Use ISO 45001 to Support OSHA VPP Star Status
By: William A. Levinson
This article originally appears on Quality Digest, here.
Chad Kymal1 gave an excellent overview of the ISO 45001 occupational health and safety (OHS) standard that was released in March 2018. I purchased a copy of the standard, and it provides an excellent framework, modeled on Annex SL, which defines the structure of all the new ISO standards, for an OHS management system. “Management system” is important because, although workplace safety has been mandatory for decades, traditional safety departments have the same limitations as traditional quality departments: The activity in question is limited to an organizational silo, as opposed to being part of a comprehensive and integrated management system.
Kymal’s webinar pointed out that ISO 45001 is not prescriptive. It does not include product safety (a separate issue from workplace safety) or even OSHA requirements, although it is emphatically synergistic with OSHA requirements, including those for OSHA’s voluntary protection program (VPP).
Another caveat is that the body of ISO 45001 does not address process safety, which is not the same thing as occupational safety. Occupational safety relates to the avoidance of individual injuries, while process safety is concerned with ensuring that the chemical plant does not blow up. The difference is similar to that between airline flight safety and occupational safety. Actions taken to improve occupational safety and health, such as avoiding back injuries among baggage handlers, will not prevent an airplane crash, while actions that prevent airplane crashes are unlikely to prevent injuries due to poor ergonomics among baggage handlers.2
What is the Voluntary Protection Program?
OSHA states, “The Voluntary Protection Programs (VPP) promote effective worksite-based safety and health. In the VPP, management, labor, and OSHA establish cooperative relationships at workplaces that have implemented a comprehensive safety and health management system. Approval into VPP is OSHA’s official recognition of the outstanding efforts of employers and employees who have achieved exemplary occupational safety and health.”3
There are three levels: Demonstration, Merit, and Star, of which Star is the highest achievable: “Star: Recognition for employers and employees who demonstrate exemplary achievement in the prevention and control of occupational safety and health hazards—the development, implementation and continuous improvement of their safety and health management system,” and note particularly the reference to a management system. OSHA also cites the bottom-line benefits: “The average VPP worksite has a Days Away Restricted or Transferred (DART) case rate of 52 percent below the average for its industry.” In addition, “VPP participants are exempt from OSHA programmed inspections while they maintain their VPP status.”4
ISO 45001-related methods, such as workplace safety committees, can reduce a company’s experience modification rating (EMR) for worker’s compensation insurance. An EMR of 1.0 is average, 1.5 is the worst possible (the company pays 50% more than average for insurance), and 0.75 is the best possible.5
How ISO 45001 supports the VPP
OSHA provides a table that cross-references VPP requirements with the clauses of ISO 45001:2018.6 This is in the public domain as a publication of the U.S. government, and it cross-references the 2000 version of the VPP Star program with ISO 45001 as follows (figure 1). The original table also references ILO-OSH (2001), ANSI Z10 (2012), and NSC Journey to Safety Excellence (2013). My opinion is that ISO 45001, Clause 5.4—Consultation and participation of workers, applies to the first row of the table as well with regard to “employee involvement.”
CSP 03-01-003 became effective in 20087 and it is therefore more up to date regarding the VPP Star requirements. It is particularly telling that this reference (page 9) cites the same systems approach that underscores ISO standards: “A Systems Approach. Compliance with the OSH Act and all applicable OSHA requirements is only the starting point for VPP participants. VPP participants develop and implement systems to effectively identify, evaluate, prevent, and control occupational hazards so that injuries and illnesses to employees are prevented” and adds (page 10), “VPP participants must demonstrate continuous improvement in the operation and impact of their safety and health management systems. Annual VPP self-evaluations help participants measure success, identify areas needing improvement, and determine needed changes. OSHA onsite evaluation teams verify this improvement.” This is consistent with ISO 45001’s requirements for continual improvement, audits, and management reviews.
Qualification relies on four elements, the first of which draws the immediate attention of anybody who is familiar with ISO standards and ISO 45001’s recurring focus on workforce participation:
• Management leadership and employee involvement
• Worksite analysis
• Hazard prevention and control
• Safety and health training
VPP Star requirements
The requirements for VPP Star status begin on page 21 of CSP_03-01-003. “All of the VPP requirements, published in Federal Register Notice 65 FR 45650-45663 and detailed below, must be in place and working effectively for at least 1 year prior to Star approval.” The program must have achieved measurable results in the total case incidence rate (TCIR) and the Days Away Restricted or Transferred (DART) rate. “Comprehensive Safety and Health Management System Requirements. The following safety and health management system elements and sub-elements must be implemented.”
“Management Leadership and Employee Involvement” starting on page 21 cites numerous requirements that correspond to clauses of ISO 45001. Page 23 adds, and this is entirely consistent with ISO 45001’s unique focus on workforce participation, “Employee Involvement. Employees must be involved in the safety and health management system in at least three meaningful, constructive ways in addition to their right to report a hazard. Avenues for employees to have input into safety and health decisions include participation in audits, accident/incident investigations, self-inspections, suggestion programs, planning, training, job hazard analyses, and appropriate safety and health committees and teams. Employees do not meet this requirement by participating in incentive programs or simply working in a safe manner.”
Appendix C of CSP_03-01-003 warns that an evaluation is not the same thing as an audit, but there is so much overlap between what is required for the evaluation and what is expected from an audit (ISO 45001:2018, Clause 9.2) and a management review meeting (clause 9.3) that the activities are highly synergistic. The requirements for “Safety and Health Management System Annual Evaluation” on page 25 state, “There must be a system and written procedures in place to annually evaluate the safety and health management system. The annual evaluation must be a critical review and assessment of the effectiveness of all elements and sub-elements of a comprehensive safety and health management system.” The latter is certainly a focus of a management review.
Audits and inspections are different activities. An audit focuses on procedures and policies, i.e., the OHS management system, while an inspection looks for potentially unsafe conditions.8 “Safety and Health Management System Annual Evaluation” (p. 25 of CSP_03-01-003) adds:
• “The written annual evaluation must identify the strengths and weaknesses of the safety and health management system and must contain specific recommendations, time lines, and assignment of responsibility for making improvements. It must also document actions taken to satisfy the recommendations.
• “The annual evaluation may be conducted by participant employees with managers, qualified corporate staff, or outside sources who are trained in conducting such evaluations” [such as third-party auditors, noting again, however, that an evaluation and an audit are not identical activities].
• “At least one annual evaluation and demonstrated corrective action must be completed before VPP approval.
• “The annual evaluation must be included with the participant’s annual submission to OSHA. Appendix C provides a suggested format.”
Appendix C of CSP_03-01-003 says explicitly, “A self-evaluation is not a compliance audit. It is a critical review of all of the elements of the safety and health management system, including a review of participant and applicable contractors’ injury and illness data and trends.” Its content includes, however, material that would be expected in a management review meeting as well as obvious subject matter for an audit.
Appendix C adds, “The most comprehensive evaluation includes reviewing written programs, walking through the workplace, and interviewing employees. During this process participants should be answering the following questions relating to each element and sub-element of their safety and health management system:
1. “Is it comprehensive?
2. “Is it operating effectively and meeting established goals and objectives? [It is among the purposes of an audit, followed by management review, to determine this.]
3. “What improvements can be made to make it even more effective? [This is a typical output of a management review meeting.]
4. “What goal modifications should be made for the upcoming year? [This also is a typical output of a management review meeting.]”
This also is a topic that should be part of a management review meeting:
“Section C: Significant Changes or Events. Describe the impact of any significant changes (management, corporate buy-outs, etc.) and events (fatality, catastrophe, accident, complaints, etc.) and steps taken to ensure or restore employee safety and health.”
Section F of Appendix C asks for success stories, and it is quite common in audits to cite best practices as well as opportunities for improvement.
Clause 5 of ISO 9001:2015 and ISO 14001:2015 cites “Leadership,” but ISO 45001:2018, Clause 5 says, “Leadership and worker participation,” while Clause 5.4—“Consultation and participation of workers” does not appear in the other two standards. The takeaway is that ISO 45001 has a particular focus on worker participation and, as shown above, this also is a prerequisite for VPP Star status. CSP_03-01-003 mentions “appropriate safety and health committees and teams,” which can of course include workplace safety committees. Pennsylvania Training for Health and Safety (PATHS) offers frequent webinars on workplace safety committees that are available at no charge, and Pennsylvania employers can get a discount on their workers’ compensation insurance premiums by having safety committees that meet the state’s requirements.
Workplace safety committees have been used effectively for roughly 100 years. In 1920 Louis Resnick wrote, “Let us look first into the organization of the Ford Company’s Department of Safety and Factory Hygiene and its educational methods. In addition to his list of assistants, the Director has a standing safety committee of 100 workmen and foremen, each selected by his own department.”9 The Resnick article also shows that the Ford Motor Co. was almost 29 times safer than its contemporaries, which means that the methods it used got results.
The hiyari hatto (“experience of an almost-accident situation”) or near-miss report empowers the workforce and other relevant interested parties to report hazards. Various safety pyramids (e.g., Heinrich’s theory, “the predominant causes of no-injury incidents are identical with the predominant causes of incidents resulting in major injuries”10) suggest that there is about one serious injury or fatality for every 300 near misses. Although Heinrich’s theory has been questioned, it is still consistent with the principle that risk is proportional not only to the individual chance of occurrence, but also the frequency with which we are exposed to the risk.
Suppose, for example, a nurse almost attaches an enteric feeding tube to an intravenous line—a mistake that, if completed, would almost certainly kill the patient. This is more of a medical safety issue than an occupational safety issue, but the near miss should initiate CAPA to make it physically impossible to attach the wrong tube. Nestle achieved this with its SpikeRight enteric connection system, which cannot be attached to an intravenous line.
The near-miss report must initiate the kind of closed-loop corrective and preventive action (CAPA) with which we are all familiar, and the knowledge gained distributed to all those who might benefit from it. The latter is simply best-practice deployment, and it supports ISO 45001, Clause 7.4.2—“Internal communication” as well as ISO 9001:2015, Clause 7.1.6—“Organizational knowledge.”
“OSHA’s On-Site Consultation Program offers no-cost and confidential occupational safety and health services to small- and medium-sized businesses in all 50 states, the District of Columbia, and several U.S. territories, with priority given to high-hazard worksites. On-Site Consultation services are separate from enforcement and do not result in penalties or citations. Consultants from state agencies or universities work with employers to identify workplace hazards, provide advice for compliance with OSHA standards, and assist in establishing and improving safety and health programs.”11
In other words, your small or medium-sized business can get free consulting services to achieve VPP Star status, which is synergistic with ISO 45001 certification. The Pennsylvania Training for Health and Safety (PATHS) webinars are meanwhile free to attendees from anywhere in the country.
1. “First ISO Health and Safety Management System Standard Is Released,” by Chad Kymal (Quality Digest, April 4, 2018).
2. “What is Process Safety?” (CCPS Process Safety Beacon, July 2008).
3. U.S. Dept. of Labor, "All About VPP.”
4. U.S. Dept. of Labor, “Voluntary Protection Programs.”
5. “Building a Business Case for Safety,” Pennsylvania Training for Health and Safety (PATHS), May 2, 2018. The reference adds a case in which workplace safety committees reduced a company’s experience modification rating (EMR) from 1.5 to 0.75.
6. U.S. Dept. of Labor, “Recommended Practices for Safety and Health Programs Voluntary Standards Crosswalk.”
7. U.S. Dept. of Labor, OSHA Directive CSP 03-01-003 (CSP stands for “Cooperative and State Programs”).
8. Pennsylvania Training for Health and Safety, Workplace Safety Committee Initial Certification Training, Jan. 9, 2018, p. 31.
9. Resnick, Louis. 1920. “How Henry Ford Saves Men and Money.” National Safety News, Sept. 18, 1920
10. Pennsylvania Training for Health and Safety Near-Miss webinar, Feb. 27, 2018.
11. U.S. Dept. of Labor, “On-Site Consultation.”