ISO 45001 for a construction SME: what "context of the organisation" means on site

The first thing a small contractor reads in ISO 45001 is clause 4, "context of the organisation", and the first thing most do is close the document. It reads like a strategy exercise for a head office. It is not. For a groundworks contractor with fourteen people and three sites, clause 4 is about four pages, every line of which the company already knows. This post translates clauses 4 and 5 of ISO 45001:2018, published in the UK as BS EN ISO 45001:2023 with the 2024 amendment incorporated, into what a small contractor writes and does, and shows where the legal register and CDM 2015 fit.

Clause 4.1: the issues, on one page

The standard asks the organisation to determine the external and internal issues that affect its ability to achieve what the system is for. On site that means writing down what makes health and safety harder or easier for this company in particular. Externally: the type of work and its hazards, deep excavations and buried services for a groundworker, work at height and hot works for a roofer; the clients it works for and what they demand at prequalification; how much of the workforce is agency or self-employed. Internally: the age of the workforce, the turnover of supervisors, the plant it owns and hires, the languages spoken on site, and how far the directors are from the work. The 2024 amendment added one line here, that the organisation determines whether climate change is a relevant issue; for a contractor it usually is, through heat, flooding and ground conditions. The output is a page, reviewed at management review, that an auditor reads to understand what the rest of the system is for. It does not need a framework. It needs to be true.

Clause 4.2: interested parties, as a table

Who, besides the workers, has an interest in the company's health and safety performance, and what do they need? For a construction SME the list is short and the table is the document: the workforce, including agency and self-employed operatives, who are workers under the standard whether or not they are employees; the clients and principal contractors; the Health and Safety Executive; the insurers; the neighbours and the public around each site; the supply chain; and the certification body. Against each, what they require and where in the system it is met. A principal contractor requires reviewed RAMS, inductions and competence cards: met in the RAMS procedure, the induction record and the competence matrix.

Clause 4.3: the scope, and the two hats

The scope statement says what the system covers, and the trap is to write one that covers only the office. It has to cover the work: the activities, the sites and the workers, wherever they are. It also has to say which hats the company wears. A contractor who is sometimes the principal contractor on a small job and sometimes a subcontractor on a large one has two operating contexts with different CDM 2015 duties, and the scope should say so. ISO 45001 permits no exclusions, so the scope is a description of the business rather than a list of things left out. Three or four sentences on the front of the manual.

Clause 4.4: the system is the joins

Clause 4.4 asks for a management system to be established, implemented, maintained and improved. In a small contractor that is not a new set of documents. It is the statement of how the pieces that already exist connect: the policy leads to the risk process, the risk process produces the RAMS, the RAMS are briefed and the briefing is recorded, the site inspections feed the corrective actions, the corrective actions and the incident investigations feed the management review. The finding that catches most first-time contractors is the missing join: a good RAMS with no process that says how RAMS are produced, or an investigated accident that changed nothing at company level. HSG65, third edition 2013, describes the same plan, do, check, act loop, and a contractor who can draw that loop on one page with its own document codes on it has met clause 4.4.

Clause 5.1: what the director does, not signs

Leadership in the standard is a list of things top management does: takes overall responsibility, sets the policy and objectives, integrates the system into the way the business is run, provides the resources, protects workers from reprisals when they report, and supports consultation. For a small contractor that is the director, and the auditor will ask them, not the safety adviser, how they do it. The evidence is behaviour with a record: site visits with the observations written down, management review minutes with the director's decisions in them, and the stop-work that was backed rather than overruled. A policy signed by someone who cannot describe the company's worst hazards is the finding an auditor writes first.

Clauses 5.2 and 5.3: the policy and the roles

The Health and Safety at Work etc. Act 1974 already requires, at section 2(3), a written policy with the organisation and arrangements for carrying it out. That document can be the ISO 45001 policy as long as it carries the commitments clause 5.2 requires, including eliminating hazards and reducing risks, and consulting and involving workers. Clause 5.3 asks for roles, responsibilities and authorities to be assigned and communicated. In construction the roles are the CDM ones as much as the company ones: who is the contractor under regulation 15 on each project, who is the principal contractor under regulation 13 when the company holds that appointment, and who has the authority to stop the work. The roles are written against names on each project's setup record.

Clause 5.4: consultation is not a toolbox talk

This is the clause that separates ISO 45001 from every system a contractor has had before. Workers must be consulted on a listed set of topics, including the policy, the roles, how legal requirements are met and the objectives; and they must participate in a further set, including hazard identification, the choice of controls, incident investigation and the audit programme. A toolbox talk is communication, one way. Consultation is two way and it changes something. The record is what an auditor opens: site meeting minutes with a standing item, the near-miss cards and what was done about them, the RAMS review where an operative's comment altered the method. CDM 2015 already requires the principal contractor to consult and engage with workers under regulation 14; the standard adds only that it be planned, recorded and free of reprisal.

The legal register, and the link to CDM 2015

Clause 6.1.3 asks for the legal and other requirements to be determined, kept up to date and taken into account. For a UK contractor that is a register: each instrument, what it requires of this company, how the company complies, the evidence, and the date it was last checked. The 1974 Act; the Management of Health and Safety at Work Regulations 1999, with the risk assessment duty at regulation 3; CDM 2015 under each hat; the work at height, lifting, COSHH, noise, vibration and RIDDOR instruments as the work requires; and the client requirements the company has agreed to. Most small contractors hold this in the consultant's head. The standard wants it written down, reviewed and, at clause 9, evaluated: not "does this apply to us" but "are we complying, and how do we know".

CDM 2015 is where the register meets the site. The general duties under regulation 8, to have the skills, knowledge and experience for the work, are the competence process. The construction phase plan under regulation 12 is the operational planning the standard asks for at clause 8. Regulation 13 is coordination with subcontractors, regulation 14 is clause 5.4, and regulation 15, the contractor's duties on every job, is the day-to-day system. A contractor that writes its ISO 45001 procedures as descriptions of how it discharges those regulations ends up with one system that a client's auditor and a certification auditor both recognise.

Our ISO 45001 Construction OHSMS is written on that basis: manual, policy, procedures, pre-populated legal register and consultation records, pointing by code at the RAMS, permits and inspection registers in the Site Health & Safety Pack rather than duplicating them. Certification is granted only by an accredited certification body after audit; the documents shorten the road, they do not remove it.