[ISO 45001 Series] Identifying Internal Issues in the Context of the Organization

Introduction

For an initial overview of the ISO 45001 occupational health and safety management system, see the preceding article, “[ISO 45001 Series] Defining External Interested Parties and External Issues.” Later articles in this series will continue to offer practical suggestions for making other ISO 45001 requirements concrete under Taiwan’s current legal framework.

This article focuses on the “internal issues” within ISO 45001’s context of the organization.

Context of the Organization and Internal Issues in ISO 45001

Before establishing and operating an OH&S management system, an organization must conduct an initial review of itself so that it can understand its current condition and identify possible directions for improvement. Under ISO 45001, the context of the organization has three main parts: understanding the organization and its context; understanding the needs and expectations of workers and other interested parties; and determining the scope of the OH&S management system. This resembles the “initial review” in national OH&S management-system guidance and the review required by ILO-OSH 2001.

ISO 45001 limits the review of organizational context to matters that are relevant to the organization’s purpose and that affect its ability to achieve the intended outcomes of the OH&S management system. Its guidance lists the following possible internal issues:

a. governance, organizational structure, roles, and accountabilities; b. policies and objectives; c. capabilities understood in terms of resources, knowledge, and competence; d. information systems, information flows, and decision-making processes; e. relationships with workers and organizational culture; f. standards and models adopted by the organization; g. the form and extent of contractual relationships; and h. working-time arrangements and working conditions.

Recommended Scope and Method for Reviewing Internal Issues

ISO 45001 divides its examination of organizational context into internal and external issues. External issues mainly concern interaction between the organization and its surrounding environment, while internal issues focus on the organization itself. Before building and operating its OH&S management system, an organization must therefore understand both its own circumstances and its position and potential influence in the broader environment.

Based on ISO 45001 and practical recommendations, I divide internal issues into four areas: the organization profile, organizational structure, workers and the work environment, and the organization’s current OH&S management. The examples and forms in this article illustrate the content that may be needed for each area.

Organization Profile

An organization profile is a general introduction to the organization itself. It should include basic organizational information together with the policies and objectives required by ISO 45001. A sample organization-profile form appears below.

Drawing on practical guidance_[1], I suggest that the basic information include at least the organization’s name, industry classification, responsible person and job title, contact details, history, capital, number of employees, land or plant area, scope of activities, and contact information for the OH&S representative.

Industry classification may affect which laws apply and whether particular exclusions are available. It should therefore be included in the profile and may be checked against Taiwan’s Standard Industrial Classification maintained by the Directorate-General of Budget, Accounting and Statistics.

Because an OH&S management system may cover the entire organization or only a defined part, the responsible-person field should identify both the organization’s overall responsible person and, where relevant, the person and title responsible for the covered part. The history field may briefly record major events from establishment to the present.

Under the ISO 45001 requirements for documented information, land, plant area, or the organization’s activity boundary may be expressed by coordinates in any coordinate system or marked on a map, and may be presented in any suitable form or medium. The following example marks the lower campus of National Chengchi University in Google Maps.

Although ISO 45001 requires top management to determine the principal OH&S policy and direction, it does not require top management to personally perform every task. Responsibilities and authority may be assigned to other levels. If OH&S or management-system work is assigned elsewhere, the profile should record the relevant contact information.

The organization’s policies and objectives should include not only policies and management principles for achieving its general purpose, but also its current OH&S policy and strategic direction.

Organizational Structure

This part addresses the ISO 45001 internal issues of organizational governance, structure, roles and accountabilities, as well as formal and informal information flows and decision-making processes.

I recommend presenting the organizational structure as a tree diagram. This makes reporting relationships visible at a glance and can also show formal and informal decision-making paths. The example below is based on the structure of a manufacturing company.

A tree diagram alone shows structure but does not fully express the “roles and accountabilities” required by ISO 45001. Because the leadership and worker-participation provisions also require worker involvement, each unit shown in the diagram should be supplemented by a table of duties. Those duties should cover the organization’s ordinary business, OH&S responsibilities and authority, and the unit’s role in the OH&S management system.

Organizations vary greatly in size, and a small organization may have only a few dozen people. Describing every role only by “unit” may therefore be unsuitable. Depending on its scale, an organization may list duties by unit, by job title, or by combining the two approaches. The following forms illustrate both options.

Reviewing Workers and the Work Environment

Apart from the matters already discussed and the current state of OH&S management, most internal issues identified by ISO 45001 concern workers and the work environment.

Worker-related issues include the form and extent of contractual relationships, working-time arrangements, and working conditions. Work-environment issues include introduced products, materials, services, tools and software, workplaces, and equipment. A complete inventory of workers and the work environment directly supports later hazard identification and risk assessment and is therefore central to OH&S risk management.

The review must not exclude management; it should cover both managerial and non-managerial workers.

When planning the review and inventory, the organization can start with the units and personnel identified in its organizational structure. This reduces the risk of omissions where ISO 45001 does not prescribe a detailed procedure.

Work allocation differs by organizational size. In a small organization, one worker often performs several kinds of work; in a larger organization, specialization may mean that several workers perform a specific activity. I therefore divide the review into a job-title-based approach and a work-activity-based approach. Small organizations may begin with job titles, while large or process-oriented organizations may use work activities or combine both approaches.

ISO 45001 does not expressly require worker participation or consultation with non-managerial workers while compiling this inventory. However, the inventory is closely connected to later hazard identification, for which worker participation is required. Because it concerns the actual environments of workers at every level, I consider worker participation and consultation appropriate at this stage as well.

Classification by Job Title

A job-title-based review uses an individual worker as the main unit of observation. For example, for an employee at a chain coffee shop, the review would record every activity performed during working hours, the environments occupied, and the equipment encountered. The inventory should include the job title, headcount, working time and frequency, contractual form, source of remuneration, competence requirements, job duties, work environment, machinery, equipment and tools used, materials encountered, and off-site work.

ISO 45001 expects internal issues to address relationships with workers and the form of contractual relationships. I therefore include the form and content of contracts and the source of remuneration as required fields. The review should not be limited to employment, independent contracting, or mandate relationships; it should cover atypical contracts as well. It should identify who contracts with the worker, for whom labor is provided, who directs and supervises the worker, and how those persons relate to the organization. This helps clarify legal relationships and responsibility if an occupational accident occurs.

Working time is a major subject of Taiwan’s Labor Standards Act and a basic indicator of possible overwork, so it should be included in the worker and work-environment inventory.

The Labor Standards Act does not expressly define every boundary between working time and rest time. Scholars have approached the issue through contractual duties, treating time during which the worker remains at the employer’s disposal as working time._[2] The Ministry of Labor’s Guidelines for Working Hours of Workers Outside the Workplace describe working time as time spent providing labor or waiting to provide labor under the employer’s direction and supervision; rest time is time in which the worker is released from that control and may use the time freely.

Other scholarship_[3][4] draws on German doctrine to distinguish four degrees of labor performance: (1) actual working time, when labor is performed at the designated workplace for the enterprise’s purposes; (2) readiness time, when no work is being performed but the worker remains attentive and prepared to work; (3) on-call time at a location designated by the employer, during which the worker must be ready to handle assigned tasks; and (4) call-back time, during which the worker need not remain at a particular place but must remain contactable.

Actual performance is generally treated as working time._[5] Call-back time is generally rest time except for time actually spent responding, because the worker’s activities are otherwise unrestricted._[3] Readiness and on-call time are more contested: the worker may not be actively controlled, yet still cannot freely dispose of the time.

Where workers and management do not dispute working and rest time, the inventory may begin with the contractual start and end times and scheduled breaks for the job title. Because arrangements vary across organizations and even among units in the same organization, I classify schedules as fixed shifts, rotating shifts, or rostered shifts and recommend reviewing the arrangement for every relevant job title.

For organizations subject to the Labor Standards Act, the review can test whether current schedules comply with the law. Normal hours are generally limited to eight hours per day and forty hours per week under Article 30(1), subject to the flexible arrangements in Article 30(2), Article 30(3), and Article 30-1. Article 35 generally requires at least thirty minutes of rest after four continuous hours of work. Under Article 32(2), normal and extended hours generally may not exceed twelve hours per day, and monthly overtime generally may not exceed forty-six hours. With union approval, or labor-management meeting approval where there is no union, the extended-hours arrangement may allow up to fifty-four hours in one month and one hundred thirty-eight hours over three months.

Reviewing working time, rest periods, and overtime helps the organization check legal compliance and identify unsuitable arrangements, unnecessary night work, understaffing, uneven workload distribution, or possible overwork.

For rotating shifts, Article 34(2) of the Labor Standards Act generally requires at least eleven consecutive hours of rest between shifts; designated work with the required approvals may exceptionally use no less than eight consecutive hours. Even in organizations not governed by that Act, workers still need adequate rest between shifts. I therefore include the average interval between shifts as a required field.

Frequent shift changes may disrupt workers’ routines and circadian rhythms. The frequency of shift changes should therefore be reviewed for rotating and rostered schedules to detect changes so frequent that workers cannot adapt.

The description of work activities is the central part of the inventory. Clear, detailed descriptions help identify hazards later and support effective controls in the OH&S management system.

Each activity should be described clearly and precisely. Where useful, the organization may prepare a timetable or flowchart showing how activities fit into the working day. Non-routine as well as routine work must be considered.

ISO 45001 requires an organization to determine competence requirements for workers who affect or may affect OH&S performance. These include the abilities needed for the work, the ability to identify work- and workplace-related hazards, and the knowledge and skills needed to address OH&S risks. The inventory should therefore record competence requirements and support a review of whether current workers meet them or whether the requirements should be adjusted.

The organization can use the results to plan appropriate training and competence assessment so that workers remain competent. Worker participation is required when competence is reviewed and determined.

The work environment, machinery and equipment, and materials encountered by workers can connect directly to hazards. Work at height may create a fall hazard, while organic solvents may create direct exposure. These factors belong in the internal-issues review.

To support effective hazard identification, I recommend using photographs as well as text to document the work environment. Practical guidance_[6] also recommends providing images of machinery or equipment where necessary, in addition to recording model numbers. Materials should be recorded by type and quantity, together with possible routes of exposure.

Under Article 18 of the Enforcement Rules of the Labor Standards Act and the Guidelines for Working Hours of Workers Outside the Workplace, work performed off site on business trips or for other reasons must be included in the review. Where working time is difficult to calculate, ordinary working hours are presumed unless actual hours can be proved.

Because off-site environments and hazards differ from those at the organization’s premises, I treat off-site work as a separate review area and recommend recording both its usual content and frequency. Photographic detail may not always be feasible, but the written description should still be clear enough for later hazard identification.

Classification by Work Activity

A work-activity-based review uses each activity as the unit of observation and treats workers as the human resources involved. It is especially suitable where work is highly specialized, a worker’s duties are narrowly defined, or operations are organized around production processes.

I divide this review into work-related and people-related information. Work-related information includes working time, activity, environment, machinery and equipment, and materials encountered. People-related information includes headcount, staffing schedules, contract form and content, source of remuneration, roles and contributions, and competence requirements. A sample form appears below.

Where specialized activities are connected, the organization can first prepare an overall process flowchart and then review each activity unit within the process.

The following example is based on a steel company’s section-steel and angle-steel process. The main category may be the overall manufacturing process, with heating, spraying, and forming reviewed as separate subcategories.

Unlike a job-title-based review, working time here means the time required for one activity, while frequency means how often the activity occurs per unit of time. In the example, this would be the duration of heating or forming and the number of times each process is started per week.

Because this approach does not emphasize the characteristics of individual workers, it is less effective for showing whether their working and rest times comply with labor legislation.

Requirements for activities, environments, machinery, equipment, and materials remain as described above. Because this approach is often used for process work, I also include possible waste generated by the activity to support later hazard identification.

On the people side, workers are treated as the human resources allocated to the activity, so staffing arrangements matter. I add each worker’s role and contribution: for the steel-process example, the organization should state whether the worker operates instruments, monitors the process at close range, or performs the work manually. This supports later hazard identification and risk assessment.

Current OH&S Management

ISO 45001 does not expressly require the review of internal issues to include the current state of OH&S management. I nevertheless recommend including it because the review can reveal gaps and provide a basis for estimating the work, cost, and differences involved in developing the management system.

This part should include the area currently covered by OH&S management, the responsible unit, the OH&S status of each job title or activity, and the organization’s management-system certification history.

The area currently covered may be described in words or marked on a map, like the National Chengchi University example above.

The responsible OH&S unit should include both the external contact point and the internal structure. Contact information can be incorporated into the organization-profile form.

The responsible unit and its duties can be shown in the organizational chart and integrated into the inventory of duties by unit and job title.

The OH&S status of each job title or activity should cover existing measures and their use, including personal protective equipment and engineering controls, as well as workers’ technical competence, OH&S knowledge, and training content and frequency. This helps identify areas requiring additional improvement. These fields are incorporated into the sample worker and work-environment forms.

The certification-history field records dates and changes relating to earlier OHSAS 18001 or TOSHMS certification and any relevant information about transition to ISO 45001.

Conclusion

Internal issues are fundamental to an OH&S management system. Understanding them supports not only system establishment but also later hazard identification, risk assessment, and control planning.

The standardized review process and forms presented here can help organizations avoid omissions and examine whether their present arrangements comply with applicable law.

After understanding the organization’s external and internal issues, the next article will discuss how to determine and evaluate the scope of the OH&S management system. See you there : D.

References

[1] Industrial Development Bureau, Ministry of Economic Affairs, Practical Manual for Promoting ISO 45001 Occupational Health and Safety Management Systems in Manufacturing, 2019, pp. 11–12.

[2] Huang Cheng-kuan, Labor Law, 2nd ed., 1997, p. 412.

[3] Wang Hui-ling, “An Examination of the Concept of Working Time,” Formosa Transnational Law Review, No. 98, 1998, pp. 2–10.

[4] Huang Yueh-chin, New Treatise on Labor Law, 4th ed., September 2012, pp. 323–324.

[5] Ibid., p. 324.

[6] Same source as note [1], p. 18.

[7] International Organization for Standardization, ISO 45001:2018/Amd 1:2024, Occupational health and safety management systems—Requirements with guidance for use—Amendment 1: Climate action changes, February 2024.

[8] International Organization for Standardization, ISO 45001:2018 and ISO/DIS 45001 standard pages, accessed September 4, 2026.