Can an ISO 45001 consultant certify a company?

No. A consultant can support implementation, training and internal audit. Independent certification bodies perform certification.

ISO 45001:2018 Consultant Malaysia for Industrial Operations: Integrating HIRARC, Contractor Control, Emergency Preparedness, Incident Investigation and Management Review

Q: Is ISO 45001:2018 suitable for a small Malaysian factory or warehouse?

Yes. ISO 45001 applies to organisations of all sizes and sectors. A smaller operation can use a proportionate system when responsibilities, controls, competence and evidence remain clear and effective.

Q: Is HIRARC the same as ISO 45001?

No. HIRARC is a hazard identification, risk assessment, risk control and review process. ISO 45001 is the wider OH&S management-system framework that integrates risk work with leadership, participation, competence, controls, emergency readiness, evaluation and improvement.

Q: What evidence should contractor control produce?

Evidence should demonstrate capability assessment, scope-specific planning, induction, permit or isolation coordination where relevant, risk-based supervision, change escalation, completion checks and performance evaluation.

Q: How often should an industrial emergency drill be conducted?

Frequency and scenarios should follow site risks, applicable obligations, emergency arrangements, changes and past drill results. A controlled programme should use findings to determine retesting and additional practice.

1. Why industrial ISO 45001 systems break at the work interface

Industrial sites may have safety policies, toolbox talks and incident forms, yet still lose control when production changes, maintenance begins, a contractor enters the work area or abnormal conditions develop. The central implementation problem is often the connection between the safety document and the real task.

ISO 45001:2018 is the current international OH&S management-system standard. ISO describes its purpose as helping organisations prevent work-related injury and ill health, manage OH&S risks and continually improve OH&S performance. It applies to organisations of all sizes and sectors.[1]

Industrial gap	Operational consequence	Evidence-led response
HIRARC does not reflect changed equipment or abnormal work	Controls are designed for an old task, not current exposure.	Review before change and after incidents; maintain a revision trail and worker briefing record.
Contractors are managed only at gate entry	High-risk interfaces proceed without clear coordination.	Use prequalification, scope planning, induction, permit coordination, supervision and close-out.
Drill findings do not reach operations and maintenance	Emergency weaknesses repeat when conditions are real.	Assign actions, verify closure and retest critical controls.
Incidents are closed after identifying an individual error	System factors remain and the event can recur.	Analyse immediate, contributing and management-system causes; check corrective-action effectiveness.

2. The industrial OH&S control cycle

The following lifecycle keeps risk control connected to operations. It is a practical implementation framework, not a substitute for a site-specific legal assessment or competent technical advice.

ISO 45001 industrial OH&S control cycle: industrial context, HIRARC, operational controls, emergency preparedness, incident learning and management review. — ISO 45001:2018 industrial OH&S control cycle. Each stage should create decision-useful evidence for the next.

3. Make HIRARC a control-design process

DOSH guidance describes risk management as hazard identification, risk assessment, risk control and review of control measures.[2] A HIRARC register becomes useful only when it divides work into meaningful operating situations. A packaging line, for example, may need separate assessments for normal running, jam clearing, cleaning, blade change, electrical isolation, forklift loading, changeover and breakdown recovery.

HIRARC question	What an industrial record should show
What can cause harm?	Task-specific mechanical, electrical, chemical, ergonomic, traffic, work-at-height, confined-space, biological and other relevant hazards.
Who can be affected?	Employees, temporary workers, visitors, drivers, maintenance personnel, contractors and people near the interface.
What controls are expected?	Elimination, substitution, engineering, administrative and PPE controls, including exact safeguards, isolations or permit conditions.
Who owns the control and how is it checked?	A named role and an inspection, test, observation, maintenance record, competency check or other effectiveness check.

Practical control principle: PPE can be necessary, but it should not be the only response where a guarding, ventilation, isolation, layout or process control can better eliminate or reduce the risk at source.

4. Treat contractor control as an operating interface

Company and contractor responsibilities meet at the work boundary. The company may control the site, plant energy sources, traffic plan and emergency arrangements, while the contractor controls specialist labour, equipment and work methods. Both sides need coordinated, risk-based control.

DOSH guidance emphasises competence, supervision, instruction, communication and coordination according to the risk involved.[2] A working contractor-control system therefore goes beyond a procurement checklist.

Control point	Practical industrial action	Audit-ready evidence
Selection	Assess competence, relevant experience, resources and equipment suitability for the work.	Approved-contractor register and evaluation.
Pre-job planning	Define work boundary, sequence, simultaneous operations, isolation, permits, traffic and emergency arrangements.	Scope, risk assessment, method statement and coordination record.
Induction and supervision	Confirm site-specific induction and set supervision based on task risk.	Induction record, competency evidence and supervisor observations.
Change and close-out	Stop and escalate when conditions differ; inspect area and close permits after work.	Permit revalidation, change record and completion inspection.

5. Test emergency readiness and learn from incidents

Emergency preparedness is not limited to an evacuation map. Select credible scenarios that follow the site’s hazards, such as chemical release, fire, electrical shock, machine entrapment, forklift collision, confined-space emergency, loss of utilities or contractor incident. Test alarm, communication, muster, casualty management, isolation, external-response contact, traffic control and recovery decisions.

Incident investigation should also look beyond individual behaviour. In a forklift collision, relevant questions can include route segregation, line of sight, loading-bay layout, lighting, congestion, training, maintenance, supervision, delivery scheduling and temporary change. The aim is to remove or strengthen the system factors that management can control.

Effectiveness test: A corrective action is not complete because it is marked “done.” It is complete when the organisation has checked that the revised control is present, understood and effective under normal and abnormal conditions.

6. Use management review to release resources and drive improvement

Management review should test whether preventive controls are working, not only whether reports exist. ISO highlights leadership commitment and worker participation as central ISO 45001 themes.[1] A management-review agenda must therefore include the information leaders need to make decisions.

Review input	Decision it should support
HIRARC changes, high-risk tasks and overdue reviews	Whether changed operations, risk controls or resourcing require immediate action.
Contractor and permit performance	Whether selection, coordination, supervision or procurement controls need redesign.
Drill findings and emergency readiness	Whether equipment, roles, training, layout or external coordination requires investment.
Near misses, incidents and action effectiveness	Whether repeating patterns point to design, maintenance, competence or culture weaknesses.
Worker consultation and leading indicators	Whether frontline feedback identifies impractical controls or emerging exposure.

7. A practical ISO 45001 implementation sequence

Set scope and leadership ownership.
Define facilities, activities, shifts, people, contractor interfaces and decision roles.

Establish context and obligations.
Maintain a method for identifying legal and other requirements; obtain competent advice for uncertain duties or interpretations.

Refresh HIRARC around actual work.
Include routine, non-routine, abnormal and emergency conditions, contractors and planned changes.

Embed controls and competence.
Integrate permits, isolations, inspections, maintenance, training, supervision and worker consultation into operating work.

Test, evaluate and improve.
Conduct realistic drills, learn from events, run internal audits, review effectiveness and act through management review.

A consultant can support a gap assessment, implementation plan, documentation design, training and internal-audit readiness. Certification remains the independent role of a certification body; ISO itself does not certify organisations.[1]

8. Frequently asked questions

Is ISO 45001:2018 suitable for a small Malaysian factory or warehouse?

Yes. ISO states that ISO 45001 applies to organisations of all sizes and sectors. A smaller operation should keep its system proportionate, while maintaining clear responsibility, applied controls, competence and evidence.[1]

Is HIRARC the same as ISO 45001?

No. HIRARC is a hazard-identification, risk-assessment, risk-control and review process. ISO 45001 is the broader OH&S management-system framework that integrates risk work with leadership, participation, competence, operations, evaluation and continual improvement.[1] [2]

What evidence should contractor control produce?

Evidence should show capability assessment, scope-specific planning, induction, permits or isolation coordination where relevant, risk-based supervision, change escalation, completion checks and contractor-performance evaluation.

How often should an industrial emergency drill be conducted?

Frequency and scenario choice should reflect site risks, applicable obligations, changes, emergency arrangements and prior drill findings. Use a controlled drill programme and retest controls where a critical weakness appears.

What leading indicators are useful for management review?

Useful leading indicators test preventive control performance before injury occurs: high-risk-control inspections, overdue HIRARC reviews, permit-verification findings, corrective-action effectiveness checks, closed drill actions and worker-reported hazards resolved.

Can an ISO 45001 consultant certify my company?

No. A consultant can support implementation, training and internal audit. ISO explains that certification is carried out by independent certification bodies.[1]

Turn industrial safety controls into a system that works on the floor.

Discuss HIRARC, contractor coordination, emergency readiness, incident learning and ISO 45001:2018 audit preparation with CAYS Scientific in Klang, Selangor.

Talk to CAYS Scientific