[ISO 45001 Series] Planning: Overview and Hazard Identification

Introduction

After examining the organization’s external and internal issues, establishing a basic understanding of the organization, and setting up roles and responsibilities, training, communication, and documented-information controls, it is time to begin the most important process in the occupational health and safety management system: planning.

To keep readers from saying that I keep product-placing my other articles into every installment (?), I will leave those links out of this introduction. Anyone who needs them can return to the previous page and browse around : D.

Good planning makes later implementation much smoother. Because each article can cover only so much, I will divide this part into several installments and discuss it carefully.

This article first gives a brief introduction to how an occupational health and safety management system works. It then discusses the structure and content of the ISO 45001 requirements for “planning” and “operation,” before turning to the first major planning topic: hazard identification.

How an OH&S Management System Works

Management-system structure would normally be introduced at the very beginning. In my view, however, the material from this article onward is more closely related to how a management system operates. The earlier articles focused more on gaining an initial understanding of the organization and creating an environment in which the system can function.

The most basic theoretical framework for an occupational health and safety management system comes from the “systems approach to management” within systems theories developed in the natural and social sciences. This theory describes a general system as containing four elements: input, process, output, and feedback. Everything outside the system is called the external environment, as shown below._[1]

Beyond the systems approach described above, an organization must also keep improving its OH&S management system. This calls for the Deming cycle—also known in practice as the Plan-Do-Check-Act process, or PDCA—as another theoretical framework.

The Deming cycle has four steps: 1. Plan: identify the problem, collect and analyze data, and make recommendations from the resulting information; 2. Do: test the proposed solution; 3. Check: evaluate the effectiveness of the implemented solution; and 4. Act: respond to the result. If the solution works, adopt it for future use; if it does not, return to planning and adjust it. Repeating the Deming cycle gradually improves the whole system._[2] Although different OH&S management-system standards exist, none falls outside this basic concept._[3]

Like other OH&S management systems, ISO 45001 is built on the PDCA concept. The relationship between its clause structure and the PDCA process is shown below.

When PDCA is applied to an OH&S management system, ISO 45001 describes it as follows: 1. Plan: determine and assess OH&S risks, other risks, and opportunities, and establish OH&S objectives and processes; 2. Do: implement the processes as planned; 3. Check: monitor and measure activities and processes against the OH&S policy and objectives, and report the results; and 4. Act: take action to improve OH&S performance and the management system.

The ISO 45001 Structure for Planning and Operation

Readers may look at this heading and ask: Aren’t we discussing the “Plan” part of PDCA? Why has “Do” suddenly appeared?

The reason lies in the clause structure of ISO 45001.

In a typical safety and health management system, planning mainly covers hazard identification, identifying legal matters, establishing OH&S objectives, assessing risks and opportunities, and planning actions to address risks and opportunities. In a broader sense, planning for performance evaluation also belongs to the planning stage of PDCA.

In ISO 45001, however, hazard identification, determining legal requirements, and assessing risks and opportunities appear in the “Planning” clause, while planning controls for risks and opportunities appears in “Operation.” Planning for performance evaluation appears in “Performance Evaluation.”

For completeness and practical usability, I therefore do not follow the ISO 45001 clause order in this and the following articles. Instead, I organize the discussion around the practical sequence, while explaining the relevant ISO 45001 requirements and how an organization can implement them.

Performance evaluation is easier to understand when introduced as one continuous topic—from deciding what performance means to choosing evaluation methods. I therefore leave it out here and address all performance-evaluation procedures in a later article.

The articles that follow will separately cover hazard identification, identifying legal and other requirements, assessing risks and opportunities, and planning controls. The remainder of this article begins with the practical implementation of hazard identification.

ISO 45001 Requirements for Hazard Identification

Hazard identification belongs to the actions for addressing OH&S risks and opportunities in ISO 45001’s “Planning” clause.

In ISO 45001, occupational health and safety risk (OH&S risk) refers to the possibility of a work-related hazardous event or exposure that could cause injury or ill health.

An occupational health and safety opportunity (OH&S opportunity) is a circumstance or set of circumstances that can improve OH&S performance—for example, opportunities involving hazard identification and the communication, analysis, and elimination of known hazards.

To plan actions for OH&S risks and opportunities, an organization must first understand its circumstances, determine which risks and opportunities need to be addressed, and then decide what action to take.

ISO 45001 therefore requires the organization to consider the initial-review material discussed under its organizational context when planning actions. When deciding which risks and opportunities require treatment, it must consider hazards, OH&S risks and opportunities, legal requirements, and other risks, opportunities, and requirements.

A hazard is a source with the potential to cause injury or ill health. It may be physical, chemical, biological, ergonomic, mechanical, electrical, or associated with motion and energy. Under ISO 45001, hazard identification means recognizing and understanding sources in the workplace, or affecting workers, that can potentially cause injury or ill health.

Hazard identification helps an organization recognize and understand workplace hazards and hazards to workers so that it can assess them, set priorities, eliminate hazards, and reduce OH&S risks. ISO 45001 therefore requires the organization to establish, implement, and maintain an ongoing, proactive hazard-identification process.

ISO 45001 does not prescribe exactly how that process must be carried out. It does require consideration of at least: a. how work is organized, social factors, leadership, and organizational culture; b. routine activities arising from normal operations and non-routine activities and situations arising from occasional or unexpected events; c. relevant past internal and external incidents, including emergencies, their causes, and potential emergencies; d. people, including those at or near the workplace and workers at locations not under the organization’s direct control, such as mobile workers, business travelers, home workers, and lone workers; e. other issues, including work-related situations near a workplace under or outside organizational control that could cause injury or ill health; and f. changes to the OH&S management system and changes in hazard knowledge and information, including published literature, research and development, and worker feedback.

The 2022 Legal Context and the Current Rules after the 2026 Amendments

Rules in force when this article was published in 2022: The original article used Articles 5, 25, 31, and 37 of the Occupational Safety and Health Act then in force, together with the management-plan items formerly listed in Article 31 of the Enforcement Rules of the Occupational Safety and Health Act, to explain the links among procurement, contracting, maternal health protection, occupational-accident investigation, and hazard-information collection. At that time, Article 12-1 of the Occupational Safety and Health Management Regulations chiefly addressed preparing and implementing an OH&S management plan according to the enterprise’s scale and nature.

The 2026 amendments: To coordinate with the Occupational Safety and Health Act amended and promulgated on December 19, 2025, the Ministry of Labor amended the Occupational Safety and Health Management Regulations on June 29, 2026, with effect from July 1, 2026. The amendments place general hazard identification and risk assessment before the management plan. Current Article 12-1 requires an employer, before having workers perform work, to assess risks associated with buildings, machinery, equipment, tools, raw materials, materials, work activities, and other potentially hazardous factors; take necessary preventive equipment and measures based on the result; and prepare a management plan based on the enterprise’s scale, nature, and risk-assessment results._[10][11]

Current rules after the amendments: For enterprises required to establish an OH&S management system meeting CNS 45001 or an equivalent-or-higher standard, current Articles 12-3 through 12-5 of the Occupational Safety and Health Management Regulations also require hazard identification and risk assessment before changes to processes, procedures, materials, or equipment; integration of safety and health requirements and risk assessment into procurement, leasing, and construction planning and design; and a contracting management plan. Current Article 26 of the Occupational Safety and Health Act also expressly requires a risk assessment before work is contracted out, together with disclosure of the work environment, hazardous factors, and required equipment and measures. The original article’s 2022 comparison to Article 25 should therefore not be read as a description of the current provision._[10][11][12]

Rules that still require attention: Current Article 31 of the Occupational Safety and Health Act still requires designated enterprises to assess, control, and grade hazards for work that may present maternal-health risks. Article 37 still requires occupational accidents to be investigated and analyzed and records to be made. The article’s method of cross-checking workers, work environments, historical incidents, and external information therefore remains useful, but actual forms, legal grounds, and control procedures must be rechecked against the law in force, the organization’s characteristics, and site-specific risks.

A Practical Method for Hazard Identification

Hazard identification not only helps an organization understand what may harm workers in the workplace; it is also essential to the later assessment, prioritization, and elimination of hazards and to reducing OH&S risks.

If hazard identification is incomplete, a particular hazard may never enter the later risk-assessment priorities. It may then remain uncontrolled when controls are planned, potentially affecting OH&S performance.

The difficulty is that the scale and complexity of hazard identification vary greatly with the size of the organization. No single standard procedure or inventory fits every organization, so omissions are common—and even people in the same organization may produce different results.

This article therefore tries to establish a hazard-identification process that is broadly adaptable to organizations of different sizes while remaining consistent with ISO 45001.

The standardized and structured process below should still be adjusted to the organization’s scale and nature.

Scope of Hazard Identification

Before using a structured hazard-identification process, the organization must first define its scope.

Hazard identification does not mean only searching that scope for hazards. It also means finding hazard information relevant to the OH&S management system. The former includes assessing possible hazards to workers in the workplace; the latter includes reviewing occupational accidents and hazard-identification results from comparable industries in Taiwan and abroad to find hazards that may also be relevant to the organization.

Using ISO 45001 as a reference, I divide the scope into internal and external areas. The internal area is further divided into current and past hazards. The scope also includes hazards brought into the organization by people, activities, and things, and hazards created by organizational activities. The categories and issues are shown below.

Within the organization, “current” hazards primarily concern workers included in the organizational system. At this stage, that excludes contractor personnel and services procured from other organizations.

These workers are not limited to people working at locations directly controlled by the organization. They also include workers within the organization who work elsewhere, such as postal workers and bus drivers, workers traveling to another location for work, home workers, and lone workers. When identifying hazards to workers, remember that Article 31 of the Occupational Safety and Health Act specifically requires hazard assessment for work that may present maternal-health risks.

Because current-hazard assessment mainly concerns workers, I recommend linking it to the worker and work-environment inventory described under organizational context. Identifying hazards by specific work activity or job title makes omissions less likely.

“Past” internal hazards mainly refer to the ISO 45001 requirement to include relevant past incidents. Practical guidance_[4] suggests covering near misses, occupational accidents, and emergencies. I recommend linking these records to different job titles and work activities in the worker and work-environment inventory to reduce omissions.

In addition to current and past internal hazards, ISO 45001 requires organizations to establish and implement controls for procured products and services. Products and hazardous materials that may create hazards must be assessed before entering the workplace, with hazards eliminated and related OH&S risks reduced. This is not unique to ISO 45001; Article 5, paragraph 2 of the Occupational Safety and Health Act also contains a similar duty.

If an organization arranges for a contractor to perform part of a function or process, hazard identification is also required for the procurement process and the outsourced function or process. When this article was published in 2022, it compared this point with the contracting-responsibility rules then contained in Article 25 of the Occupational Safety and Health Act.

ISO 45001 also requires hazard identification for visitors and other external people entering a workplace controlled by the organization.

I group the ISO 45001 requirements above as hazards introduced into the organization by people, activities, and things.

Contractors and procured-service personnel are workers even though they do not belong to the organization’s internal structure. The worker and work-environment inventory should therefore already contain relevant records by job title or work activity, which can be linked directly to hazard identification.

For procured products, including raw materials, machinery, and equipment, the procurement-control measures discussed in a later article can be used to meet the relevant ISO 45001 requirements.

External people entering a controlled workplace do not necessarily fall within the workers covered by the OH&S management system. Here they are examined as a potential source of hazards. When assessing hazards to workers, the organization can ask whether a work activity involves contact with external people and what hazards those people may introduce.

Organizational processes and activities may produce waste, and environmental legislation may require corresponding handling procedures. That waste may become a hazard source for workers and must be considered.

Organizational activities may also affect external interested parties who are outside the OH&S management system, so hazards to those parties must be considered.

As discussed in “[ISO 45001 Series] Defining the Scope of External Interested Parties and External Issues,” an external interested party may expect not to be affected by the organization’s activities. Planning the OH&S management system requires the organization to consider interested parties’ needs and expectations.

In other words, even when external interested parties are not people covered by the OH&S management system, their needs and expectations must still be considered in planning and implementation. I therefore believe the organization should identify hazards through which its activities could affect them.

The external scope must also include the ISO 45001 requirement to consider hazards arising near a workplace under the organization’s control. Such hazards may cause injury or ill health to workers, but because they neither arise inside the workplace nor result from workers traveling for work, this article classifies them as external.

For external hazard-information sources, practical guidance_[4] and ISO 45001 indicate that the organization should review near misses, occupational accidents, and hazard-identification information from the same and related industries in Taiwan and abroad. It should also consider changes in existing hazard knowledge, published literature, research and development, and worker feedback.

Structured Hazard-Identification Process

Once the scope has been defined, the work falls into two parts: collecting hazard information and identifying hazards for specific targets.

Collecting Hazard Information

Hazard-information collection covers near misses, occupational accidents, and hazard-identification material from within the organization and from the same or similar industries outside it.

Article 37, paragraph 1 of the Occupational Safety and Health Act requires an employer, whenever an occupational accident occurs, to take necessary first-aid and emergency measures and to investigate and analyze the event with worker representatives and make records. Paragraph 2 also requires occupational accidents of specified severity—such as a fatality or three or more affected people—to be reported to the labor inspection authority within eight hours. Internal occupational-accident investigation reports therefore provide a clear source of historical information.

For hazard-identification records and near misses, the 2022 version of this article relied on the management-plan structure then found in Article 31 of the Enforcement Rules of the Occupational Safety and Health Act. It assumed that organizations of every size had safety and health plans and that organizations above a specified size had OH&S management systems. Historical hazard-identification material from those plans or systems can therefore be reviewed.

External information from the same or similar industries is harder to obtain. Severe occupational accidents can be found through Ministry of Labor statistics, news, and other external channels because they must be reported, but hazard-identification records, near misses, and smaller accidents are less visible. Industry exchanges, conferences, and voluntary information-sharing databases can help fill this gap.

For new and changing hazard knowledge, I recommend reviewing relevant projects commissioned by the Ministry of Labor and the National Science and Technology Council (NSTC), as well as academic literature.

Worker feedback can be gathered through the communication system recommended in “[ISO 45001 Series] System Framework: Communication and Retention of Documented Information,” by consulting workers and encouraging reporting before and during implementation of the OH&S management system.

Hazard Identification for Specific Targets

Specific targets include all workers, products and services procured externally, external people entering the organization, and external interested parties who may be affected by organizational activities.

I recommend linking this work to the lists by job title or work activity created through the worker and work-environment inventory described in “[ISO 45001 Series] Defining and Examining Internal Issues in the Organization’s Context.” The following sections explain the structured process and the details that matter for each type of target.

Many types of hazards exist. Hazards of the same type may come from different sources, and one source may create several different hazards. This distinction matters.

Occupational safety and health legislation is worker-protection law, and it uses two general approaches. One prescribes employer conduct to promote worker health, such as the toilet requirements in Article 319 of the Occupational Safety and Health Facilities Rules. The other prescribes employer conduct because a work environment, specific machinery or equipment, or hazardous substance may cause injury or ill health.

Under the second approach, a legal duty indicates that the legislature considers a hazard capable of arising in the specified circumstances and believes protective measures are necessary. Following this idea and practical guidance,_[5] I use occupational safety and health legislation as a framework: for each employer duty in a specified situation, identify the hazard the provision is intended to prevent. This creates a hazard-identification checklist that can be adapted across industries. Provisions concerned solely with promoting worker health are not used to build the checklist.

After hazard identification and risk assessment, ISO 45001 requires the organization to review applicable OH&S legislation and evaluate compliance. Using legislation as the checklist framework has another advantage: completing hazard identification also organizes part of the OH&S legislation applicable to the organization, which supports the later compliance review.

I recommend building the hazard inventory as a checklist. For each worker or work activity, the organization can ask whether a particular hazard source exists in the environment and whether the hazard could occur. A sample checklist is shown below.

Applicable OH&S legislation varies greatly with an organization’s scale and nature, and non-OH&S laws may also apply. The sample checklist therefore includes only broadly applicable instruments—the Occupational Safety and Health Act, its Enforcement Rules, and the Occupational Safety and Health Facilities Rules. Even with those instruments, Article 5, paragraph 1 of the Act still requires consideration of hazards not expressly addressed by legislation.

ISO 45001 requires both legal requirements and other requirements to be considered. In this legislation-based approach, an organization must therefore add not only the Act, Enforcement Rules, and Facilities Rules, but also its other requirements. For example, the law may not expressly require controls for a fall caused by crowding, but if an organizational requirement or commitment does, that hazard belongs in the checklist. The checklist should be adjusted to organizational scale.

I therefore recommend adding a “legal basis” field to the checklist to show which provision supports each item. Numbered entries can link to a separate inventory explaining what each source may cause, what the legal or other requirement requires, and whether the assessment needs special attention, as shown below.

For other requirements that are not legally binding, the organization can decide whether to include them according to their importance and whether the organization has made a specific commitment.

Hazard analysis includes qualitative and quantitative analysis._[6] Qualitative analysis recognizes accident agents such as hazardous energy and substances, as well as unsafe acts, work attitudes, and human error, so that causal relationships, deviations from normal operation, and warning signs of abnormal situations can be identified. Quantitative analysis estimates the magnitude and scope of adverse consequences and the probability of related events.

The hazard-identification method here emphasizes qualitative analysis: hazard types in the work environment, causal relationships between hazards and accidents, and descriptions of circumstances. The checklist therefore adds a “possible source” based on the circumstances addressed by legislation and a “description of possible consequences.” This supports both checking whether a hazard may exist and describing how it could lead to an accident.

For hazard types such as falls and collisions, I use the accident-type classifications published by the Occupational Safety and Health Administration, Ministry of Labor._[7]

Machinery, equipment, and tools are numerous, and legislation for a specific type often addresses several hazards rather than one—as in the “Prevention of Machinery Hazards” chapter of the Occupational Safety and Health Facilities Rules. I recommend adding a subitem such as “all types of machinery, equipment, and tools” under the broader “machinery and equipment” category, and listing every hazard these items may create. When a task uses a particular machine, the organization can check each listed hazard and then review whether OH&S legislation imposes type-specific requirements or employer measures.

Details also differ according to the target being assessed.

For workers, the organization can combine hazard identification with the worker and work-environment inventory and check each job title or activity against its hazard-identification checklist.

ISO 45001 requires routine and non-routine activities and the organization of work to be considered. The worker and work-environment inventory should therefore record detailed work activities, working time, and frequency.

ISO 45001 also requires organizational and leadership culture to be considered because harassment and exclusion can create hazards. These matters are difficult to describe in a worker and work-environment inventory, so I recommend listing them directly in the hazard checklist.

Qualitative hazard analysis covers not only contact with an accident agent but also unsafe behavior, work attitudes, and human error. This relates to worker competence in ISO 45001. In addition to reviewing competence through the worker and work-environment inventory, the organization can list “worker not competent” as a hazard source and examine what hazards could arise if a worker were not competent for a job title or activity.

For externally procured products, the range changes often, and different raw materials or products may be purchased between periodic hazard-identification exercises. I therefore recommend identifying their hazards when they enter the organization, through the procurement-control process discussed in a later article.

External people entering the organization may not be workers covered by the OH&S management system, but they may be hazard sources for organizational workers. From the worker’s perspective, record possible contact with external people in the work activity, add them as possible sources in the checklist, and identify the hazards they could create.

Hazard identification for external interested parties affected by organizational activities is more difficult because these parties are often an indefinite group rather than one or two people. Yet ISO 45001 requires their needs and expectations to be considered. The organization can investigate hazards and sources through contact channels such as surveys, interviews, and briefing sessions.

Points to Watch When Conducting Hazard Identification

The hazard identification discussed here is only the preliminary hazard analysis (PHA) described in the Occupational Safety and Health Administration’s Risk Assessment Technical Guidelines._[8] “Preliminary” means the first analysis of the whole system: investigate hazards with broad and significant effects on a job title or activity, then decide whether further, broader, or deeper analysis is needed. Its main purpose is to screen for major workplace hazards._[9] Because even this stage requires a basic description of circumstances, effects, and severity, the person using the checklist should understand the work and preferably have relevant experience._[9] Frontline workers should also participate._[4]

Conclusion

This article finally enters the familiar PDCA process of a management system. A distinctive feature of ISO 45001, however, is that an organization must first understand itself and its interested parties before establishing the OH&S management system. In substance, the standard also calls for roles, units, training, communication, and other systems that allow management to operate.

We first examined the PDCA process and its relationship to the ISO 45001 OH&S management system. ISO 45001’s clause order does not mirror PDCA perfectly, so practical implementation may require reorganizing the sequence.

We then turned to hazard identification, arguably the first and most important planning process, because its completeness strongly affects later control planning. ISO 45001 lists factors to consider but does not supply a universal procedure, and omissions are easy. I therefore proposed a hazard checklist built on OH&S legislation and adaptable to different organizations.

Organizations can modify the basic checklist in this article and combine it with the worker inventory by job title or activity described elsewhere, adapting both to organizational characteristics and scale to reduce omissions.

I also strongly recommend involving several experienced workers or supervisors. Hazard identification depends heavily on knowledge of the actual workplace; when necessary, external specialists can help reduce blind spots.

The next article builds on this hazard-identification method to examine how to identify legal and other requirements. See you there : ).

References

[1] Health and Safety Executive, Lecture Note: Health and Safety Management Systems.

[2] Su-Fen Yang, Quality Management, 2nd ed., 2006, pp. 56–57.

[3] Institution of Occupational Safety and Health, Systems in Focus—Guidance on Occupational Safety and Health Management Systems, 2015, p. 3.

[4] Institute of Labor, Occupational Safety and Health, Ministry of Labor, A Study of Employers’ General Duties under the Occupational Safety and Health Act, 2015, p. 56.

[5] Industrial Development Bureau, Ministry of Economic Affairs, Practical Manual for Promoting Occupational Safety and Health Management Systems in Manufacturing—ISO 45001, 2019, pp. 57–63.

[6] Ching-Hsien Huang, Hazard Analysis and Risk Assessment, 2nd ed., 2018, pp. 62–63.

[7] Occupational Safety and Health Administration, Ministry of Labor, Government Open Data Platform—Classification Notes for Accident Types in the Online Occupational Accident Statistics Reporting System, last accessed April 5, https://data.gov.tw/dataset/41471

[8] Occupational Safety and Health Administration, Ministry of Labor, Risk Assessment Technical Guidelines, 2015.

[9] See note [6], p. 237.

[10] Ministry of Labor, Occupational Safety and Health Act, amended and promulgated December 19, 2025; effective July 1, 2026.

[11] Ministry of Labor, Occupational Safety and Health Management Regulations, amended June 29, 2026; effective July 1, 2026.

[12] Occupational Safety and Health Administration, Ministry of Labor, “Amended Occupational Safety and Health Act and 11 Subordinate Regulations Take Effect on July 1: Focusing on Prevention at Source and a Worker-Friendly Workplace System,” July 1, 2026.