[ISO 45001 Series] Planning: Overview of Controls and Planning Risk Controls

Update (September 2026): This article discusses the 2015 version of Taiwan’s Risk Assessment Technical Guidelines. On September 21, 2026, the Occupational Safety and Health Administration published the renamed Risk Assessment Guidelines. For practical application, check the current guidance and applicable law.

Introduction

After identifying hazards, investigating legal and other requirements, and assessing risks and opportunities to understand how hazards may arise, the next—and most important—step is to plan controls for the risks identified through the assessment.

Without controls, the process stops at finding problems and understanding their context; it does not actually solve them.

Because every organization has a limited budget, it cannot address every risk at once or reduce every risk to zero—which is impossible in any case. Choices therefore have to be made. In “[ISO 45001 Series] Planning: Assessing Risks and Opportunities,” I combine the method in Taiwan’s Risk Assessment Technical Guidelines with risk assessment to rank occupational health and safety risks in the work environment, allowing the organization to prioritize its controls accordingly.

Planning controls can be as extensive as the “institutional structure” discussed in my earlier articles, and may be considerably more extensive. I will therefore begin with a brief overview of how the different types of controls relate to one another, then focus on controls for routine risks.

The Structure of ISO 45001 Clause 8, “Operation”

An organization must establish and implement the operational planning and control processes needed to improve occupational health and safety by eliminating hazards or, where elimination is not practicable, reducing OH&S risks in its operational areas and activities to the lowest reasonably practicable level. This is an ISO 45001 requirement and, in fact, the principal objective of the occupational health and safety management system as a whole.

Under the process described in the “Planning” clause of ISO 45001, after identifying hazards, risks, and opportunities, the organization must plan controls for those hazards, risks, and opportunities while considering factors such as the context of the organization, and must then implement the planned controls.

The Planning clause does not explain in detail how measures addressing hazards, risks, and opportunities should be planned or how the planned measures should be carried out. Those matters are addressed together in the “Operation” clause. That clause covers both the planning of controls and the implementation of those controls; in other words, it includes both “Plan” and “Do” in the PDCA cycle.

The requirements in ISO 45001 show that the control framework includes controls for routine risks, management of change, procurement controls, outsourcing and contractor controls, and emergency preparedness and response.

An Overview of the Types of Controls Proposed in This Article and Their Relationships

Although ISO 45001 places the planning of controls in the “Operation” clause, part of its substance is plainly planning work.

A comparison of the Taiwan Occupational Safety and Health Management System (TOSHMS) and ISO 45001 shows little difference in their approaches to planning controls: both address risk controls, emergency preparedness and response, procurement, and contractor and outsourcing arrangements. Many operational details and practical procedures can therefore draw on the guidance originally issued by Taiwan’s Ministry of Labor for TOSHMS.

I want to emphasize this once again: what we learned under an earlier system can be adapted to the times. A new system does not necessarily require us to discard everything that came before it.

These controls are not unrelated to one another. I have summarized the relationships among them in the following figure.

The detailed requirements for each type of control will be discussed in later articles.

ISO 45001 Requirements for Risk Controls

For hazards and risks identified through assessment, ISO 45001 provides a systematic hierarchy of controls that organizations can use when determining which controls to apply. In descending order of effectiveness, the hierarchy is:

1. Eliminate the hazard: remove the potential hazard entirely—for example, discontinue the use of a hazardous chemical, apply ergonomic principles when designing a new workplace, or eliminate monotonous work.

2. Substitute less hazardous processes, operations, materials, or equipment—for example, use an online guide to address customer complaints or adopt more advanced technology.

3. Use engineering controls, reorganize work, or do both—for example, isolate people from the hazard, install protective measures such as ventilation systems, automate operations, or reduce noise.

4. Use administrative controls—for example, conduct periodic safety-equipment inspections, train relevant personnel, establish health or medical surveillance programs for workers identified as being at risk, and provide incident-reporting channels while protecting reporters from retaliation.

5. Provide and ensure the use of adequate personal protective equipment, including instructions on the use and maintenance of protective clothing and equipment—for example, safety footwear, safety glasses, hearing protection, and gloves.

For any hazard or risk, eliminating the hazard is the most effective approach. Not every hazard can be eliminated, however. Where elimination is not possible, the organization must next consider substitution, isolation, or other controls. Compared with eliminating the hazard, these lower-level measures are less effective at reducing workers’ occupational health and safety risks.

ISO 45001 requires the organization to work progressively through the hierarchy and determine whether each level can control the hazard or risk and reduce OH&S risk to the lowest reasonably practicable level. If one level is not feasible or sufficient, the organization moves to the next level or combines multiple controls to reduce the risk.

After selecting controls through the hierarchy, the organization must establish operational planning and control processes for them. Examples of such processes in ISO 45001 include: 1. using work procedures or systems; 2. ensuring worker competence; 3. establishing preventive or predictive maintenance and inspection programs; 4. specifying requirements for the procurement of products and services; 5. reviewing applicable legislation, other requirements, or operating guidance; 6. applying engineering or administrative controls; and 7. adapting work to workers.

A Practical Method for Planning Risk Controls

Begin with the registers of workers and work environments established for different job titles or work activities, conduct the corresponding hazard identification, and then use the preliminary findings to carry out What-If Analysis and risk assessment. This produces the risk level of each hazard associated with a job title or work activity, the causal chain from the hazard source to the hazard, and suggested improvement methods.

In the example provided in the Ministry of Labor’s Risk Assessment Technical Guidelines, hazards can be divided into “acceptable risk” and “unacceptable risk.” Risk levels 2 and 1—“low risk” and “minor risk”—are treated as acceptable, while levels 5, 4, and 3—“critical risk,” “high risk,” and “medium risk”—are treated as unacceptable. A fuller explanation appears in “[ISO 45001 Series] Planning: Assessing Risks and Opportunities.”

Based on the classification used in the practical literature_[1] and the results of the What-If Analysis, unacceptable risks can be further divided into “correctable risks” and “uncorrectable risks.”

Where a risk is assessed as “unacceptable but correctable,” risk controls must be applied to reduce it. Both ISO 45001 and the Risk Assessment Technical Guidelines provide a systematic hierarchy to help the organization determine which controls to use. I have arranged the hierarchy according to control effectiveness in the following figure.

The following table combines recommendations from ISO 45001 and the Risk Assessment Technical Guidelines to show methods available at each level of the hierarchy.

The organization must use the improvement methods identified through the What-If Analysis and screen them according to the effectiveness of the controls described above.

For priority improvements, ISO 45001 requires the organization to begin with the most effective option—eliminating the hazard. If elimination is not possible, the organization must move to the next most effective option, substitution. If substitution alone still does not reduce the risk to an acceptable level, it must be combined with other controls, such as engineering controls and personal protective equipment.

After selecting the appropriate level of control, the organization uses the recommendations from the What-If Analysis to establish operational planning and control processes consistent with that level. ISO 45001 requires workers to participate in this planning.

For controls adopted to reduce risk, the Risk Assessment Technical Guidelines require the organization to estimate the residual risk after implementation. This confirms whether the operational planning and control process can achieve its objective. If it cannot, the organization must consider additional controls until the residual risk is reduced to an acceptable level.

In my view, the organization can assess the likely outcome of an operational planning and control process by estimating its severity and likelihood and applying the same risk-assessment method. If the method does not reduce the residual risk to an acceptable level, another control should be selected and the process repeated until the residual risk reaches an acceptable level. Only then is the planning of controls complete.

Where the same control can be implemented through different operational planning and control processes, the organization may choose a particular process in light of its finances, resources, and level of knowledge.

Where a risk is assessed as “unacceptable and uncorrectable,” the practical literature_[2] concludes that the relevant work should be stopped rather than allowed to continue. I agree.

Where a hazard is assessed as presenting an “acceptable” risk, I believe that even if no risk-improvement measure is required, the organization should still review legal compliance periodically and confirm the continuing effectiveness of existing safeguards.

Planning controls for different types of risk can address both OH&S risks and OH&S opportunities. ISO 45001 therefore requires the organization to retain documented information.

I incorporated the risk assessment, control planning, and residual-risk evaluation described above into the “Reference Template for Hazard Risks and Opportunities Assessment, Control Planning, and Residual-Risk Evaluation” in “[ISO 45001 Series] Planning: Assessing Risks and Opportunities.”

The hazard number in that template corresponds to the number in the hazard-identification checklist in “[ISO 45001 Series] Planning: Overview and Hazard Identification.” The work-activity or job-title number corresponds to the number assigned in the inventory of specific job titles and work activities prepared during the “worker and work-environment review” in “[ISO 45001 Series] Identifying Internal Issues in the Context of the Organization.” By integrating these forms, the organization can build one continuous process from reviewing organizational working conditions through hazard identification, investigation of legal requirements, understanding how hazards arise, and finally establishing controls.

Conclusion

This is arguably one of the most important procedures in an occupational health and safety management system—but, as I always say, there is hardly any procedure in a safety and health management system that is not important. XDD

In the first half of this article, I used ISO 45001 and guidance for Taiwan’s TOSHMS to explain the relationships among the different types of controls.

I then focused on “risk controls” for routine risks. The ISO 45001 requirements for risk controls are essentially consistent with the relevant Taiwanese guidance. In turning the requirements into a practical method, I therefore rely directly on that guidance and adjust it to align with ISO 45001.

This tells us something important: however standards may change, many of the concepts and principles behind them remain the same.

The next article will continue this thread by introducing the next type of control in ISO 45001—management of change. As always, I’ll see you in the next article. : D

References

[1] Institute of Labor, Occupational Safety and Health, Ministry of Labor, Study on Employers’ General Duties under the Occupational Safety and Health Act, 2015, p. 57.

[2] Ibid., p. 55.