How to Build a Health and Safety System

Before You Build a Health and Safety System

Building a health and safety system starts with understanding the work your people do, the hazards they face and the practical ways to prevent injuries and occupational illnesses. A good system does more than meet legislative requirements. It helps supervisors manage risk, gives workers clear instructions, sets accountability and creates a consistent approach to safety across every crew, site and shift.

No two systems should look the same. A system built for a 12-person office won't fit a pipeline contractor, and a manual bought off the shelf rarely matches how your work is actually done. The system has to be built around your work, your hazards and the law in the province or territory where you operate.

The words used for all this cause a lot of confusion. Most Canadian legislation calls the whole system a "health and safety program," ISO 45001 calls it an occupational health and safety management system, and in day-to-day work "program" usually means something narrower, such as an inspection program or a ground disturbance program. In this guide, the health and safety system is the whole thing, and health and safety programs are the documents inside it that set out how each part is managed. The guide sorts out those levels first, sets out what ISO 45001 requires, explains how the documents fit together, then walks through how to build the system.

Management System vs. Health and Safety System vs. Health and Safety Programs

The operational management system runs the whole organization. The health and safety system is one of the systems inside it, and it protects the people who work there. Health and safety programs sit inside the health and safety system and set out how each part of it, or each significant hazard, is managed. Knowing which is which tells you what each document is for, where it belongs and who owns it.

The Operational Management System (OMS)

The operational management system, or OMS, is the framework an organization uses to run everything it does. It brings all of the organization's management systems together: health and safety, environmental, quality, finance, production, human resources, maintenance and more. The International Organization for Standardization describes a management system as the way an organization manages the interrelated parts of its business, and the OMS is where those parts meet.

Several systems inside the OMS have their own international standard, such as ISO 9001 for quality, ISO 14001 for environmental management and ISO 45001 for occupational health and safety, but none of them is the OMS on its own. What the OMS provides is the common ground they all share: one set of business objectives, one way of controlling documents and records, one approach to competency, one internal audit process and one management review where senior leaders see how every part of the business is performing.

The Health and Safety System

The health and safety system is the management system inside the OMS that protects workers across every activity the business carries out. Its requirements come from two places. OHS legislation sets the legal minimum: most provinces and territories call the system a "health and safety program," the federal regulations call it a hazard prevention program, and most jurisdictions require one in writing once a business reaches a set size or hazard level. ISO 45001 sets the international standard for what a complete system contains, as the next section explains. When this guide quotes the law, "program" in that sense means the whole system.

Health and Safety Programs and Codes of Practice

Health and safety programs are the documents that set out how the system is carried out. Some cover an element of the system, such as an inspection program, a training program or an incident investigation program. Others cover a specific hazard or type of work, such as a ground disturbance program, a fall protection plan, a hazardous energy control program or a working alone program. Each one sets out its scope, responsibilities, requirements, training and records, and relies on safe work practices and forms to put it into practice.

Some programs must be in writing under OHS law, and the name changes across Canada. Alberta's OHS Code calls them codes of practice and requires them for hazards such as confined space entry (section 44). British Columbia requires a written exposure control plan where workers may be exposed to certain harmful substances (section 5.54). In the Northwest Territories and Nunavut, a code of practice is guidance published by the regulator rather than a document the employer writes. Whatever the name, the employer's written document plays the same role in the system.

How the Three Work Together

Direction flows down and evidence flows back up. The OMS sets the organization's objectives, resources and common processes. The health and safety system turns them into health and safety requirements. The programs turn those requirements into specific rules for each element and hazard, carried out through safe work practices and forms. The records the forms generate then show whether the programs work, feed the health and safety system's performance reviews and reach the OMS management review alongside quality, environmental, financial and production results.

Ground disturbance shows how this works. OHS regulations across Canada generally require buried facilities to be located and marked before the ground is disturbed, and the national standard CSA Z247 sets out damage prevention practices for underground infrastructure.

• The OMS commits the organization to protecting workers, the environment and other owners' infrastructure, approves the resources for locates and hydrovac excavation, and reviews line strikes and near misses at management review.
• The health and safety system identifies ground disturbance as a high-hazard activity that needs its own program, and supplies the competency, inspection, incident investigation and document control processes the program relies on.
• The ground disturbance program sets the field rules: locate requests through the provincial or regional one-call service, safe exposure by hand or hydrovac, and a permit and a competent supervisor's sign-off before digging.

Locate tickets, permits and inspection records then travel back up as evidence. If any level is missing, the chain breaks: a program without the system around it is a procedure in a binder, and a system without the OMS behind it lacks the authority and resources to stay alive. The same structure prevents duplicate paperwork, because the health and safety system shares the OMS's document control, internal audit and management review instead of running its own.

What ISO 45001 Requires in a Health and Safety System

ISO 45001:2018 is the international standard that sets out what a complete occupational health and safety management system must contain. It applies to any organization, of any size and in any industry, and it's the standard certification audits are measured against. Even if you never pursue certification, its requirements are a sound benchmark for what your system should include. A revised edition is in development, so check for updates before you start a certification project.

The requirements are grouped into seven clauses:

Two points matter for how you document the system. First, ISO 45001 doesn't require a safety manual. It requires documented information: the documents the standard calls for and any others the organization decides it needs, controlled so they're current and available, plus records kept as evidence. Second, ISO 45001 doesn't replace OHS law. Clause 6.1.3 requires the organization to identify the legal requirements that apply, and clause 9.1.2 requires it to evaluate compliance with them, so a certified system still has to meet every provincial, territorial or federal requirement where you work.

Organize the System's Documents

A health and safety system is documented at four levels, plus the records those documents produce. Each level supports the one above it. Together they let a supervisor start at the policy and follow a clear path down to the form they need, while an auditor follows the same path up from any record to the commitment behind it.

1. Policy. The employer's written commitment to health and safety, signed by senior management. It sets the direction for everything below it.
2. Programs. The documents that set out how each part of the system is managed: element programs such as hazard assessment, inspections, training, incident investigation and emergency response, and hazard-specific programs and codes of practice such as ground disturbance, fall protection and confined space entry.
3. Safe work practices. The practices and procedures that support the programs and tell workers how to do the work: general safe work practices for a type of work, such as using ladders, and step-by-step safe job procedures for specific high-risk tasks, such as isolating a conveyor for maintenance.
4. Forms. The paper or digital forms, checklists and permits people complete to carry out the programs and practices, such as hazard assessments, inspection checklists and ground disturbance permits.

Records are what the forms generate once they're completed: filled-in hazard assessments, inspection reports, training records, meeting minutes, investigation reports and corrective action logs. They aren't another level of instruction. They're the evidence that the system is working.

Two rules keep the documents working together. First, every document points both ways: a safe work practice names the program it supports and the forms it uses. Second, a lower-level document can add detail but never contradict a higher one; if a practice and its program disagree, one of them is wrong. A legal requirements register sits beside the documents, so each requirement can be traced to the document that meets it.

Document control keeps it all trustworthy. Each controlled document needs an owner, a version number, an approval date and a review date, and one master list shows the current version of everything. Obsolete copies come out of circulation, including printed ones in trucks and site trailers. Records aren't revised once they're made, but they must be kept, protected and retrievable for as long as the law, your audit cycle and your due diligence require.

How to Build a Health and Safety System, Element by Element

A working health and safety system has ten elements. They're listed in a sensible order for a first build, but in practice they overlap: hazard assessment shapes training, inspections feed corrective actions, and the review at the end feeds back into everything. Urgent hazards and mandatory legal requirements are dealt with right away, whatever stage you're at.

1. Determine Your Legal Requirements and Scope

Start by identifying the OHS legislation that applies to your business. That depends on where your people work, whether you're provincially or federally regulated, the type of work, the number of workers and the hazards involved. Most Canadian jurisdictions require a formal system, which the law calls a health and safety program, once a business reaches a set size or hazard level, and several spell out what it must contain:

Quebec, Newfoundland and Labrador, Prince Edward Island and Yukon set their own thresholds and contents, and our OHS Legislation in Canada page links to the law for each one. Two cautions apply everywhere. A business below the threshold still has every general duty in the Act, so it still needs a way to manage its hazards, even if it's simpler. And a generic safety manual doesn't provide compliance on its own: the system has to reflect your jurisdiction and your work.

Finally, set up a way to track legal changes. A legal requirements register lists each requirement that applies to you, the document that meets it and who's responsible for it, and it gets reviewed whenever the law or your work changes.

2. Establish Management Commitment and Responsibilities

Write a health and safety policy and have it approved and signed by senior management. Keep it short and specific to your business, and make sure it says what the business will actually do, not just what it believes.

Then define what owners, managers, supervisors, workers, contractors and safety personnel are each responsible for. Assign specific responsibilities for inspections, training, hazard assessments, incident investigations and corrective actions, and make sure the people assigned have the time, authority and resources to do them. A responsibility that nobody is resourced to carry out is a gap an auditor or officer will find quickly. Supervisors carry much of the day-to-day load, and they need to know exactly what's expected of them.

3. Involve Workers in Developing the System

Workers know how the work is actually done and which hazards they face, often better than the people writing the procedures. Ask them before you write, while you write and after you introduce each part of the system.

Set up a joint health and safety committee or a health and safety representative where the law requires one, and give workers simple ways to raise concerns, suggest improvements and hear back. Participation should continue long after the system is introduced. Our Committees and Worker Participation guides explain how to make that work.

4. Identify Hazards and Assess Risks

Look at routine and non-routine work, equipment, materials, the work environment and possible emergencies. Consider physical, chemical, biological, ergonomic and psychosocial hazards, and include the work done by contractors, visitors and people working alone.

Use formal hazard assessments to evaluate work activities and a job hazard analysis for tasks with significant risk. Field-level hazard assessments help workers catch changing conditions before they start each job. The hazard assessment is the foundation of the whole system: it tells you which health and safety programs you need, what procedures to write and what training to provide.

5. Select and Implement Effective Controls

Use the hierarchy of controls: elimination and substitution first, then engineering controls, then administrative controls, then personal protective equipment. A warehouse, for example, should look at physically separating forklifts and pedestrians rather than relying on high-visibility vests and warning signs alone.

Once controls are in place, verify that they work. A guard that's routinely removed, or a procedure that adds 20 minutes to a rushed job, may look good on paper and fail in practice. Where one hazard needs a whole set of controls, such as fall protection, confined space entry or ground disturbance, that's the point where a health and safety program or code of practice earns its place among the system's programs.

6. Develop Health and Safety Programs and Procedures

Write safe work practices and safe job procedures for the activities where consistent instructions are important to controlling risk. Depending on the operation, these may cover working at heights, hazardous energy isolation, equipment operation, chemical handling, working alone, driving or contractor management. Where the hazard assessment shows a hazard needs a whole set of controls, training and records, build a health and safety program or code of practice for it, such as a ground disturbance or fall protection program, and file it at the programs level of your documents.

Procedures should be practical, easy to find and based on how the work is really done. The best test is to walk through a procedure with the workers who do the task. If they can't follow it, or they'd have to break it to get the job done, it needs rewriting.

Two processes that ISO 45001 calls out are easy to miss. Management of change makes sure new equipment, processes, people and work sites are assessed before they're introduced. Contractor management makes sure contractors and suppliers meet your requirements before and during the work.

7. Provide Orientation, Training and Competency Verification

Train workers before they do tasks that need specific knowledge or skills. Orientation should cover the workplace hazards, emergency procedures, required PPE, how to report hazards and incidents, the right to refuse unsafe work and job-specific instructions. Supervisors need training too, especially in their legal responsibilities and how to lead hazard assessments, inspections and investigations.

Keep training records, and verify competency through demonstration, practical assessment or observation. Finishing a course doesn't prove a worker can do the task safely. A training matrix, showing which roles need which training and when it expires, makes gaps easy to spot.

8. Establish Inspections and Corrective Action Processes

Schedule workplace inspections based on the risks involved and the legal requirements that apply, and include equipment inspections, preventive maintenance and routine supervisor checks. Record each deficiency, assign the corrective action to a responsible person with a completion date, and verify that the action has actually controlled the hazard before it's closed.

This is the element that turns a documented system into a working one. Findings that are recorded but never fixed leave a written trail of hazards the employer knew about and didn't address.

9. Prepare for Emergencies and Investigate Incidents

Build emergency response procedures from credible scenarios at your workplaces: medical emergencies, fires, spills, severe weather, and events that need rescue, such as a fall arrest or a confined space entry. Arrange first aid to meet the requirements where you work, and test the plan with drills and exercises. Our Emergency Management guides cover planning and exercises in detail.

Set up a separate process for reporting and investigating incidents, including injuries, occupational illnesses and near misses. Investigations should look for the underlying causes and the system improvements that will prevent a repeat, not someone to blame. Our guide on how to investigate a workplace incident walks through the process.

10. Monitor, Evaluate and Improve the System

Set measurable objectives and review the system's performance regularly. Track a mix of leading indicators, such as inspections completed, overdue corrective actions, training compliance and hazard reports, and lagging indicators, such as incidents and claims. The US Occupational Safety and Health Administration's guidance on program evaluation recommends using both, evaluating at least once a year, and reviewing again after a serious incident or a significant change in equipment, processes or people.

Run internal reviews or audits, look for recurring problems, and update the system when equipment, staffing, activities or legal requirements change. Several jurisdictions set a maximum interval: New Brunswick requires a review every year, and Saskatchewan, Manitoba, the Northwest Territories, Nunavut and federally regulated employers at least every three years. The UK Health and Safety Executive's guide Managing for health and safety makes the broader point well: health and safety works best as an integral part of how the business is managed, not as a separate system run beside it. That's why the management review of the health and safety system should be part of the business's regular planning cycle, with senior management in the room.

Safety Manuals: The Collection and Outcome of the System

A safety manual is the collection of the health and safety system: the policy, programs, safe work practices and forms brought together so people can find and use them. It's also an outcome of the system, because what the manual contains, and whether an organization has one at all, depends on the size and circumstances of the organization.

• Small organizations usually collect the whole system in one safety manual. For them, the manual is the health and safety system written down in one place.
• Larger organizations may produce safety manuals for a region, a business line, a project or a client, collecting the parts of the system that apply to that operation and drafted for its circumstances.
• Some organizations with large health and safety systems don't have a safety manual at all. They keep the system's documents in a controlled library or portal instead.

Whichever approach fits, the manual has to come from the system, not replace it. Every document in it should go through the system's document control, so the manual stays current when the programs and practices it collects change. A manual bought off the shelf works the other way round, which is why it rarely reflects how the work is really done.

A Practical Six-Month Implementation Plan

Building a health and safety system takes time, mostly because the documents have to be drafted, tested and agreed with the people who will use them. For a small to mid-sized employer building its first system on its own, six months is a realistic timeline, and most of it goes into drafting the policy, programs, safe work practices and forms with supervisors, workers and the health and safety committee or representative. Urgent hazards and mandatory legal requirements are dealt with immediately, whatever the phase.

The end of month six isn't the finish line. It's the point where the system starts producing records you can learn from, and the first internal review should follow about six months later.

How to Know Whether Your System Is Working

An effective health and safety system produces evidence that its requirements are being carried out. Workers can explain the hazards of their jobs and how they control them. Supervisors know their responsibilities and have records showing they're meeting them. Problems that are found get corrected, and follow-up confirms the fix worked.

A useful test is to pick one significant hazard and trace how the business manages it, down through the system's documents and back up again: from the hazard assessment, through the control chosen, the program or procedure that describes it, the training and instruction workers received, the inspections that check it and the corrective actions that followed. If that trail can't be shown, the business may have a documentation system rather than a working health and safety system.

The documents themselves are a means, not the goal. The documentation a business needs depends on its jurisdiction, size and work, and a 200-page manual that nobody opens is worth less than a short, well-organized system that supervisors and workers understand and use.

Should You Build the System Around COR or SECOR?

For businesses working toward a Certificate of Recognition (COR) or a Small Employer Certificate of Recognition (SECOR), it can be efficient to design the system with the certifying partner's audit standard in mind. COR programs run across Canada through certifying partners such as provincial and industry safety associations, and while each uses its own approved audit standard, the audit elements map closely to the ten elements above. Even for businesses that aren't pursuing certification, a certifying partner's audit standard makes a useful checklist.

Why we often build to the COR standard. At Calgary Safety Consultants, we often build safety manuals and health and safety systems to the COR audit standard, with the documents organized element by element in the same order as the audit. It makes auditing easier for several reasons:

• The auditor's path matches yours. COR auditors work through the standard one element at a time, reviewing documents, interviewing workers and supervisors and observing the work. When the manual and the system follow the same elements, each audit question points straight to the program, practice and records that answer it.
• Gaps show up before the audit does. Building to the standard makes missing pieces visible while you build, not when an auditor finds them.
• Evidence is easier to gather. Records sit with the programs they support, so pulling a sample of inspections, training records or investigations for an element takes minutes rather than days.
• Maintenance audits get simpler. COR is kept through regular maintenance audits, and a system that already follows the standard needs little rework from one audit to the next.
• It still fits the law and ISO 45001. The COR elements cover much of the same ground as Canadian OHS requirements and ISO 45001, so building to COR doesn't pull the system away from either.

Certification and legislation serve different purposes, though. The system has to meet every legal requirement that applies, including those an audit standard doesn't specifically cover, and passing an audit isn't the same as compliance. Calgary Safety Consultants helps employers build health and safety systems and prepare for audits, but we don't issue certificates. CORs and SECORs are issued through the applicable certifying partner.

Common Mistakes to Avoid

• Buying a generic manual and calling it a system. A manual that doesn't reflect your jurisdiction, hazards and work isn't a health and safety system, and auditors and officers can tell.
• Running parallel systems. Separate safety and quality document sets with different numbering and approvals breed conflicting instructions.
• Confusing the system with its programs. A binder of hazard programs with no policy, responsibilities, inspections or review behind it isn't a health and safety system.
• No document hierarchy. Without one, nobody knows which document governs, and old versions stay in circulation.
• Writing procedures without the workers who do the job. Procedures that don't match the work get ignored.
• Assigning responsibilities without resources. A supervisor who's responsible for inspections but never given time for them can't meet the expectation.
• Treating training as competency. A course certificate doesn't prove someone can do the task safely.
• Never reviewing the system. Systems drift as work, people and law change, and some jurisdictions set a maximum review interval.

The Bottom Line

Building a health and safety system isn't a one-time paperwork exercise. It means identifying risks, putting controls in place, explaining expectations, assigning responsibilities, keeping records and checking that the system works, with health and safety programs added where specific hazards call for them and documents organized from the policy down to the forms so everything is findable and current.

The goal is a system that protects people, supports supervisors, meets the requirements that apply and becomes part of how the business normally runs. Done well, it also reduces operational interruptions, improves consistency, supports contractor prequalification and strengthens audit readiness.

Download the Health and Safety System Builder Checklist

Two free downloads go with this guide.

• Health and Safety System Builder Checklist (PDF). A three-page checklist with clickable checkboxes covering your legal requirements, the ten elements, the four levels of documents, the six-month plan and the working test.
• Master Document List and Legal Register (Excel). A ready-made register for your system's documents, with level, type, element, owner, version, approval date and review date. It flags reviews that are due soon or overdue, includes a starter list of 35 typical documents and a legal requirements register, and summarizes everything on one tab for your management review.

Click either button to download the file. Adapt the starter list to the documents your own system needs.

About the author

John Duplessis, B.Sc., CRSP

President and Principal Health & Safety Consultant

John Duplessis is a Canadian Registered Safety Professional with more than 30 years of occupational health and safety experience in oil and gas, construction, green energy, midstream operations and industrial project work.

Meet our team