Why Clause 6.1.1 Is the Foundation of OH&S Planning
If you have ever sat in an audit and watched an organisation struggle to explain why their OH&S management system looks the way it does, there is a good chance the problem traces back to Clause 6.1.1. This is the planning clause that asks organisations to think carefully about what could go wrong, what could go right, and what they need to do about both. Get it right, and the rest of the system has a logical foundation. Get it wrong, and you end up with a collection of procedures that exist because someone once said they were needed, not because they address any real risk or opportunity.
On this page
Clause 6.1.1 of ISO 45001:2018 sits within Section 6, which covers planning. It is titled General, and it sets the scene for everything that follows in that section, including hazard identification, risk assessment, legal requirements, and objective setting. Understanding what the clause actually requires, and how auditors assess it, is essential for anyone working within an OH&S management system.
What Clause 6.1.1 Actually Requires
The clause requires the organisation to determine the risks and opportunities that need to be addressed. This determination must take into account the context of the organisation established under Clause 4.1, the needs and expectations of workers and other interested parties identified under Clause 4.2, and the scope of the OH&S management system defined under Clause 4.3.
The purpose is to ensure the OH&S management system can achieve its intended outcomes, prevent or reduce undesired effects, and achieve continual improvement. The clause also introduces a concept that some organisations miss entirely: risks and opportunities are not just about safety hazards. They relate to the management system itself.
The Distinction Between OH&S Risks and Management System Risks
This is where many organisations get confused. ISO 45001 already has a detailed process for hazard identification and OH&S risk assessment under Clauses 6.1.2.1 and 6.1.2.2. Clause 6.1.1 operates at a different level. It is about risks and opportunities that could affect the OH&S management system as a whole.
Think of it this way. A hazard is a forklift operating near pedestrians. An OH&S risk is the likelihood of a collision and its severity. But a management system risk under Clause 6.1.1 might be that your organisation is about to double in size through a merger, and your current system was designed for a workforce of 50, not 200. That growth is a context factor that creates a risk to the system's ability to function effectively. Failing to address it means the system may not achieve its intended outcomes, regardless of how good your forklift traffic management plan is.
What Counts as an Opportunity Under This Clause
Opportunities are often underplayed in OH&S management. Most organisations focus heavily on risks, which makes sense given the nature of workplace safety. But the standard is explicit that opportunities must also be considered.
Opportunities under Clause 6.1.1 might include:
- New technology that could eliminate or reduce a hazard category across the organisation
- A change in workforce demographics that opens the door to improved training approaches
- Industry developments that allow better monitoring of occupational health exposures
- A shift in organisational culture that creates genuine appetite for worker participation in safety decisions
- Regulatory changes that, while adding requirements, also clarify expectations and reduce ambiguity
Treating opportunities as a genuine input to planning, not just a box to tick, is what separates organisations that improve from those that simply maintain compliance.
Exemplar Global Recognised Training ProviderRTP No. 310970
The Link Between Clause 4 and Clause 6.1.1
You cannot properly implement Clause 6.1.1 without a solid Clause 4 foundation. The standard makes this connection explicit. The risks and opportunities you identify must be informed by your understanding of the organisation and its context.
Context factors that feed into Clause 6.1.1 planning include internal factors such as organisational culture, resource constraints, changes in leadership, high staff turnover, and the nature of work being performed. External factors include regulatory changes, industry trends, economic pressures, changes in the supply chain, and community expectations around safety.
If an organisation's context analysis is superficial, their Clause 6.1.1 planning will be equally superficial. Auditors who understand this connection will often start at Clause 4.1 and trace the thread through to the risks and opportunities register. If the context analysis mentions that the organisation operates in a high turnover industry with a significant proportion of labour hire workers, but the risks and opportunities register makes no reference to this, that is a finding worth raising.
For a deeper look at how Clause 4.1 feeds into the planning process, the article on Clause 4.1 of ISO 45001: Understanding Organisational Context is worth reading alongside this one.
Documented Information Requirements
ISO 45001 requires the organisation to maintain documented information on risks and opportunities and on the processes and actions needed to address them, to the extent necessary to have confidence that the processes are carried out as planned.
This does not mean you need a lengthy formal document. Some organisations maintain a simple register or table that lists each identified risk or opportunity, its source, the actions planned, the person responsible, and the status of those actions. Others integrate this into a broader risk management framework. The format matters less than the substance.
What auditors look for is evidence that the process was actually carried out, that the outputs are current and reflect the organisation's actual situation, and that the identified risks and opportunities have influenced planning decisions. A register that was created three years ago and has not been reviewed since the organisation moved to a new site, took on a major new client, or restructured its workforce is not serving its purpose.
How Auditors Assess Clause 6.1.1 in Practice
When auditing Clause 6.1.1, experienced auditors do not simply ask to see the risks and opportunities register and tick a box. The assessment involves tracing connections and testing whether the planning process is genuine.
Questions Auditors Typically Ask
Expect questions along these lines during an audit of this clause:
- How did you identify the risks and opportunities relevant to your OH&S management system?
- What context factors did you consider when developing this list?
- How have the needs and expectations of workers influenced what you have identified here?
- When was this last reviewed, and what triggered the review?
- Can you show me an example of an opportunity that has been acted on?
- How do the risks identified here connect to your OH&S objectives?
The last question is particularly important. If the risks and opportunities register identifies a significant risk around contractor management, but the organisation's OH&S objectives make no reference to contractor safety performance, that gap suggests the planning process is not actually driving the system.
Evidence Auditors Examine
Beyond the register itself, auditors will typically look at:
- Management review records to see whether risks and opportunities are discussed and updated
- Meeting minutes from safety committees or leadership meetings that reference system level risks
- Records of changes to the system that were triggered by identified risks or opportunities
- Worker consultation records to confirm that workers have been involved in identifying risks to the system, not just operational hazards
- Objective setting documentation to verify alignment between identified risks and planned actions
Common Nonconformities Against Clause 6.1.1
Having conducted hundreds of external audits across a range of industries, certain patterns come up repeatedly when organisations are not meeting the intent of this clause:
- Confusing OH&S operational risks with management system risks. The register lists workplace hazards rather than factors that could affect the system's ability to function.
- No evidence of opportunity identification. The register lists only risks, with no consideration of what the organisation could do better or what favourable conditions exist.
- No linkage to context. The risks and opportunities appear to have been generated in isolation, with no visible connection to the context analysis or interested party needs.
- Stale documentation. The register has not been updated to reflect significant changes in the organisation's circumstances.
- No connection to planning outputs. The risks and opportunities have been identified but have not influenced objectives, programmes, or system design in any demonstrable way.
For a broader look at how these types of findings appear across the full planning section, the article on Clause 6 of ISO 45001: The Most Common Nonconformities covers the full picture.
Practical Guidance for OH&S Managers
If you are responsible for maintaining an OH&S management system, here is how to approach Clause 6.1.1 in a way that actually adds value rather than just satisfying an audit requirement.
Start With a Structured Review of Context
Before you can identify risks and opportunities, you need to be honest about your organisation's situation. Bring together people who understand different parts of the business, including operations, HR, finance, and frontline supervision. Ask them what is changing, what pressures the business is facing, and what conditions might affect the organisation's ability to manage safety effectively over the next one to three years.
Document what comes out of that conversation. It does not need to be elaborate. A table with internal and external factors, and a brief note on how each one might affect the OH&S management system, is sufficient as a starting point.
Think at the System Level
When you move from context to risks and opportunities, keep asking yourself: does this factor create a risk or opportunity for the management system, not just for a specific work activity? A risk to the system might include losing your dedicated safety manager with no succession plan in place, or a significant increase in workload that stretches your audit programme beyond its capacity. An opportunity might be that senior leadership has recently made a public commitment to safety culture improvement, creating organisational appetite for changes you have wanted to make for some time.
Connect the Outputs to Your Planning
The real test of whether Clause 6.1.1 is working is whether it influences decisions. If you identify a risk that your documented information is poorly controlled and accessible only to office staff, that should drive an action. If you identify an opportunity to improve worker participation through digital reporting tools, that should show up somewhere in your objectives or improvement plans.
If your risks and opportunities register sits in a folder and nothing flows from it, you have documentation, not a planning process.
Review It Regularly and When Things Change
The standard does not specify how often you must review the risks and opportunities, but the intent is clear. It should be a living process, not a one off exercise. Review it at management review, after significant incidents, when the organisation changes materially, and when new information emerges about external factors such as regulatory changes or industry incidents.
The article on Assessing OH&S Risks: A Guide to Clause 6.1.2.2 provides useful context on how the operational risk assessment process connects to the broader planning framework established by Clause 6.1.1.
The Relationship Between Clause 6.1.1 and Worker Participation
One aspect of Clause 6.1.1 that is easy to overlook is the requirement to consider the needs and expectations of workers as an input to identifying risks and opportunities. ISO 45001 places significant emphasis on worker participation throughout the standard, and Clause 6.1.1 is no exception.
Workers often have the clearest view of what is and is not working in the management system. They know whether the hazard reporting process is genuinely accessible, whether safety training is relevant to their actual tasks, and whether management follows through on commitments. Their perspective should inform the identification of management system risks and opportunities, not just operational hazards.
Practical ways to capture this input include safety committee discussions, toolbox talks that include questions about system effectiveness, anonymous feedback mechanisms, and direct consultation during the context review process. The key is that the input is genuine and that it can be traced through to the planning outputs.
For more on how worker participation requirements work across the standard, the article on Worker Participation and Consultation in ISO 45001 provides a thorough explanation.
Exemplar Global Recognised Training ProviderRTP No. 310970Clause 6.1.1 in the Context of an Integrated Management System
Many Australian organisations operate integrated management systems that combine ISO 45001 with ISO 9001 and ISO 14001. All three standards include equivalent planning clauses that require the identification of risks and opportunities relevant to the management system. Because all three follow the harmonised structure, the approach is broadly similar across standards.
In an integrated system, it is common to maintain a single risks and opportunities register that covers all three management systems, with columns or sections that identify which standard or aspect of the system each entry relates to. This can be efficient, but it requires care. The risks and opportunities relevant to the OH&S system are not always the same as those relevant to the quality or environmental systems. An integrated register that blends them together without distinction can obscure important planning information and create problems during a certification audit where each standard is assessed separately.
Preparing for an Audit of Clause 6.1.1
If you are preparing for an internal audit or a certification audit that will cover Clause 6.1.1, here are the key things to have ready:
- A current risks and opportunities register or equivalent documented information, with a clear date of last review
- Evidence of how the register was developed, including reference to the context analysis and interested party needs
- Records showing that the register has been reviewed at management review or in response to significant changes
- A clear line of sight from identified risks and opportunities through to OH&S objectives and planned actions
- Evidence of worker involvement in identifying management system risks and opportunities
Being able to walk an auditor through this chain of evidence, from context to risks and opportunities to planning outputs, demonstrates that the process is genuine and functioning as intended.
