What is a safety management system?

A safety management system is the set of policies, processes, responsibilities and records an organisation uses to manage health and safety systematically rather than reactively. In the UK the HSE frames it as Plan, Do, Check, Act in guidance HSG65. It is the same underlying model that ISO 45001 formalises for certification.

Why a system rather than a set of rules

Most organisations start with rules. A rule works when someone remembers it, is able to follow it, and there is a reason to. A system is what makes the outcome independent of all three.

The practical difference shows up in what happens when the safety manager leaves. If knowledge of what needs doing, when, and by whom lived in one person’s head and diary, it goes with them. If it lived in a system, the reviews still fall due, the actions still have owners, and the records still accumulate.

The other difference is evidence. After an incident, a regulator or an insurer does not ask whether you cared about safety. They ask what your arrangements were and to see the records showing they operated. Intentions leave no trace. Systems do.

Plan, Do, Check, Act

HSG65 sets out four stages, and the framing is genuinely useful because it exposes where organisations stop.

• Plan. Set the policy and the direction. Decide what good looks like, who is responsible, and what the objectives are. Establish how you will assess risk.
• Do. Put it into practice. Assess risks, decide controls, provide the resources, train people, and run the operational processes including permits, inspections and reporting.
• Check. Measure whether it is working, through active monitoring such as inspections and audits, and reactive monitoring through incidents, near misses and ill health.
• Act. Review performance, learn from what the checking found, and change the plan accordingly.

Most systems run Plan and Do adequately and then fail at Check, because checking costs time and produces uncomfortable findings. A system that never checks is not a system, it is a policy document with a distribution list.

What a working system contains

The components vary by sector and size, but a system that functions generally has these parts, and can show records for each.

• A policy that says what the organisation is committing to, signed at the top, and reviewed rather than framed.
• Defined responsibilities so that every duty has a named owner rather than a department.
• Risk assessments covering the actual activities, reviewed when things change. See what a risk assessment is.
• Operational controls including safe systems of work, permits for high risk activities, maintenance and inspection regimes.
• Competence and training records showing who is qualified for what, and when it expires.
• Consultation arrangements so workers can raise concerns and see what happened to them.
• Incident and near miss reporting that people actually use, with investigation proportionate to the potential consequence.
• Emergency arrangements that have been tested rather than written.
• Monitoring, audit and review producing findings that change the plan.

Leading and lagging indicators

How you measure the system determines how it behaves. Lagging indicators count things that already went wrong: injuries, lost time, RIDDOR reports. They are easy to collect, comparable between organisations, and almost useless for prediction, because by the time they move, the harm has happened.

Leading indicators measure whether the system is operating: inspections completed on schedule, actions closed within target, training currency, near misses reported per head, permits audited. They are messier and less comparable, and they are the ones that tell you something before an injury does.

A rising near miss count is the clearest example of why this matters. Read as a lagging indicator it looks like deterioration. Read as a leading indicator it usually means people have started trusting the reporting process, which is the outcome you wanted. Judging the two by the same logic is how organisations accidentally punish the behaviour they were trying to encourage.

Where systems break down

Four failure modes account for most of it.

• The system describes work that does not happen. Procedures written for an ideal version of the job, while the real job is done another way. Everyone knows, and the gap is never written down.
• Actions are raised and never verified. Closing an action means somebody ticked a box. Whether the cause was removed is a separate question that nobody asks.
• Reporting is discouraged by accident. Not by policy, but by a form that takes fifteen minutes, or by nothing visibly happening after a report is made.
• Review is a meeting rather than a decision. Performance is presented, noted, and the plan does not change.

None of these are solved by buying software, and it would be dishonest to suggest otherwise. What a system of record does change is the visibility of the first two, because unclosed actions and unverified fixes become countable rather than anecdotal.

Logincident