WHS Management System: What It Is, What Goes In It and How to Prove It Works

A WHS management system is the set of policies, procedures, plans and records a business uses to manage work health and safety systematically: identifying hazards and controlling risks, consulting workers, training people, managing contractors, reporting incidents, and checking the thing works. It covers the business, not a single project, and no Australian WHS law requires one by that name.

Plenty of clients, principal contractors and government funders do require one. A safety management system is the same thing by another name. This is general information, not legal advice. Section and regulation numbers below are from the Queensland WHS Act and Regulation, which carry the model laws; Victoria runs its own OHS law, and the regulator where the work happens is the authority.

System, plan, policy: three documents people mix up

Comcare’s page on WHS management systems makes the point that matters most: a system is much more than having safety forms, policies and documented procedures. It is doing what those documents say, in an ongoing and managed way. A binder on a shelf is documentation. A system is the binder plus the evidence that somebody uses it.

The plan is where the confusion starts. A principal contractor must have a written WHS management plan for each construction project; our guide to principal contractor duties covers what goes in it and offers a free WHS management plan template. The system sits above every plan and feeds it the incident arrangements, consultation arrangements and site rules, which is why a contractor with a working system writes a project plan in an afternoon, and one without spends a week copying the last job’s plan and changing the address.

The eight elements of a WHS management system

ISO 45001 builds the system around a policy, planning, operation, auditing and review on a plan-do-check-act cycle, and Comcare groups its evidence differently again. For a field business the working list comes out at eight, and each should leave a record.

Risk management is the engine. Safe Work Australia’s managing risks page sets out four steps (identify hazards, assess risks, control risks, review control measures) and says you must consult workers and their health and safety representatives at each one. Regulation 36 fixes the order of controls: substitution, isolation or engineering first, then administrative controls, and PPE last. Regulation 38 lists when a control must be reviewed: it is not working, a workplace change may bring a new risk, a new hazard turns up, consultation calls for it, or an HSR asks. That is a ready-made review procedure, and better than many written ones. The JSA template and SWMS guides cover the task-level forms, and psychosocial hazards belong in the same register as falls and plant.

Consultation is the element most often done and least often recorded. Section 49 of the WHS Act requires it when identifying hazards, deciding on controls, proposing changes, and deciding the procedures for consulting, resolving issues, monitoring and training. So the system’s own procedures get consulted on, not handed down, and a toolbox talk with an attendance list is the record.

Contractor management is where office-built systems fall over. The primary duty in section 19 covers workers a business engages, and workers whose activities it influences or directs, which takes in the subbie’s crew. Subcontractors in a separate spreadsheet are a hole in the system exactly where blended crews make it hardest to see; the subcontractor onboarding checklist covers the pack.

Incident reporting has to beat the walk to the site office, or near misses go unreported. Our guide to incident reports and notifiable incidents covers what to capture and when the regulator must be told.

Is a WHS management system a legal requirement?

Not by that name, for most businesses. The model WHS Act sets duties, not formats: “safety management systems” appears once in the Queensland Act, in the schedule of matters regulations may cover, and Comcare frames a system as something an employer can choose to establish to help meet its duties.

The duties describe a system in everything but name. Section 19 requires a PCBU to ensure, so far as is reasonably practicable, safe systems of work, the information, training, instruction or supervision needed to protect people, and monitoring of workers’ health and workplace conditions. Section 27 says an officer’s due diligence includes reasonable steps to ensure the business has and uses processes to eliminate or minimise risks, to receive and respond to information about incidents and hazards, and to comply with its duties, and to verify those processes are used. Beside the eight elements, the overlap is close to complete: an officer asked how they verified it will be describing a WHS management system, whatever they call it.

Three places a system becomes compulsory in practice:

• Some licences. An applicant for a class A asbestos removal licence must give evidence of a certified safety management system (regulation 493), and the regulator must be satisfied of it (regulation 498). The Regulation defines that as one complying with AS 4801:2001 or an equivalent the regulator determines.
• Commonwealth-funded building work, through the Federal Safety Commissioner’s scheme below.
• Contracts and prequalification. Principal contractors routinely ask a subcontractor for a safety management plan or system, a WHS policy and a risk register before its crew sets foot on site. The law did not require it; the contract does.

ISO 45001 and certification

AS/NZS ISO 45001:2018 is the Australian standard for WHS management systems. Comcare suggests a sensible start: compare the intent of each element of the standard with what your business already does. Most have more of a system than they thought, just not joined up.

ISO’s page for the standard lists its key elements as leadership commitment, worker participation, hazard identification and risk assessment, legal compliance, emergency planning, incident investigation and continual improvement. It also answers the question most small contractors are really asking: certification by a third-party body is available, but optional. Some organisations implement the standard for the practice in it; others certify to reassure customers.

ISO lists the 2018 edition as current, with a 2024 amendment on climate action, and plans a revision for publication as ISO 45001:2027, so ask a certification body how it will handle the new edition before you start.

Certification earns its cost when a client or tender panel asks for it. For a 12-person crew whose clients never ask, it mostly does not. A certificate shows the system met the standard on audit day; the records show whether it ran on the other 364.

The Federal Safety Commissioner’s WHS Accreditation Scheme

For builders chasing Commonwealth-funded work, the system is audited by government. Under the Federal Safety Commissioner Act 2022, only builders accredited under the WHS Accreditation Scheme can enter head contracts for building work funded directly or indirectly by the Australian Government, subject to the thresholds the Office of the Federal Safety Commissioner (OFSC) sets out:

Accreditation is an online application followed by on-site audits of the builder’s WHS systems and practices. The OFSC says there are no fees, more than 550 companies hold it, and it is automatically recognised against the WHS elements of the building prequalification schemes in every state and territory except Tasmania. Building work is defined widely, earthmoving and scaffolding included.

The scheme accredits the head contractor, whose responsibilities the OFSC says include engaging subcontractors and making sure the scheme’s requirements are met. For a subbie, that means a longer pack at the gate.

What a WHS policy says

The policy is the front page of the system. Comcare’s features of a good policy: it states matters of principle, focuses on action (what is to be done and by whom), is made by a person or body with the power to make it, and suits the nature and scale of the business’s risks. For a field business that comes to about a page:

• The commitment in plain words, signed and dated by the most senior person.
• Who it covers: employees, labour hire, subcontractors and visitors, on every site.
• Who is responsible for what, by role, from director to leading hand.
• How workers are consulted, and how anyone raises a hazard and what happens next.
• The next review date.

A template signed unchanged reads like one. If your supervisors could not give its gist at a prestart, it is decoration.

Paper, spreadsheets or software

A small crew on one or two sites can run a sound system on paper; the law does not care about the medium. Paper fails in predictable places: the prestart that lives in a ute, the ticket register nobody opens while building Monday’s roster, and the subbie whose certificate of currency lapsed in March and was noticed in June. Time to change is when several sites, mixed crews and a client asking for records arrive in the same month.

Software does not make a system; it makes records harder to lose. Dedicated safety management products tend to be strongest on risk registers, audits and investigations, workforce platforms on credentials, inductions, forms and the roster. Our guide to choosing WHS software for field crews has the vendor questions.

The records that prove a WHS management system works

When an inspector, principal contractor or insurer asks whether your system works, they mean “show me”. The answer is dated records tied to people:

• The signed policy with a current review date.
• The risk register, with each control’s last review and what triggered it.
• Toolbox talk and prestart records with attendance.
• Induction and credential registers by worker and site (see qualification and induction tracking).
• A pack per subbie: insurances, licences, worker tickets, SWMS.
• Incident, hazard and near-miss reports with actions closed out; each notifiable incident’s record kept at least 5 years from the day the regulator is notified (WHS Act section 38).
• Inspection and audit findings with close-out dates.
• Injury rates with the hours behind them (TRIFR and LTIFR covers the arithmetic).
• Management review minutes that record a decision, not just attendance.

The test that separates a system from a binder: pick one worker and one day, and time how long it takes to show what they were cleared for and what they signed before starting. Ten minutes and the system runs. A box of paperwork in a ute somewhere near Gladstone and it exists, technically.

How Humanz fits

Humanz is a workforce management platform for field crews, and it carries the people side of a WHS management system. Every worker, whether employee, labour hire or subcontractor, has a profile of licences, tickets, inductions and competencies with expiry dates, and alerts reach the worker until the item is renewed. Compliance rules set per client and per site flag or block a worker who is not cleared when a shift is booked.

Prestarts, toolbox talks, inductions and incident reports are custom forms with mandatory questions and photo and signature capture, completed on phones (offline if the signal drops), timestamped and stored against the job. Certificates sit in a document portal with version control, and every record carries who entered it, who approved it and what changed.

The limits: Humanz does not write your policy, assess hazards, choose controls, decide whether an incident is notifiable, notify the regulator, investigate incidents or give safety or legal advice. It does not use AI to generate or assess anything and does not track a worker’s location. If your system’s weight sits in audit programs and investigations, a dedicated safety product may be the stronger tool, with Humanz holding the crew records beside it. To see your induction and ticket requirements set up as rules, walk through it with our team.

Frequently asked questions

What is a WHS management system?

A WHS management system is the set of policies, procedures, plans and records a business uses to manage work health and safety across all its work. It typically covers a WHS policy and responsibilities, risk management, consultation, training and competency, contractor management, incident reporting and investigation, monitoring and audit, and management review. It is also called a safety management system, and the Australian standard for one is AS/NZS ISO 45001:2018.

Is a safety management system the same as a WHS management system?

Yes, they are two names for the same thing. Both describe the policies, procedures, plans and records a business uses to manage health and safety systematically, and AS/NZS ISO 45001:2018 is the Australian standard for either. The WHS Regulation also uses the term certified safety management system, meaning one that complies with AS 4801:2001 or an equivalent system the regulator determines, which an applicant for a class A asbestos removal licence must have in place.

Is a WHS management system a legal requirement in Australia?

Not by that name for most businesses. The WHS Acts set duties rather than formats, including safe systems of work, consulting workers and, for officers, due diligence to ensure the business has and uses processes to manage risks. A documented system is the usual way to meet and demonstrate those duties, and some licences, Commonwealth-funded building contracts and principal contractors require one outright.

What is the difference between a WHS management system and a WHS management plan?

A WHS management system covers the whole business and every job it does, while a WHS management plan covers one construction project. The plan is a legal requirement for the principal contractor and must be written before work on the project starts. A working system supplies the plan’s consultation, incident and site rule arrangements.

Do you need ISO 45001 certification?

No, ISO 45001 certification is voluntary. A business can implement the standard without certifying, or have a third-party certification body audit its system. Certification is mainly worth the cost when clients, tender panels or prequalification schemes ask for it. Commonwealth-funded building work above the funding thresholds has a separate requirement: the head contractor must hold Federal Safety Commissioner accreditation.

What should a WHS policy include?

A WHS policy should state the business’s commitment to health and safety, who it covers, who is responsible for what, how workers are consulted and raise concerns, and when it will be reviewed. It should be signed by the most senior person, suit the nature and scale of the business’s risks, and fit on about one page.

What is the Federal Safety Commissioner’s WHS Accreditation Scheme?

It is the scheme under the Federal Safety Commissioner Act 2022 that decides which builders can take head contracts for Australian Government funded building work. Accreditation is required for directly funded projects worth $4 million or more, and for indirectly funded projects with $4 million or more of building work where the Commonwealth contributes at least $6 million and at least half the project, or $10 million or more regardless of share. Builders apply online and are audited on site, with no fees, and accreditation is recognised against the WHS elements of the building prequalification schemes in every state and territory except Tasmania.