Skip to main content
    QHSEtech
    Updated
    All glossary terms
    Content date: · No individual check logged· AI use

    Safety Management System

    Also known as: OHS management system, OSH management system, Health and safety management system, HSMS

    Definition

    The interrelated elements an organisation uses to set a safety and health policy and objectives and to achieve them: policy, organising, planning, evaluation and improvement.

    Editorial definition: The QHSE Standard, updated 3 October 2026 · https://qhsetech.com/glossary/safety-management-system

    Scope: A system is not a policy, a plan or a certificate. ISO 45001 is a certifiable standard, OSHA 3885 and the ILO guidelines are voluntary, and US offshore SEMS is regulation.

    Example for your evaluation: Follow one audit finding to a corrective action, a management review decision and a changed policy or plan.

    Sources checked: . Examples are editorial illustrations.

    What the ILO, OSHA, HSE, ISO and the US offshore rules say a safety management system is

    The ILO's guidelines on occupational safety and health management systems, ILO-OSH 2001, define an OSH management system as a set of interrelated or interacting elements to establish an OSH policy and objectives and to achieve them. The guidelines say the system should contain the main elements of policy, organizing, planning and implementation, evaluation and action for improvement, with worker participation set within the policy element. They state that the employer is accountable for and has a duty to organise occupational safety and health, and that a system is one useful way to meet it. They are voluntary, not legally binding and not meant to replace national laws, and applying them does not require certification. They also say the system should be compatible with, or integrated into, the organisation's other management systems.

    OSHA's Recommended Practices for Safety and Health Programs (OSHA 3885, October 2016) say in their disclaimer that they are recommendations only: employers are not required to have a programme that complies with them and will not be cited for lacking one. They set out seven core elements: management leadership, worker participation, hazard identification and assessment, hazard prevention and control, education and training, program evaluation and improvement, and communication and coordination for host employers, contractors and staffing agencies. OSHA says the elements are interrelated and best viewed as an integrated system, and that a programme can start basic and grow. HSE's Managing for health and safety (HSG65, third edition, 2013) uses Plan, Do, Check, Act: plan covers policy and planning, do covers risk profiling, organising and implementing, check covers measuring performance and investigating, and act covers review and learning. HSE says its guidance is not compulsory, and that using a formal management system is the employer's decision.

    Law and standards differ again. In Great Britain regulation 5 of the Management of Health and Safety at Work Regulations 1999 requires every employer to make and give effect to arrangements, appropriate to the nature of its activities and the size of its undertaking, for the effective planning, organisation, control, monitoring and review of preventive and protective measures. An employer with five or more employees must record them. The regulation names no system and no certificate. ISO describes ISO 45001 as an international standard that specifies requirements for an occupational health and safety management system, built on Plan, Do, Check, Act, and says organisations may be certified by third-party bodies or may implement it without certification. ISO lists the 2018 edition as published, with a revision planned as ISO 45001:2027. In US offshore oil and gas the system is a regulation: 30 CFR part 250 subpart S requires operators to develop, implement and maintain a safety and environmental management system (SEMS) program with 17 listed elements, documented and available to BSEE on request. This page is general information, not legal advice.

    Sources opened :

    What a safety management system record set holds in software

    • The policy, dated and signed by the employer or the most senior accountable person, with its review history and the roles and responsibilities allocated under it.
    • The initial review that serves as the baseline: hazards and risks assessed, and the legal and other requirements identified.
    • Objectives with measures, and for each a plan with an owner, a date, resources and a performance criterion.
    • Training and competence records, and records of worker consultation and participation.
    • Monitoring results, active (inspections, completed actions) and reactive (injuries, incidents), with investigations.
    • Audit reports, management review minutes, and corrective actions with an owner, a due date and a check that the action worked.

    Safety management system, policy, plan, programme and standard

    A policy is one document inside the system. HSE says it sets the direction and says who does what, must be written down for an employer with five or more employees, and should be signed by a person at the top. A plan says how an objective will be met: the ILO guidelines ask for responsibility, performance criteria and resources for each objective. The system includes both, plus checking and improvement. OSHA says programme for what the ILO calls a system. Safety management plan has no definition in the sources opened; where law names a plan, as regulation 12 of the CDM Regulations 2015 does for a construction phase plan, it is a project document, not the system. The ILO, OSHA and HSE sources cover occupational safety and health, so an EHS policy that adds environmental commitments goes beyond them. ISO 45001 is a certifiable standard, OSHA 3885 and the ILO guidelines are voluntary, and the offshore SEMS is regulation.

    A hypothetical example: one site, one policy, one plan, one system

    Everything in this case is invented and describes no real company. A packing firm with 60 staff on one site writes a one-page policy with its workers' representatives, and the managing director signs and dates it. It sets three objectives: a quarterly inspection of every area, a hazard report answered within five working days, and refresher training for forklift drivers. Each objective has a plan naming an owner, a date and the time set aside. The policy is the direction and these are the plans, yet neither is a system.

    The system appears when the parts connect. Inspection findings and worker reports go to a register. Incidents are investigated with a worker representative, and the results go to the next management review with the audit report. In the second quarter the firm has completed 3 of the 4 planned inspection rounds, which is active monitoring, and logs 2 injuries, which is reactive. The review notes the missed round, moves a supervisor's time to cover it, and records the change in the plan.

    Common misunderstandings about safety management systems

    • A manual is not a system. HSG65 warns that too much attention to formal documentation distracts from controlling risks, and that success hinges on the attitudes and behaviours of people.
    • A system is not the law. The ILO guidelines are not legally binding and not intended to replace national laws, so the legal requirements still have to be identified.
    • Certification is not required by every source. ISO says it is optional, the ILO guidelines say applying them needs no certification, and OSHA 3885 describes no certificate.
    • OSHA 3885 is not a rule. Its disclaimer says the practices are recommendations only and that employers will not be cited for failing to have a programme that complies with them.
    • A policy is not the system. The policy sets direction, and the system is the interrelated elements that carry it out, check it and improve it.

    How a safety management system relates to other glossary terms

    The system is the frame that holds risk assessment, controls, monitoring and review, so its nearest terms are the standard, the field and the parts.

    • ISO 45001: the certifiable international standard for an occupational health and safety management system.
    • OHS: the field of work that the system is meant to organise.
    • Risk assessment: the step inside the system that judges risk and feeds the choice of controls.
    • Management review: the periodic evaluation of whether the system is suitable and effective.
    • IMS: a system that integrates safety with other management systems, as the ILO guidelines allow.

    Records and evidence that usually exist for a safety management system

    • The written policy with its date, signatory and review record.
    • The allocation of responsibility, accountability and authority.
    • The initial review and the risk assessments that followed.
    • Objectives, plans and the records of progress against them.
    • Training, competence and worker consultation records.
    • Monitoring, investigation, audit and management review records.
    • Corrective actions with owners, due dates and closure evidence.

    What a software tool needs to capture for a safety management system

    • Versioned documents, with the approver, the date and the next review date on each.
    • Objectives linked to plans, owners, dates and the evidence that each was met.
    • A way to show which element of the chosen framework each record supports, without claiming the system conforms.
    • Active and reactive indicators held apart, so injury counts are not the only measure.
    • Audit findings and management review decisions turned into tracked actions.
    • A log of worker consultation and a route for workers to raise concerns.
    • Export of the records for a certification body, an auditor or an inspector.

    Catalog profiles documenting EHS management records

    The list comes from the rule used by the EHS software guide. It does not show that a product holds a management system as a whole, or that it follows ISO 45001 or any other framework, so ask for a worked audit-to-action example in a demonstration.

    Same rule for every product: tagged “EHS Management” or “Safety Management” or assigned primary category “EHS Management” or “Safety Management”, with a sourced incident management capability in its record, or one the vendor stated to us, labelled as vendor-stated. Documented and conditional capabilities qualify; check the linked scope before treating a module as included.

    Tekmon pays for a sponsored placement (above); its place in this list follows the same rule as every entry. How lists are ordered

    All 57 matching profiles are shown. Documentation review, not hands-on testing or a claim of compliance.

    Related software

    Frequently asked questions

    Is a safety management system a legal requirement?

    It depends on the country and the sector. In Great Britain regulation 5 of the Management of Health and Safety at Work Regulations 1999 requires arrangements for planning, organisation, control, monitoring and review, and names no system or certificate. OSHA 3885 is recommendations only, while US offshore operators must keep a SEMS under 30 CFR part 250 subpart S. Check the law that applies.

    Is a safety management system the same as ISO 45001?

    No. ISO 45001 is one standard that specifies requirements for an occupational health and safety management system, and third-party certification to it is optional. The ILO guidelines, OSHA 3885 and HSE's HSG65 describe systems of the same kind without any certificate.

    How do a policy, a plan and a system differ?

    A policy states the direction and who does what, and is signed at the top of the organisation. A plan sets out how an objective will be met, with responsibilities, performance criteria and resources. The system is the set of linked elements that holds both, together with checking and improvement.

    More safety terms

    Related guides