise, chemicals
Ergonomic Hazards Strains and stresses on the body caused by workplace motions and body positions Poorly designed work areas, repeated motions, lifting heavy weights
Psychological or Societal Hazards Hazards caused by interacting with people and social conditions at the workplace Workplace violence, sexual harassment, stress, depression, alcohol and drug addiction

You then try to find a way to “control” the hazard, which means find a way to eliminate it or reduce it. And when you’re looking for ways to eliminate or reduce the hazard, you look at specific types of controls in a specific order. That order is:

  1. Elimination
  2. Substitution of less hazardous materials, etc.
  3. Engineering controls
  4. Warnings
  5. Administrative controls
  6. Personal protective equipment (PPE)

Here’s a little closer look at that, with examples.

Hazard Control Description Example
Elimination Remove a hazard from the workplace Changing a production process so that a chemical known to cause cancer is no longer used
Substitution Replace a hazard with something less hazardous Changing a formula so that instead of working with a highly explosive fluid, workers work with a fluid that’s less explosive
Engineering Control(s) Design a solution that controls the hazard at its source (requires a physical change at the workplace) Encasing a noisy machine inside a sound-proof barrier
Safe Work Practice(s)/Warnings Develop specific rules and procedures for all workers to follow when working in the presence of or potentially exposed to a hazard Placing warning labels on hazardous chemicals
Administrative Control(s) Developing other work practices to protect workers from hazards Limiting the amount of time workers can work in a noisy area
Personal Protective Equipment (PPE) Protective clothing or equipment that protects a worker from a hazard Providing hearing protection to people who work in a noisy area


The idea of the hierarchy is to try to controls at the top of the hierarchy, such as elimination, first. That’s because they’re more effective. And then if they don’t work or are impractical, try controls lower in the hierarchy later.

HoC Effectiveness


In addition to what we’ve said above, keep the following two points about the hierarchy of controls in mind as well.

Multiple Controls

In some cases, you’ll need to use multiple controls to effectively control a hazard. This may include controls from different levels of the hierarchy.

PPE as Last Resort

Always use personal protective equipment as a last resort. Don’t default to PPE as a first option.

For more information, see our separate, more focused article on the hierarchy of control.

Or, you may want to watch our free elearning course about the hierarchy of controls by clicking the play button below. You can download a free copy of this eLearning course here.


1C. Design Review & Management of Change

Hazards can often by prevented or controlled during design and redesign stages. This may include changes that involve a management of change process.

As Z10 notes (in E5.1.3), the design review should consider all aspects, including:

  • Design
  • Procurement
  • Construction
  • Operation
  • Maintenance
  • Decommissioning

As for management of change, Z10 notes in E5.1.3 this may take place as a result of changes in:

  • Technology
  • Equipment
  • Facilities
  • Work practices and procedures
  • Design specifications
  • Raw materials
  • Organizational staffing
  • Standards and/or regulations

Either way, whether we’re talking about design, redesign, or management of change, Z10 says the process should include:

  • Identification of tasks and the health and safety hazards associated with those tasks (see our article on the job hazard analysis and/or download our free JHA Guide for more on this)
  • Recognition of hazards that are associated with human factors, including human errors caused by design deficiencies
  • Review of regulations, codes, standards, internal guidelines, and external guidelines
  • Application of control measures, using the hierarchy of controls
  • Determination of appropriate scope and degree of design review and management of change processes
  • Employee participation

Relying on the additional notes in Z10, let’s look at three of those items more closely:

Design deficiencies that may contribute to human error

Machines, equipment, facilities, processes, and work areas should be designed to take human factors into account. In this context, “human factors” the capabilities and characteristics of humans-or, in other words, what humans can and can’t do, as well as what people tend to do and tend not to do.

According to Z10’s E5.1.3B, some design deficiencies that may contribute to human error include:

  • Difficult-to-access machine controls
  • Labels on controls that are worn off or hard to read in other ways
  • Color-coding that’s inconsistent, random, and/or contradictory
  • Points of operation that are difficult to see
  • Remote power boxes
  • Pipes that are not labeled and/or color-coded
  • Inconsistent control layouts
  • Non-customary measures and labels in different languages

Conditions that should trigger a design review or management of change process

Design reviews and management of change processes should kick in when changes that may affect safety and health occur.

According to Z10’s E5.1.3E, here are examples of conditions that should trigger either a design review or a management of change process:

  • New technology, including facilities, equipment, and/or software
  • Modifications to existing technology, including facilities, equipment, and/or software
  • New work procedures, practices, and/or design specifications
  • Revised work procedures, practices, and/or design specifications
  • Changes in raw materials and/or new raw materials
  • Major changes to the site’s organization structure and/or staffing
  • Changes to the site’s use of contractors
  • Changes to the health and safety devices and equipment used at the site
  • New and/or changed health and safety regulations that apply to the site

Effectiveness of design review and management of change

The processes of design review and management of change are more effective if they include employees who know a lot about, and are experienced with, the facilities, equipment, systems, and processes. The input of knowledgeable and experienced employees is especially helpful in identifying job tasks, including hazards, and considering the feasibility of control measures.


1D. Applicable Life Cycle Phases

Always take all applicable life cycle phases into consideration during design, redesign, and management of change processes.

As noted in Z10’s E5.1.3.1, the life cycle phases may include:

  • Concept design stage
  • Preliminary design
  • Detailed design
  • Build or purchase process
  • Commissioning, installing, and debugging process
  • Production operations
  • Maintenance operations
  • Decommissioning

Remember that instead of buying equipment or installing after-market/add-on controls, it may be preferable to just buy new equipment.

1E. Process Verification

Businesses and organizations change and make changes over time. That’s a given.

And those changes can introduce new safety and health hazards.

As a result, an organization should always have processes in place to verify, or confirm, that all changes are evaluated to make sure any safety and health risks that those changes create are controlled. This includes changes to facilities, documentation, personnel, and operations.

As Z10’s E5.1.3.2 explains, these processes are sometimes known as management of change, and includes new additions but also changes in existing operations, products, or services. Furthermore, Z10 notes that management of change processes should take the following into consideration:

  • Technology and equipment
  • Work practices and procedures
  • Design specifications
  • Raw materials
  • Organizational or staffing changes
  • Standards or regulations

1F. Procurement

An organization should create a process ensuring that procurement takes into consideration:

  • Health and safety risks
  • Controls
  • Health and safety requirements, including regulations

This should all be documented. Fortunately, Z10 provides help for this in section 5.4 (we’ll get back to that).

Let’s look at each of the three essential considerations in a little more detail.

Health and safety risks

When purchasing products, raw materials, and/or other goods and services, health risks should be identified and evaluated before they’re introduced into the work area


The organization should establish requirements for supplies, equipment, raw materials, and other goods and services that are purchased in order to control potential health and safety risks

Health and safety requirements, including regulations

The organization must ensure that products, raw materials, and other goods/services purchased are in line with the organization’s health and safety requirements.

Deliver. Report. Manage. Convergence Training EHS Course Library

1G. Contractors

Make organizations work with contractors. This may include contractors engaged in:

  • Maintenance
  • Construction
  • Operations
  • Security
  • Landscaping
  • Facility upkeep
  • Janitorial
  • Clean-up of production processes
  • Consultants
  • Administrative
  • Accounting
  • Other functions

When working with contractors, the organization must establish and follow a process to identify, evaluate, and control health and safety risks:

  • To the organizations’ employees from the contractor’s activities, operations, and materials on the organization’s premises
  • To the contractors’ employees from the organizations activities, operations, and materials

This process may involve delegating authoring to the parties who are most capable and best qualified to identify, evaluate, and control health and safety risks. For example, organizations may delegate this responsibility to contractors with specialized knowledge, skills, methods, and means. Even still, this does not mean the organization that is delegating authority is not still responsible for the health and safety of its own employees.

Click the following link to read more about best practices for contractor management.

One aspect of contractor management is the development, delivery, and record keeping for contractor site-specific safety orientations. Click here to read more about contractor safety orientations and/or click here to download a FREE GUIDE TO ONLINE CONTRACTOR ORIENTATIONS.

1H. Emergency Preparedness

The final operational element we’ll consider in this section is emergency preparedness.

Because an ounce of prevention is always better than a pound of cure, the organization should establish a process for identifying, preventing, preparing for, and (when necessary) responding to emergencies. This includes:

  • Developing plans to prevent and minimize risks from potential emergencies
  • Periodic testing of emergency plans through drills and similar activities
  • Evaluating and updating the plans and procedures as necessary

This should all be documented. Z10 addresses this more in Section E4, which we deal with below.

Emergency preparedness should address natural and man-made emergencies. Organizations should assess these potential emergencies on the health and safety risks they may bring, and the organizations should focus on preventing hazards from those risks and responding to health and safety incidents arising from those risks/hazards.

According to Z10’s E5.1.6, emergency preparedness should provide for:

  • Compliance with all legal and other requirements
  • Availability of emergency response resources, including medical rescue, crisis response, law enforcement, fire departments, and similar)
  • The information, communication, and coordination necessary to protect all people, including contractors, visitors, and employees, in the work site
  • Informing and communicating with all employees, contractors, visitors, vendors, relevant authorities, emergency response personnel, and neighboring communities
  • Establishing, maintaining, and informing all personnel of evacuation routes and evacuation procedures
  • Training members of the organization about emergency response procedures
  • Evaluating the effectiveness of all emergency preparedness and response steps after each drill and each actual emergency, leading to the correction of any deficiency identified and putting into place any opportunity for improvement identified

Here’s an example of the kind of emergency preparedness training you might want to deliver to employees.

Step 2. Training

We’re now done looking at operational elements, the first (and largest) of the four aspects involved in implementing and operating an OHSMS.

We’ll now turn our attention to training.

As Z10 notes in E5.2A:

“Employee awareness of safety is essential for the OHSMS to be effectively implemented. This includes the why, what, when, and how of safety. Employees at all levels of an organization should be aware of the risks and control measures associated with their job so they are not injured, are better prepared, and are educated to fully implement the OHSMS requirements. This awareness should include why safety is important.”

Because employee awareness of safety is a necessary foundation of an effective OHSMS, the organization should establish a process to do the following:

  • Define and assess the OHSMS competence needed for employees and contractors
  • Use education, training, or other methods to make sure that employees and contractors are aware of the OHSMS requirements that apply to them and understand their importance
  • Making sure that employees are competent to carry out their responsibilities as defined in the OHSMS
  • Make sure employees and contractors have access to, and remove any barriers to, participation in the education and training defined in the OHSMS
  • Making sure that training is provided in a language that employees understand
  • Making sure training is (1) ongoing and (2) provided in a timely fashion
  • Making sure that trainers are competent to train employees

Let’s take a closer look at some of the items above.

Training in OHSMS Responsibilities

As Z10 notes in E5.2A, this kind of training might include, for example:

  • Training engineers in safety design, including things like hazard recognition, risk assessment, risk mitigation, and so on
  • Training people who will conduct incident investigations and audits for identifying underlying OHSMS non-conformance (see our extended article on incident investigations and/or our eLearning course on incident investigations)
  • Training people involved in procurement on the safety and health impacts of their purchases
  • Training others involved with the identification of OHSMS issues, controls for those issues, and how to prioritize implementing those controls

Awareness of Requirements & Capable of Completing Requirements

The training of employees and others working for the organization about OHSMS issues and responsibilities can occur during their basic job training.

It’s important for the organization to periodically evaluate this training to ensure it’s effective and improve it if it’s not.

See the final sections of our FREE Guide to Effective EHS Training for more information about evaluation and continual improvement of training.

Removing Barriers to Participation

Z10’s E5.2C lists the following examples of barriers to participation:

  • Disability issues
  • Training without compensation
  • Scheduling issues
  • Problems with the training environment
  • Literacy issues
  • Language issues

To help with a few those issues, we’ve got a few suggestions for you.

Scheduling and training environment issues

Many times, these can be overcome by using a learning management system to assign and deliver training online. Click to read more about learning management systems (LMSs), how they can be used for safety training, and some benefits of using them.

If you’re not familiar with LMSs are, the video below may help.

Click to talk to us about getting an LMS at your work.

Literacy issues

Many organizations employee workers with literacy issues. It’s difficult for these workers to complete written training materials, as you’d understand.

Fortunately, training materials like the online courses below can help to bridge that gap for workers with literacy issues because they rely so heavily on visuals and audio narration to communicate.

Click here to view more of the titles in our Health and Safety Online Training Library.

Language issues

Organizations also sometimes struggle to train workers who speak different languages.

One nice solution is to have an eLearning course like the one below. When the employee opens this course, the first thing he/she sees is a screen asking what language the training should be presented in. In the example below, “Spanish” was chosen.

Click here for more information about multi-language health and safety training.

Timely Training

As Z10 notes in E5.2E:

“Training is most effective when conducted before employees are assigned to a job or task, and when changes in job assignment or tasks occur.”

This basic idea is encapsulated in the famous list of adult learning principles you may have seen before. In particular, the adult learning principles that call for learning experiences that are:


…because adults want training for a task they’ll do soon


…because they goal is not to be “safe” in general from some hazard they may never be faced with, but to be safe in specific from a hazard they will confront soon

In line with employee’s motivation

…because employees are motivated to learn stuff they’ll need soon

Click to read more about adult learning principles for safety training.

Competent Trainers

Not just anyone can be an effective trainer.

As a result, an organization’s safety trainers should be competent. This includes both:

Subject matter expertise

Knowledge of and skills in training development and delivery, including the adult learning principles we just mentioned

As Z10’s E5.2F notes:

“Competence is the ability to apply knowledge and skill to achieve intended results. It is normally achieved or demonstrated through one or more of the following: education, training, mentoring, experience, certification, licensing, and performance reassessment.”

You can read more about the traits and qualities of an effective, competent safety trainer in our FREE Guide to Effective EHS Training.

Step 3. Communication

The third of the four aspects involved in operating and implementing an OHSMS that we’ll cover in this guide involves communication.

Like pretty much everything, an effective OHSMS depends on full and effective communication. According to Z10, communication will be attended to if the organization establishes a process to:

  • Communicate information about the OHSMS  with everyone in the organization, at all levels, and even with relevant external parties, such as contractors
  • Create a system that allows for employee reporting of work-related injuries, illnesses, incidents, hazards, and risks, and ensure employees are using it
  • Encourage employees to make recommendations about hazard controls and reporting procedures
  • Inform contractors, and other relevant external interested parties, when changes that affect their OHS occur.
  • Identify and remove barriers to any (and all) items above

Internal communication about the OHSMS should include communications about organization’s OHSMS implementation plan. It’s important to communicate initially but also again when any changes take place that may have an OHS impact.Remember to tailor communications about the OHSMS program so it’s appropriate for each audience.

In addition to establishing communication with contractors, other relevant external audiences may include:

  • Visitors
  • Vendors
  • Neighbors
  • Emergency services
  • Insurers
  • Regulatory agencies

Deliver. Report. Manage. Convergence Training EHS Course Library

Step 4. Document and Record Control Processes

The fourth and final aspect of implementing and operating an OHSMS that we’ll address has to do with document and record control processes.

Z10 states that organizations should put together a process for (1) creating and (2) maintaining documents and records called for by the OHSMS in order to:

  • Implement the OHSMS
  • Assess its own conformance with the OHSMS
  • Document its conformance with the OHSMS

The documentation and record keeping keeping process should ensure that:

  • Documentation that must be controlled be identified
  • Documents that must be controlled are properly reviewed and updated as necessary, with dates of revision
  • Documents and records are legible; easy to identify; accessible; protected against wear, damage, and/or deterioration; and are retained for appropriate periods of time

As Z10 notes, not all organizations will need documentation of the same types and amounts. Instead, it will depend on the size and complexity of the organization, and of course on the hazards and risks involved.

In addition, there’s no single format in which documentation must be written. The important thing is to document what’s necessary, to keep those documents up to date, and to keep records of older versions.

But what to document? Z10 DOES specifically requirement documentation of:

  • The occupational health and safety policies (see Section 3.1.2 of Z10 or our article here)
  • Objectives of the OHSMS (see Section 4.3 or our article here)
  • The OHSMS implementation plan (see Section 4.4 A or our article here)
  • Audits (see section 6.3 or stay tuned for our article to be written shortly)
  • Management reviews (see Section 7 or stay tuned our article to be written shortly)

Of course, you may document more than the explicitly required minimum list above.

Conclusion: Implementing & Operating an OHSMS at Work

That’s it for this article. Please use the comments area below if you have experiences with implementing and operating an OHSMS you’d like to share, or if you have questions, or if you just need to exercise your typing fingers.

In addition, we have three bits of additional and hopefully helpful information for you below:

Some notes about helpful appendices in the Z10 standard related to implementing and operating an OHSMS

Links to the previous articles in this series

A free 60-page Guide to Effective EHS Training, based on ANSI Z490.1, which you can download for yourself

Appendices in Z10

Here’s a summary of the appendices in Z10 that will help with implementing and operating an OHSMS. As we said at the beginning of the article, the appendices in this standard are very nice and by themselves are worth the full cost of buying the standard.

  • Appendix F, page 47, relates to Risk Assessment
  • Appendix G, page 53, relates to the Hierarchy of Control
  • Appendix H, page 54, relates to Management of Change Processes
  • Appendix I, page 57, relates to Procurement
  • Appendix J, page 58, relates to Contractor Safety and Health

Links to our earlier articles in this series about Safety and Health Management Systems (OHSMS) and ANSI Z10

Here are links to the earlier articles in our series.

Free Guide to Effective EHS Training

That’s it, right below. Click and enjoy.


Effective EHS Training: A Step-by-Step Guide

Learn how to design, create, deliver, and evaluate effective EHS training by following these best practices with our free step-by-step guide.

Download Free Guide

Jeffrey Dalto

Jeffrey Dalto

Jeffrey Dalto is an Instructional Designer and the Senior Learning & Development Specialist at Convergence Training. Jeff has worked in education/training for more than twenty years and in safety training for more than ten. You can follow Jeff at LinkedIn as well.

2 thoughts on “Implementing and Operating an OHSMS: 4 Steps to Getting It Right

  1. Hi Jeffrey, I think you’ve done a great job in getting a complex idea across in a very small space. I have a couple of questions for you though
    1) what was your reasoning for taking an ANSI standard for the OHSMS vs an international standard such as OHSAS18001 or the new ISO 45001?
    2) you touched very lightly on assurance in your article. How do you see the role of independent assurance, whether external or as an independent function within an organisation?

    1. David, thanks for the “great job.” Much appreciated.

      I wound up writing about ANSI Z10 partly just because I had really wanted to write about the upcoming OSHA guideline, but it wasn’t finalized when I started, and/or about ISO 45001, but it’s also not finalized and is now in a lengthy period of revision/delay.

      So I just decided to write about Z10 partly because it existed and was in final form.

      I will definitely return to write about the new OSHA Guideline now that it’s final, and I may well discuss ISO 45001 when it’s finalized as well.

      What are your own thoughts on these different standards? Which are you more familiar with and which do you/have you used in the past/present?

      As for assurance–good question. Stay tuned to the future articles in the series for this.

      Thanks for writing. Have a great day and a great holiday season.

Leave a Reply

Your email address will not be published. Required fields are marked *