[ISO 45001 Series] Planning: Procurement Controls

Introduction

Following the context of the previous article, “[ISO 45001 Series] Planning: Management of Change,” the next topic is procurement controls—another set of controls for non-routine risks.

“Change” concerns changes that may occur within an organization, such as changes to processes or personnel. “Procurement,” by contrast, addresses the process of introducing resources from outside when the organization itself has not changed. Although procurement may also cause changes within the organization, it generally has little effect on the organization’s underlying structure, so separate control measures and planning are needed.

Procurement controls in ISO 45001

When an organization procures products or services, hazards may be introduced from external sources during the procurement process and create occupational safety and health risks. ISO 45001 therefore requires the organization to establish, implement, and maintain processes for controlling procurement.

For products, hazardous materials, and other items that may create hazards, the organization must evaluate them before they enter the workplace, eliminate their hazards where possible, and reduce the related occupational safety and health risks so that they conform to the organization’s OH&S management system. For procured equipment and materials, the organization must also ensure that they have been delivered in accordance with specifications, have completed the required testing, and are accompanied by the necessary protective measures.

Wait—is that all?

That’s right. It really is that short XD.

Recommended practical approach

When an organization procures products or services, hazards may be introduced from external sources during the procurement process and create occupational safety and health risks. For that reason, Article 5, paragraph 2 of the Occupational Safety and Health Act, Article 31, subparagraph 6 of the Enforcement Rules as they stood when this article was published, and ISO 45001 all required organizations to establish, implement, and maintain controls for “procurement.”

However, the former Enforcement Rules did not specify how a procurement-control process should be established. ISO 45001 likewise states only that risks associated with hazardous materials or substances, raw materials, equipment, and services must be reduced before they are introduced into the workplace and that procurement must conform to the OH&S management system; it does not provide a detailed recommended procedure.

The 2022 legal basis and the rules in force after the 2026 amendments

Legal context when this article was published in 2022: The original article relied on Article 5, paragraph 2 of the Occupational Safety and Health Act, former Article 31, subparagraph 6 of the Enforcement Rules of the Occupational Safety and Health Act, and ISO 45001 to explain why procurement management should be incorporated into an organization’s OH&S management processes. At the time, Article 31 of the Enforcement Rules listed “procurement management, contracting management, and management of change” among the matters to be included in an occupational safety and health management plan.

The 2026 amendments: Following the Occupational Safety and Health Act amended and promulgated on December 19, 2025 and brought into force on July 1, 2026, the related subordinate legislation was revised. Article 31 of the Enforcement Rules of the Occupational Safety and Health Act was deleted. The management-plan matters formerly listed there were moved to Article 12-1 of the Regulations of Occupational Safety and Health Management, amended on June 29, 2026 and effective on July 1, 2026. Article 12-1, paragraph 4, subparagraph 5 currently continues to list “procurement management, contracting management, and management of change.”_[7][8][9]

Rules currently in force after the amendments: In addition to the requirement for general business entities to conduct risk assessments and establish management plans under Article 12-1, entities falling within Article 12-2 are more directly required by current Article 12-4 to establish procurement-management procedures. When machinery, equipment, tools, materials, raw materials, personal protective equipment, or similar items are purchased or leased, the contract must contain concrete occupational safety and health specifications that comply with legislation and actual operational needs, and compliance must be confirmed before acceptance or use. When planning or design for construction work is commissioned, risk-assessment and construction-management requirements must also be incorporated into the conditions of performance._[7]

How to apply this article: The discussion below preserves the original 2022 wording so readers can understand the institutional context at the time. When establishing or auditing procurement controls in practice, however, the legal basis should be the current Articles 12-1 and 12-4 of the Regulations of Occupational Safety and Health Management. The current text of Article 5, paragraph 2 of the Occupational Safety and Health Act primarily requires designers, manufacturers, or importers of machinery, equipment, tools, raw materials, materials, and similar items—as well as persons who design or construct projects—to conduct risk assessments at the source. The employer’s general duty of prevention appears in paragraph 1 of the same article._[9] Current legislation uses the term “safety data sheet”; the term “material safety data sheet” retained below is the older wording used in the original article.

Because ISO 45001 and Taiwan’s Occupational Safety and Health Management System (TOSHMS) guidance are similar, and because the Ministry of Labor issued the Procurement Management Technical Guideline in 2015 alongside the TOSHMS guidance,_[1] setting out basic procurement-control principles and recommended practices, this article primarily combines that guideline with ISO 45001 and the related systems discussed earlier to establish a practical procurement-control process.

Meaning of “procurement”

The term “procurement” in the Procurement Management Technical Guideline refers to the definition in Article 2 of Taiwan’s Government Procurement Act: “the contracting of construction work, the purchase or custom-made manufacture of property, the lease of property, and the retention or employment of services.” The guideline accordingly classifies procurement as “construction procurement,” “property procurement,” or “service procurement.”

It should be noted that procurement controls are not limited to procurements governed by the Government Procurement Act. Ordinary procurement activities also need procurement controls. The technical guideline uses the Government Procurement Act only to explain the relevant meaning and categories of “procurement.”

“Construction procurement” means the construction, extension, reconstruction, repair, or demolition of structures above or below ground and their associated equipment, as well as alteration of the natural environment. It includes construction, civil engineering, water resources, environmental, transportation, mechanical, electrical, chemical, and other projects recognized by the competent authority.

“Property procurement” means the procurement of goods (other than fresh agricultural and fishery products), materials, equipment, machinery, other movable property, immovable property, rights, and other property recognized by the competent authority.

“Service procurement” means the procurement of professional services, technical services, information services, research and development, operations management, maintenance, training, labor, and other services recognized by the competent authority.

Because the Government Procurement Act describes construction procurement as “the contracting of construction work,” prevailing academic_[2] and judicial views_[3] generally characterize the resulting construction contract as a contract for work under Article 490 of the Civil Code. Some scholars,_[4] however, argue that treating every construction contract as a contract for work overlooks the common practice in which the contractor also supplies materials; on that view, a construction contract should be characterized as a mixed contract combining work and sale.

The principal purpose of property procurement is the payment of a price and transfer of a property right._[5] The resulting contract is therefore generally a contract of sale under Article 345, paragraph 1 of the Civil Code. The guideline’s procurement controls also cover leases of property, not only purchases.

Depending on its nature, a contract resulting from service procurement may be a contract of employment, mandate, or work.

Application of procurement controls versus contractor and outsourcing controls

There is little doubt that contracts of sale and lease resulting from property procurement fall within the Procurement Management Technical Guideline. But when external labor is introduced to assist the organization’s work, should the activity be governed by contractor controls or procurement controls?

The Ministry of Labor distinguishes the two through the Contracting Management Technical Guideline_[6] and the Procurement Management Technical Guideline.

If an organization merely assigns part of its work to another party while retaining the authority to direct, supervise, coordinate, and plan the work, the arrangement is not “contracting” for purposes of the Occupational Safety and Health Act. It should therefore be controlled through the procurement controls discussed in this article.

If, however, an organization transfers all or part of its undertaking, does not retain overall planning authority, and the receiving party operates independently and autonomously, the arrangement falls within contractor controls.

It follows that the classification cannot be determined solely by asking whether the subsequent contract is called a “contract for work” under the Civil Code. The author recommends considering the organization’s actual degree of control and planning over the work performed by another party when deciding whether procurement controls or contractor controls should apply.

Where the organization retains a meaningful degree of control and planning over all or part of the work, procurement controls are more likely to apply. Where the organization has no authority to plan how that part of the work is performed and another party principally controls it, contractor controls are more likely to apply.

Procurement-control procedures and system

The approach adopted by the Procurement Management Technical Guideline is to plan OH&S management-system measures at every step of the organization’s existing procurement process, thereby reducing OH&S risks and improving OH&S performance. The discussion below therefore follows a general procurement process and explains the OH&S controls that should be planned at each step.

A typical organizational procurement process begins when a requesting unit specifies the required construction work, property, or service. The procurement unit then carries out requisition, inquiry, quotation comparison, negotiation, ordering, delivery and acceptance, reimbursement, and related procedures.

The three stages most directly related to OH&S risks and requiring consideration of OH&S matters are “requisition,” “supplier selection before negotiation or tender preparation,” and “delivery and acceptance.” Because these steps are handled by procurement personnel, the technical guideline requires the relevant personnel to receive necessary occupational safety and health education and training.

Based on the Procurement Management Technical Guideline, the author organized the related OH&S controls around a general procurement process as shown below. Each part of the process is explained afterward.

Starting the procurement process

A designated unit within the organization ordinarily identifies and submits what it needs to procure. This article calls that unit the “requesting unit.”

Before construction work, property, or services are requisitioned, the technical guideline requires the organization to identify applicable occupational safety and health legislation. For example, if a requesting unit intends to purchase “hazardous chemicals” defined by the central competent authority or a “new chemical substance” not included in the chemical-substance inventory announced by the central competent authority, Articles 11 and 13 of the Occupational Safety and Health Act may apply, and the potential safety and health hazards and risks must be considered.

The author therefore recommends that, when submitting a requisition, the requesting unit describe the construction work, property, or service and how it will be used after entering the organization in detail. The organization’s occupational safety and health unit should review the request first to determine which statutory OH&S requirements apply.

Although the proposed construction work, property, or service has not yet entered the organization and cannot undergo actual hazard identification, the occupational safety and health unit can provide comments based on the requesting unit’s description of subsequent steps and intended use. For example, when a mobile ladder is requested, the unit should consider the applicable OH&S legislation and verify whether the ladder to be procured meets the legal standards.

After the occupational safety and health unit completes its review, the requesting unit should consolidate the review comments and forward the requisition to the procurement unit for the remaining procurement procedures.

Processing by the procurement unit

After receiving the requisition, the procurement unit should incorporate the necessary safety and health specifications into the procurement requirements or contract, based on the occupational safety and health unit’s review comments and the legislation it identified.

For construction, property, and service procurement, the Ministry of Labor’s Procurement Management Technical Guideline gives examples of corresponding occupational safety and health specifications that an organization may require. These may be included as conditions of performance to be fulfilled by the supplier. The examples are organized in the following figure for reference.

To avoid differences in how personnel understand the safety and health specifications required for the same construction work, property, or service, the procurement unit should establish clear safety and health specifications and requirements as the basis for the subsequent requisition, procurement, and acceptance processes.

After confirming the construction work, property, or service to be procured, the procurement unit may actively seek quotations and information from suppliers that meet the requirements—such as the material safety data sheet referred to in Article 10, paragraph 2 of the Occupational Safety and Health Act, specifications, and plans—or may wait for suppliers to submit bids through a tendering process.

The procurement unit should evaluate the information, specifications, or plans submitted by suppliers. Where necessary, it may invite representatives of the requesting unit and relevant specialists to participate in the evaluation.

To ensure the quality of supplied property or avoid supply shortages caused by major supplier incidents, the technical guideline recommends that supplier evaluations may require certification to an international quality-management system, establishment of an OH&S management system, or inclusion of the supplier’s OH&S condition in the evaluation criteria. Relevant factors include compliance with the requisition or contract’s safety and health requirements, the supplier’s OH&S performance, and its OH&S management capability. For suppliers providing continuing supplies, the organization may also audit their safety and health performance during the supply period.

For suppliers that pass the evaluation, the author recommends maintaining an approved-supplier list so they may be approached first for quotations in later procurements. Once a supplier is selected, the procurement unit may proceed with quotation comparison, negotiation, and other purchasing steps. Because those steps are less directly related to the OH&S management system, they are not discussed further here.

Acceptance and testing after procurement

For procured construction work, property, or services, personnel from the requesting unit, procurement unit, materials-management unit, or another responsible unit may conduct acceptance against the criteria established in the procurement requirements or contract and perform functional testing. Acceptance from the supplier is completed after the results are confirmed to be satisfactory.

ISO 45001 additionally requires organizations to ensure that procured equipment and materials have been delivered and tested in accordance with specifications and to confirm, before use, that applicable occupational safety and health legislation has been satisfied.

The author therefore recommends that, before the procured construction work, property, or service is used or formally commissioned, the organization conduct hazard identification and risk assessment—together with a safety inspection—for the scope of its use or impact, corresponding to the work-environment inventory established by job title or work content. The inspection should verify that applicable safety standards and risk controls have been met. Any deficiency must be corrected and verified before the requesting unit is permitted to use the procurement. If a new chemical substance or item of machinery or equipment also falls within management of change, this pre-use or pre-start-up inspection may be combined with the management-of-change pre-start-up safety review to simplify the process.

Retention of documented information for procurement controls

Because procurement and control records provide information showing how the organization planned, implemented, controlled, and maintained processes to meet its OH&S management-system requirements, the author considers them documented information that should be retained under ISO 45001.

ISO 45001 does not prescribe the detailed extent of those records. Drawing on the Procurement Management Technical Guideline, the author considers that OH&S-related procurement records should demonstrate: 1. appropriate application, review, and approval; 2. requisitions or contracts containing safety and health requirements; 3. the results of communications or coordination with suppliers; 4. the results of safety and health management and supervision while suppliers install or perform construction; 5. acceptance results and the results of tests or inspections performed during acceptance; 6. pre-use safety inspection results for machinery and equipment, together with the results of corrective measures taken in response; and 7. supplier safety and health evaluation results.

Only when procurement records demonstrate this information can they provide the confidence required by ISO 45001 that the process has been carried out as planned.

Conclusion

No organization can be entirely self-sufficient. In other words, almost every organization conducts procurement to some degree.

Procurement enables specialization and improves efficiency, but for an organization’s OH&S management system it also unquestionably creates a path for potential external risk. In the planning of controls, ISO 45001 therefore requires the OH&S management system to establish a corresponding process for controlling the risks that procurement may create.

ISO 45001 does not provide highly detailed procurement controls; at most it identifies matters that require attention. This article therefore uses the TOSHMS Procurement Management Technical Guideline together with ISO 45001 to fill in how this part of the system can operate in practice.

For controls addressing non-routine risks, the next article will introduce the planning and key considerations for contractor and outsourcing controls. See you in the next article : D.

References

[1] Occupational Safety and Health Administration, Ministry of Labor, Procurement Management Technical Guideline, 2015.

[2] Lin, Cheng-er, New Systematic Explanations of Specific Obligations, Volume II, 2nd ed., May 2015, pp. 85–91.

[3] Supreme Court Civil Judgment No. 96-Tai-Shang-153 and Supreme Court Civil Judgment No. 107-Tai-Shang-1840.

[4] Wang, Wen-yu, “Contract Classification, Gap Filling, and Default Rules: A Judgment Terminating a Construction Contract as an Example,” National Taiwan University Law Journal, Vol. 38, No. 2, 2009, pp. 131–186.

[5] Lin, Cheng-er, New Systematic Explanations of Specific Obligations, Volume I, 2nd ed., May 2015, pp. 75–82.

[6] Occupational Safety and Health Administration, Ministry of Labor, Contracting Management Technical Guideline, 2015.

[7] Ministry of Labor, Regulations of Occupational Safety and Health Management, amended June 29, 2026 and effective July 1, 2026.

[8] Ministry of Labor, Enforcement Rules of the Occupational Safety and Health Act, current Article 31 deleted.

[9] Ministry of Labor, Occupational Safety and Health Act, amended December 19, 2025 and effective July 1, 2026.