How to Build an OHS System That Actually Works
Building an OHS system that actually works
Most businesses that get an improvement notice already had a policy. The gap wasn't the paperwork — it was that nobody below it knew their part. A former WorkSafe inspector on why s.21 requires both provide and maintain, and how to build a system around your departments instead of a template.
Two verbs, two different jobs
Section 21 doesn't just require an employer to have a system of work. It requires the system to be provided and maintained. Section 20 sets the standard both duties are measured against.
An employer must, so far as is reasonably practicable, provide and maintain a working environment that is safe and without risks to health.
Provide or maintain plant or systems of work that are, so far as is reasonably practicable, safe and without risks to health.
Eliminate risk so far as reasonably practicable. Where it can't be eliminated, reduce it so far as reasonably practicable. You can't eliminate or reduce a risk you haven't identified.
Serious injury, illness and dangerous incident thresholds. The reporting duty that surfaces when a department-level gap wasn't controlled in time.
Reg 14, 15 and 16 make psychosocial hazard management an enforceable duty under s.21 — created through department-level decisions on workload, role clarity and reporting culture.
Risk isn't created by hazard category. It's created by function.
A generic system is written around manual handling, plant, chemicals, psychosocial. That's a fine structure for a manual. It's a poor structure for accountability, because hazard categories don't map to who's responsible for controlling them.
Plant interaction, manual handling, traffic movement — the risks that show up in near-miss reports, if anyone's collecting them.
Guarding, isolation, plant condition — the gap between what's scheduled and what's actually done.
What gets bought, what SDS comes with it, whether a supplier's obligations were checked before the contract was signed.
Workload design, role clarity, reporting culture — the operational drivers behind psychosocial risk.
What gets budgeted for controls versus deferred, and whether anyone with authority is actually seeing the risk register.
If you can't name what risk your own function creates, that's the first gap a document can't fix.
Four outcomes, one underlying failure
Serious injury, notifiable incidents, fatality and psychological harm aren't four separate compliance problems. They're four outcomes of the same structural gap — a system that was provided once and never maintained against how the business actually runs. The incidents that trigger a notification duty under s.37 rarely come from a hazard nobody knew existed. They come from a hazard a specific department knew about, in a system that never carried that knowledge to the person who could control it.
"I don't start with your document register. I start with a person. A machine operator: what would you do if this guard was missing? A supervisor: who do you report a near miss to, and what happens after that? An HR contact: how would you know if a team's workload had become a risk? A director: how do you know your risk register reflects what's happening on the floor right now."
The gap between what the document says and what the person on the ground actually knows is the finding. It's not a trick question — it's the same test s.21 sets.
Building this from scratch
☐ Operations ☐ Maintenance ☐ Procurement ☐ HR ☐ Finance/Directors — whatever your real structure is.
☐ Not what risk it experiences — what it creates. This reframing is usually where the first real gaps show up.
☐ A role, not an entity. If no one can answer this for a given risk, that's a gap a document can't fix.
☐ This is the maintain test. Ask them the way an inspector would.
☐ New equipment, new shift pattern, new supplier, new manager — each is a maintain trigger, not the calendar.
The follow-up questions
Section 21 sets the actual duties — provide and maintain a safe working environment, provide or maintain safe plant and systems of work, among others. Section 20 defines the standard those duties are measured against: the reasonably practicable test, which requires eliminating risk where possible and reducing it where it can't be eliminated.
The size of the business doesn't change the duty under s.21 — it changes how the system should be built. A five-person business doesn't need a corporate management system; it needs the same department-by-department accountability, scaled to however few roles actually exist.
That's the provide/maintain gap this article describes. It's the single most common finding behind improvement notices for businesses that already have a documented system, and it's the first thing tested in a WorkSafe inspection interview.
The Psychological Health Regulations 2025 require psychosocial hazards to be identified and controlled the same way physical hazards are — but the hazards are created by decisions inside specific departments (workload design, rostering, reporting structures), not a standalone psychosocial policy. The same department-mapping approach applies.
Start with the interview test, not the document register. Ask a handful of people in different functions what risk their role creates and who they'd report it to. The gaps that surface are more accurate than anything a document review will tell you.
Find out where your system was provided but never maintained
An OHS gap analysis maps your business function by function — not hazard category by hazard category — against what a WorkSafe inspector actually tests.
Book a free consultation