Direct answers on health, safety, environment and compliance

A workplace hazard class follows the activity code of the main work carried out there. The annex of the Communiqué on Workplace Hazard Classes marks every code as low, hazardous or highly hazardous. Of the 2,142 six-digit codes on that list, 898 are low, 888 hazardous and 356 highly hazardous. Where the main work is unclear, the founding purpose decides.

NACE is the classification of economic activities; in Türkiye workplace registrations are kept with six-digit NACE activity codes. Its weight in occupational health and safety is direct: the hazard class of a workplace hangs on this code. The annex list marks each of its 2,142 codes as low, hazardous or highly hazardous.

The highly hazardous class covers 356 of the 2,142 activity codes in the annex, a share of 16.6 percent. Of the 46 mining codes 44 are highly hazardous, of the 72 construction codes 60, and of the 72 coke and chemical manufacturing codes 54. Finance and information technology divisions hold no highly hazardous code at all.

If the hazard class changes, the employer must carry out the work the new class requires within 90 days and notify the Directorate General of Occupational Health and Safety. The change reaches everything: specialist and physician time, the risk assessment interval, training hours and the size of the emergency teams.

The NACE activity code of your workplace is written in its social security registration record; the workplace declaration and the registration letter carry the same six-digit code. Once you have the code, read the hazard class from the annex list. Our lookup page holds all 2,142 codes on that list and shows the class directly.

The specialist's time is measured in minutes per employee: at least 10 minutes a month in a low hazard workplace, 20 in a hazardous one and 40 in a highly hazardous one. A full-time month equals 195 hours, that is 11,700 minutes, so one full-time specialist covers 1,000, 500 or 250 employees respectively.

Yes. Article 6 of Occupational Health and Safety Law No. 6331 places a duty on every employer within its scope to assign a workplace physician; hazard class and headcount change only the required time, not the duty itself. The service may be met in-house or bought from a joint health and safety unit.

For each of the firefighting, rescue and protection teams, at least one support member is assigned per 30 employees in a highly hazardous workplace, per 40 in a hazardous one and per 50 in a low hazard one. First aiders are counted separately: one per 10, 15 and 20 employees. Below ten employees the three teams may be combined.

A risk assessment is renewed at most every two years in highly hazardous workplaces, every four in hazardous ones and every six in low hazard ones. Even before that, it is renewed wholly or partly when the site moves, technology or production method changes, or a work accident, occupational disease or near miss occurs.

Basic occupational health and safety training is at least eight lesson hours in a low hazard workplace, twelve in a hazardous one and sixteen in a highly hazardous one. Before that, every worker including apprentices and interns receives at least two hours of induction training. Refresher training is at least eight lesson hours.

The low hazard class does not remove duties, it stretches the intervals. The risk assessment and the emergency plan are renewed every six years; basic training is at least eight lesson hours and repeats every three years; the specialist works 10 and the physician 5 minutes per employee a month.

Personal protective equipment is provided by the employer free of charge. Article 4 of Law 6331 states plainly that the cost of occupational health and safety measures cannot be passed on to workers. The duty covers not only the first issue but cleaning, maintenance, repair, and replacing equipment that has reached the end of its life.

There are two sources. The first is the risk assessment: suitable PPE is mandatory for every residual risk that cannot be removed at source. The second is the regulation's own list; the Regulation on the Use of Personal Protective Equipment at Workplaces names the tasks for which each type of protection is required. That list is a minimum and does not replace the assessment.

The employer must inform workers about the protective equipment to be used and train them in its use. For complex equipment — respiratory protection, fall arrest systems — information is not enough and practical training is required. Instructions must be in a language the worker understands and available where the equipment is used.

The document shows that explosion risks have been identified and assessed, which areas are classified into which zones, which minimum requirements apply there, and that workplaces and equipment are used safely. The annexes are part of it: the zone drawing, the equipment list, inspection records and the permit-to-work arrangement.

The document is reviewed when the workplace, the work equipment or the work organisation undergoes a significant change, extension or modification. A new chemical, a new line, altered ventilation, a relocated filling point or an incident all trigger it. Without change, it need not be rewritten because time has passed; with change, no waiting period applies.

The calculation has three steps. First every dangerous substance present is inventoried — raw materials, intermediates, products, wastes and substances that could be generated. Then each is either found by name in the list or placed in a hazard category. Finally quantities are compared with the thresholds, and substances in the same heading are assessed together under the summation rule.

There are two tiers. At the lower tier, notification, a major accident prevention policy and a safety management system are required. At the upper tier a safety report, an internal emergency plan, information for the external plan and a tighter inspection programme are added. The tier follows from the quantity of substances held, not from the size of the company.

Notification is made when the establishment comes into scope, and as a rule before operations begin. Anything that changes its content — a change in the quantity or nature of substances, a change of tier, a change of operator, closure — requires a fresh notification. It is not a one-off form but a record kept current.

The document in which the operator sets out, in writing, its overall aims and principles of action on preventing major accidents, the structure created to deliver them and the resources allocated. It is required at both tiers. Left as a statement of intent it achieves nothing; the safety management system is what ties it to practice.

Required for upper-tier establishments, it demonstrates five things: that the prevention policy and safety management system are implemented, that major accident hazards and scenarios have been identified, that the plant is safely designed and operated, that internal emergency plans have been drawn up, and that the information needed for land-use decisions has been supplied.

This is an obligation specific to the Turkish regime, and it applies at both tiers. The document sets out the major accident scenarios that could occur at the establishment, how each could develop, and the preventive and mitigating barriers placed against them. Its difference from the safety report is coverage: the scenarios are not limited to the upper tier.

Every establishment in scope provides people liable to be affected with information about the establishment, the dangerous substances, the kinds of accident that could occur and what to do if one does. The information is kept permanently available and updated on change. At the upper tier the scope widens; parts of the safety report and emergency planning become publicly accessible too.

There are two stages. First the immediate notification: that it happened, where and when, which substances were involved, the first effects identified and the emergency measures taken. Then the detailed report: causes, development, consequences, and the measures taken and to be taken. Information learned later requires the report to be updated.

An obligation specific to the Turkish regime, binding at both tiers. The card carries what the responder will look at in seconds: what the substance is, its hazards, which extinguishing media to use and which not to, what to do in a release, and what protective equipment is needed. It does not replace the safety data sheet; it is that sheet simplified for response.

The team consists of the employer or a representative, the appointed safety specialist and occupational physician, worker representatives, support staff, and workers chosen so that every unit of the workplace is represented. External support may be brought in where knowledge is lacking. Participation is not a formality: without the knowledge of the person who actually does the work, the assessment covers the job as written, not as done.

The duty to have a risk assessment carried out belongs to the employer, who may do it in house with a team including the appointed safety specialist and occupational physician, or by buying in a service. Whichever route is chosen, responsibility stays with the employer. The document is signed by the whole team.

A requirement arises in one of two ways. Laws and regulations bind automatically, by country and activity — nobody opts in and nobody may opt out. ISO certificates are voluntary; only the organisation knows whether it holds one, so it is asked. The distinction is not a detail: a system that puts both in the same questionnaire can be silenced by unticking the law.

The register is the written list of legal and other requirements binding the organisation; clause 6.1.3 of ISO 45001 asks for it. But writing legislation titles one under another is not a register. Each line needs four things: which provision, which practice meets it here, which record evidences it, and who owns it. Without the fourth, it is a table nobody has claimed.

There are three routes. The first is a rule reaching beyond its own country: an organisation offering services to people in the European Union is bound by GDPR too. The second is contract: a customer imposes their country's requirement on you by agreement. The third is market access: a product sold in a country must meet that country's product rules.

The register is updated in two situations. The first is a change in legislation — the tracking process brings that. The second is a change in the organisation itself: a new activity, new machinery, a new chemical, headcount crossing a threshold, work in a new country. The second is forgotten more often, because no notice arrives; the organisation makes the change itself.

The duty to comply belongs to the employer; carrying out the tracking is assigned — in most organisations shared between the safety specialist, the occupational physician, quality and legal. The critical part is that the split is written down: which subject sits with whom, who updates, who works out the impact. Unwritten, tracking becomes everybody's job and therefore nobody's.

A management system's mandatory outputs come from the clauses of the harmonised structure: scope (4.3), policy (5.2), actions to address risks and opportunities (6.1), compliance obligations (6.1.3), objectives and plans (6.2), competence evidence (7.2), communication records (7.4), control of documented information (7.5), monitoring and measurement results (9.1), internal audit programme and report (9.2), management review outputs (9.3), nonconformity and corrective action records (10.1). On top of these come the documents that arise from law and from the sector.

A construction health and safety plan assesses the likely risks on a site and sets out the measures to be taken throughout the work, the site organisation, the working methods, when the work will be done and by whom, and the coordination between the parties. Türkiye's regulation gives no separate "the plan shall contain" list: the mandatory content follows from the definition itself. As measured, 19 content items bind the plan and its neighbouring documents on the Turkish side, 14 of them unconditionally.

The core is seven items: assessment of likely risks, health and safety measures throughout the work, site organisation, working methods, when the work will be done, by whom, and coordination between parties. Around that core sit the employer's duties to provide, information and consultation of workers, suitability and periodic inspection of work equipment, prevention of unauthorised entry, and keeping the plan updated. Annex 2 high-risk works, Annex 4 minimum requirements and Annex 5 equipment requirements are conditional: present on site means mandatory in the plan.

The duty to have the plan prepared rests with the employer or the project supervisor. The preparation-stage coordinator ensures the plan is prepared; the construction-stage coordinator makes or arranges the adjustments the plan needs as the work progresses and changes. Contrary to common belief the duty does not sit with the site manager — and a detail noticed during measurement: the Turkish word for "site office" never appears in the regulation, which says "construction area" throughout.

Notification becomes mandatory when either threshold is crossed: work lasting more than 30 working days with more than 20 workers present continuously, OR work exceeding 500 person-days. The notification goes to the Ministry's provincial directorate of labour and employment and is displayed as a board on the construction area. It is a separate document from the plan; having prepared the plan does not discharge the notification duty.

A health and safety coordinator must be appointed whenever more than one employer or subcontractor is present on the same construction area. The exception is narrow: excluding work that requires notification, and only where none of the Annex 2 high-risk works is present, a coordinator need not be appointed. So the exception requires both staying under the threshold and staying entirely clear of the high-risk list; if either fails, appointment is mandatory.

Directive 92/57/EEC sets minimum health and safety requirements for temporary or mobile construction sites. The plan must do two things: set out the rules applicable to the site, and include specific measures for work falling into the Annex II categories. The construction-stage coordinator adjusts the plan as the work progresses. As measured, 10 items bind the plan and its neighbours on the directive side — 6 unconditional, 4 conditional.

The directive's prior notice threshold works on two arms: work lasting longer than 30 working days with more than 20 workers at the same time, OR work exceeding 500 person-days. The notice goes to the competent authority before work begins and is displayed on site. The coordinator duty depends not on numbers but on structure: on every site with more than one contractor, one or more coordinators are appointed for the preparation and construction stages.

Annex IV lists the minimum health and safety requirements for construction sites in three parts: Part A general requirements (18 headings), Part B Section I workplaces indoors (11 headings), Section II outdoors (14 headings). It is not an unconditional list: it applies where the characteristics of the site, the activity being carried out, the circumstances or a hazard require it. Türkiye's counterpart is Annex 4 and works on the same conditional logic.

Under CDM 2015 the construction phase plan must set out three things: the health and safety arrangements for the construction phase, the site rules, and — where applicable — specific measures for the high-risk work in Schedule 3. Headings beyond those (project description, objectives, cooperation arrangements, site induction) sit at guidance level in HSE's L153. The measurement keeps that distinction: of 15 items, 6 are binding and the rest are guidance or conditional.

Where a project involves more than one contractor, or it is reasonably foreseeable that it will, the client must appoint a principal designer and a principal contractor in writing. If no appointment is made the duties do not disappear: the client is treated as having taken them on. This is the UK counterpart of the coordinator logic in Türkiye and the EU; what differs is this explicit fallback written so that responsibility never falls into a gap.

We read the full text of 29 CFR 1926 Subpart C: US federal law has NO general, content-listed, mandatory construction health and safety plan in the EU or Turkish sense. There is also no prior notice, no coordinator appointment and no health and safety file. Instead the employer must initiate and maintain accident prevention programmes, train workers, and have frequent and regular site inspections carried out by a competent person. No written document or content list is required.

In the US the duty arises not from a general plan but from particular work. The four conditional plans measured are: the emergency action plan (only when another OSHA standard expressly requires it, and it must be written), the fall protection plan (only in leading edge, precast concrete erection and residential construction work where conventional fall protection is infeasible or creates a greater hazard), the site safety and health plan (only in hazardous waste operations, with ten listed content items) and the permit-required confined space programme.

Ownership belongs not to whoever drew the barrier or wrote the procedure, but to the role with the <strong>authority</strong> to keep it working. The test is one question: if this barrier stops working tomorrow, who can commit resources and fix it? A barrier with no owner also has no test frequency, so it degrades quietly — the picture incident reviews return most often. Ownership is attached to a role, not a person; otherwise the barrier is orphaned when the person moves on.

The site system we measured defined seven roles, held together by one rule: the permit holder and the approver can never be the same person. The reason is simple — the holder is the party that wants the work to happen, while the approver is the party that may want it stopped. Merge them and signatures keep being collected while the control disappears. The same document also carried an exception to its own rule; our measurement recorded that as a contradiction.

In the site system we measured, a permit was valid for one shift and the same party could work at most eleven hours a day. A permit could be extended six times at most, and no single form could cover more than seven shifts. Three things closed it: a change of more than a third of the working party, a break of a day or more, and activation of the emergency plan — in an emergency every active permit became void.

In Turkish legislation we could not measure a retention period for the permit form itself: the general provision requires records to be kept but gives no figure. For records attached to the permit the periods are explicit — at least 40 years for records kept in work with carcinogens or mutagens and for asbestos exposure records, and a floor of 10 years for occupational hygiene measurement results where legislation sets no period. The site procedure we measured wrote "41 years"; the regulation says at least 40.

In 2026 the administrative fine for failing to carry out or commission a risk assessment is between TRY 66,725 and TRY 200,175 under Act 6331, penalty article 26/1-ç. The amount is read from the cell where the employee-count band meets the hazard class. If the breach continues, a further TRY 100,119 to TRY 300,357 applies for every month.

In 2026 the administrative fine for not appointing an occupational safety specialist is between TRY 111,263 and TRY 333,789 under Act 6331, penalty article 26/1-b. The same amounts apply to not appointing a workplace physician. The figure is read from the cell where the employee-count band meets the hazard class.

For each violation item the fine is read from the intersection of three inputs: the employee-count band (fewer than 10, 10-49, 50 or more), the hazard class (low hazard, hazardous, very hazardous) and the item's own table. Items without a matrix apply a flat base amount; per-worker items are multiplied by the headcount, and the items are added up.

Administrative fines rose by the 2026 revaluation rate of 25.49 percent, and the same rate was applied across all six labour acts: 6331, 4857, 854, 5953, 6356 and 6735. For example, the fine for a collusive workplace declaration went from TRY 241,043 to TRY 302,484, and employing a foreign national without a work permit from TRY 81,683 to TRY 102,503.

A per-worker fine means the amount is not applied once to the workplace but separately for every worker affected by the breach. For a breach of the equal treatment principle, for instance, the 2026 amount is TRY 2,531 for each worker. In some items the multiplier doubles and the fine runs for each worker and each month.

Law 6331 places the duties on the employer, and the administrative fine is addressed to the employer. A representative acting for the employer and taking part in running the work is subject to the same duties. Buying in safety expertise or consultancy does not remove the employer's responsibility; the provider's own responsibility arises separately.

A forklift must undergo periodic inspection every year where the standards set no period. In Annex-III, Table-2 of the Turkish work equipment regulation the forklift has no row of its own; it sits in the "industrial trucks" row, and the inspection criteria are the TS EN ISO 3691 series and FEM 4.004. One year is a maximum, not a target.

Winches and lifting gear must be inspected every 12 months where the standards set no period. Annex-III Table-2 keeps winches and cranes in separate rows: the maximum period is one year for both, but the criteria differ — TS EN 14492-1+A1 for winches, and standards such as TS EN 15011 and TS ISO 9927-1 for cranes.

Annex-III has no row called "compressor"; the compressor's air receiver runs from the Table-1 row "compressed air and gas tanks" and is inspected yearly where the standards set no period. The criteria are TS 1203 EN 286-1, TS EN 13445-5 and TS EN 764-7. The machine body, not named in the table, falls under general provision 1.4.

The periodic inspection is carried out and the report signed by a "person authorised to carry out periodic inspections"; the report states that person's name, profession and EKİPNET registration number. A report without that signature is invalid. The daily visual check belongs to the operator and maintenance to the authorised service, and neither replaces the periodic inspection.

The maximum periodic inspection period for pressure vessels and installations in Annex-III Table-1 is, as a rule, one year: 10 of the table's 13 rows follow it. Three rows differ — ten years for atmospheric vertical cylindrical above-ground storage tanks, the period given by the standard for cryogenic tanks, and the period in the written plan for liquefied gas tanks.

There are three levels of inspection. Visual finds defects apparent without tools. Close inspection uses access equipment to see details such as loose fittings and gasket condition. Detailed inspection requires opening the equipment and, where needed, isolating it. Frequency follows the zone and the conditions; an inspection without a record counts as not done.

As soon as the document is produced, the questions turn to the site: are the zones on the drawing the zones on the floor, does the marking on equipment inside a zone match the category, was every ignition source assessed, were inspections carried out and their findings closed, was the document updated after the last change. The most common finding is a well-written document that does not agree with the site.

Establishments in scope are inspected under a programme decided in advance; inspection does not wait for a complaint. Frequency follows the tier and a systematic appraisal of hazards — upper-tier establishments are inspected more often. What is sought is not the existence of documents but evidence that the system runs: a record, a drill report, a finding closed out.

An internal audit is the organisation testing, at planned intervals and on evidence, whether its own management system meets the requirements and is effectively implemented. Clause 9.2 of ISO 45001 requires it explicitly. Its purpose is not to collect documents but to see whether the system really works — and where it does not.

The programme sets frequency, methods, responsibilities, planning requirements and reporting. Frequency is not spread evenly: the importance of processes, the changes made and the results of previous audits all shape it. High-risk processes and those with findings last year are audited sooner; the annual calendar is the output of that reasoning, not its starting point.

Auditors are selected independently of the activity being audited; nobody audits their own work. In a small organisation this looks difficult but has solutions: units cross-audit each other, or an auditor is brought in from outside. Where independence is lost, the audit stops being the system's mirror and becomes its endorsement.

The plan covers the audit's objective, scope and criteria, dates and times, the people to be interviewed and the clauses to be tested, and it is communicated to the auditee in advance. Arriving unannounced is not an audit technique; a unit caught unprepared receives an unfair finding because it cannot produce its records. The aim is not to catch anyone but to see the truth.

A nonconformity is the non-fulfilment of a requirement — of the standard, of legislation, or of the organisation's own procedure. The common classification has three levels: a major nonconformity showing that an element of the system is absent or has broken down entirely, a minor one showing a single deviation, and an observation flagging something that is not yet a nonconformity but is on its way to becoming one.

A finding has three parts: the requirement breached (clause, legislation or internal procedure), the evidence observed (which record, which date, which field observation) and a one-sentence statement of the gap between them. A proposed solution is not part of the finding — choosing the fix belongs to the auditee; otherwise the auditor audits their own suggestion next time round.

Examining every record is impossible in most organisations, so audits sample. How the sample is drawn decides the strength of the finding: random selection shows the general state, risk-based selection shows the weak points. The sampling method and size go into the report — without them nobody can tell whether a finding is a single exception or a pattern.

The report covers the audit's objective, scope and criteria, the dates and team, the people interviewed and the evidence examined, the classified findings and the overall conclusion. Sampling information and any areas excluded from scope are written in too. The report is not an indictment; it is an input to the next management review.

For every finding, the correction and corrective action are planned, then done, then verified for effectiveness. Closure is not the moment the action is completed but the moment its effectiveness is shown. The number and the age of open findings are among the most honest indicators of a system's real condition.

Initial certification has two stages: stage one asks whether the system is ready — documentation, internal audit and management review carried out; stage two tests the effectiveness of implementation on site. After certification, surveillance audits continue and, at the end of the cycle, a recertification audit follows. Stage one cannot be passed without an internal audit.

Clause 9.1.2 of ISO 45001 asks for compliance with legal requirements to be evaluated at planned intervals. The evaluation asks one question of every register line: is this provision met, and what is the evidence? The answer can be met, partly met or not met. The third is a finding and goes to corrective action; so does the second.

What shows a provision is met is not a sentence describing it but a record showing it was applied: a document carrying a date, an owner, and a signature or a system trail. The question at an inspection is always the same — show me. So each register line is tied to a record, and where that record lives is written down.

Preparing for a certification audit is not collecting files the week before; it starts at the previous internal audit. An auditor does not look at documents one by one but follows a chain of evidence: policy to objective, objective to process, process to record, record to corrective action and effectiveness verification. If one link is broken, the completeness of the rest does not change the outcome. The most efficient preparation is to run the internal audit properly and close its findings.

According to SGK's 2025 yearly statistics, 766,625 occupational accidents were reported in Türkiye in one year: 766,039 under scheme 4/a and 586 under scheme 4/b. In the same year 1,944 workers died in occupational accidents and 916 occupational disease cases were recorded. İstanbul alone reported 163,939 accidents.

Construction has the most occupational accidents: in SGK's 2025 data, building construction (NACE 41) leads with 51,927 accidents, followed by food and beverage service activities with 50,225 and food product manufacturing with 43,649. Building construction also leads in deaths with 360; the three construction divisions together carry 586 deaths.

The frequency rate is the number of occupational accidents per one million working hours: accidents multiplied by one million, divided by total working hours. In SGK's 2025 table the frequency rate for scheme 4/a is 15.39, the incidence rate is 3.46 per 100 workers, and the severity rate is 533.30 lost days per million working hours.

ILOSTAT reports a fatal occupational injury rate of 11.47 per 100,000 workers for Türkiye (2024); Eurostat's EU-27 value is 1.64 (2023) — roughly seven times lower. For non-fatal injuries Türkiye is at 4,409.18 against the EU-27's 1,392.49, about 3.2 times. Both sets are measured per 100,000 workers.

SGK's 2025 statistics record 1,944 fatal occupational accidents: 1,931 under scheme 4/a and 13 under 4/b. Construction's three divisions account for 586 deaths (30.1%) and land transport for 289. Under 4/a, workplaces with fewer than 50 employees carry 55.6% of all deaths.

In construction (NACE 41, 42, 43) 60 of the 72 activity codes — 83% — fall in the highly hazardous class, so obligations apply at their strictest level. SGK recorded 82,024 occupational accidents and 586 deaths in these three divisions in 2025: 30.1% of all occupational accident deaths in the country.

In mining (NACE 05, 07, 08, 09) 42 of the 44 activity codes — 95% — are highly hazardous, and not a single code is less hazardous. SGK recorded 18,116 accidents, 65 deaths and 40 occupational disease cases in these divisions in 2025: 2.2 diseases per 1,000 accidents against a national average of 1.2.

In healthcare (NACE 75, 86, 87, 88) seven of the 40 activity codes are highly hazardous, 24 are hazardous and nine are less hazardous. SGK recorded 38,627 accidents, 20 deaths and 16 occupational disease cases in these divisions in 2025, with 36,436 of the accidents reported in human health activities (NACE 86).

Yes. The less hazardous class is not an exemption: SGK recorded 20,062 occupational accidents and 70 deaths in the office, IT and professional service divisions in 2025. Of the 165 activity codes in this view 143 are less hazardous, but six are highly hazardous, and office administration alone accounts for 8,114 accidents.

In the food and agriculture view (NACE 01, 02, 03, 10, 11) 134 of the 190 activity codes are hazardous and seven are highly hazardous. SGK recorded 51,363 accidents and 94 deaths in these divisions in 2025; 43,649 of the accidents were in food manufacturing and 24 of the deaths in crop and animal production.

A sector list is a shortcut, not a substitute for the rule. Falls and head injury dominate in construction, dust and respiratory exposure in mining, permeation and splash in chemicals, biological agents and sharps in healthcare. But every workplace has its own work: the sector set is a starting point, the risk assessment has the last word.

We measured four regimes side by side. Türkiye and the EU share the same threshold (30 working days plus 20 workers, or 500 person-days) and both have a plan, a separate file and a coordinator. The UK uses the same threshold but appoints a principal designer and principal contractor instead of a coordinator, and the burden returns to the client if nobody is appointed. The US has no general plan, no prior notice and no coordinator; the duty comes from work-specific conditional plans. One of the few shared items is the high-risk work list.

A near miss is an event at the workplace that had the potential to harm a worker, the workplace or work equipment but did not actually cause harm. In Türkiye that wording comes from Article 4 of the OHS Risk Assessment Regulation, and Law No. 6331 obliges the employer to investigate such events and write a report on them.

An occupational disease is an illness that arises as a result of exposure to occupational risks; that is the definition in Article 3 of Turkish Law No. 6331. The employer must notify the social security institution within three working days of learning of a case, and a physician who makes a preliminary diagnosis refers it to an authorised health provider.

Personal protective equipment is all equipment designed to be worn or held by the worker to protect against one or more hazards likely to endanger safety and health at work, together with any accessory serving that purpose. That is the definition in Article 2 of European Directive 89/656/EEC, mirrored in the Turkish PPE at work regulation.

In Türkiye an occupational health and safety board must be set up at workplaces with fifty or more workers where continuous work lasting more than six months is carried out. The duty comes from Article 22 of Law No. 6331; the membership and the working rules of the board are set out in the OHS Boards Regulation.

The lower explosive limit is the minimum concentration of a substance in air needed for an ignition source to cause a flame or explosion. The upper explosive limit is the other end of that band: above it the mixture is too rich to ignite. Between the two limits the substance forms an explosive mixture with air.

A law sets the framework and the sanction; a regulation details how the law is applied; a communiqué usually carries the figure, the list and the format. All three are binding. For tracking, the important difference is speed: laws change rarely, communiqués can change every year — the penalty amounts revalued annually and the hazard class list are the clearest examples.

Publication date and effective date can differ; the gap is for preparation. Transitional provisions then say what becomes of documents obtained under the old rules, training in progress and work already started: some stay valid until they expire, some must be renewed by a stated date. This is the part most often skipped in tracking.

Legislation is set by public authority and compliance is mandatory; a standard is a consensus technical document and voluntary as a rule. But the voluntariness is not absolute: if a regulation references a standard, or a customer contract requires it, that standard becomes binding in effect. The register carries both, separated by source.

Where the same subject is governed by both legislation and an adopted standard, the stricter applies in practice. But it is not collapsed into one register line: if the certificate is dropped, the requirement from the standard falls away and the legal one does not. An organisation that merges the two sources cannot tell, on the day it drops the certificate, which duty survives.

A management system is the connected whole of policy, processes, responsibilities and records that keeps one aim — occupational health and safety, environment, quality, energy — being met over time. What distinguishes it is not the number of documents but the closed loop: something is measured, a deviation is seen, it is corrected, and whether the correction worked is measured again. Without that loop you do not have a system, you have files.

Annex SL is the common skeleton ISO gives all of its management system standards: clause 4 context of the organisation, 5 leadership, 6 planning, 7 support, 8 operation, 9 performance evaluation, 10 improvement. ISO 45001, 14001, 9001 and 50001 share it; their differences live inside the clauses. The practical consequence: scope, policy, objectives, internal audit and management review sit in the same place in all four, so each can be built once and serve all of them.

Documented information is any written or recorded information the organisation must keep under control: procedures, instructions, forms, records, measurement results, video, database entries. Standards no longer draw a formal line between "procedure" and "record"; clause 7.5 requires the creation, updating and control of the information. Control means the right version, with the right person, available when needed — and the old version withdrawn from use.

Continual improvement is the commitment to raise the system's performance over time, required by clause 10.3 of the harmonised structure. Its evidence is not a statement of intent but a trend: how indicators moved between periods, whether closed corrective actions had their effectiveness verified, whether audit findings stopped recurring. An organisation with no indicators can show neither improvement nor decline; that system has not started measuring.

The plan manages the measures during construction and who does what and when. The health and safety file protects what comes AFTER the project: it carries the information the people doing later cleaning, maintenance, alteration, renovation and demolition need to know. They are separate documents, and the file is the one usually neglected — yet years later it is the only record that keeps a maintenance crew out of a hidden hazard.

Pre-construction information is the set of information the client provides about the project, forming a legal input to the construction phase plan; the principal designer assists in gathering and passing it on. It is a separate document and comes BEFORE the plan: asbestos in the existing structure, hidden services, ground conditions or neighbouring activities must be known before a contractor enters the project. The Turkish and EU regimes have no exact counterpart of this step.

Optifora is a modular compliance platform that brings occupational health and safety together with legislation tracking, environment, energy and industrial standards under one roof. It is not a single program: an organisation picks the modules it will use from a catalogue. It is built by EGEROBOT, and the surface open to customers today is the iOS application.

The catalogue lists thirty modules. Three are ready today: personal protective equipment, the explosion protection document and the major accident (Seveso) module. Risk assessment and the setup wizard are in development, and the remaining twenty-five are on the roadmap. The status label comes from the product's own inventory.

Twelve tools on this site work without an account or a sign-in: hazard class query, fine tables and the fine calculator, periodic inspection periods, the OHS duration calculator, the emergency team calculator, the carbon footprint calculator, the OHS glossary, the occupations dictionary and the national and global accident statistics pages.

The tables and calculators on this site are fed by twenty-four data sets. Each set is downloaded from its official provider and listed with its download date on the resources page. The providers include the Turkish social security institution and labour ministry, the national legislation portal, Eurostat, ILOSTAT, OECD, the World Bank and US BLS, OSHA and EPA.

Optifora is a product of EGEROBOT Automation Eng. Proj. Cons. Ind. Trd. Ltd. Co. The company is based in İzmir, Türkiye and was founded in 2014; it works in industrial automation and in occupational health, safety and environment. The corporate side runs from egerobot.com.tr, while the product's own pages live on the optifora.com domain.

No. Optifora is a compliance platform assembled from modules: alongside occupational health and safety it covers environment and waste, energy and carbon, chemicals and explosion protection, ergonomics, workplace monitoring, training and competence, equipment and periodic inspection, contractors, committees and reporting. The organisation decides which modules to switch on.

The category is not a quality grade but the severity of the risk covered. Category I covers minimal risks only and the manufacturer may self-declare. Category II covers the risks in between and requires type examination. Category III is for risks that are fatal or cause irreversible harm: on top of type examination, continuing surveillance of production is required.

Equipment made to a harmonised standard is presumed to meet the legal requirements; that is the presumption of conformity. When the standard is withdrawn, the presumption ends. Equipment already in the field does not become unusable that day, but new purchases and renewed certification must follow the current standard. This is why a PPE inventory has to hold the standard AND its status.

The marking is the manufacturer's declaration that the product was placed on the market in accordance with the legislation; it is not a grade of quality. The real information is in the declaration of conformity: the product's category, the standards it was assessed against, and — for categories II and III — the notified body that carried out type examination. Where the purchase record is not kept with that document, what risk the item was bought for cannot be shown later.

The match is fixed: category 1 equipment for zones 0 and 20, category 2 for zones 1 and 21, category 3 for zones 2 and 22. A higher category may always be used in a lower zone; the reverse never. G is added for gas, D for dust. A plant with a classification but no equipment match is a plant with a document and no protection.

From T1 to T6 the permitted maximum surface temperature falls: T1 450 °C, T2 300 °C, T3 200 °C, T4 135 °C, T5 100 °C, T6 85 °C. The selection rule is single: the equipment's surface temperature must stay below the ignition temperature of the substance with the lowest one present. On the dust side the criterion differs; there the cloud and the layer are assessed separately.

The group is set by ignition energy and by how a flame behaves passing through a narrow gap. IIA is the least demanding, IIC the most; hydrogen and acetylene sit in IIC. Equipment certified for IIC may be used in IIB and IIA atmospheres, never the other way round. Where several gases are present, the most demanding group decides.

Example: II 2G Ex db IIB T4 Gb. In order: Group II (surface), category 2 (zone 1), G (gas atmosphere), Ex db (flameproof protection type), IIB (gas group), T4 (maximum surface temperature 135 °C), Gb (equipment protection level). What matters, in purchasing and in inspection alike, is whether that line matches the zone on site part by part.

Software can look at the records it holds and say “there is a record for this clause”. It cannot give the conformity verdict: reading a training record, it cannot know whether that training actually covered the hazard. So the system finding and the auditor verdict are kept in separate fields, and the auditor must be able to raise a nonconformity against a clause the system believes is satisfied.

The bowtie module is <strong>on the roadmap</strong> today — we do not present it as a working screen and we do not describe something that does not exist. What does exist and is measured is the method catalogue: 34 risk assessment methods, each recorded with its inputs, scale table, formula, result bands and action rule. The bowtie sits there as a qualitative method; the catalogue also records that it has no numeric band and that numeric effectiveness thresholds were not measured.

Five steps: gather the hazards, write down who could be harmed and how, rate the risk with the controls already in place, decide on further controls with an owner and a date, then review. The method you pick does not change these steps; it only defines how the rating is produced.

The type of work chooses the method: a matrix for general workplace risk, a task analysis for single jobs, a guideword-based systematic study for continuous processes, and a protection-layer analysis where safeguards must be counted. No single method fits everything; most organisations run two or three side by side.

The first question is filter or supply. If oxygen is insufficient, if the contaminant is unknown, or if the concentration exceeds the filter's limit, a filtering device cannot be used — supplied-air or self-contained equipment is required. Where a filter can be used, its type follows the contaminant and its class follows the concentration; face fit and seal are inseparable from the choice.

It is the standard for occupational health and safety management systems. It prescribes no particular technical solution; it requires you to understand your context, determine risks and opportunities, set objectives, measure and review. Because it shares a common high-level structure with the environmental and quality standards, the three can be run together.

Selection starts from the risk, not from the product. First the hazard and the exposure are assessed, then the protection class that answers that hazard is decided, and only at the end is a product chosen that meets the class and fits the wearer. Where several items are worn together, compatibility is a requirement in its own right: if the ear defender lifts the helmet, neither is protecting anybody.

PPE does not remove a hazard; it stands between the hazard and the person. Its protection depends on being selected correctly, worn correctly, maintained correctly and worn at the moment it matters — if any one of those four fails, the protection goes to zero. An engineering control works regardless of what a person does. That difference is where the order of the hierarchy comes from.

There are three triggers. When the manufacturer's service life or shelf life is reached; when the pre-use check finds damage, deformation or a missing part; and when the equipment has been through an event that tested it — a system that arrested a fall, a helmet that took an impact, a glove splashed with chemical is taken out of use even if its life has not run out.

Noise is measured first; selection rests on measurement, not on impression. The protector's attenuation must bring the effective level at the ear below the exposure limit. Over-protection is also a defect: a protector that makes speech and warning signals inaudible gets removed, and the protection goes to zero. Wearing time decides the outcome; a protector taken off for part of the shift does not deliver the calculated protection.

A good PPE record answers four questions: who is using which item, since when, and when it was last checked. A signature on receipt answers only one of them. Where the record also carries the product's standard and category, a withdrawal or a defect notice can be traced to every affected item with a single query.

The method has two steps. Each hazard is first assessed on its own and given the protection class that answers it — breakthrough time for a chemical, resistance class for cutting, attenuation for noise. Then those items are tested for working together. If one disturbs how another sits, the selection is made again; it is not left to be solved in the field.

An explosive atmosphere is a mixture of flammable gas, vapour, mist or dust with air in a proportion such that, once ignition starts, combustion spreads through the whole mixture. Three conditions must coincide: flammable material, oxygen and an ignition source. Protection is built on those three — prevent the atmosphere forming, then prevent ignition, then limit the effect.

The method has three steps. First every source of release is found — flange, gland, filling point, vent. Then each source is given a grade of release: continuous, primary, secondary. Finally ventilation is taken into account, and the type and extent of the zone follow. Declaring an area unclassified is also a decision, and its reasoning is written down.

For gas, vapour and mist there are three zones. Zone 0: an explosive atmosphere is present continuously, for long periods or frequently. Zone 1: it is likely to occur occasionally in normal operation. Zone 2: it is not expected in normal operation and, if it occurs, only briefly. The number is about frequency, not severity — but frequency decides the protection level equipment must have.

For clouds of combustible dust in air there are three zones: 20 continuously, for long periods or frequently; 21 occasionally in normal operation; 22 not expected in normal operation and brief if it occurs. The critical point: a settled layer is not itself a zone, but because it can be lifted it drives both the classification and the housekeeping regime.

The classification rests on an explosion severity constant measured in the laboratory: ST1 weak, ST2 moderate, ST3 violent. The class says not whether the dust will explode but how violently — an ST1 dust explodes too. Protective systems are sized from that constant.

Thirteen are listed: hot surfaces, flames and hot gases, mechanically generated sparks, electrical apparatus, stray currents and cathodic protection, static electricity, lightning, electromagnetic fields, electromagnetic radiation, ionising radiation, ultrasonics, adiabatic compression and shock waves, and exothermic reactions including self-ignition of dust. An assessment addresses all thirteen separately.

An uncontrolled development during the operation of an establishment — a major emission, fire or explosion — that creates serious danger to human health and the environment, inside or outside the establishment. What separates it from an ordinary accident is scale: the effect can cross the fence. That is why the legislation mandates what happens before an accident — policy, management system, scenarios, plans.

For every substance the quantity is divided by its threshold and the ratios are added. The addition is done separately under three headings: health hazards, physical hazards and environmental hazards. If any of the three totals is one or greater, the establishment is in scope at that tier. The calculation is made twice — once for the lower tier, once for the upper.

This is where the policy becomes practice. It has seven elements: organisation and personnel, identification and evaluation of major hazards, operational control, management of change, planning for emergencies, monitoring performance, and audit and review. It is required at both tiers.

Where establishments are close together and hold particular substances, a major accident at one may trigger or worsen one at another; that is the domino effect. Once such a group is identified, the establishments exchange information, build their prevention policies and emergency plans taking that information into account, and cooperate in informing the public and their neighbours.

The score is the product of three values: likelihood (L), exposure (E) and consequence (C). On the original scale L runs from 0.1 to 10 and E from 0.5 to 10. The bands are defined too: above 400 stopping the operation is considered, 200–400 immediate correction, 70–200 correction required, 20–70 attention, below 20 possibly acceptable. Having defined bands is what sets it apart from a matrix.

Likelihood and severity are each scored 1 to 5, and their product gives a score between 1 and 25. The critical point: there is NO international normative source for the band limits, and commercial guides contradict each other. So the bands are set according to the organisation's size and the complexity of its activities, approved by top management, documented and reviewed periodically.

The level of risk considered tolerable once legal obligations and the organisation's own policy have been met. The calculation itself does not set that level — it only ranks. Whoever draws the line carries the responsibility for it, which is why the decision belongs to top management, is written down, and stands with its reasoning.

The level of risk remaining once the identified controls have been implemented. It is written separately for two reasons: it shows whether the control actually brought the level to where it was meant to go, and it settles who monitors what remains. An assessment that never records residual risk never asked whether the control worked.

A structured team study that takes the process node by node and, at each node, questions deviations from the design intent using guide words: more flow, no flow, reverse flow, more pressure, more temperature. For every deviation the causes, consequences, existing safeguards and recommendations are recorded. It is the most widely used hazard identification method in process safety; it is not a quick screening tool and needs time and a team.

The task is written step by step, the hazard of each step is identified, and a control is defined for each hazard. Its strength is concreteness: instead of a generic “maintenance work” line it describes the order in which the work is really done. A JSA prepared without the person who does the work therefore analyses a task that exists only on paper.

Each failure mode is given three scores: severity, occurrence and detection, each from 1 to 10. The risk priority number is their product (1–1000). The critical point: there is NO single threshold in the literature — published sets use limits as different as 100, 150, 200 and 500. The threshold is therefore chosen by the organisation and justified.

At the centre sits the moment control is lost (the top event); to the left the threats leading to it and the preventive barriers; to the right the consequences and the recovery barriers that limit them. It produces no score; its strength is making barriers visible. Every barrier must be effective, independent and auditable, and active barriers must complete detect–decide–act.

The initiating event frequency is multiplied by the probability of failure on demand of each independent protection layer; the result is the mitigated frequency of the scenario. If that exceeds the tolerable risk criterion, a layer is added and the required safety integrity level is derived from the gap. To count as a layer, a safeguard must be effective, specific, independent, dependable and auditable.

The team generates “what if…?” questions for each stage of a process or task, and for each question writes the consequence, the existing safeguard and a recommendation. Unlike HAZOP it is not bound to guide words: it is faster, but its completeness depends on the team's experience. That is why it is usually run alongside a checklist.

The first hazard screening for a project or plant, carried out early, before detailed design exists. Its purpose is to see the major hazards, and which design decisions they affect, while change is still cheap. Once the plant is built, the same finding costs far more to act on.

A method in which known hazards and good practice are listed in advance and the site is reviewed against that list. Its strength is repeatability: the same list asks the same questions every time. Its limit lies there too — it will not find a hazard that is not on the list. So it is used alongside a question-generating method, not on its own.

Follow-up is impossible without three fields on the control line: owner, due date and closure evidence. Closure is not writing “done” but the record showing it was done — an order, a measurement, a training record, an inspection form. Once a control closes, the line's residual risk is reassessed; without that, the table has assumed the effect of a control that may not have delivered it.

There are two separate jobs. A correction fixes what has appeared — the missing signature is obtained, the spill is cleaned. A corrective action removes the cause so it does not recur. A corrective action record carries four things: the root cause, the work to be done, the owner and due date, and how effectiveness will be verified.

An internal audit is an independent auditor testing conformity to defined requirements against evidence; its output is conformity or nonconformity. A self-assessment is the organisation placing itself on a maturity scale; its output is a level, used to track a trend. A self-assessment does not replace an audit — it has neither the independence nor the evidence requirement.

Tracking does not end with hearing the news. It has three steps: the change is noticed, its impact here is worked out, and the affected documents, training, checklists and instructions are updated. An organisation doing only the first knows about the change and does not apply it — at an inspection that is a heavier finding than never having heard of it.

Rules take effect on publication in the official gazette, so that is the primary source. But reading the whole daily publication is not sustainable; a filter is needed, and the filter comes from the register — the laws, the ministries and the subject headings you are tied to. Tracking without a filter lasts a few weeks and is then abandoned.

A change can leave traces in six places: documents, instructions, checklists, training content, periods and competence requirements. An impact analysis asks all six. An organisation that updates only the document carries on working in the field with the old checklist and believes it has made the change.

A good notification does three things at once: it reaches the right person, it says what the change affects here, and it leaves an action behind. One that says only “this regulation changed” puts the reader at the start of a research task rather than a piece of work. As the number of notifications rises, the read rate falls — so the filter matters as much as the notification.

Scope draws the boundary of the management system: which sites, which activities, which products and services, which people are inside it. The harmonised structure requires it in clause 4.3 and requires it to be documented. Writing scope narrowly saves work in the short run, but a contractor or a site left outside does not leave your liability when something happens. The measure of a scope decision is not convenience but actual influence.

The policy is top management's written commitment about the system. The harmonised structure requires it in clause 5.2, and at least four things are expected in it: a commitment to prevent injury and ill health, a commitment to fulfil legal and other requirements, a commitment to eliminate hazards and reduce risks, and a commitment to consultation and participation of workers and their representatives. It need not exceed one page; but if it is built from empty sentences it means nothing at the audit and nothing on site.

Objectives turn the policy's commitment into numbers. The harmonised structure requires them in clause 6.2 and expects four things to be written for each: what will be done, with what resources, who is responsible, when it will be completed — plus how the result will be evaluated. An objective that cannot be measured is a wish. A sound set of objectives does not stop at lagging indicators (accident counts); it includes leading ones as well — site tours completed, near misses reported, training completion rate.

PDCA — Plan, Do, Check, Act — is the engine of management systems, and it is built into the clause order of the harmonised structure: planning in 6, support and operation in 7-8, performance evaluation in 9, improvement in 10. In practice the most frequently skipped step is the fourth: measurement happens, a report is written, and no action follows. The cycle then flattens into a line, and the same deviation appears in the same report every year.

Optifora's data layer defines nine improvement methods across 45 phases: PDCA (4), PDSA (4), SDCA (4), OODA (4), DMAIC (5), 5S (5), A3 (7), 8D (9) and Kaizen event (3). The choice follows the problem, not fashion: a deviation with a known cause needs no more than PDCA; a recurring problem with an unclear cause calls for DMAIC or 8D; an event to be reported to a customer or a regulator needs 8D's discipline; holding an improvement in place is what SDCA is for.

A nonconformity is a requirement not fulfilled. A correction removes the consequence — mopping up the spilled chemical. A corrective action removes the cause so it does not recur — changing the transfer method that led to the spill. Clause 10.1 of the harmonised structure asks for both and requires the effectiveness of the corrective action to be reviewed. An action whose effectiveness was never verified is an open problem that looks closed.

The order is: context and interested parties, scope, leadership and roles, risk assessment and legal obligations, policy, objectives, processes and controls, competence and communication, monitoring and measurement, internal audit, management review, corrective action. An organisation that starts by writing documents rewrites most of them once the context becomes clear. The most common mistake is setting objectives before the risk assessment — the objective then chases what is easy rather than what is risky.

Annex 2 lists the work types where workers may be exposed to particular risks. If any of those 11 types is present on the construction area, the plan must contain measures specific to that work — general measures do not satisfy the requirement. The same list appears as Annex II in the EU directive and as Schedule 3 in the UK's CDM 2015; the measurement shows Schedule 3 and Annex II to be the same 10 items.

The top event is the moment control over the hazard is lost — nobody has been hurt yet, but the event is now under way. A well chosen top event is a single sentence, observable and neutral: "liquid released from the tank". "Injury" is not a top event, it is a consequence; "valve failure" is not one either, it is a threat. The commonest mistake is placing it too late or too early: too late and there is no room left for preventive barriers, too early and the diagram fills with normal operating steps.

Every box on the left of a bowtie is a threat: an independent pathway that can reach the top event on its own, with nothing else needed. "Fatigue", "lack of training" and "production pressure" are not threats; they are deeper causes that weaken several pathways at once, and in a bowtie they belong among the escalation factors. The test is simple: if a box cannot produce the top event by itself, it is not a threat.

Preventive barriers on the left stop the top event occurring; recovery barriers on the right stop the consequence growing once it has occurred. The distinction is not cosmetic: a site may say "we have twelve barriers", but if all twelve are on the right, that site is not preventing the event, only reducing the damage. This balance is the fastest thing to read off a bowtie.

The measured validity test asks three things: is the barrier <strong>effective</strong> (can it stop that pathway on its own), <strong>independent</strong> (would it fail together with another barrier), and <strong>auditable</strong> (can it be shown to work). A box that fails one of the three is removed or flagged as a weak control. This is exactly where the value of a bowtie appears: what matters is not how many boxes are on the page, but how many pass the test.

The measured classification recognises five types: passive hardware, continuously working hardware, active hardware, active human, and active hardware plus human. The general rule is to prefer whatever sits higher on that list — a passive barrier does not have to decide, does not wait to be alerted and does not forget. Where a human barrier is unavoidable, all three of detect, decide and act must be in place; if one is missing, the barrier is missing.

An escalation factor is a condition that disables or weakens a barrier — a sensor past its calibration date, a silenced alarm, a task handed to someone unauthorised. To find them, ask one question of every barrier: "what would stop this working?" Each answer is an escalation factor and calls for a secondary barrier of its own. This is the least drawn and most useful part of a bowtie.

A bowtie produces no score. Barriers are assessed instead in three dimensions: <strong>effectiveness</strong> (does it really stop the pathway on demand), <strong>availability</strong> (is it ready when needed) and <strong>reliability</strong> (does it do the same job time after time). Numeric limits for these three are not given in the source we measured; saying "anything above this percentage is acceptable" would be invention. If a number is required the method changes — numbers are not invented for a bowtie.

A barrier is critical when nothing else stands behind it on that pathway, or when it stops several pathways at once. The measured rule is plain: barriers of high criticality are placed in a <strong>barrier management plan</strong>. The plan records three things — who owns the barrier, how it will be tested, and how often. Without those three, the barrier is not being managed, only drawn.

A bowtie makes barriers visible but produces no number; layer of protection analysis multiplies an initiating event frequency by the probabilities of failure on demand of the independent protection layers and compares the result with a tolerable risk criterion. The usual order is: the bowtie sets out the structure, the numeric analysis quantifies the critical pathway. Counting a barrier as an independent protection layer takes five tests — harder than the three a bowtie asks.

Deviations produced by multiplying a parameter with a guide word are candidate threats on the left of a bowtie; the consequences of the deviation go to the right, and existing safeguards become candidate barriers in the middle. Copying them straight across gives a wrong result: a study produces hundreds of deviations and they are not all separate threats. The filter is the threat test — a deviation that can reach the top event alone is a threat, otherwise it is an escalation factor.

The left side of a bowtie carries fault tree logic: the pathways leading to the top event. The right side carries event tree logic: the consequences branching after it. A bowtie merges the two on one page without gates or probability arithmetic. The gain is readability; the loss is the "and"/"or" distinction — a bowtie cannot show whether two causes are needed together or whether either alone is enough.

This question has no measured answer: the bowtie method has neither a numeric band nor a rule saying "at least this many barriers on every pathway", and numeric effectiveness thresholds are recorded as NOT MEASURED in our source. The answer is therefore a set of tests rather than a number — every pathway needs barriers that pass the validity test, are independent of one another and are of different types where possible. If a number is required, the method changes.

A bowtie is strong for sudden loss scenarios that gather around a single top event. It is weak for risks with no such moment: long term exposure, cumulative health effects, gradual degradation, organisational drift. It also falls short wherever a numeric decision is needed, because it produces no score. The third limit is practical — add enough threats and barriers and the diagram becomes unreadable, which destroys its only real advantage.

In a real site permit system we measured, eight categories required a permit: hot work, confined space entry, work at height, lifting operations, excavation and backfill, assembly and dismantling, work with hazardous chemicals, and hazardous energy. The instructive part was not the list itself but the table beside it — six jobs exempt from a permit, each with a condition and an exception column. Sites could not add to that exemption list on their own.

A checklist only works when it is a <strong>decision gate</strong>. In the system we measured the rule was single: if even one question is answered "no", the permit is not issued; the non-conformity is corrected and the same question is asked again. Answers were three way — yes, no, not applicable — and the third option is essential, otherwise irrelevant questions force the site to say "no" and the rule is broken in the first week.

Testing is done before entry, but it does not end there: the atmosphere of a confined space changes during the work — welding fume, solvent vapour, sludge disturbed at the bottom. The system we measured used 19.5 to 23.5 per cent for oxygen, below 5 ppm for hydrogen sulphide, below 25 ppm for carbon monoxide and ammonia, and required the instrument to have been calibrated within the last six months. Instrument calibration binds as much as the reading itself.

Control of hazardous energy is the most mature subsystem of a permit regime. The system we measured had seven application steps: preparation and notification, shutting the machine down, isolating every energy source, tagging, locking, releasing stored energy, and trying. Five steps were defined for the return to normal operation. Energy types were listed as electrical, mechanical, hydraulic, pneumatic, chemical and thermal — gravity and springs are mechanical energy too, and they are the two most often forgotten.

The design of the site system we measured was sound: roles separated, questions coded, thresholds numeric, durations defined. The defects were in the medium. The system lived in five separate places — a document system, a contractor portal, spreadsheets, e-mail and paper — and none of them knew about the others. There was no single place to answer "how many permits are open on site right now". The permit form was a single wet signed copy, at risk of loss while having to be kept for years.

It is a document with sixteen fixed sections describing a chemical's hazards, its safe use and what to do in an emergency. The section order is the same worldwide; the real work is not filing the sheet but carrying its hazard statements into your own operations.

It is a method that decides the required control approach from the substance's hazard statements, its volatility and the quantity used, without waiting for measurements. The output is not a number but one of four approaches: general ventilation, engineering control, containment, or specialist advice.

An establishment falls in scope when the quantity of dangerous substances it may hold exceeds the Annex I thresholds. There are two tiers, lower and upper, and the tier decides which obligations arise. Even if no single substance passes a threshold, substances in the same hazard category are combined through the summation rule.

Every workplace where an explosive atmosphere may occur — LPG filling, paint shops, plants with flour, sugar or wood dust, and battery charging rooms among them. The document shows three things: the zone classification, the suitability of the equipment for that zone, and the protective measures taken.

The decisive criterion is breakthrough time: how long does the chemical take to pass through the glove material and reach the inside? That time is specific to the chemical–material pair; there is no general product called a “chemical glove”. It must exceed the contact time of the task. Puncture, tearing and mixtures are assessed separately; a mixture does not behave like its components.

It is a control method in which the conditions for a high-risk job are verified in writing before work starts, opened under a responsible person's signature and closed when the job ends. It is standard practice for hot work, confined spaces, work at height, excavation and energy isolation.

Write the event on a timeline and keep asking "why was this possible" at each step until you reach a cause that sits in the system rather than in a person's behaviour. If the analysis ends at "carelessness", it has stopped early: look for the condition that made carelessness possible.

Fall arrest is a system, not a product: an anchor point able to take the load, a full body harness, and the element connecting them — an energy-absorbing lanyard, a retractable device, or a horizontal or vertical line. Whether the system is right depends on the fall clearance calculation: the total distance, including stretch, must be shorter than the clearance below. A rescue plan is part of the system.

Hazardous work in a zone — hot work, maintenance, cleaning, equipment removal — runs under a written permit. The permit evidences three things: the atmosphere has been measured and is safe, ignition sources are under control, and the person authorised to stop the work is named. It is issued before the work and closed when the work ends; an unclosed permit is a hazard left open.

Required for upper-tier establishments. The plan sets out who will do what on site if a major accident scenario occurs, with what resources and in what order, and how communication with outside bodies will work. It is reviewed at intervals and tested by drill — a plan never drilled is a plan never tested.

The engine of the permit form we measured was a set of 101 coded risk control questions: 15 in the general block, 16 for lifting, 12 for confined space, 12 for work at height, 12 for hazardous energy, 10 for hot work, 10 for excavation, 9 for hazardous chemicals and 5 for assembly and dismantling. The general block was always open; category blocks opened on selection. The coding was not decoration: non-conformities had to be reported by code, so unique codes were essential for the system to work.

We measured that United States federal construction law has no general, mandatory site health and safety plan; on the confined space side, however, the duty binds. 29 CFR 1926.1204 makes a programme conditionally mandatory where permit required confined space entry will take place: preventing unauthorised entry, identifying hazards, safe entry procedures, and providing the necessary equipment to workers at no cost. In the United States the binding level is therefore the permit, not the plan.

Hot work — welding, cutting, grinding, flame heating — brings the ignition source into the job. The permit therefore does not try to remove the hazard but to clear the environment: separation from flammables, atmosphere testing, covering and segregation, extinguishing readiness, an attendant. In the system we measured, flammables had to be at least 15 metres away and an attendant was mandatory in hazardous areas, while the explosive gas threshold for hot work was stricter than for confined space entry.

The core of the rule is one sentence: one worker, one lock, one key. There are no spare keys, keys do not open each other's locks, and only the person who fitted a lock may remove it — the authority cannot be delegated. In group work the authorised person places all keys in a box and fits their own lock; every worker adds a personal padlock, and the box opens only when all of them are gone. At shift handover locks do not change hands: the outgoing worker removes their lock and the incoming one fits theirs.

If the person who fitted a lock has left the site, the lock may be cut — but not arbitrarily. In the system we measured the sequence was explicit: attempt to reach the person, involve the department manager and the safety specialist, notify the person, report the situation in writing, obtain approval, remove the lock and complete a lock removal notification form. The length of the process is deliberate: if cutting locks becomes easy, the lock stops being a barrier.

A fall arrest system stops the fall but leaves the person suspended; someone who collapses in a confined space cannot get out unaided. A rescue plan is therefore not an attachment to the permit but a condition of it. In the system we measured, the general block of the permit form carried a specific item asking whether the need for a rescue plan had been assessed with the safety function, and three plan templates were maintained.

It is a record showing which competence each task requires and who holds it, in one table. It has two axes — task and person — and at the intersection sit the certificate, its expiry date and its verification status.

An attendance sheet measures nothing. Measurement runs at four levels: reaction, learning (a test), behaviour (observation in the field) and results (the trend in incidents and non-conformities). If only the first two are measured, the training is still an assumption.

With the same cycle as physical risk: identify the hazard, assess it, control it, review. The difference is that the hazard sits in the work itself — demands, control, support, relationships, role clarity and how change is managed. Validated worker surveys are used to measure it.

An auditor needs to know the standard and audit technique; but without the third leg the first two are not enough: understanding the work being audited. An auditor who does not know the process finds only formal gaps — a signature, a date, a form number. Competence starts with training, continues through observed audits, and is reviewed regularly.

In the system we measured an attendant was mandatory for all confined space work and for all hot work in hazardous areas, and the form had separate questions where the attendant's name had to be written. The attendant's job is not to do the work or to help but to watch and, if needed, to raise the alarm. The commonest deviation is the attendant "lending a hand" while the space is left unwatched — the barrier falls in exactly that second.

Maintenance keeps equipment running; a periodic inspection independently verifies that it is safe. One is a production record, the other a safety record, and neither substitutes for the other.

An uncalibrated instrument produces a number but not evidence. Where a decision rests on that number — gas detectors, sound level meters, pressure gauges, scales — you must be able to show the number traces back to a reference.

Emissions are gathered in three scopes: direct fuel use (scope 1), purchased energy (scope 2) and indirect value-chain emissions (scope 3). Each activity figure is multiplied by a conversion factor; the difficulty is not the arithmetic but collecting the data completely.

It is the five-step order for waste decisions: prevention, preparing for re-use, recycling, other recovery including energy, and disposal. Moving to a lower step while a higher one is available requires a stated reason.

The limit is not a single number of kilograms. The distance of the load from the body, the height of the hands, the vertical travel, trunk twist, lifting frequency, duration and grip quality each cut a starting value down step by step. What comes out is the recommended limit for that specific task.

Three things are measured: posture (how far a joint deviates from neutral), force (how hard the effort is) and repetition (how often it happens). Combined with duration these produce the risk; none of them is sufficient alone.

The sound level and the duration of each task are taken separately and normalised to eight hours to give one daily exposure level. Sound level is logarithmic: a 3 dB rise doubles the energy, so halving the time at the same level lowers exposure by 3 dB.

First the airborne concentration is measured and divided by the exposure limit to give a hazard ratio. The protection factor assigned to the respirator class must exceed that ratio, and the maximum use concentration — the protection factor times the limit — must not be exceeded.

A lagging indicator counts what already happened (accidents, lost days); a leading indicator measures the behaviour that comes before it (inspections completed, actions closed on time, near-miss reporting rate). The same event can be both: a near miss is lagging, the near-miss reporting rate is leading.

Four stages: pre-contract capability assessment, a joint risk assessment and site induction before work starts, supervision and incident reporting during the work, and a performance review at the end. Collecting certificates is only the first link in that chain.

Top management reviews the suitability, adequacy and effectiveness of the system at planned intervals. Its inputs include the status of previous review decisions, internal and external audit results, incidents and nonconformities, monitoring and measurement results, compliance evaluation, worker participation and the adequacy of resources. Its output is decisions: objectives, resources and needed changes.

An integrated management system builds the shared elements of several standards — scope, policy, objectives, competence, document control, internal audit, management review — once, then links them to each standard. The real gain is not fewer audits; it is that the same question stops having four different answers in four places. In Optifora's data layer that link is held as 53 document-to-standard relations: one document type can serve several standards.

When a management system earns the certificate but changes no behaviour, the cause is usually one of four: the documents describe someone else's work, the objectives have nothing to do with the site's real risk, reporting is punished so the system has gone blind, and the loop does not close — measurement happens but no action follows. The symptoms are measurable: the same audit finding two years running, falling near-miss reports, corrective actions that look complete and keep recurring.

A signature shows who approved a record, when, and that it has not been altered since. What gets disputed in an audit is usually not the content of a record but whether that content existed on that date; a signature closes exactly that gap.

The most widely used two-axis arrangement: the likelihood of an event and the severity of its outcome are scored separately, and their product gives the risk.

A three-axis method: alongside likelihood and severity, frequency of exposure enters as a separate variable.

A root-cause arrangement that, instead of tying an outcome to a single cause, splits causes into named groups and probes each group separately.

An office looks low-hazard, but its hazards are quiet ones: posture, screens, lighting, electricity and evacuation.

What sets a school apart is crowding and children: the same hazard produces a very different outcome in an evacuation or a laboratory.

Retail has three constant hazards: manual handling, slips and falls, and the traffic between the stockroom and the sales floor.

A kitchen is a small production plant in safety terms: heat, knives, oil, gas, slipping and time pressure all at once.

A small workplace does not mean small risk: chemicals, constant standing and sharp tools share the same few square metres.

The employer is the management, the workers are the caretaker and technical staff; the hazards gather in the shared areas.

Goods, service and construction lifts, together with cranes, lifting tables and slings, sit in the same family and share the same interval.

Boilers, air receivers, compressor tanks and steam cookers sit in the same family; inspection is more than a pressure test.

The electrical and earthing installations are two sides of the same inspection.

The measured resistance value is only part of the result; continuity and the integrity of connections are tested too.

Lightning protection is not a single rod but a capture-conduction-earthing chain; the inspection looks at every link.

Portable extinguishers, fixed suppression systems, detection and pressurisation are each inspected separately.

For cranes, forklifts and platforms, inspection is a whole in which capacity, brakes, safety devices and operator competence are tested together.

A short check made in a few minutes at the start of a shift, recorded, and stopping the equipment when it finds a fault.

Once the required assignment time reaches the size that calls for full-time work, the workplace can no longer be run on part-time external service.

Where a full-time assignment is required, a unit is established; a unit is not a room but a structure with defined conditions.

Giving instructions is a duty; but an instruction that works is one written in the language of the person doing the job, following that job's steps.

The standing of a representative taking on the OHS service is not open: full-time employment, authority to represent, and an actual role in management are required together.

The certificate a trainer needs depends on the subject and the type of training; not everyone can teach every topic.

A short reminder at the start of a shift, focused on that day's work; it does not replace periodic training, it completes it.

In some jobs, employing someone depends on their holding a vocational training certificate; without it there is no employment.

That the holder meets the defined competences of an occupation, measured by examination.

Operating is more than driving: vocational qualification, workplace authorisation and fitness are required together.

Introducing the equipment is not enough: suspension, rescue and anchor point selection belong inside the training.

The report is obtained before work starts, and it assesses not the person but their fitness for that work.

The interval follows the exposure of the work rather than the person's age, and the exposure also sets what the examination covers.

From the moment it is notified, the risk assessment is reopened for that person; a general assessment is not enough.

A role supporting the running of health surveillance alongside the physician; in some cases the assignment is compulsory.

The physician runs health surveillance and advises; they do not take business decisions, nor do they take on treatment.

The duty to notify starts the moment it is learned of and applies where there is suspicion; a confirmed diagnosis is not waited for.

Notification is the first link in the accident record; once its deadline is missed, a later investigation does not make up for it.

An investigation does not look for someone to blame; it looks for the root causes that would stop the event recurring, and ties each root to an action.

Reporting an event without a consequence means learning the accident cheaply; the system works only if reporting carries no penalty.

A good corrective action targets the cause rather than the symptom, and has an owner, a date and a verification.

The process does not end with medical treatment; notification, records and the accuracy of documents directly affect the worker's position.

The specialist's responsibility is measured by the findings and advice they gave in writing; the decision itself is the employer's.

The committee is not a meeting but a body that produces decisions and follows them up; its members follow from their roles.

A meeting whose agenda is circulated in advance, that ends in decisions and whose decisions are followed; the minutes are the record, not the result.

The document that writes down in advance how the committee will work: how it meets, how it decides, how duties are shared and how follow-up runs.

The representative is the workers' voice on health and safety; they are elected and protected because of the role.

The book where the specialist's and physician's written findings reach the employer and the response is recorded; a signature is a record, not an acknowledgement.

The record is produced in the product, turned into the data set and sent through authorised software; every link in the chain is recorded.

The specialist is tasked with reporting the designated health and safety information to the Ministry; reporting is part of the role.

An assignment is completed by mutual approval in the system; a contract left unapproved does not count as made.

Ending is not a date but a handover: records are delivered, open items are closed and no gap is left.

Most blockages are record problems rather than system problems: capacity, timing and record mismatch are the three common causes.

A plan is not a document but an arrangement tested by drills: scenarios, teams, escape routes and communication are built together.

Team size follows headcount and hazard class; people are assigned, trained and tested in drills.

A drill is a measurement, not a display: time, behaviour and whether the systems actually work are measured.

The number follows headcount and hazard class; the calculation rounds up and is distributed across shifts.

The drawing shows the reader how to get from where they stand to an exit; one is prepared for each mounting point.

A permit is a closed loop showing that conditions were met before hazardous work began and that the area was handed back when it ended.

A written arrangement that cuts and locks every energy source of the equipment, tags it and verifies zero energy.

First prevent the fall, then arrest it: personal equipment is the end of the list, not its start.

Selection follows the likelihood of an explosive atmosphere and the properties of the substance present.

Collective protection reduces the hazard for everyone and does not depend on individual behaviour; personal equipment comes last.

The list is derived from the workplace's own risks; filling in a generic template is paperwork, not inspection.

The plan puts the year's work into the calendar in advance: training, examinations, inspections, drills and audits gathered in one place.

Culture is what gets done when nobody is watching; measuring it looks at behaviour and at reporting behaviour.

Observation addresses the behaviour rather than the person, and its output is not a penalty but the removal of what makes the safe behaviour hard.

The principal employer's and the contractor's duties do not replace one another; coordination sits with the principal.

Posture, force, repetition and duration are assessed together; weight alone does not explain ergonomic risk.

The recommended weight limit for a specific lifting task, from the geometry of the task and its repetition.

A guard either prevents access to the danger zone or stops the machine when access occurs; a guard that does not slow the work is the one that stays on.

Monitoring is a design task, not a date: who, where, when and for how long is decided in advance.

Temperature alone is not enough: humidity, air velocity, radiation, workload and clothing are assessed together.

The aim is not to build an archive but to find the document being asked for, in seconds, during an inspection or an event.

A report describes not what was done but what changed; it is written so the reader can decide.

The authorisation certificate is issued when full-time staff, premises conditions and the application file are completed together.

The regulation's definition is explicit: a certified person, employed full time, responsible to the Ministry for the unit's business and transactions.

Points apply to breaches that do not require direct revocation; when points accumulate, the authorisation is suspended.

Suspension comes from points, revocation from listed grounds; both are published on the website.

Planning means comparing the total time the contracts require with the capacity of the current staff.

A quotation rests on the time and scope of the service to be given; a price quoted without calculating time squeezes the service later.

Scope, term, parties, ownership of records and the ending arrangement are written; approval in the system completes the contract.

Employee health records are special-category data; access is narrowed, retention is defined and handover is recorded.

Preparation is continuous rather than done beforehand; what an inspection asks is the state of the records today.

What decides is not the number of screens but where the record sits and what happens when the provider changes.