PUBLIC HEALTH AND DATA ANALYSIS / PRACTICAL GUIDE
[ISO 45001 Series] Institutional Structure: Communication and Retention of Documented Information
ISO 45001 is not whatever you say it is—without two-way communication and documentary records, the system is like air: invisible and impossible to grasp!
Version and Timeliness Note
This article was first published on April 5, 2022. The body was updated in September 2026 to use the current names of government agencies. It is based primarily on ISO 45001:2018 and the CNS 45001 framework; the 2024 climate-action amendment and the direction of the revision expected in 2027, which remains at the DIS stage, because the draft may still change, implementation and certification should follow the formal standards and legislation in force at the relevant time.
Education and training carry information from the top down, but a management system also needs frontline feedback, coordination across functions, and appropriate communication with external interested parties. This article turns the ISO 45001 requirements on communication and documented information into practical systems. It covers:
- The role of communication:
- Why education and training alone do not provide every direction of information flow
- Upward, horizontal, and external communication channels
- Designing a practical communication system:
- What, when, with whom, and how to communicate
- Consultation forms, proactive reporting, and the occupational safety and health committee
- The 2026 rules on committee-roster registration, filing, and training
- Creating and controlling documented information:
- Information required by the standard and information the organization deems necessary
- Identification, review, approval, distribution, retention, and change control
- Balancing availability with confidentiality and integrity
Introduction
We have finally reached the last article in the institutional-structure part of the management-system series! Although I call it the last article, it actually covers both the communication system and the system for retaining documented information.
It is absolutely not because both subjects are relatively short and I decided to squeeze them into one article (seriously).
In my previous article, “[ISO 45001 Series] Institutional Structure: Education and Training System,” I explained that an occupational health and safety management system depends on participation and effort throughout the organization. Education and training are therefore needed so that non-managerial workers understand the organization’s current direction and what it is doing.
In essence, however, education and training usually transmit information in one direction, from the top down. Because top management does not necessarily work directly in frontline environments, it may not understand the work environment or unexpected situations as clearly as frontline workers do.
In addition to top-down education and training, an organization therefore needs upward communication and communication across units at the same level. Once the organization’s relationships with external interested parties and the need to understand their requirements are considered, channels between the organization and external parties are also necessary.
Another important supporting system concerns the retention of documents connected with the organization’s occupational health and safety management system. In my published paper, “The Connotation of Employer's Protection Obligation to Prevent Occupational Accidents- Concretized by Occupational Health and Safety Management System,” I noted that, when an occupational accident occurs, materials from the management system may serve as a source of evidence for both employers and workers in litigation and may help reduce evidentiary burdens.
Yet even if an occupational health and safety management system has been implemented thoroughly and with enormous effort, it will be difficult to use that work as evidence in litigation if no written or documentary record remains. Retaining documented information is therefore important not only because ISO 45001 requires it, but also because it can help the management system serve its fullest purpose if an occupational accident unfortunately occurs.
Communication System and Recommended Practices
Communication Requirements in ISO 45001
ISO 45001 addresses communication within Clause 7, “Support.”[1]
For matters relating to its occupational health and safety management system, an organization must establish internal communication among different levels and functions and external communication concerning matters such as applicable legal and other requirements. It must determine what to communicate, when to communicate, with whom to communicate, and how to communicate.
The communication process must support the collection, updating, and dissemination of information. When establishing the process, the organization should take into account the views of relevant workers and external interested parties, along with legal and other requirements.
The organization should respond to communication relevant to the management system, ensure that the process enables workers to contribute to continual improvement, and retain documented information as appropriate. Relevant information should be communicated in a form that its intended recipients can receive and understand.
Recommended Communication Practices
Under ISO 45001 requirements on leadership and worker participation, an organization must consult workers at applicable levels and establish the mechanisms, time, training, and resources needed for that consultation.
Clause 7, “Support,” further requires the organization to establish both internal and external communication mechanisms.
Considering these requirements together, I believe an organization should establish an independent mechanism for external communication and communication across organizational levels before operating its occupational health and safety management-system processes. This can also help satisfy the standard’s worker-consultation requirements.
For internal use, an organization can create an occupational health and safety consultation and communication form through which workers or units at different levels may submit proposals. The following template was developed with reference to practical guidance.[2]
After receiving a proposal, an organizational unit may involve relevant personnel or other units in consultation and communication as appropriate. ISO 45001 requires the organization to provide necessary information during the communication process. Where appropriate, I believe that suitable recognition may also be given to workers who initiate communication, thereby encouraging use of the system.
External communication should use channels appropriate to the organization’s relationship with the external interested party and to applicable legislation or methods designated by the competent authority. Statutory notifications, filings, and other administrative communication with an authority may, for example, be conducted through official correspondence, online reporting or registration systems, or another method announced by the authority. Such communication should not be categorically limited to official correspondence.[3]
In addition to passive communication—providing information after someone asks for it—practical guidance identifies matters that require proactive communication even without an inquiry. Examples include periodic declarations or notifications required by a competent authority and workplace environmental-monitoring results that must be communicated to onsite workers.[2]
Whether proactive communication is required may depend on applicable legislation and on the requirements of the organization’s internal or external interested parties.
To ensure that external parties and workers at different levels understand how the system operates, relevant documents should clearly state what will be communicated, when, to whom, and how. The results and conclusions of communication should be retained as documented information, and the organization should ensure that the relevant workers and interested parties receive and understand the information intended for them.
Taiwan’s legally required occupational safety and health committee can itself serve as one method within a communication system because its membership includes the employer, labor representatives, occupational safety and health personnel, and other organizational representatives.
Current Requirements After the 2026 Amendments
Rules when this article was published in 2022: The original article treated the occupational safety and health committee primarily as a mechanism for communication, coordination, and consultation among different organizational levels. That basic function remains unchanged under the current rules. Committee membership continues to include the employer, labor representatives, department heads and supervisory personnel, and personnel responsible for occupational safety, occupational health, and occupational health services.[3]
The 2026 amendment: Rules effective July 1, 2026 added registration and filing requirements for committee rosters. Where a business entity is legally required to establish an occupational safety and health committee, the employer must prepare the committee roster, register it in accordance with the content and method announced by the central competent authority, and submit it to the labor inspection agency for record. The same applies when the roster changes. An organization should therefore incorporate registration, amendment, and filing of the roster into its management procedures in addition to establishing and operating the committee.[3]
Education and training: The Occupational Safety and Health Education and Training Rules amended in 2026 also place occupational safety and health committee members within the relevant training framework. Because different amended provisions have different effective dates, an organization arranging training should verify which provisions are in force and review the competent authority’s current announcements.[4]
Retention of Documented Information and Recommended Practices
ISO 45001 Requirements for Documented Information
ISO 45001 defines documented information as information required to be controlled and maintained by an organization, together with the medium on which it is contained.[1]
Although Clause 7, “Support,” contains dedicated requirements for documented information, other processes and stages of ISO 45001 also require particular information to be documented. I have organized those requirements in the following table for reference.
The scope of an organization’s documented information includes information required by ISO 45001 and information that the organization itself determines is necessary for the effectiveness of its occupational health and safety management system. At a minimum, therefore, both categories must be considered.
The extent of documented information may differ according to the organization’s size and type, its legal and other requirements, and worker competence. Its complexity should be kept as low as reasonably possible to support efficiency and ease of use, but it must not be simplified to the point of losing effectiveness.
When creating and updating documented information, the organization should adopt appropriate measures for identification and description, format, and media, and should review and approve the information for suitability and adequacy.
Created and updated documented information must be controlled so that it is available and suitable where and when needed, while being protected against loss of confidentiality, improper use, or loss of integrity. Control should address distribution, access, retrieval and use; storage and preservation, including legibility; control of changes so that obsolete information is not used; and retention and disposition.
Recommended Practices for Retaining Documented Information
An organization may store relevant information electronically or on paper, but it should ensure that workers or interested parties who need the information and are appropriately authorized can obtain suitable documented information where and when required. Access, distribution, retention, change, and use should be controlled according to the nature of the information, with due regard for availability, legibility, confidentiality, and integrity. This does not mean that every document must be made available without restriction to every worker or external interested party.[5]
Compared with other areas of ISO 45001, the requirements for documented information are relatively detailed, so I will not repeat every point here. The main checks are whether the system covers at least the information identified in the preceding table and whether it provides appropriate availability and confidentiality.
Conclusion
A communication system is just as important as an education and training system. Good communication between management and workers, across units at the same level, and with external parties should be two-way whenever appropriate. This makes meaningful communication and information exchange more likely and reduces the risk that management and frontline workers will simply proceed in different directions.
The results of an occupational health and safety management system that required so much effort should also be supported by a sound system for retaining documented information. Such information supports internal audits and inspections and can provide a clearer basis for determining responsibility after an occupational accident. Beyond questions of compensation, it can also help the organization examine weaknesses in the management system, improve them, and prevent the same tragedy from happening again.
After these articles, the institutional-structure portion of the series is finally in reasonably complete shape. The next articles move into “Planning”—the “Plan” stage of the occupational health and safety management system’s PDCA cycle. I will see you in the next article : D.
References
[1] International Organization for Standardization. ISO 45001:2018, Occupational health and safety management systems—Requirements with guidance for use. 2018.
[2] Industrial Development Bureau, Ministry of Economic Affairs (now the Industrial Development Administration, Ministry of Economic Affairs). Practical Manual for Promoting Occupational Safety and Health Management Systems in Manufacturing—ISO 45001. 2019, p. 84.
[3] Ministry of Labor. Regulations of Occupational Safety and Health Management (amended June 29, 2026; effective July 1, 2026), Articles 11 and 87. Last accessed September 5, 2026. https:/
[4] Ministry of Labor. Occupational Safety and Health Education and Training Rules (amended June 25, 2026), Articles 17 and 18. Last accessed September 5, 2026. https:/
[5] Occupational Safety and Health Administration, Ministry of Labor. “Section I: Support (Chapter 7 of CNS 45001).” Last accessed September 5, 2026. https:/
FAQ
Education and training generally transmit information from the organization downward. A communication system also allows frontline workers to provide upward feedback and enables necessary exchanges across functions and with external interested parties.
Based on its management-system needs, the organization should determine what to communicate, when to communicate, with whom to communicate, and how to communicate, while considering workers, external interested parties, and legal and other requirements.
No. The organization should follow applicable legislation and the method designated by the authority. Depending on the matter, this may include official correspondence, online reporting or registration systems, or another announced channel.
No. Electronic or paper media may be used, but relevant authorized users must be able to obtain suitable information when needed, and access, retention, changes, confidentiality, and integrity must be controlled.
A business entity legally required to establish a committee must prepare its roster, register it using the method announced by the central competent authority, and submit it to the labor inspection agency for record; changes must also be reported. Training arrangements should be checked against the effective dates of the amended rules.
Share this article:
You May Also Like
Support Wakame’s Work
If this article helped you turn ISO 45001’s communication and documented-information requirements into systems that can be implemented, retained, and improved, you can support Wakame in creating more carefully researched, updated, and structured long-form work.
Support Wakame’s Work