The OHSAS 18001:1999 standard was revised in July 2007. The transition period is expected to last until July 1, 2009.

The following are notable changes in OHSAS 18001:2007, and comparisons with ISO 14001:2004.

4.1 General Requirements
No major changes.

4.2 OH&S Policy
Top management is to define, authorize, and periodically review the policy. This now includes a commitment to the prevention of injury and ill health. The policy must be communicated to all persons working under control of the organization.

4.3.1 Planning: Aspects & Hazards
Aspects and hazards must be formally documented. “Aspects” include those that can be controlled and those that can be influenced.
The 2007 version is more prescriptive on considerations for hazard ID and risk assessments (including management of change).
Hierarchy of controls for hazards: elimination, substitution, engineering controls, signs and administrative controls, and PPE.

4.3.2 Legal and Other Requirements
Must communicate relevant information on legal and other requirements to persons working under control of the organization, and other relevant interested parties.

4.3.3 Objectives, Targets, and Programs
Objectives and targets shall be measurable, where practicable.
Must consider legal and other requirements when establishing and reviewing objectives and targets.
Programs must be reviewed at regular and planned intervals, and adjusted as necessary to ensure objectives are achieved.

4.4.1 Resources, Roles, Responsibility, and Accountability
Similar requirements to ensure availability of resources (define, document, communicate). Now includes additional requirements for communicating the identity of the management appointee. Additionally, all those with management responsibility must demonstrate commitment, and all persons in the workplace must take responsibility for OH&S aspects they control, including adherence to requirements.

4.4.2 Competence, Training and Awareness
Identify training needs, train, document. Must evaluate effectiveness of training for persons working under control of (instead of “on behalf of” for EMS) the organization. The training is to take into account differing levels of responsibility, ability, language skills, literacy, and risk.

4.4.3 Communication
Requires a procedure for communication with contractors and other visitors to the workplace.

4.4.3.2 Participation and Consultation
Workers are to participate in:

• Hazard ID, risk assessment, and controls, as appropriate
• Incident investigation, as appropriate
• Development and review of OH&S policies and objectives
• Consultation for changes affecting their OH&S
• Representation on OH&S matters

The organization must inform workers on participation arrangements, and worker representatives.
Consultation with contractors where changes affect their OH&S.
Where appropriate, external interested parties are consulted.

4.4.4 Documentation
Virtually the same requirements. The challenge is to provide an adequate description of main elements, their interaction, and reference to related documents.

4.4.5 Control of Documents
No major changes.

4.4.6 Operational Control
Operations associated with identified hazards where controls are necessary. This must include management of change. Controls are required for purchased goods, equipment, services, and related to contractors and other visitors.

4.4.7 Emergency Preparedness and Response
Requires procedures to identify the potential for emergency situations, and how to respond to them. Must periodically review (and revise) and test procedures.

4.5.1 Monitoring and Measurement
Monitor and measure key characteristics that can have significant environmental impacts; and performance toward objectives.
Requires proactive monitoring for measures of effectiveness of controls (for health as well as safety), and reactive measures of performance that monitor ill health, incidents, etc.  Also record data and results of monitoring to facilitate analysis of corrective and preventive actions.

4.5.2 Evaluation of Compliance
Requires periodic evaluations of compliance with legal and other requirements. Records of the results of periodic compliance evaluations must be kept.

4.5.3.1 Incident Investigation
Record, investigate, and analyze incidents. Investigations are to be performed in a timely manner.

4.5.3.2 Nonconformity, CA/PA
Similar to EMS, except: where CA/PA identifies new or changed hazards or the need for new or changed controls, proposed actions shall be taken through risk assessment prior to implementation.

4.5.4 Control of Records
Same requirements. Establish and maintain records as necessary to demonstrate conformity. Records shall be legible, identifiable, and traceable.

4.5.5 Internal Audit
The audit must determine whether the system conforms to planned arrangements and the standards, and has been properly implemented and maintained.
The audit must determine if the system is effective in meeting the policy and objectives.  Additionally, it requires that the procedure includes competencies for planning and conducting audits.

4.6 Management Review
Relevant outputs must be made available for communication and consultation.