OHS management system for business services in Australia

An OHS management system is the set of policies, procedures, records and reviews a business uses to find health and safety risks and control them. Offices, consultancies, IT firms and other business services have lower-risk work than a building site, but they still owe the same duty of care to workers, contractors and visitors. A simple, written system is the practical way to show you're managing that duty.

This guide explains what the system should cover for a business services organisation, how it relates to the WHS laws and AS/NZS ISO 45001, and the steps to build one that fits your business.

OHS or WHS?

The terms mean much the same thing. OHS (occupational health and safety) is the older term. Most jurisdictions adopted the model Work Health and Safety (WHS) laws from 1 January 2012, and the WHS name stuck. Victoria still runs under its own OHS Act 2004 and the Occupational Health and Safety Regulations 2017. Western Australia adopted the model laws from 31 March 2022. If you work across states, check the WHS laws in each state before you write your system.

The duties are the same idea whatever you call them. The main one sits in section 19 of the WHS Act: a business must ensure, so far as is reasonably practicable, that its work doesn't put workers and others at risk.

Do you need a formal system?

The WHS laws don't require an office to hold a document with the name "OHS management system". They do require you to manage risk. A documented system is how you show that you've done it, and it helps when staff change, a client asks for evidence or something goes wrong.

For a business services firm, a system can be short. Five to ten pages of policy and procedures, a hazard register and a few forms will usually do. A Business Services OHS Manual gives you a starting structure. For the wider picture, read our overview of safety management systems.

What the system should cover

Hazards in business services

Office-based work carries fewer dramatic risks, but the common ones cause real harm over time. Check your system against these:

• Ergonomics. Poorly set-up desks, chairs and screens cause neck, back, shoulder and wrist pain. Set up workstations for each person, not just once when the office opens.
• Electrical safety. Overloaded power boards, damaged leads and equipment left running in wet areas. Keep a test-and-tag record for portable equipment and report damage promptly.
• Slips, trips and falls. Cables across walkways, boxes in corridors, wet floors in kitchens and bathrooms, and stairs with worn edges.
• Psychosocial hazards. Excessive workloads, deadlines, bullying, and aggression from clients or the public. The model Code of Practice on managing psychosocial hazards at work, published in 2022, sets out what to do about them. A psychosocial hazards management plan is a practical place to record your controls.
• Fatigue and after-hours work. Long hours to meet deadlines, and staff working alone late at night.
• Work-related driving. Staff driving to client sites or between offices are exposed to the road, and you still have duties for their safety.
• Emergencies. Fire, evacuation, medical events and violence. Staff need to know where the exits are and who to call.

Work through these with your team. People who sit at the desks every day often spot hazards you won't see from a management office.

Five steps to build the system

1. Get leadership on board and talk to staff. For a short start on the basics, see our guide to WHS fundamentals for small businesses. The WHS laws require you to consult workers on matters that affect their health and safety (section 47). Start by asking your team what worries them. Record the answers.
2. Identify hazards and assess the risks. Walk the workplace and list what could hurt someone. Rate each risk by how likely it is and how bad the harm would be.
3. Choose controls, starting at the top. Eliminate the hazard where you can. If you can't, substitute, isolate, or use engineering controls, such as ergonomic furniture or a power board with overload protection. Use training and procedures as backup, not the main control.
4. Write the procedures and train people. Keep them short and specific. Name who does each task, what they check and what they record. Train new starters before they start work.
5. Review it. Review controls when they aren't working, before a change at the workplace (such as a move or new software that changes how people work), when a new hazard appears, after consultation shows it's needed, or when a health and safety representative asks. Regulation 38 sets out those triggers.

Keep the paperwork simple enough that people will use it. A one-page incident report that staff fill in on their phone beats a 20-page form nobody opens.

Where ISO 45001 fits

AS/NZS ISO 45001:2018 is the Australian adoption of the international standard for occupational health and safety management systems. It replaced AS/NZS 4801. The standard sets out a framework for identifying hazards, controlling risk and improving your safety performance over time. You can buy it from the Standards Australia store.

ISO 45001 is voluntary. Following it doesn't make you compliant with the WHS laws, and certifying to it doesn't remove your duties. Many business services firms use it anyway, because clients and tender panels ask for it and because it gives a tidy structure for the system. If you're considering certification, our guide to the ISO 45001 certification process explains the steps.

Common questions

Do I need an OHS management system if I only have an office?

You need to manage the risks in the office. A written system, even a short one, is the easiest way to show you've done it. The WHS laws apply to office work just as they do to a construction site, though the controls will be simpler.

Is ISO 45001 a legal requirement?

No. It's a voluntary standard. The WHS Act and Regulations set the legal duties, and ISO 45001 is one way to organise how you meet them.

Who is responsible for safety in a small business?

The business is, through its primary duty of care. Officers such as directors must exercise due diligence to make sure the business complies (section 27). Workers must take reasonable care for their own safety and others' (section 28).

How often should I review the system?

At least once a year, and whenever something changes: a new hazard, an incident, a move or a new way of working. Keep a record of each review.

This is general information, not legal advice. Check the current law with your WHS regulator.