[ISO 45001 Series] Institutional Structure: Organizational Roles, Responsibilities, and Authorities

Introduction

As explained in the previous article, “[ISO 45001 Series] Institutional Structure: Responsible Personnel and Organizational Units,” the ISO 45001 requirements relevant to an organization’s institutional structure are distributed across several clauses. To make those requirements concrete, the relevant provisions must be brought together and implemented through the institutional arrangements established before the management system is put into operation.

An occupational health and safety management system is not merely the responsibility of designated personnel or a responsible unit. From design through implementation, it requires cooperation throughout the organization. This is also what ISO 45001 requires. Its clause on leadership and worker participation therefore assigns roles, responsibilities, and authorities across different organizational levels.

The previous article discussed how an organization can establish the personnel and units responsible for its OH&S management system in accordance with current legislation. This article follows that discussion and continues to develop the institutional structure.

Having addressed responsible personnel and organizational units, the next question is how roles, responsibilities, and authorities for the OH&S management system should be arranged across the organization.

Distinguishing and Positioning Workers and Employers

ISO 45001 assigns different tasks and responsibilities to different organizational levels. Before discussing how an organization should allocate roles and responsibilities within an occupational safety and health risk-management process, it is therefore necessary to clarify the definitions of “worker” and “employer,” as well as the vertical divisions within the organization. Only then can the responsibilities assigned by ISO 45001 be connected accurately with Taiwanese labor legislation.

Under labor legislation, the employer is generally the other party to the employment contract. The employer may therefore be a natural person, including the proprietor of a sole proprietorship; a partnership; a legal entity, including a company; a school; a government agency; or an organization.

Subparagraph 2 of Article 2 of the Labor Standards Act adopts a functional definition of employer and includes persons who exercise managerial authority on behalf of the business owner. Although contractual responsibility belongs to the party to the employment contract, the person who actually performs the employer’s obligations may be a natural person acting for that party.

By contrast, Subparagraph 3 of Article 2 of the Occupational Safety and Health Act defines an employer as the owner of a business entity or the person in a position of managerial responsibility for that entity. Compared with the functional approach of the Labor Standards Act, the concept under the Occupational Safety and Health Act centers on the natural-person employer, the legal-entity employer, and the director or representative who manages the legal entity’s affairs.

Subparagraph 1 of Article 2 of the same Act defines “workers” to include laborers, self-employed workers, and other people engaged in work under the direction or supervision of the person responsible for a workplace. The Act therefore draws a relatively visible line between employers and workers: most people who are not the employer may fall within the statutory concept of worker.

ISO 45001 defines a worker as a person performing work or work-related activities under the control of the organization. The concept includes top management, managerial persons, and non-managerial persons. The closest ISO concept to an employer as defined under Taiwan’s Occupational Safety and Health Act is often “top management,” meaning the person or group of people who directs and controls an organization at the highest level.

The scope of “worker” under ISO 45001 therefore differs from the definition in Taiwan’s Occupational Safety and Health Act. Because ISO 45001 includes top management, the people covered by the OH&S management system may be broader than the statutory category of worker.

For this reason, I do not believe an organization should allocate OH&S management-system responsibilities only to the “workers” defined by the Occupational Safety and Health Act. The employer must also be included. Where the employer is a legal entity, the entity cannot physically perform its own duties; the chairperson, director, or another authorized representative acts on its behalf.

One practical guide_[1] excludes the employer from the category of worker while placing the chairperson within top management. In my view, that creates a tension. The guide also treats the occupational safety and health committee as top management, even though the Regulations of Occupational Safety and Health Management make the employer an ex officio member of that committee. To avoid this contradiction, the original analysis argued that the employer should be included when identifying the people corresponding to top management.

On that basis, when establishing roles, responsibilities, and authorities under ISO 45001, I recommend treating the standard’s broad concept of “worker” as covering both the employer and everyone who performs work for the organization, and then distinguishing among “top management,” “managerial workers,” and “non-managerial workers.” The following diagram applies this approach to the structure of a representative business enterprise.

This article recommends determining whether the employer, board of directors, general manager, or another role constitutes top management by examining actual authority to direct and control the organization and allocate resources. An occupational safety and health committee must likewise be assessed in light of its actual authority and the organization’s governance structure; it does not automatically become top management merely because legislation requires its establishment.

Managerial workers include managers at different levels within each organizational unit, such as division and section heads. The precise allocation may be adjusted to the organization’s size. Where an occupational safety and health management unit has been established, I recommend treating both the head and staff of that unit as managerial workers for purposes of this framework.

Non-managerial workers are those within the organization’s units who do not hold managerial positions.

An organization may adapt the correspondence between these levels and its internal units to its size and nature, and then assign responsibilities accordingly.

Recommended Institutional Structure for Roles, Responsibilities, and Authorities

The following table combines the ISO 45001 provisions concerning workers, managerial workers, and top management with the organizational levels discussed above. It provides a reference for the concrete methods and allocation of responsibilities examined in this article and later articles.

Because the table summarizes the responsibilities assigned by ISO 45001 at each organizational level, the following discussion of top management, managerial workers, and non-managerial workers focuses on implementation rather than repeating every listed responsibility.

Top Management

Responsibilities and Authorities

Top management determines the principal policy and direction of the OH&S management system. Although authority may be assigned downward, top management retains ultimate accountability. The ISO 45001 clause on leadership and worker participation identifies ways in which top management must demonstrate leadership and commitment, as summarized in the table. Because the standard does not prescribe one exclusive method of doing so, the following examples draw on practical guidance_[2].

Top management can establish an occupational health and safety policy and use opportunities for direct contact with workers—such as recruitment and training—to demonstrate its responsibility and accountability for providing safe and healthy workplaces.

Top management also establishes strategic direction, which expresses the organization’s intentions across different fields. A manufacturer of petrol-powered vehicles deciding to introduce electric scooters, for example, signals intentions concerning environmental performance and product development. ISO 45001 requires the OH&S management system to be compatible with the organization’s strategic direction and integrated into its business processes, rather than built as a separate parallel institution. Ensuring that integration is a responsibility of top management.

The ISO 45001 clause on support also requires the organization to determine and provide the resources needed for the OH&S management system. These may include human, natural, infrastructure, technological, and financial resources. In practice, top management can identify OH&S resources within the organization’s operational planning so that workers at every level understand what is available.

The needs and expectations relevant to the OH&S management system can be analyzed using the approach described in “[ISO 45001 Series] Defining External Interested Parties and External Issues.” The organization can compare actual results with those needs and expectations, use the differences to set improvement directions and objectives, and ultimately embed the intended outcomes in its organizational culture.

Because top management cannot operate the system alone, all workers must participate. Support for workers at every level can be demonstrated through clearly defined roles, duties, responsibilities, and authorities; effective communication across levels; and recognition of individuals or groups that contribute to improved occupational safety and health.

Worker reports are an important means of identifying hazards, risks, and opportunities. Through websites, training, and other channels that reach managerial and non-managerial workers, top management can communicate that workers will not be dismissed or penalized for reporting relevant matters. Where appropriate, it may also recognize such contributions publicly.

In addition to demonstrating commitment on particular issues, top management is responsible for establishing the occupational health and safety policy that guides improvement in OH&S performance. The policy must be compatible with the organization’s strategic direction. It may be maintained as documented information in operating manuals or other records and reviewed periodically through management review so that its direction can be revised when necessary.

Placement Within the Organization

In the simplified discussion used in the original 2022 draft, a smaller organization with no more than 100 workers was described as not being required to establish an occupational safety and health management unit or committee. On that view, top management might consist only of a natural-person employer or the authorized representative of a legal-entity employer, who would perform the responsibilities assigned to top management by ISO 45001. As explained in the legal update below, however, the 100-worker figure is not a universal exemption threshold.

Where a business entity falls within Article 10 of the Regulations of Occupational Safety and Health Management, the employer must establish an occupational safety and health committee. The committee reviews, coordinates, and makes recommendations on occupational safety and health matters. Whether it also constitutes top management under ISO 45001 still depends on whether it actually directs and controls the organization at the highest level. Current Article 12 continues to require the committee to meet at least once every three months and retain meeting records for three years.

The 2022 Discussion and the Current 2026 Requirements

Wording used in the original 2022 draft: The original text generalized that a business entity with no more than 100 workers was not required to establish an occupational safety and health management unit or committee. That statement was overly broad and should not be treated as a universal threshold. Even under the rules then in force, duties concerning management units, occupational safety and health personnel, and committees had to be determined separately by reference to the business category, workforce size, head-office arrangements, and the qualifications and thresholds in the applicable schedules.

What changed in 2026: Following the amendment of the Occupational Safety and Health Act promulgated on December 19, 2025 and effective July 1, 2026, the Ministry of Labor amended the Regulations of Occupational Safety and Health Management on June 29, 2026. For the matters directly relevant here, Article 12 retained the existing committee-meeting frequency and record-retention period. Article 87 changed the committee-roster requirement from retention for inspection to registration in the content and manner announced by the central competent authority and filing with the labor inspection agency for reference. The amendment also strengthened the relationship between general risk assessment and the occupational safety and health management plan, but it did not create a single workforce threshold for every organizational role._[3][4]

How the current requirements should be applied: Under current Article 2-1, a Category One business entity with at least 100 workers must establish a dedicated first-level management unit directly subordinate to the employer, while a Category Two business entity with at least 300 workers must establish a first-level management unit directly subordinate to the employer. Article 10 then links the committee requirement to entities covered by Article 2-1 and Paragraph 2 of Article 6. Whether an entity below those thresholds must still appoint an occupational safety and health supervisor or other management personnel must be determined under Article 3 and Schedule 2. In practice, the business category, workforce size, head-office structure, and regional business units must all be checked; the question cannot be answered solely by asking whether the workforce exceeds 100._[3][5]

Top Management as Both Workers and Managerial Persons

Under the ISO 45001 classification and the analysis above, top management falls within the broad definition of worker. Responsibilities that the standard assigns to workers therefore also apply to top management.

For example, the support clauses require workers to be aware of the OH&S policy and objectives; their contribution to the effectiveness of the system; the implications and potential consequences of failing to conform to system requirements; and hazards, OH&S risks, and relevant measures. Requirements for worker participation in the leadership and worker-participation clauses also extend to top management where applicable.

Managerial persons include top management as well as the group described in this article as managerial workers. ISO 45001 responsibilities and requirements applicable to managerial persons therefore also apply to top management.

For example, the leadership and worker-participation clauses require consultation with non-managerial workers on matters such as determining the needs and expectations of interested parties, establishing the OH&S policy, and determining how legal requirements and other requirements will be fulfilled. Top management must also ensure that these consultation obligations are met.

Managerial Workers

Responsibilities and Authorities

Managerial workers are both workers and managerial persons. The ISO 45001 responsibilities and requirements applicable to each status therefore apply to them. Because the preceding discussion of top management already introduced those requirements, they are not repeated in full here.

In addition to ISO 45001, the Regulations of Occupational Safety and Health Management prescribe duties for occupational safety and health management personnel.

Where a business entity has not appointed an occupational safety or occupational health management specialist, an occupational safety and health management officer, a management unit, or a committee, the occupational safety and health supervisor has broader duties, including formulating, planning, and promoting occupational safety and health management matters.

Where those personnel or bodies have been established, the occupational safety and health supervisor’s role centers on managing and supervising occupational safety and health matters. Other workplace supervisors and managers must, within their authority, direct and supervise their subordinates in implementing occupational safety and health matters and coordinate and guide the relevant personnel.

Placement Within the Organization

Under the Regulations, occupational safety management specialists, occupational health management specialists, occupational safety and health management officers, and occupational safety and health personnel in first-level units formulate, plan, and promote occupational safety and health matters and guide relevant departments or personnel in implementation. In my view, these responsibilities resemble those assigned to managerial persons under ISO 45001.

I therefore recommend that “managerial workers” in the ISO 45001 framework include managers of the organization’s operational units and, where an occupational safety and health management unit exists, both the head and personnel of that unit.

Non-managerial Workers

Non-managerial workers are neither top management nor managerial workers. The ISO 45001 requirements and responsibilities applicable to workers therefore apply to them, as summarized in the table above.

Because the OH&S management system directly affects their working environment and health, non-managerial workers should participate in accordance with relevant policies and engage in consultation. In my view, they should not refuse without legitimate reason and should provide assistance proactively where necessary.

Conclusion

Building an occupational health and safety management system is never the responsibility of only a few people. Occupational accidents and the safety of the working environment concern everyone in the organization, and improvement can be achieved only through collective effort. ISO 45001 accordingly emphasizes cooperation from the bottom up as well as leadership from the top down.

“No one should be excluded.” That was my conclusion after reading the ISO 45001 requirements as a whole, and it is consistent with the training I received during my studies.

ISO 45001 nevertheless uses the concepts of worker, managerial persons, and top management, while Taiwanese legislation distinguishes among laborers, workers, and employers. The terms can therefore be confusing. This article has spent considerable space clarifying their relationship so that responsibilities and authorities can be assigned more accurately at every organizational level.

The next article will continue to focus on institutional structure. See you there : ).

References

[1] Industrial Development Bureau, Ministry of Economic Affairs, Practical Manual for Promoting Occupational Safety and Health Management Systems in Manufacturing—ISO 45001, 2019, p. 47.

[2] Ibid., pp. 42–44.

[3] Ministry of Labor, Taiwan, Regulations of Occupational Safety and Health Management, amended June 29, 2026; effective July 1, 2026. Retrieved from: https://laws.mol.gov.tw/flaw/FLAWDAT0201.aspx?id=FL015039

[4] Occupational Safety and Health Administration, Ministry of Labor, Taiwan, Content and Method of Registration Required When an Employer Has Established an Occupational Safety and Health Committee, 2026. Retrieved from: https://isafe.osha.gov.tw/zh-TW/NNews/Index/115

[5] Ministry of Labor, Taiwan, Occupational Safety and Health Act, amended December 19, 2025; effective July 1, 2026. Retrieved from: https://laws.mol.gov.tw/Eng/FLAWDAT01.aspx?id=FL015013

[6] International Organization for Standardization, ISO 45001:2018 Online Browsing Platform, Clauses 3.12 and 5.1, last accessed September 4, 2026. Retrieved from: https://www.iso.org/obp/ui/#iso:std:iso:45001:ed-1:v1:en