What Clause 6.1.4 Is Actually Asking You to Do
If you have worked through the planning section of ISO 45001, you will have noticed that Clauses 6.1.1 through 6.1.3 do a lot of heavy lifting. You identify hazards, assess OH&S risks and opportunities, and determine your legal and other requirements. Then comes Clause 6.1.4, and for many organisations it is where the wheels fall off.
On this page
Clause 6.1.4 is titled Planning action. Its purpose is straightforward: once you know what your risks, opportunities, and compliance obligations are, you need to plan what you are going to do about them. The clause requires the organisation to plan actions to address those risks, opportunities, and requirements, and then plan how to integrate those actions into its OH&S management system processes, and evaluate their effectiveness.
That sounds simple enough. In practice, it is where a lot of organisations stop at the risk register and never quite make it to the action plan. Auditors see this constantly. A detailed hazard identification process, a well populated risk matrix, a comprehensive legal register, and then a vague list of controls that nobody owns and nobody checks. Clause 6.1.4 is designed to close that gap.
The Three Inputs Clause 6.1.4 Draws From
Before you can plan actions, you need to understand what you are planning actions for. Clause 6.1.4 draws from three upstream sources, and your planned actions need to address all of them.
OH&S Risks and Opportunities From Clause 6.1.1
The risks and opportunities identified under Clause 6.1.1 are your starting point. These include both risks to the OH&S management system itself and the OH&S risks arising from hazards in your operations. For each significant risk or opportunity, Clause 6.1.4 expects you to have planned a response. Not every low rated risk needs an elaborate action plan, but anything that came out of your assessment as significant needs to be addressed.
An opportunity is just as important as a risk here. If your hazard identification process revealed an opportunity to improve worker participation in safety planning, Clause 6.1.4 expects you to plan how you will take advantage of that. Many organisations focus entirely on risk reduction and ignore the opportunity side. That is a gap auditors will flag.
Legal Requirements and Other Requirements From Clause 6.1.3
Your compliance obligations register feeds directly into Clause 6.1.4. For each legal requirement or other requirement that applies to your OH&S management system, you need to plan how you will meet it. This is not the same as simply listing the law and saying you comply. The standard wants to see planned actions that make compliance happen and stay current.
In Australia, this means your planned actions need to reflect requirements under the relevant Work Health and Safety Act and Regulations in your jurisdiction, as well as any codes of practice, standards, or contractual requirements that apply. If your legal register identifies that you must conduct quarterly workplace inspections under a specific regulation, your planned actions should reflect how that requirement is being met and who is responsible for it.
Hazard Identification and Risk Assessment Results From Clause 6.1.2
The detailed hazard identification and risk assessment outputs from Clauses 6.1.2.1 and 6.1.2.2 also feed into your planning. For each significant hazard and risk, you need planned controls. Those controls should follow the hierarchy of controls, which ISO 45001 references explicitly. Elimination sits at the top, then substitution, engineering controls, administrative controls, and finally personal protective equipment.
The planned action is not just the control itself. It is the decision about what level of the hierarchy you are applying, why, and what you will do to verify the control is working. This is what separates a mature OH&S management system from a folder of procedures that nobody reads.
Exemplar Global Certified Training ProviderRTP No. 310970
What Planned Actions Must Include
Clause 6.1.4 does not prescribe a specific format for planned actions, but it does set out what those actions need to achieve. When you plan an action, you need to think about how it will be implemented and operated, how it will be integrated into the OH&S management system, and how you will evaluate whether it was effective.
Implementation and Operation
A planned action without an owner is not a plan. It is a wish. For each action you plan, there needs to be clarity about who is responsible, what they are expected to do, and by when. This does not need to be a complex project management tool. A simple action register with a description, an owner, a due date, and a status column will satisfy this requirement if it is actually being used and reviewed.
The operational side of the action matters too. If your planned action is to install guarding on a piece of machinery, the implementation includes procuring the guarding, having it installed, verifying it meets the required standard, and training workers on its purpose. All of those steps need to be planned, not just the purchase order.
Integration Into the OH&S Management System
This is the part of Clause 6.1.4 that catches organisations out most often. The standard says actions must be integrated into OH&S management system processes. That means your planned actions cannot sit in a separate spreadsheet that nobody looks at. They need to be woven into the processes that actually run the business.
For example, if a planned action involves updating a safe work method statement to reflect a new control, that action connects to your documented information process, your training and competence process, and your operational control process. Integration means those connections are made deliberately, not accidentally.
Auditors look for this integration. They will ask to see how a risk that was identified in the hazard register flows through to a control in an operational procedure, and then to a training record, and then to a monitoring activity. If those threads exist, the system is integrated. If each element exists in isolation, it is not.
Evaluation of Effectiveness
Planning an action and implementing it is not the end of the story. Clause 6.1.4 requires you to plan how you will evaluate whether the action was effective. This is the link to Clause 9.1, which covers monitoring, measurement, analysis, and evaluation.
Effectiveness evaluation does not need to be complex. For a control like guarding on machinery, effectiveness might be evaluated by checking that the guarding remains in place during routine inspections and that no incidents or near misses related to that hazard have occurred. For an administrative control like a permit to work system, effectiveness might be evaluated by auditing a sample of permits to check they are being completed correctly and that workers understand the requirements.
The key is that the evaluation method is planned in advance, not invented after the fact when an auditor asks how you know the action worked.
How Clause 6.1.4 Connects to the Rest of the Standard
Clause 6.1.4 does not operate in isolation. It is one of the most connected clauses in the standard, and understanding those connections helps you implement it properly and audit it effectively.
Connection to Clause 8: Operational Controls
The actions planned under Clause 6.1.4 are largely implemented through the operational controls described in Clause 8. Clause 8.1.1 covers the general requirements for operational planning and control, and it explicitly references the need to implement the actions determined in Clause 6.1. This is the formal handoff between planning and doing.
If you plan an action in Clause 6.1.4 and it never makes it into an operational control, procedure, or work instruction, you have a gap. Auditors will check this connection. They will take a planned action from your register and ask to see where it shows up in your operational processes. If the answer is nowhere, that is a finding.
Connection to Clause 9: Performance Evaluation
The evaluation of effectiveness planned under Clause 6.1.4 is carried out through the performance evaluation processes in Clause 9. Monitoring and measurement under Clause 9.1.1 is where you check whether your controls are working. Internal audits under Clause 9.2 provide another mechanism for evaluating whether planned actions have been implemented and are effective.
Management review under Clause 9.3 is where the results of that evaluation are considered at the top level, and where decisions are made about whether further action is needed. This is the PDCA cycle in action: plan the action in Clause 6, do it in Clause 8, check it in Clause 9, and act on the results back in Clause 6 or Clause 10.
Connection to Clause 10: Improvement
When an evaluation reveals that a planned action was not effective, that feeds into Clause 10. Corrective action under Clause 10.2 is the formal mechanism for addressing failures in planned actions. Continual improvement under Clause 10.3 is where the organisation looks for opportunities to do better, which then generates new planned actions under Clause 6.1.4. The loop is closed.
Common Nonconformities Against Clause 6.1.4
Having conducted and reviewed hundreds of ISO 45001 audits, there are patterns in where organisations struggle with this clause. Understanding these common failures helps you avoid them in your own system and know what to look for when you are auditing.
Actions That Exist on Paper Only
The most common finding is an action register that has been created but is not being actively managed. Actions are listed, owners are named, due dates are set, and then nothing happens. The register is not reviewed at management meetings, owners do not receive reminders, and overdue actions accumulate without consequence. This demonstrates that the actions have been planned but not integrated into the management system in any meaningful way.
No Link Between Risk Assessment and Controls
Another frequent gap is a disconnect between the hazard register and the controls that are actually in place. The hazard register might identify a risk of forklift and pedestrian collision in a warehouse, rated as high. But the planned action to address it, whether that is physical separation, traffic management procedures, or a combination, cannot be found in any operational document. The risk has been identified and assessed, but the planning of action has not been completed.
Controls That Do Not Reflect the Hierarchy
Organisations sometimes plan actions that go straight to administrative controls or PPE without considering whether elimination, substitution, or engineering controls are practicable. ISO 45001 expects the hierarchy of controls to be applied when planning actions. If an auditor sees a high risk that has been addressed only with a procedure and PPE, they will ask whether higher order controls were considered and why they were not selected. If there is no documented rationale, that is a finding.
No Planned Method for Evaluating Effectiveness
Many organisations implement controls without planning how they will know whether those controls are working. When asked how they evaluate the effectiveness of a specific control, the response is often a blank look or a vague reference to incident statistics. Clause 6.1.4 requires this to be planned, not improvised. The evaluation method should be documented and linked to the monitoring and measurement process.
How to Audit Clause 6.1.4 Effectively
Whether you are conducting an internal audit or a certification audit, Clause 6.1.4 requires a specific approach. You cannot audit it in isolation. You need to trace the thread from risk identification through to planned action, implementation, and effectiveness evaluation.
Start with the hazard register or risk register. Select a sample of significant risks and ask to see the planned actions associated with each one. Then follow those actions into the operational processes. Ask to see the procedure, work instruction, or control that implements the action. Then ask how the organisation evaluates whether that control is working. Look for monitoring records, inspection checklists, audit results, or incident data that relates to the specific hazard.
Do the same for legal requirements. Take a sample of requirements from the compliance obligations register and ask how the organisation plans to meet each one. Look for the connection between the requirement and the operational process that addresses it.
Ask the people doing the work, not just the managers. A worker on the shop floor should be able to tell you what controls are in place for the hazards they face, why those controls are there, and what they do if a control is not working. If workers cannot answer those questions, the planned actions have not been effectively integrated into operations, regardless of what the paperwork says.
For a deeper look at what auditors check when examining the OH&S risk assessment process that feeds into this clause, the article on audit questions for OH&S risk assessment under Clause 6.1.2.2 covers the upstream process in detail. And if you want to see how the hierarchy of controls should be applied when planning those actions, auditing the hierarchy of controls walks through what auditors look for at each level.
Documented Information for Clause 6.1.4
ISO 45001 does not mandate a specific document format for Clause 6.1.4. There is no required procedure or register prescribed by the standard. However, Clause 6.1.4 does require the organisation to retain documented information to the extent necessary to have confidence that the processes have been carried out as planned.
In practice, most organisations maintain some form of action register or risk treatment plan that records planned actions, owners, timelines, and status. This is the most common approach and it works well provided it is kept current and actively reviewed. Some organisations integrate this into a broader risk register that captures hazards, risk ratings, planned controls, and monitoring activities in a single document. Others use separate registers for different types of actions.
What matters is not the format but the substance. The documented information should make it possible for an auditor to trace a risk from identification through to a planned action, through to implementation, and through to an evaluation of effectiveness. If that trace is possible, the documentation is adequate. If it is not, regardless of how many documents exist, there is a gap.
It is also worth noting that the planned actions themselves often generate documented information requirements in other parts of the standard. A new operational control generates a procedure. A new training requirement generates a competence record. A new monitoring activity generates measurement records. These downstream documents are part of the evidence that the planned action has been implemented.
Exemplar Global Certified Training ProviderRTP No. 310970Practical Tips for Getting Clause 6.1.4 Right
If you are responsible for maintaining an ISO 45001 system, here are some practical steps that make Clause 6.1.4 work in practice rather than just on paper.
First, make your action register a living document. Review it at every management meeting, every toolbox talk where relevant, and every internal audit. Actions that are overdue need to be escalated, not just rolled forward with a new due date.
Second, assign real owners. An action owned by a team or a department is an action owned by nobody. Each planned action should have a named individual who is accountable for its completion and who understands that accountability.
Third, plan your effectiveness evaluation at the same time you plan the action. Do not leave this until after implementation. Decide in advance what evidence will tell you the action is working, and make sure that evidence will be generated by your monitoring and measurement processes.
Fourth, check your controls against the hierarchy. Before finalising any planned action, ask whether higher order controls have been considered. If they have been ruled out, document why. This protects you in an audit and demonstrates genuine risk management rather than administrative compliance.
Finally, make sure your workers know about the controls that apply to their work. The best planned action in the world is ineffective if the people it is designed to protect do not know it exists or do not understand why it matters. Worker awareness and consultation, required under Clause 5.4, is not separate from Clause 6.1.4. It is part of how planned actions become real controls.
For those looking to build a more robust understanding of how Clause 6 fits together as a whole, the article on Clause 6 of ISO 45001 common nonconformities covers the planning section in its entirety and identifies where organisations most often fall short across all of Clause 6. You might also find it useful to read about how to audit Clause 6.1.1 to see how the upstream planning process is assessed, since the quality of your Clause 6.1.4 planning depends entirely on the quality of what comes before it.
Building Your Skills in ISO 45001 Auditing
Understanding Clause 6.1.4 in theory is one thing. Auditing it in practice, whether as an internal auditor or as part of a certification audit team, requires a different kind of skill. You need to know how to trace evidence across clauses, how to ask questions that reveal whether integration is genuine or superficial, and how to grade findings appropriately when gaps exist.
At Audit Workshop, the ISO 45001 internal auditor and lead auditor courses are built around exactly this kind of practical, clause level understanding. The training covers not just what each clause requires but how to audit it, what evidence to look for, and how to write findings that drive real improvement. If you are working toward your first ISO 45001 auditor credential or looking to sharpen your existing skills, the courses at Audit Workshop are worth a look.
