EHS Policy vs Safety Management Plan: What Goes in Each

This guide separates the EHS policy from the safety management plan, using regulator, ILO and CCOHS pages read on 17 October 2026.

The short answer

A policy is a short written statement of commitment, signed or endorsed by the most senior person. A plan says what is to be done, by whom and by when. ILO-OSH 2001 puts the plan in those words: a plan for each objective, "what is to be done by whom and when". Procedures say how a task is carried out, and records show that it was. No page we read gives one definition of "safety management plan", so check what your regulator, client or contract means by it. Duties differ by country, and this article is general information, not legal advice.

Policy, plan, procedure, record

Policy. OSHA suggests a written policy signed by top management, describing the commitment to safety and health and pledging a programme for all workers. ILO-OSH 2001 (3.1) asks for one that is concise, dated, communicated and reviewed, made effective by the signature or endorsement of the employer or most senior accountable person. CCOHS quotes a definition of a policy as the "intentions and direction of an organization" as expressed by top management.

Procedure and record. CCOHS says procedures, a specified way to carry out an activity, put the policy into practice.

Where "safety management plan" comes from

The pages we read use the idea in four ways.

• A programme. CCOHS calls a health and safety programme a "definite plan of action" to prevent incidents and occupational disease, and says it should be available in a single written document.
• A planning step. ILO-OSH 2001 (3.8) asks for planning arrangements: objectives defined and prioritised, a plan for each with responsibility and performance criteria, measurement criteria and resources. HSE's HSG65 (2013 edition) explains a plan-do-check-act approach, and HSE's introduction says the outcome of each review feeds the next plan.
• A hazard control plan. OSHA 3885 (October 2016) uses that name for the list of controls with owners and dates.
• A named plan that the law or a contract requires. HSE says a construction phase plan must be prepared before the construction phase begins, by the principal contractor (or, on single-contractor projects, the contractor), covering the health and safety arrangements, site rules and measures for the risks in Schedule 3 of CDM 2015. In the US, 29 CFR 1910.38 sets what an emergency action plan must contain, and 1910.1200(e) requires a written hazard communication program at each workplace.

What goes in an EHS policy

ILO-OSH 2001 (3.1.2) lists four principles as a minimum: protecting people by preventing injury and ill health; complying with laws and other requirements the organisation subscribes to; consulting workers and encouraging their participation; and continually improving the system. CCOHS adds accountability for each level of management, training, a method for setting and reviewing objectives and targets, and funding.

HSE uses the word more widely. Its guide to writing a policy has three parts: a statement of intent (signed by the employer or most senior person, reviewed regularly), who is responsible (names, positions and roles), and the arrangements, which are the practical measures such as risk assessment and training. In our reading, much of what OSHA or the ILO would put in a plan sits in HSE's "arrangements". Check which sense your regulator or customer uses.

The sources we read cover occupational safety and health. The environmental side belongs to standards such as ISO 14001, which we did not open for this guide; see our ISO 14001 entry and implementation guide. For the terms, see EHS, EHS, HSE and QHSE compared and quality policy.

What goes in a safety management plan

• Objectives. ILO-OSH 2001 (3.9) asks for measurable objectives, consistent with the policy, realistic, documented and communicated. OSHA suggests goals that include prevention, not only injury and illness rates.
• Actions, owners and dates. One row per action, with a named person, a due date and a measure. OSHA asks for a person with the power to implement each control and a target completion date.
• Resources. OSHA lists staff time, training and equipment; ILO-OSH 2001 lists human, financial and technical resources.
• Verification. OSHA says to plan how to check that controls work, at least annually and when conditions change.
• Review. ILO-OSH 2001 (3.14) has management review assess progress towards objectives and whether the policy and objectives need to change. OSHA suggests evaluating the programme at least annually.

OSHA's crosswalk of safety programme standards lists ISO 45001:2018 clause 5.2 as the OH&S policy, 6.2.2 as planning to achieve OH&S objectives and 9.3 as management review, as separate clauses. We do not quote ISO text. See safety management system, management review and ISO 45001.

What the sources say about the duty

Check the law that applies to you.

Great Britain. Section 2(3) of the Health and Safety at Work etc. Act 1974 requires a written statement of general policy and of the organisation and arrangements for carrying it out, revised as appropriate and brought to employees' notice, "except in such cases as may be prescribed". HSE's guidance says employers with five or more employees must write the policy down. Regulation 5 of the Management of Health and Safety at Work Regulations 1999 requires arrangements for planning, organisation, control, monitoring and review, recorded by employers of five or more.

United States. OSHA 3885 says its practices are recommendations only and that employers will not be cited for lacking a programme that complies. Specific standards require specific written plans, such as those above.

Elsewhere. EU-OSHA describes Directive 89/391/EEC as making risk assessment a key element, with documentation and periodic reassessment of hazards; the page does not mention a written policy or plan. CCOHS says most Canadian jurisdictions require some form of programme. ILO-OSH 2001 is voluntary and not legally binding.

A worked example (invented)

This example is invented and describes no real company, a 120-person warehouse. The policy fits on a card:

We will protect the health and safety of everyone who works at or visits our sites by preventing injury and ill health. We will meet the law and the other requirements we sign up to, consult our workers and their representatives, and keep improving. The Managing Director signs this statement, and it is reviewed every year.

The plan below sits under it, with prevention measures rather than injury rates.

The plan has 5 rows and 4 different owners, and four of the five actions fall due within the first seven months. A barrier inspection procedure says how to check a barrier; the monthly records show that someone did.

Four common mistakes

Putting every action in the policy. ILO-OSH 2001 asks for a concise policy, and CCOHS says procedures put it into practice. HSE's wider "arrangements" section is the exception, so know which model you follow.

A policy nobody signed or has seen. OSHA asks for a signature from top management and communication to workers and, as appropriate, contractors and visitors.

Actions with no owner or date. ILO-OSH 2001 asks for defined responsibility; OSHA adds a target completion date.

Never revisiting either document, or measuring only injury rates. CCOHS says to review the policy at least annually, and OSHA says goals should include prevention rather than focus on rates.

What 212 vendor profiles record about policies, plans and documents

We checked the records of 212 QHSE, EHS and ESG software profiles through 14 October 2026. In the 212 profiles researched, a missing statement means we found none, not that the product lacks the feature. No product is named, and the methodology describes the profile set.

Counting rule: only a capability's name admits it, a statement needs a source URL, and unverified or unsupported statements are left out. Supplier, contractor and asset documents and document exports are not counted. These are a floor. The action row includes corrective-action tracking from any source. We counted no row for objectives or targets because the same words name emissions targets in sustainability tools.

In the 212 profiles researched, 61 (29%) name at least one of document control, management review, action tracking or recurring tasks; for the other 151 we found no such statement. Of the 35 that name document control, 3 (9%) also name action tracking and 4 (11%) tie a document to training; 3 name a read acknowledgement; 26 name none of action tracking, recurring tasks, a document-to-training link or management review. If you keep a policy in software, ask to see it revised, re-signed and acknowledged, with the old version kept.

None of this shows that software establishes compliance, and none of it ranks a product. Software can hold documents and route actions; the judging stays with people. See document management software, compliance management software, document control in QHSE software and the library. For inspections and audits, see our inspection and audit guide.

Disclosure. One of the 212 profiles belongs to a vendor that pays for sponsored placement on this site, and the editor works at that vendor. Its record was read by the same rules as every other and is counted in every figure above like any other profile. It is not named in this article.

FAQ

What is the difference between an EHS policy and a safety management plan?

A policy is a signed statement of commitment from top management. A plan lists actions with owners, dates, resources and measures. Procedures and records sit beneath both.

Must an EHS policy be written and signed?

HSE says employers of five or more must write it down. OSHA, ILO-OSH 2001 and CCOHS describe a policy signed or endorsed by top management. Other countries differ.

How often should they be reviewed?

CCOHS recommends reviewing a policy at least annually. OSHA suggests verifying a hazard control plan at least annually and when conditions change.

Does a safety management plan need software?

No source we read requires it. Our reading: a spreadsheet can serve one site; software helps with many sites, owners and reminders.

Sources

Read on 17 October 2026.

• OSHA: OSHA 3885 (PDF), management leadership, voluntary standards crosswalk (PDF)
• OSHA: 29 CFR 1910.38, 1910.1200
• HSE: how to manage, HSG65, prepare a policy, how to write it, planning for construction work
• legislation.gov.uk: Health and Safety at Work etc. Act 1974, s. 2, MHSWR 1999, reg. 5
• ILO: ILO-OSH 2001 (PDF)
• EU-OSHA: Framework Directive
• CCOHS: policy, programme
• The QHSE Standard: methodology and the profile evidence files behind the vendor counts