Almost every Australian business has a procurement process. Very few have QHSE procurement controls. The purchase order carries a price, a quantity and a delivery date. It says nothing about the quality, safety and environmental requirements the supplier must meet.
Then reality lands at the gate. The hired plant arrives without a compliance plate. The drum of degreaser arrives without a current Safety Data Sheet. The subcontract crew arrives without the high risk work licence the task requires. None of those started as site failures. Each one started as a purchasing decision.
Your integrated management system does not stop at your boundary. It follows the money out.
What the standards actually ask of your purchasing
ISO 9001:2015 Clause 8.4 requires you to ensure that externally provided processes, products and services conform to requirements. Under Clause 8.4.1 you set criteria for evaluating, selecting, monitoring and re-evaluating your external providers. You also keep the documented results. Clause 8.4.2 then asks you to match the extent of control to the potential impact of what you buy. Finally, Clause 8.4.3 tells you to communicate your requirements before you buy. That covers products, processes, approvals, personnel competence and how you will control performance.
ISO 14001:2015 Clause 8.1 asks you to determine the environmental requirements for procuring products and services. You then communicate those requirements to external providers, contractors included, consistent with a life cycle perspective.
ISO 45001:2018 goes furthest of the three. Clause 8.1.4.1 wants processes that control procurement so what you buy conforms to the OH&S management system. Coordination matters too. Clause 8.1.4.2 asks you to align procurement with your contractors so you identify their hazards and control the risks. Outsourcing gets its own line. Clause 8.1.4.3 tells you to control outsourced functions and to define the degree of that control.
The common thread across all three is a simple sequence. Specify before you buy. Verify what arrives. Monitor how they perform.
The Australian duty chain does not end at your supplier
The Work Health and Safety Act 2011 places duties across the whole supply chain. Those duties reach past the business doing the work. Sections 22 to 26 cover designers, manufacturers, importers, suppliers and installers of plant, substances and structures. Under section 25 a supplier must ensure, so far as is reasonably practicable, that what they supply carries no risk to health and safety. They must also tell you how to use it safely, what testing showed, and what conditions keep it safe.
That does not shrink your own duty. Section 19 remains your primary duty of care. Section 16 adds that more than one person can hold the same duty. Each must discharge it to the extent of their influence and control. A hazard arriving on a delivery truck becomes your hazard the moment it hits the ground.
Other obligations attach to purchasing decisions too. Chapter 7 of the WHS Regulations tells you to obtain the Safety Data Sheet from the manufacturer, importer or supplier. You need it when a hazardous chemical first reaches your workplace. The sheet must also carry a review date inside the last five years. Under the Heavy Vehicle National Law, Chain of Responsibility reaches further again. Consigning, packing, loading or receiving freight brings a primary duty for transport safety, even if you own no trucks. Larger entities also report annually on supply chain risk under the Modern Slavery Act 2018 (Cth). Their head contract terms then push the same questions down to their subcontractors.
Why QHSE procurement controls fail in practice
Three patterns show up again and again when QHSE procurement controls exist on paper but not in the transaction.
Start with the unspecified purchase. The requirement lives in a procedure inside the IMS. It never reaches the purchase order, the hire agreement or the subcontract. If it is not in the document the supplier signs, it is not a requirement. It is a hope.
Next comes the one-off check. Your team prequalifies the provider thoroughly at onboarding, files the paperwork, and never refreshes it. Public liability policies lapse. Licences expire. Certification quietly disappears at the next surveillance audit. Nobody notices, because nothing tracks an expiry date.
Worst of all is the unverified receipt. Goods inwards checks quantity and price. Nobody looks for the compliance plate, the test and tag date or the calibration certificate. Nobody checks the SDS either before the item goes into service. The control existed at the specification stage and evaporated at the loading dock.
Building QHSE procurement controls that hold
Start by risk-rating what you buy rather than treating every purchase the same way. Plant and equipment, hazardous chemicals, labour and subcontract services, transport and waste disposal sit at the high end. Consumables, PPE and calibration services sit in the middle. Stationery and office supplies sit at the bottom. Matching the extent of control to the potential impact is exactly what ISO 9001 Clause 8.4.2 asks for. It also stops your team drowning a stationery order in prequalification paperwork.
For each high-rated category, write down the requirements you will state before you buy. Plant usually needs the compliance plate and operator manual, current test and tag, and guarding to AS 4024. Design or item registration applies where Schedule 5 of the WHS Regulations bites. Hazardous chemicals need a current SDS before delivery, GHS-compliant labelling, and storage that suits the product. Services need insurances, licences, a SWMS for high risk construction work under regulation 291, competency records and induction.
Push those requirements into the documents that actually move. Amend the purchase order template, the standard hire terms and the subcontract schedule. The requirement then travels with the transaction. Verify on receipt and record what you checked. An unverified check looks exactly like no check at an audit.
Finally, put an expiry date on every piece of evidence you hold and let the register drive the reminder. Insurance certificates, licences, SDS review dates, calibration certificates and ISO certificates all age. A register that calculates its own status turns supplier assurance from an annual scramble into a monthly glance.
Practical Application
Consider an Australian civil contractor with 25 staff working across several sites. Its buying falls into five real categories. They are plant hire, hazardous chemicals, subcontract labour, waste and spoil disposal, and consumables including PPE.
The Operations Manager rates the first four as high impact and consumables as low. One short requirements block per category then goes into every order. Plant hire orders now call for the compliance plate, current service record and pre-delivery inspection report. Chemical orders call for the SDS before dispatch. Subcontract orders call for certificates of currency, licences and a reviewed SWMS before mobilisation. Waste orders call for the facility licence number and weighbridge dockets with the invoice.
Every certificate that comes back goes into the register with an expiry date. The register then calculates Current, Due Soon or Overdue on its own. Each month the Operations Manager opens one tab and sees who needs chasing. Nobody has to remember anything. Every commitment carries a date.
Twelve months later that register becomes the evidence base. It shows an auditor exactly how the business specified, verified and maintained its QHSE procurement controls. It also shows a regulator that the business used the influence it actually had.
Conclusion
Procurement is one of the highest leverage points in any integrated management system. It sits at the moment before a risk enters your business rather than the moment after. Specify the requirement while you still hold the money. Verify it when the goods or people arrive. Track the evidence to a date. Do those three things consistently and a large slice of your site risk never reaches site at all.
The MiSAFE All-in-One QHSE subscription includes configuration of your procurement and supplier assurance registers. You also get automated expiry reminders and order requirement blocks matched to your buying categories.
Ready to act? Contact us today or book a free 45-minute consultation.
Download the Free Template
Download the free QHSE Procurement Control Register (.xlsx) and start specifying your QHSE requirements before the money leaves, not after the risk arrives.
Recent Comments