Most businesses know they need "something" for health and safety, but are not sure whether what they have qualifies as a system, or whether they need a formal one at all. This guide helps you answer that question.
Do You Need a Health and Safety Management System?
HSWA 2015 does not use the words "management system" or require a specific set of named documents. What it does require, under section 36, is that every PCBU ensures the health and safety of workers and others so far as is reasonably practicable. In practice, that means you need to be able to demonstrate that you identify hazards, manage risks, train your people, respond to incidents, and review your controls.
A management system is how you demonstrate all of that in one place. Without one, your evidence is scattered across folders, emails, and filing cabinets, and when someone asks you to prove you manage safety, you are assembling the answer in real time.
You almost certainly need a formal system if:
- You have employees or engage contractors or subcontractors
- A client, principal, or main contractor is asking for your health and safety documentation
- You are applying for or renewing SiteWise or Tōtika prequalification
- WorkSafe has contacted you or you have had a notifiable event
- Your business has grown and the informal approach that worked when it was small no longer covers your risks
If you are a sole trader with straightforward work, a lighter set of documentation may be enough. Our Sole Trader Pack covers that scenario. For everyone else, a proper system is the standard approach.
What a Health and Safety Management System Contains
The specifics are tailored to your business, but most systems cover these core areas.
| Component | What it does |
|---|---|
| Health and safety policy | Your commitment to safety and how you manage it. The document clients and principals ask to see first. |
| Hazard identification and risk assessment | A structured process for identifying what could go wrong and what you are doing about it. |
| Hazard and risk register | Every identified hazard, the risk rating, and the controls in place. A living document that gets updated as your work changes. |
| Incident and near-miss reporting | How incidents are recorded, investigated, and acted on, including the process for notifying WorkSafe of notifiable events. |
| Emergency planning | What happens in an emergency: evacuation procedures, first aid, emergency contacts, and who does what. |
| Training and competency register | Who is trained in what, when it expires, and what needs renewing. |
| Worker engagement and participation | How your people are involved in health and safety decisions, as HSWA 2015 requires. |
| Contractor management | How you select, induct, and manage anyone working for or alongside you. |
| Inspection and audit procedures | Scheduled checks to make sure the system is being used and controls are working. |
| Document control and review | How the system itself stays current. Who reviews it, how often, and what triggers a revision. |
Every component should be tailored to your business type, your number of staff, and the risks specific to your industry. A system built from a generic template with your name dropped in will not hold up when someone actually checks it.
Management System vs. Policy vs. SSSP
These terms get confused. Here is how they relate to each other.
| Document | Scope | When it applies |
|---|---|---|
| Health and safety policy | One document stating your commitment and approach | Part of the system, not the system itself |
| Management system (OHSMS) | The complete set of policies, procedures, registers, and records for your whole business | Ongoing, covers all operations |
| SSSP | One specific site or project | Created for each new job where one is required |
The management system is the foundation. Your policy is one part of it. Your SSSPs are produced from it for individual jobs. Without the system behind them, both the policy and the SSSPs lack substance.
Do You Need ISO 45001?
Probably not. AS/NZS ISO 45001 is the international standard for occupational health and safety management systems. It is voluntary in New Zealand. WorkSafe explicitly notes that conforming to the standard does not necessarily mean you are complying with the law.
What most New Zealand businesses need is a practical, working system that meets their HSWA 2015 duties and satisfies prequalification requirements. That is not the same thing as ISO 45001 certification, which involves formal auditing, ongoing surveillance, and significant cost.
A well-built management system aligns with the principles behind ISO 45001, including the Plan-Do-Check-Act cycle, without the overhead of formal certification. If you do need ISO 45001 for contractual reasons, the system gives you a strong foundation to work from.
How to Tell if What You Have Is Enough
If you already have some health and safety documentation but are not sure whether it qualifies as a working system, ask yourself these questions:
- Could you produce your hazard register right now and show it to a client?
- Does the register reflect the work you actually do today, not three years ago?
- If an incident happened this afternoon, do you have a documented process for reporting, investigating, and notifying WorkSafe if required?
- Are your training records current, and do you know which licences are expiring?
- Is there a documented emergency plan that your people have actually seen?
- If WorkSafe visited tomorrow, could you show them evidence that you actively manage risk?
If the answer to any of these is no, you either need to build a system or check whether your existing one holds up. A gap analysis is the fastest way to find out.
The Foundation for Prequalification
SiteWise, Tōtika, and other prequalification schemes assess whether you have a health and safety system that works. You cannot pass them without one.
Many businesses discover this the hard way. They apply for SiteWise, get asked for evidence across 13 assessment sections, and realise they have nothing behind the paperwork. Building the system first and then applying for prequalification is faster and cheaper than trying to do both at once and failing.
Frequently Asked Questions
Sources
- Health and Safety at Work Act 2015, section 36: primary duty of care requiring every PCBU to ensure health and safety so far as is reasonably practicable. legislation.govt.nz
- WorkSafe New Zealand, on management systems: conformance with a formal management system standard such as AS/NZS ISO 45001 does not equal compliance with the law. worksafe.govt.nz
- Health and Safety at Work (General Risk and Workplace Management) Regulations 2016: the supporting regulations covering risk management, workplace facilities, and general duties. legislation.govt.nz