ISO 45001:2018, 14001:2015 and 9001:2015 are based on the High Level Structure. The International Organizations for Standardization (ISO) High Level Structure (HLS) is about to enter another phase of revision of the HLS. The definition of “Risk” in the ISO HLS and the term “risk and opportunity” is causing confusion with drafters and users of ISO 45001.
Removing the special definition of term risk and eliminating use of the term risk and opportunity will help standards drafters reduce ambiguity in the standard requirements and help other users better understand how to plan. implement, operate and audits ISO management systems.. The following discussion is based on our extensive experience auditing, teaching and consulting for ISO 45001, 14001 and 9001.
The Definition of “Risk” and Use of the Term “Risk and Opportunity” in ISO High Level Structure
The HLS was introduced in 2012 to “harmonize” management system standards around a common structure. The common structure helps organizations integrate quality, environmental, health and safety and other management systems.
Figure 1 is the Table of Contents of the HLS as currently proposed in Draft ISO/DGuide 83 – 06/03/2020.
In this post we discuss two issues being raised during the HLS revision process.
the definition of the term risk in the HLS,
use of the terms risk and opportunity in the HLS.
Resolving these two issues is important to users understanding of what ISO 45001 is designed to manage.
In a previous post, we provided an overview of proposed changes to the HLS duirng the minor revision stage, As the HLS revision begins to enter the major revision stage we believe there are important issues to be addressed by ISO. We believe that ISO should carefully consider the unintended negative consequences of creating a special definition of risk and using the term risk and opportunity in future versions of the HLS.
Risk as a “defined term”.
Definition of risk
The Oxford English Dictionary (OED) is the official dictionary of ISO and defines risk as the “possibility of loss, injury, or other adverse or unwelcome circumstance”. The Merriam-Webster definition is similar, “possibility of injury or ill health”. These definitions of risk have been in use for many decades and with great success by organizations managing Occupational Health & Safety (OH&S) performance.
In 2012 ISO introduced the term risk as a “defined term” giving it a different definition than OED or Merriam -Websters. The HLS definition of risk is now “the effect of uncertainty” (see Figure 2).
The new definition is designed to encourage organizations to take a broader view of both the positive and negative characteristics of risk. This approach is supported by the ISO technical committee that develops guidance standards on risk management (TC 262). ISO 31000 is the flagship standard in this series. ISO 31010 is guidance on risk assessment techniques.
Use of “on objectives” in the HLS definition of risk
TC 262 isnow promoting another revision to the definition of risk that adds the words “on objectives” to the HLS definition of risk They believe the concept of risk cannot be comprehended without reference to the term objectives in the definition of risk (Figure 3).
However, adding the words “on objectives” creates ambiguity and confuse drafters and users of ISO 45001. This is because the term objectives is already used in 45001 referring to specific goals the organization needs to achieve to improve OH&S performance.
The objectives refereed to in the ISO 31000 definition of risk are more broad and include business and societal objectives. The potential unintended consequence of adding the words on objectives to the definition of risk is users will only address risk associated with objectives and not more broadly address OH&S risk to workers and the organization..
Unintended consequences of changing the definition of risk
The addition of a special definition of risk has increased ambiguity about the meaning of the term risk. It has also had unintended consequences for both those using the HLS when developing management system standards, and those using these standard to plan and implement OH&S management systems..
As an example, because of the way ISO has now defined risk, the developers of ISO 45001 found it necessary to add two additional notes to the definition of risk (Figure 4). The ISO 45001 definition of risk now has 6 notes (198 words) to explain the three word definition of term risk.
The drafters of ISO 45001 also found it necessary to create another defined term OH&S risk (Figure 5). This new definition was added to clarify ambiguity caused by the HLS definition of risk and how OH&S professionals had traditionally understood the concept of risk in the OH&S management discipline.
The intent of the new ISO special definition of risk was to shed light on the practice of risk management and encourage organizations to take a broader view of the dynamics between risk and opportunity. That objective may have been achieved but with significant additional confusion by standards drafters and users. ISO should consider removing the special definition of risk from the HLS and return to use of the Oxford English Dictionary of risk.
Risk and Opportunity in the High Level Structure.
The association of the word risk with the word opportunity (risk and opportunity) in HLS clause 6 has confused drafters and users of ISO 45001. There is uncertainty if the term risk and opportunity refers to a single concept or two different concepts. To help explain what is meant by risk and opportunity ISO prepared a white paper titled Risk Based Thinking in ISO 9001:2015. Although the title indicates the topic is ISO 9001 Quality Management systems, the examples used in the white paper are also applicable to an ISO 45001.
To clarify ambiguity about the term risk and opportunity, drafters of ISO 45001 added a new defined term OH&S opportunity (Figure 6).
The ISO 45001 definition of OH&S opportunity refers the concept of OH&S performance improvement, another defined term in ISO 45001 (Figure 7) . The definition of OH&S performance references another 5 defined terms in ISO 45001. The need to create a separate defined term of OH&S opportunity and then refer to 5 other defined terms to explain the OH&S performance, This tortured effort to reduce ambiguity is further evidence of the confusion the term risk and opportunity has introduced to ISO 45001.
ISO 45001 also refers to other risks and other opportunities that the organizations needs to address (Figure 8). These terms are not defined in ISO 45001. This adds uncertainty about the concept of risk and opportunity in ISO 45001.
Figure 8 – ISO 45001 Other Risk and Other Opportunities
These many terms associated with the concept of risk and opportunity in Clause 6 creates uncertainty about what ISO 45001 is supposed to manage. Those implementing, operating and auditing an OHSMS are confused, especially when identifying what is important to the organization’s OH&S performance. The unintended consequence of adding the term risk and opportunity is user confusion about answers to important questions like:
When the HLS uses the term opportunities is it referring to potential financial or societal gain or to a discipline specific intended result such as a safer workplace?
What is the difference between the concept of risks and opportunities and the concept of OH&S risk, OH&S opportunity and other risk and other opportunity or are these the same thing?
Are the concepts of hazards and risks being tre focus of OH&S management systems now obsolete, or can it still be used when planning an OH&S management system?
Conclusion and Recommendation
The introduction of a special definition of risk and the use of the term risk and opportunity in the HLS has led to unintended and unnecessary confusion by drafters and users of ISO 45001. ISO should remove the definition of risk and use of the term risk and opportunity from the ISO HLS. during the next phase of the HLS revision.
Here is a webinar we lead for ASSP on Covid-19 recently. The webinar discusses how organizations can use occupational health and safety management system audits and the corrective action process to respond to Covid-19 challenges.
Leadership commitment to a management system is critical to its performance. Encouraging support is sometimes challenging. The management review process required by ISO management system standards can help gain leadership commitment.
Do’s and Don’ts
Coordinate management review with management other business review meetings. Conducting “management review” during regular business review meetings gives the sense that the management systems is part of the overall business. Management reviews conducted infrequently and apart from the other important business management meetings leads to a silo-ed perception of the management system.
Make management review value added. Ensure the information being presents is actionable by leadership. Give them a few choices for recommendations with supporting information and ask them to decide. They will appreciate your opinion and recommendations to help make decisions.
Do the Math and Have Backup.
Defend your recommendations for improvement with cost and return on investment information. Showing leadership how the management system helps save and even makes money, contributes to their support and commitment.
Take Good Notes
Recording leadership decisions during the management review helps ensures follow-up. Records of management review are also evidence of their leadership commitment, especially during audits.
Timely Management Review Follow-up
Follow-up on management review recommendations in a timely fashion and report on progress at the next management review opportunity. This will enhance leaderships perception of the management system, their support and commitment.
Management Review Frequency
Most organizations perform periodic reviews of the business performance to make sure things are going along smoothly and to make any course corrections needed. Integrating the ISO system management review with these regular business review meetings will help ensure that:
Management system performance issues are addressed in a timely fashion
The management system is integrated with all other business processes
Timely information is provided to leadership to help make important business decisions
Management Review Inputs
Management review meetings should not necessarily address all management review inputs during each meeting. Management review inputs that should be reviewed at every management review include:
Follow-up from previous management reviews
Status of actions from previous management reviews;
Status of corrective actions and incident investigation
Progress toward achieving objectives.
Management review inputs to be reviewed less frequently and as needed such as
Customer Complaints and interested party concerns
Changes including new compliance obligations
Adequacy of resources
changes in risks and how they are being addressed
Management Review Outputs
The purpose of management review is to ensure the management system is able to achieve it intended outcomes. The outputs of management review are an important part of the Act part of the Plan-Do-Check-Act continual improvement cycle. It is where leadership has the opportunity to review the information generated in the “Check part of the PDCA cycle and intervene (Act) and continually improve the management system
Records of management review are the notes of the meeting (output notes). They are required by all ISO management system standards. Outputs are what leaderships asks the organization to do to improve performance. These records are also excellent evidence of leadership commitment during third party audits.
The goal of management review is to provide information to leadership that it can act on. Planning and conducting good management reviews will enhance leaderships opinion and support of the management system.
The ISO High-Level Structure (HLS) is the basis for all management system standards and is now being revised by ISO. These changes will affect all management system standards. Users of ISO management system standards such as ISO 14001, 9001 and 45001 will need to evaluate how these changes will affect the organizations ISO management systems.
Introduced in 2012, the HLS was created to help better integrate quality, environmental and health and safety management systems. Prior to its introduction ISO 9001 had a different structure that ISO 14001 that complicated integration of the management core processes such as corrective action and management review. The HLS solved that problem. The revision introduced a new name for the HLS and it is now called Annex L, Appendix 2.
The revision will also introduce guidance on use of the HLS for standard writers and users. This guidance is called Annex L, Appendix 3. Both Annex L, Appendix 2 and 3 will be combined as a table.
Appendix 2 is in the final stages of an initial “limited” revision and not yet available to the public. Appendix 3 is in mid-stage revision and should be approaching the final stage later this year.
Here are a few of the most important changes to Annex L, Appendix 2 from the “limited” revision:
Definition of Risk
A lengthy debate is ongoing within ISO about if a revision to the definition of “Risk” is needed. “Risk” is currently defined in the HLS as “the effect of uncertainty”. Some within ISO argue that a better definition is “the effect of uncertainty on objectives“.
Others fear that the addition of the words “on objectives” to the definition of risk will cause confusion in standards like ISO 9001, 14001 and 45001. They believe this because these standard have a specific requirement to create measurable “objectives” within the management system.
The debate over the definition of risk has lead to several proposals including eliminating the definition of risk entirely from the HLS. A subgroup has been assigned the task of sorting this difficult issue and the results will be reflected in a future revision of the HLS. For now however the definition of “risk” will remain as it is in the HLS.
Expected Outcomes Vs Results
The previous version of the HLS used the term “expected outcomes” to describe the results organizations should expect from its ISO management system. Some users found the term “expected outcomes” confusing so it has been changed to “expected results”. The change was also made to simplify translation to other languages.
The old HLS used the term “outsourced processes”. Manufacturers sometimes send their products to other organizations who perform specialized processes like heat treating or electroplating. This relationship between organizations was called “outsourcing” in the previous version of the HLS. The concept of “outsourced processes” however does not apply as well to other disciplines such as environmental management or health and safety management systems.
The term “external provider” is now being used in place of outsourced process. This change has been made in response to several comments that found the term “outsource” unclear. The use of external provider clarifies that outsourced, contracted, and purchased products, services and processes all need to be controlled by the management system.
The use of the terms “maintain” and “retain” to describe what needs to be done with certain types of documents in the management system has been replaced with the term “shall be available”. This change has been made to avoid confusion between maintaining and retaining documented information. This change is not expected to impact organizations with mature document control process and management systems.
This part of the HLS has been substantially reorganized. The title of 9.2.1 was changed to General and 9.2.2 Internal Audit Program has been added. This change has been made for ease in understanding. Now the two distinct concepts covered in the paragraph (what an audit program entails and what should be considered when establishing an audit program) are listed separately.
Effects of the Annex L, Appendix 2 and 3 Revisions (Whats Next?)
The revision of Annex L is not expected to have a significant immediate effect on ISO standards or ISO management system audits. The revisions will not requires revision of any of the ISO management system standards until these standard are revised and updated as required by ISO. However, organizations in the process of implementing an ISO management system or integrating a new discipline specific standard such as ISO 45001 into an existing management system structure, should anticipate that these changes will appear in future revisions of ISO management system standards.
A long-time professional college “The Honorable Scott Weyburn”, recently posted an interesting question focusing on benefits of ISO 9001 registration. I posted a response that prompted Scott to ask for more so here it is. Here is a link to Scott’s post which you might want to read first.
Understanding the Problem
The cause of the problem is easy to understand but difficult to correct. In my three decades performing nonfinancial audits for CBs if have found the CB customers primary interest is in sending a signal of sustainability to customers and other interested parties. Improving sustainability performance is subordinate to that perceived imperative. As a result, the organization focuses on passing the audit, not on having an effective management system. Investment is in readying for the audit not on the resources of an effective system. This is partially due to naivety and a lack of readiness in leadership in the organizations.
It is also due to financial tension within the organization. Investing in audit readiness only cost less than skillful implementation of an effective management system. Leadership calculates “If all I want is certification for messaging and developing a MS with that goal is cheaper than an effective system, why would I invest in an effective system?”. Leaderships misunderstanding is almost excusable considering the misrepresentation bombardment from CB’s and AB’s that their certifications and accreditation’s are evidence of system effectiveness.
Audit Services as Commodities
Another reason the certification process is failing is organizations seeking certification services perceive them as a commodity to be purchased from the lowest bidder. They do not understand certification audits are a professional service where auditor and CB competence are critical to obtaining a return on their certification investment.
To be competitive CB’s in the past would reduce the number of audits days and thereby reduce the cost of their service over their competitors. IAF implemented MD-5 to try to control this audit day downward trend. MD-5 is a complex system for determining audit days that was of some help early on. However, as time went on CBs recognized that the only way to be competitive was to reduce the day rates for auditors. Subsequently there has been a continuing downward spiral in compensation of qualified auditors, especially for contract auditors with no employment benefits.
Many experienced auditors like myself have subsequently reduced the number of audits we perform for accredited CBs doing only enough to remain competent for purposes of certification. The CBs now rely on inexperienced, inexpensive, and often incompetent auditors to perform audits on their behalf.
ABs Playing a Role
The ABs have also found themselves in a difficult financial conundrum. There has been much consolidation in the CB business reducing the ABs revenue streams. They recognize the threat to their clients, that major findings of auditor incompetence would bring, and are reluctant to issue meaningful nonconformities that compel change. The incentives created by the ABs for CBs to improve their performance are more prescriptive and lead to “lipstick on a pig” corrective actions that exacerbate the problem.
These are tough problems to solve that cannot be wrestled to the ground overnight. The financial assurance industry addressed similar problems with Sarbanes–Oxley Act of 2002 as well as in the Accounting Standards Codification issued by the Financial Accounting Standards Board (FASB). The best chance of fixing the underlying problems with assurance in the non-financial sector is to enact similar legislation which is unlikely to happen in the foreseeable future.
The Exemplar Global certified ISO 14001:2015 EMS lead auditor courses are presented over a two week period 4 hours per day Monday thru Thursday. In the first week students take the ISO 14001:2015 Environmental Management System content (EM) . The EM content is delivered from 8:00am to 12:00pm each day of class.
The first two days of the second week of the class is the Auditor content (AU). The second two days of the second week is the Team Leaders content (TL). A test is administered after each course module.
ISO 14001 – EM
July 6-9, 2020 August 3-6, 2020
Auditor – AU
July 13-14, 2020 August 10-11, 2020
9:00am – 1:00pm
Team Leader – TL
July 15-16 2020 August 12-13, 2020
9:00am – 1:00pm
Exemplar Global Certified Course Schedule
Certified by Exemplar Global
Understand environmental terms and definitions
View the ISO 14001:2015 requirements from an auditor’s perspective
Plan, manage, and schedule an audit program
Identify, understand, and manage environmental aspects and impacts
Understand the requirements of ISO 14001:2015 to be able to conduct a successful audit. The course includes hands-on workshops to prepare you for real-life auditing situations. You’ll learn to manage the audit process and complete reporting..
This is a four-day, instructor-led classroom course. There are written tests on each of the competency units on days 2, 3, and 4. Days 1 and 2 will cover ISO 14001:2015 along with a corresponding competency exam. Day 3 will cover management systems auditing (AU) along with a corresponding competency exam. Day 4 will cover leading management systems audit teams (TL) along with a corresponding competency exam.
Who Should Attend
Those responsible for planning and scheduling an internal audit program for ISO 14001:2015 and those who must perform audits to ISO 14001:2015, environmental, suppliers, managers, or anyone interested in conducting first-party, second-party, or third-party audits.
All attendees are required to bring their own copy of the ISO 14001:2015 Environmental Management Systems – Requirements. Copies will not be provided for you.
Describe the ISO 14001 Environmental Management System (EMS)-Requirements standard and development process
Describe the intent and requirements of ISO 14001:2015
Determine the evidence needed to demonstrate conformity to ISO 14001:2015
Apply the process approach and Plan-Do-Check-Act (PDCA) methodology
Identify aspects and impacts
Apply the principles, processes, and methods of auditing
Demonstrate the activities involved in preparing for an audit
Determine an effective audit in the context of the auditee’s organizational situation
Apply effective audit skills and practice personal behaviors necessary for an effective and efficient conduct of a management system audit
Establish and plan the activities of an audit team
Manage the audit process
Prepare the audit report and perform an audit follow-up
The purpose of this brief webinar is to discuss the advantages of using internal audits and corrective actions to check that an organizations Covid-19 program is effective. The webinar explores how organizations can use ISO 45001 management system tools to respond to new challenges from the Covid -19 pandemic.
As the economy reopens organizations are being required to establish new programs and controls to minimize the spread of the virus among employees. Internal audits combined with corrective action programs help organizations establish and operate effective Covid-19 programs rapidly.
The webinar covers the following topics:
Identifying Covid-19 compliance obligations
Risk assessment methods for determining which Covid-19 Risk to addressed
Establish operational controls for Covid-19 risks to employees
When and how often to audit the Covid-19 program
How to safely conduct Covid-19 audits
How to effectively address Covid-19 internal audit findings through corrective action.
Report the results of Covid-19 audits and corrective action to leadership
Kevin Lehner is a member of the US Technical Advisory Group (US-TAG) to ISO 45001: He is an expert and represents the US-TAG at international meetings. He recently traveled to Kigali, Rwanda to attend the 9th international meeting of TC 283 (interview with Martin Cottam in Kigali). Kevin is a certified lead auditor conducting ISO 45001 audits for clients including accredited ISO 45001 certification bodies.
The WDNR Green Tier program requires participants to conduct periodic “outside” EMS audits to check that the system is functionally equivalent to ISO 14001:2015. By law, the minimum frequency of these audits is once every three years for Tier 1 participants and annually for Tier 2 participants.
Many organizations choose to perform WDNR Green Tier audits more frequently than prescribed by the Green Tier law. Longer than a year between audits result in increased risk to the organization. Postponing an annual physical from your doctor increases the risk that a medical condition will becoming a bigger medical issue.
WDNR Green Tier audits also provide important information to leadership. Reviewing Green Tier audit findings during management reviews allows leadership to evaluate how the EMS is functioning and if it is achieving the intended results. Leadership may miss important information when it reviews the results of audits only every three years.
Organizations that invest in their WDNR Green Tier audit program have better performing EMS’s and get a better return on their EMS investment. ISO 19011:2018, Guidelines for auditing management systems provides guidance for organizations wishing to improve their EMS audits. This guidance includes:
WDNR Green Tier EMS audits evaluate audit criteria against audit evidence. Performing WDNR Green Tier audits ensures that “what should be is” and “what should not be is not”. Examples of audit criteria are requirements of Green Tier functional equivalence, compliance obligations such as permit requirements or requirements such as WDNR universal waste and hazardous waste regulations. They can also be internal requirements the organization has set for itself.
A robust EMS audit process and procedures coupled with effective corrective action process to address audit findings is critical to the effectiveness of am EMS. If the audit process or the corrective action process is weak the EMS may not be able to achieve the intended results of the EMS.
WDNR Green Tier Audit Corrective Actions
Green Tier audits are fundamental to superior environmental performance, but audits alone do not make changes that improve performance. Audits simply identify conformance and nonconformance to the requirements of Green Tier and the organizations internal requirement for the EMS.
Audits can be good news or bad news. If an organization is performing audits and find nothing but “good news” that is not especially noteworthy to leadership. Things are going along well, according to plan, and there is no identified need for action. When audits find nonconformances or bad news, this is good news to leadership because the audit has identified things that need to be fixed.
If organizations are either not performing effective audits or no audits at all this is bad news for leadership. Leadership has no way of knowing if the EMS is performing as planned. “No news” is bad news.
Audit nonconformance findings are good news and a source of EMS performance improvement. Audit nonconformances are not evidence of failure or reason to find fault. Doing so will create fear of the audit process within the organizations and increase the difficulty in gaining employees trust and cooperation with the audit process.
To benefit from the results of audits organizations also need to fix the nonconformance problems the audits discover. Performing audits and then being unable to correct the problems discovered is often a bigger problem than not performing audits at all. An example is an audit of regulatory compliance status that discovers a potential noncompliance. Uncorrected findings later discovered in a regulatory agency compliance audit could result in enhanced “knowing and willful” criminal penalties. Finding a potential noncompliance problem and not fixing it is worse than not finding it in the first place. To reduce risk, organizations need to take corrective action on audit findings in a timely fashion.
Some organizations struggle to get traction on their corrective action process for two primary reason.
A clear process or workflow for performing corrective action has not been defined and or communicated by the organization.
The organization has not established a systematic way to keep track of and report on if and how the nonconformance are being addressed.
WDNR Green Tier Audit Corrective Action Workflows
Corrective action workflows for audit nonconformance should be a team effort. Teams should follow several sequential steps collaboratively and reach consensus on each stage in the workflow. The last stage of the workflow is verification of effectiveness of the corrective action.
This team approach is similar to the collaborative product design process used by industries to develop products. The design process has desecrate points in the process called gates. Design teams agree that each step was completed before the design process can progress through the gate to the next stage
The purpose of this design review workflow is to ensure the design process is proceeding in a systematic fashion and to minimize the potential for design flaws that will become apparent in the production or use stage of product or service.
Figure 1 is an example of a corrective action workflow with approval gates and stages.
Gates separate some of the stages in the corrective action workflow. The number of approval-gates in the corrective action process can vary depending on the organizations’ needs. Stages in the corrective action workflow can include:
Stage 1 – New (Contain and Assign)
Recognition of the problem is the first step in the corrective action workflow. Recognition can occur as the result of an audit or incident. How the workflow proceeds after recognition depends on the gravity of the problem or incident encountered. The team leader or gate keeper needs to quickly decide what type of problem it is such as:
Easy to Fix – We understand the problem cause and we can just fix it because it is unlikely to recur
Not so easy to fix – We do not fully understand the problem but believe that the cause and solution can be discovered without commitment of substantial resources at this stage.
Difficult to fix – This type of problem needs significant resource (horsepower) to address it with skill.
The preliminary evaluation will determine the size and competencies of the team needed to address the problem.
The team should consider Immediate steps to contain the problem (stop the bleeding) and what that containment should be. Placing lables and dates on the universal waste containers corrects the audit finding.The person assigned to the corrective action task should not delay implementation.
Stage 2 – Investigate (Cause and Corrective Action)
Putting a band aid on the problem with a short-term correction alone will not address the underlying problem cause and the nonconformance is likely to recur. Determining the cause of a problem is necessary to find a solution that fixes the problem and prevents recurrence. The team should investigate why the problem happened in the first place.
Root cause analysis is a huge topic and there are many approaches to doing a cause analysis, but sometimes asking “why did that happen?” several times can help identify the underlying cause of the problem (5 why analysis). Other problems can be more complex and require more horsepower than a 5 why analysis can deliver. These types of problems may need more sophisticated cause analysis techniques such as Six Sigma (DMAIC), 8 Disciplines (8D) or others.
The root cause of the problem helps the team discover an effective corrective action that will prevent the problem from recurring. The team should reach consensus that the proposed corrective action is appropriate to the cause before the corrective action is implemented. This will improve the likelihood that the corrective action will fix the problem in a way that it will not happen again..
Corrective action solutions that are based on one individual’s perception of the root cause and how to fix that problem often oversimplify both the cause and the solution. The tendency is for individuals to hurry the process and close the nonconformance as quickly as possible. This leads to weak root cause analysis which in turn compromises the selection of an appropriate corrective action.
If the corrective action process is not monitored in a team setting the assignee is more likely to close out the issue (get it off their desk) as soon as possible. A team approach to the corrective action process that use approval-gates can help avoid this consequence. Approval-gates encourage robust cause analysis.
The following is an example of poor cause analysis and proposed corrective action for the audit finding that universal waste containers were not properly labeled and dated.
Proposed Cause – “The employee had not been trained in how to properly package and label the universal waste”.
Proposed Corrective Action: Train the employee in how to properly package and label universal waste.
This cause analysis simply repeats the finding. It does not describe why the problem happened in the first place and the proposed corrective action is more of a correction than a corrective action. Implementing this action will not ensure that the same problem does not happen again.
Root Cause Analysis
Figure 2 shows the results of a more appropriate cause analysis of the universal waste packaging and labeling nonconformance.
Once the root cause is identified an appropriate corrective action can be proposed that will prevent it from happening again.
Often there are several options for corrective actions that fix the problem in a way that it does not recur. Some might have potential to be extremely effective but are costly to implement. An example might be to outsource the universal waste management to a contractor that comes to the site daily to check that the universal waste is being management correctly. This is highly effective and can transfer some of the risk of universal waste management, but it is expensive to implement. Before the corrective action is approved the team needs to decide if the proposed corrective action is appropriate for the cause.
An appropriate corrective action decided by the team for this problem and cause might be something like:
Leadership will direct the HR department to develop a training matrix that shows competence required for all jobs including temporary fill in positions.
The HR department will develop a process(es) that require(s) employees to demonstrate competence to do a job before the employee can be assigned to that job including temporary fill-in positions.
The team should reach consensus that the proposed corrective action is appropriate for the root cause before it is implemented. Once approved the actions should be implemented without delay.
The team implements the corrective action after it is approved by the team and its leadership. One individual can implement a simple corrective action quickly. Complex problem solutions may require development of a project plan that assigns team members tasks. Task assignee’s need to accomplished these task by established dates. The team monitors progress on the tasks and periodically reports to the team leaders.
Stage 4 – Verification of Effectiveness
Verification confirms that the agreed upon corrective action was implemented as planned. It also confirms that the corrective action implemented was effective and fixed the problem in a way that it will not happen again.
Corrective action verification is usually performed by internal or external auditors during regularly scheduled or other audits. Others in the organization or on the team can perform the verification but it is important that the verifier be independent to the implementation process or the area where the verification is occurring.
Stage 5 – Closed
Team can close the corrective action after it has been verified. The team may need to invest additional effort if the verification finds that the corrective action implemented did not fix the problem. The team may need to re-investigate the cause and to re-propose and implement another corrective action.
Communicating and Tracking Corrective Action Status
A significant stumbling block that organizations sometime encounter when addressing nonconformances is the absence of a method to communicate and track the status of completion of the corrective action. Information about corrective action status has traditionally been paper based or electronic. These systems assign a corrective action task to someone to investigate and complete.
The team leader passes the physical or electronic copy of the corrective form to team member responsible for investigating the cause and proposing a corrective action. Then the paper or electronic copy is passed to other team members to add information or it is returned to the team leader for review and approval.
Assignee’s can misplace paper or electronic copies of corrective actions. Paper-based tracking systems require large three ring binders to store the completed corrective action forms and associated supporting documentation such as pictures or other evidence of completion of the corrective action. Electronic documents are often individually stored in folders located on the organizations servers or in the cloud.
With paper-based systems, communicating the overall status of corrective actions to leadership requires a labor-intensive process of thumbing through the three ring binders and manually recording the status of the corrective actions. Individual documents stored on servers or in the cloud have similar problems. Sorting through individual folders and files takes time to to find important information about the corrective action program. Use of electronic spreadsheets can help here but create other problems that limit the effectiveness of this solution
Corrective Action Tracking Database Apps
Industry 4.0 revolution will soon fundamentally and significantly change almost all business. This revolution is helping organizations store data optimize equipment and operations using the cloud environment. Organizations will be able to access enormous amounts of information with a click. Affordable cloud-based applications that track corrective action progress progress of are now becoming available to all types of businesses. Some of these application are easy to use and allow quick access to trends that inform management decisions.
The heart of these cloud based applications are databases that organize and store information. They help communicate the status of corrective actions to team members and leadership. These applications make it easy to monitor the approval-gate process and communicate with team members via automated emailing functions when the status of a corrective action changes or is approaching a due date. Correcttrack.com is a cloud based application that helps organizations keep track of Green Tier audit findings and improve the effectiveness of the corrective action process.
WDNR requires Green Tier participants to periodically audit their Green Tier EMS. Audits confirm the organization has established and is operating a “Functionally Equivalent” EMS that results in superior environmental performance. They are the critical “checking” part of an effective functionally equivalent EMS. If performed with skill the audit results can provide important information that the organizations leaders need to determine if the EMS is achieving its intended results.
Ensuring the results of audits are addressed in a timely fashion is critical to an effective EMS. This is especially true for nonconformance and noncompliance audit findings because findings that go unaddressed or with poor corrective actions increase the risk to organizations than if audits had not been done at all.
The ISO 45001 Technical Committee TC 283 is meeting in Kigali, Rwanda the week of October 6-12, 2019. The meeting will start with a plenary of all attendees to update national members on TC 283 developments. Task Groups (TG) and Work Groups (WG) will meet independently to work out the contents of several new work items that in are in progress including:
TG1 – Communications
TG3 – Revision of the High Level Structure
(Annex L Appendix 2 & 3)
WG2 – Psychological Health and
Safety at the Workplace
WG3 – Implementation Handbook
The TG3 discussions on revision of the ISO High
Level Structure will focus on issues that have been encountered by users of ISO
45001 with respect to:
The definition of risk as it applies
to an OHSMS
The relationship between risk and
opportunity and the traditional OH&S discipline specific terminology ‘Hazards
Outsourced processes and how these
to the OH&s discipline.
Comments are welcome here on opinions of
changes to the HLS that will benefit the discipline specific ISO 45001.
Note. I want to be clear upfront that my intention is not to discredit the contribution organized labor made to the development of ISO 45001:2018. The point I make here is that they had a significant impact on the requirements in certain sections of ISO 45001:2018. This fact may help inform users about the intent of the requirements for purposes of implementation and conformity assessment.
Clause 5.4 of ISO 45001:2018 discusses requirements for consultation and participation of workers and is the result of an interest groups desire to ensure their constituents were give certain rights to have influence over the organizations OHSMS. Organized labor got a symbolic win here for their constituents but does this additional language add value to the standard or simply create unnecessary complexity and confusion for users of the standard?
As an auditor my approach would be to check if the workers themselves believe that their opinions about the OHSMS have been considered in its development and implementation. The best way to do this is to ask them directly. Here is a line of questioning I would use to get objective evidence of conformity to the participation and consultation requirements in 5,4 of ISO 45001:2018.
My first question would be something like “Have you heard about the OHSMS here?”. The answer to this question helps me get a sense of the organizations general awareness of the existence of an OHSMS. You might have to rephrase the question to get them to understand what you are asking.
The next questions would be something like… Can you tell me about what you do as your job here and what you do to keep yourself safe from injury or ill health? A good answer would be something like… My job is to load railcars. I need to stand on top of the railcar and inspect it after it is loaded. I need to wear this fall protection harness when I am on the railcar in case I accidently fell off. The harness would break my fall and prevent or reduce my chances of injury.
The next question would go directly to participation and consultation and would be something like this. Did you participate in any of the planning part of the OHSMS giving leadership your opinion of your comfort level with safely performing you job. Another good answer would be something like…Yes, our entire crew participated in a hazard identification and risk assessment meeting where we went over all the job tasks and risks. We were asked if we felt safe doing these tasks given the safety procedures and equipment that was in place. One of the areas we raised as potentially unsafe was the absence of fall protection. Based on that, our leadership has provided us with these ladders, harnesses and showed us how to use them. I feel much safer now with this enhanced risk control.
Based on the results of this interview I would have good objective evidence that the intent of 5.4 had been achieved. If most other worker interviewed had a similar tale to tell I would feel comfortable in concluding that the organizations had meet the requirements of clause 5.4 of the standard.
Of course, this line if questioning could have gone in many other directions and the answers given may not have supported a finding of conformity to varying degrees. Auditors are certified and calibrated to make decisions during audits while considering all the evidence presented much like a judge does in a legal case. Auditors who focus on too much detail like expecting the auditee to produce evidence of each of the 21 individual requirements of 5.4 are missing the point and need to step back and look at the bigger picture.