Introduction
If you've ever traced a near-miss back to a new piece of equipment that wasn't properly assessed — or received an audit finding because your OHSMS didn't reflect how work actually gets done — Clause 8.1.3 is where those problems originate.
ISO 45001 Clause 8.1.3 requires organizations to establish a formal process for implementing and controlling both planned and unintended changes that affect occupational health and safety (OH&S) performance. It exists because change is one of the most consistent sources of new workplace hazards.
New equipment installations, process modifications, workforce restructuring, facility moves — each can invalidate controls that were previously effective. Without a formal review step, workers end up exposed to hazards no one evaluated.
As of the 2023 ISO Survey, ISO 45001:2018 holds 185,166 valid certificates covering 309,056 sites worldwide. Every one of those certified sites is expected to have this clause working in practice — not just on paper.
Key Takeaways
- Clause 8.1.3 requires a defined process for managing both planned (temporary or permanent) and unintended changes that affect OH&S performance.
- Four change categories trigger the process: new or modified products/services/processes, legal requirements, updated hazard knowledge, and technological developments.
- Unintended changes — not just formally proposed ones — must be reviewed and mitigated.
- The process must address hazard identification, risk assessment, controls, communication, and training before changes go live.
- Effective change management actively controls risk — it drives operational decisions, not paperwork.
What Is ISO 45001 Clause 8.1.3: Management of Change?
The Exact Standard Language
The ISO 45001:2018 standard states:
"The organization shall establish a process(es) for the implementation and control of planned temporary and permanent changes that impact OH&S performance... The organization shall review the consequences of unintended changes, taking action to mitigate any adverse effects, as necessary."
The clause specifies four trigger categories (detailed in the next section) and adds a note that changes can result in both risks and opportunities.
What "Management of Change" Means in Practice
Operationally, this clause functions as a required checkpoint: assess the safety impact before implementation, not after. It is not a retroactive documentation exercise. The standard's intent is proactive — assess first, implement second.
Many organizations get this backwards, documenting changes after the fact to create an audit trail. Auditors recognize the pattern immediately, and post-hoc documentation neither satisfies the standard nor prevents the incident it was meant to avoid.
Where Clause 8.1.3 Sits in the Standard
| Clause | Heading | Function |
|---|---|---|
| 6.1 | Planning | Identifies hazards and addresses risks during planning |
| 8.1.2 | Eliminating hazards | Establishes the hierarchy of controls |
| 8.1.3 | Management of change | Controls planned changes; reviews unintended ones |
| 8.1.4 | Procurement | Covers contractors and outsourced processes |
Clause 8 is the "Do" phase of the PDCA cycle. Where Clause 6.1 plans for risks and opportunities, Clause 8.1.3 governs operational execution when changes occur.
Why Managing Change Is Critical for OH&S Performance
The Safety Rationale
HSE's organizational change guidance is direct: staffing reductions, outsourcing, delayering, and process modifications can compromise the controls that prevent major accidents. Their plant modification guidance adds that poor control of modifications often increases risk not just at the modification point, but in areas remote from it.
These failures follow a consistent pattern: a change is made with good intentions, existing hazard controls aren't re-evaluated against the new state, and workers are exposed to something nobody formally assessed.
What Happens Without It
When change management is absent or treated as a paperwork exercise:
- New hazards enter operations without going through risk assessment
- Workers encounter unfamiliar conditions without adequate training or warning
- The OHSMS falls out of sync with actual operations — creating both safety exposure and audit nonconformances
- Controls designed for the old process remain on paper while the new process runs without them
The 2024 CSB investigation into the BP-Husky Toledo refinery fire illustrates this directly. A planned valve replacement in 2019 included a management of change review — but that review defined the change too narrowly and failed to analyze liquid naphtha backflow through connected piping under abnormal conditions. In September 2022, more than 23,000 lb of naphtha was released and ignited, killing two employees and causing approximately $597M in damage. The MOC process existed; it just didn't examine the right scenarios.
How Clause 8.1.3 Connects to the Rest of the OHSMS
Clause 8.1.3 doesn't function in isolation. Changes identified here must:
- Feed back into hazard identification (Clause 6.1.2)
- Be communicated internally (Clause 7.4.2)
- Inform management review (Clause 9.3)
- Drive corrective action when adverse effects occur (Clause 10.2)
When these linkages break down, the OHSMS loses coherence: hazard registers go stale, corrective actions miss the root cause, and management reviews are built on outdated operational data.
How the ISO 45001 Clause 8.1.3 Change Management Process Works
The Four Trigger Categories
The standard specifies exactly which categories of change activate the management of change process:
| Trigger | What It Covers | Example |
|---|---|---|
| Products, services, and processes | New or modified processes, locations, work organization, conditions, equipment, workforce | Installing a new CNC machine or restructuring shift patterns |
| Legal and other requirements | Changes to applicable laws, regulations, or other requirements | A revised OSHA standard affecting confined space procedures |
| Hazard and risk knowledge | New or updated information about hazards and OH&S risks | A new toxicology study on a chemical you use |
| Knowledge and technology | Developments in knowledge or technology | New engineering controls becoming available for a known hazard |
The first category is deliberately broad — it covers organizational changes (workforce restructuring, supervision changes) as readily as equipment changes.
Planned vs. Unintended Changes
These are two distinct obligations under the clause:
- Planned changes — temporary or permanent — follow the proactive process below. They're formally proposed, assessed, controlled, and approved before implementation.
- Unintended changes — an unapproved material substitution, an informal procedure shortcut, an equipment swap made without authorization — must be identified after the fact and reviewed for adverse OH&S effects, with corrective action taken as needed.
Organizations that only document formally proposed changes and ignore informal ones are leaving the second obligation unaddressed.
Step 1: Identify, Classify, and Initiate the Change
Any employee, department, or management function proposing a change that may affect OH&S submits a formal change request capturing:
- Nature and description of the change
- Reason for the change
- Scope of affected areas, processes, or personnel
- Preliminary view of potential OH&S impact
The standard is flexible on format — digital forms, paper-based systems, or integrated management system platforms all qualify — but a consistent, documented process is required.
For organizations managing multiple sites or departments, a centralized system — such as a cloud-based intranet hosting all controlled documents and records in one place — simplifies version control and keeps procedures consistent across sites.
Step 2: Assess OH&S Risks and Determine Controls
Before approval, the organization must evaluate:
- Whether the change introduces new hazards
- Whether existing controls remain effective under the new conditions
- What the overall OH&S risk profile of the change looks like
This assessment should reference the hierarchy of controls from Clause 8.1.2, prioritizing elimination and substitution before defaulting to administrative controls or PPE. As the BP-Husky refinery incident demonstrated, the assessment must examine abnormal and off-normal operating conditions — not just routine operation.
Once the risk assessment is complete, a designated authority reviews the findings and either approves the change with specified controls, requests modifications, or rejects it. Document both the decision and the rationale.
Step 3: Implement, Communicate, and Monitor
Competent personnel execute approved changes with specified controls in place, keeping affected workers informed. Key requirements:
- Communicate changes to affected workers — Clause 7.4.2 explicitly requires internal communication of OHSMS updates
- Train personnel when the change alters tasks, equipment, or procedures that affect how people work
- Involve workers early: Clause 5.4 requires consultation and participation in hazard identification, risk assessment, and control decisions — worker input belongs in the assessment phase, not just after approval
- Monitor outcomes after implementation to confirm the change achieved its intended result without introducing new adverse effects
- Documentation updates: Update procedures, risk registers, job safety analyses, and any other OHSMS documentation that reflects the changed state
Records of the full cycle — change request, risk assessment, approval decision, implementation, training, monitoring — must be retained to demonstrate compliance during audit.
Common Mistakes in Implementing Clause 8.1.3
These patterns generate audit findings — and leave real safety gaps:
Applying the same process depth to every change. A minor administrative update doesn't need the same rigor as a new production line installation. The standard doesn't mandate one-size-fits-all, yet many organizations either over-bureaucratize small changes or under-assess large ones.
Only managing planned changes. Clause 8.1.3 explicitly requires reviewing unintended changes. Documenting only formally proposed changes fails this requirement — and misses the hazards that informal changes quietly introduce.
Conducting risk assessments after implementation. The clause's entire protective value depends on assessment before exposure, not after. Post-implementation review satisfies neither the standard nor worker safety.
Excluding workers from the assessment phase. ISO 45001 places significant weight on worker participation (Clause 5.4). People who do the work routinely know about hazards that never appear in any formal hazard register — their input is required, not optional.
Running it as a standalone procedure. Clause 8.1.3 must connect to hazard identification, risk assessment, competence management, internal communication, and management review. Organizations that treat it as a separate process — disconnected from the broader OHSMS — often produce documentation that satisfies auditors on the surface without reducing actual risk.
Conclusion
Clause 8.1.3 requires a defined, documented, and consistently applied process that ensures no planned or unintended change alters OH&S performance without first being assessed, controlled, communicated, and recorded.
Done well, this clause is one of the most operationally significant in the standard — because it's the mechanism by which your OHSMS stays aligned with how work actually happens, rather than how it happened when the system was first built. Organizations that implement it effectively protect their workers, stay audit-ready, and build a safety culture that responds to how operations actually evolve — not just how they looked on day one.
Building that process from scratch — or closing gaps in an existing one — is where many organizations stall. Synergistic Systems has guided ISO 45001 implementations across manufacturing, oil and gas, food processing, and construction for over 25 years, and offers a complimentary discovery meeting to help organizations map exactly what a complete Clause 8.1.3 procedure needs to cover for their specific operations.
Reach their Plano, TX office at (972) 415-9217 or connect through e-ssy.com.
Frequently Asked Questions
What is ISO 45001 Clause 8.1.3 Management of Change?
Clause 8.1.3 requires organizations to establish a formal process for identifying, assessing, controlling, and documenting both planned and unintended changes that may impact OH&S performance. It covers four trigger categories — see the question below for the full breakdown.
What is Clause 8 of ISO 45001?
Clause 8 covers "Operation" — the implementation phase of the OH&S management system — and represents the "Do" stage of the PDCA cycle. Sub-clause 8.1 addresses operational planning and control (including hazard elimination, management of change, and procurement); sub-clause 8.2 covers emergency preparedness and response.
What types of changes must be managed under ISO 45001 Clause 8.1.3?
The standard specifies four categories:
- Changes to products, services, or processes (including equipment, workforce, work organization, and locations)
- Changes to legal or other applicable requirements
- New or updated knowledge about hazards or OH&S risks
- Developments in knowledge or technology
What is the difference between planned and unintended changes under Clause 8.1.3?
Planned changes are formally proposed and assessed before implementation. Unintended changes occur without formal authorization — such as unapproved material substitutions or informal procedure modifications — and must be reviewed after the fact to identify and mitigate any adverse OH&S effects.
Does ISO 45001 Clause 8.1.3 require documented procedures and records?
Yes. While the standard is flexible on format, organizations must retain documented information covering the change request, risk assessment, control decisions, communications, training, and monitoring outcomes. This documentation is what auditors will look for to confirm compliance.
How does Clause 8.1.3 connect to hazard identification and risk assessment?
Any change subject to Clause 8.1.3 must be evaluated through the organization's hazard identification and OH&S risk assessment process (Clause 6.1.2) before implementation. This ensures that new hazards introduced by the change are identified and controlled before workers are exposed to them.
