Safety Management System Explained: Parts, Legal Duties & ISO 45001

Ask ten safety managers what their safety management system is and you will hear about a manual, a software login, an ISO certificate, and a set of forms in a shared drive. None of those is the system. This guide sets out what a safety management system actually is, what goes in one, and the places where Australian law requires one by name.

The worked example is a road freight depot in transport and logistics, where the rules changed on 1 August 2026, with a note for property and facilities management. It is an illustration, not a customer.

What Is a Safety Management System?

A safety management system is the way a business manages health and safety on purpose rather than by habit: the policies, procedures, plans, and records it uses to find hazards, control the risks, and check the controls work. Comcare defines a workplace health and safety management system as a set of policies, procedures, and plans that systematically manages health and safety at work and can help to minimise the risk of injury and illness from workplace operations.¹

The working parts are more concrete than the definition. The Australian Government's Creative Workplaces guidance lists five things an effective system has: a process to identify hazards and risks, safe systems of work communicated to workers, a process for providing and recording training and instruction, ways to consult workers, and a process for providing and maintaining safe equipment and workspaces.²

The Commonwealth regulator's page adds the part most systems miss. It says a management system is much more than having safety forms, policies, and documented procedures in place; it evolves, uses feedback to improve, and builds on the processes a business already runs.¹ A folder of procedures nobody follows is paperwork. A short list of procedures that are used, checked, and changed when they fail is a system.

Is a WHS Management System the Same Thing?

Yes. Safety management system, WHS management system, OHS management system, and health and safety management system all describe the same thing. Comcare uses "workplace health and safety management system", WorkSafe Victoria uses "occupational health and safety management system", and the heavy vehicle, rail, maritime, and aviation regulators say "safety management system".¹³

Two things share the words and are different. A construction project's WHS management plan is a written plan the principal contractor prepares for one project before work starts, under regulation 309 of the model WHS Regulations.⁴ It covers one site for one job. The safety management system is how the whole business runs safety, project after project.

Is a Safety Management System a Legal Requirement in Australia?

Not by that name, for an ordinary business. We searched the full text of the model WHS Act and the model WHS Regulations as at 5 December 2025. The Act uses the phrase only once, in a schedule listing matters the regulations may deal with, and no regulation requires every business to have one.⁵⁴

What the law requires is the work a system does. Under section 19 of the model WHS Act, a person conducting a business or undertaking must ensure, so far as is reasonably practicable, the health and safety of workers it engages or causes to be engaged and of workers whose work it influences or directs, and that the health and safety of other persons is not put at risk from its work, including by providing and maintaining safe systems of work.⁵ Where the Regulations require a risk to be managed, regulations 34 to 38 set out how: identify reasonably foreseeable hazards, eliminate risks so far as is reasonably practicable or, if that is not reasonably practicable, minimise them so far as is reasonably practicable, maintain the controls, and review them.⁴

Officers carry their own duty. Section 27 requires an officer to exercise due diligence, which includes taking reasonable steps to ensure the business has, and uses, appropriate resources and processes to eliminate or minimise risks, and to verify that those resources and processes are provided and used.⁵ In practice, a director who wants to show that is asking for a system, whatever it is called.

The model laws have been implemented in every jurisdiction except Victoria, which has its own Act, and some jurisdictions have made variations.⁶ WorkSafe Victoria describes an OHS management system as a way to improve safety performance and compliance, and lists demonstrating that the organisation is meeting legal requirements among its benefits.³ Check your own state's version before quoting a regulation number.

Where the Law Names a Safety Management System.

A handful of regimes require one by name. Two of them matter to logistics businesses, and one to anyone managing old buildings.

Heavy vehicle accreditation. The NHVR says it is not mandatory under the Heavy Vehicle National Law to have a safety management system, but an operator seeking heavy vehicle accreditation must establish and implement one that complies with the Safety Management System Standard.⁷ The new Heavy Vehicle Accreditation scheme took effect on 1 August 2026, and from that date the NHVR can no longer grant new accreditation under the old scheme.⁸ The standard was approved by responsible Ministers on 13 May 2026, and it says compliance is assessed on evidence that the system is effective in managing public risk, not merely on the existence of documents.⁹

General Safety Accreditation is the entry tier, and an operator gets it by passing an audit that verifies its system complies with the standard.¹⁰ The NHVR contrasts the two schemes plainly: the old one audited systems for selected modules such as mass, maintenance, and fatigue; the new one audits a whole-of-business safety management system.¹¹ Existing accreditations under the old scheme stay valid until they expire, so most operators are moving across over the next few years rather than all at once.

Rail, ships, and aircraft. The Office of the National Rail Safety Regulator says having an appropriate safety management system in place is a legislative requirement of accreditation for rail transport operators.¹² AMSA says all domestic commercial vessels must have one.¹³ CASA lists the aviation operators who must, including holders of an air operator's certificate under Part 119 of the Civil Aviation Safety Regulations 1998.¹⁴

Major hazard facilities and asbestos removal. Under regulation 558 of the model WHS Regulations, the operator of a determined major hazard facility must establish a safety management system, documented and covering the matters in Schedule 17, and implement it so far as is reasonably practicable.⁴ The same Regulations require a certified safety management system for a Class A asbestos removal licence.⁴ For a facilities manager, that is a question to ask the removalist before friable asbestos comes out of a plant room.

The Parts of a Safety Management System.

Every framework published by an Australian regulator describes the same cycle in different words. WorkSafe Victoria's has five steps: top management commitment and policy, planning, implementation, measurement and evaluation, and review and improvement, with consultation part of each step.³ The heavy vehicle standard groups its requirements under five categories: leadership and commitment; risk management; people; assurance, monitoring and improvement; and safety systems.⁹

Underneath any of them, a working system has these eight parts.

Part	What it holds	The question it answers
Policy and responsibilities	A short safety policy, and who owns what by name	Who decides, and who is accountable?
Hazard and risk register	Every hazard found, its rating, controls, and owner	What could hurt someone here?
Safe work procedures	The steps for higher-risk tasks, permits included	How is this job done safely?
Training and competency	Who is trained, inducted, and licensed for what	Is this person able to do this task?
Consultation	How workers and other businesses are consulted	Who was asked, and what changed?
Contractors and suppliers	What a contractor must hold before starting	Is this business cleared to work here?
Incidents and actions	Reports, investigations, and corrective actions	What went wrong, and is the fix done?
Inspection, audit, and review	Scheduled checks and the review of the system	Are the controls still working?

The risk management in the middle of that table follows the four steps in Safe Work Australia's code of practice: identify hazards, assess risks where necessary, control risks, and review the controls.¹⁵ The code adds that the process will look different by size: larger businesses, and those where workers face more or higher risks, are likely to need more sophisticated processes.¹⁵

Do You Need ISO 45001?

No, unless a contract or a client asks for it. Safe Work Australia says standards are not laws, so there is no general requirement to conform to one, though a standard may still be relevant to a court deciding whether a duty holder complied, and conforming does not automatically mean the law was met.¹⁶

AS/NZS ISO 45001:2018 is the current Australian standard for a health and safety management system. Standards Australia adopted it in October 2018 and moved the older AS/NZS 4801:2001 to 'available superseded', while noting in August 2019 that 4801 was still cited in legislation across Australia.¹⁷ Certification is a business decision: it helps when tendering to clients who score it, and it means regular external audits. Certification is not what the law tests: an uncertified system can still help you meet your duties, and a certified system that is not followed does not. The exception is a Class A asbestos removal licence, which needs a certified safety management system; the model WHS Regulations as at 5 December 2025 still define that as one complying with AS 4801:2001, or an equivalent system the regulator determines.⁴

A Worked Example: A Regional Freight Depot in the New Accreditation Scheme.

A family-owned carrier runs 40 prime movers from one depot, with its old accreditation for mass and maintenance due to expire next year. Its safety manager knows the move to the new scheme means a whole-of-business audit, and that the auditor will look for evidence the system works rather than a manual.

She starts with the register, not the manual. The depot's hazards are already known in pieces: fatigue on the overnight runs, the forklift and pedestrian mix on the dock, drivers climbing onto trailers to check loads, and visiting drivers from other carriers walking the yard. Each gets one row with an owner. Then she checks the evidence for each control: the fatigue records, the induction for visiting drivers, the dock exclusion zone, and the last time anyone inspected the load restraint gear.

The gaps are not where she expected. The procedures exist. What is missing is proof they run: inspections done but not recorded, a near miss at the dock nobody wrote up, and two subcontract drivers with no induction on file. Fixing those is the work of the next three months, and it is the same work that would satisfy a WHS inspector who walked in tomorrow.

A facilities manager running a portfolio of buildings would follow the same order, with different rows: roof access, plant rooms, lifts, the asbestos register, and the dozens of trades who come and go. The part that changes most is contractors, because most of the people doing risky work in a building are not the building's employees.

How to Tell Whether Your System Works.

The heavy vehicle framework gives a test any business can use. It assesses each part of a system as present, meaning documented and in place; suitable for the size, nature, complexity, and risk of the operation; operating, meaning used consistently day to day; and effective, meaning it achieves the safety outcome intended.¹⁸

Run it on three controls you rely on most. If a procedure is present but nobody can show you a record of it being followed last month, it is not operating. If it is followed but incidents of the same kind keep happening, it is not effective. The NHVR's own warning fits every industry: a system is not a single document or a manual that sits on a shelf.⁷ For the signs a paper system has outgrown itself, our guide on when a manual safety management system stops working has five tests.

Where Software Fits.

Software does not make a system; it makes the evidence easy to find. In ComplyFlow's WHS and safety management system software, risks are recorded against each hazard with an initial score from your risk matrix, controls, and a residual score, and a consolidated view shows each risk across every site where it is present.¹⁹ Inspections can be scheduled to repeat and assigned to users, a site, or a staff category.²⁰ Contractor requirements, inductions, and incidents sit on the same record, which is what an auditor asks to see.

Start With the Three Controls You Would Bet the Business On.

Write down the three controls that stand between your people and the worst thing that could happen on your site. For a depot that might be fatigue management, the dock exclusion zone, and load restraint; for a building, roof access, isolation of plant, and the contractor sign-in. For each one, find the record that shows it ran last week. Where the record exists, you have a system. Where it does not, you know where to start. To see one record across risks, inspections, and contractors, book a demo and bring the control you find hardest to prove.