Safety Management System: ISO 45001 vs HSG65, Build or Buy
Creating and maintaining a safe workplace is a vital component of the operations of any organisation. To competently protect workers, their health, and the environments they conduct their work in, both large and small organisations need to be armed with a precisely tuned Safety Management System (SMS).
With an effective and efficient SMS, organisations can manage safety programmes, identify hazards, report incidents, and be progressive in controlling risk, especially when it comes to regulatory compliance and sizing concerns. However, making the crucial decision to either design and develop an internal SMS, or instead purchase a third-party SMS service, is one that many organisations face as a challenge when adhering to employment Health & Safety (HSE) standards.
What is a Safety Management System?
A safety management system (SMS) is the structured framework of policies, processes, and procedures an organisation uses to manage health and safety risk. Rather than treating safety as a series of one-off fixes, an SMS builds it into everyday operations: identifying hazards, controlling risk, recording incidents, and driving continual improvement. It is the layer that turns individual safe systems of work into something the whole organisation runs on. In the UK, two frameworks shape most systems, the international standard ISO 45001 and the HSE’s own guidance, HSG65.
ISO 45001 and HSG65
ISO 45001 is the international standard for occupational health and safety management systems. It follows the same high-level structure (Annex SL) as ISO 9001 and ISO 14001, which makes it straightforward to integrate quality, environmental, and safety systems. The HSE’s HSG65, “Managing for Health and Safety”, sets out a Plan, Do, Check, Act approach that maps closely to ISO 45001 and is widely used by UK employers.
Worth knowing before you commit budget: the HSE’s management systems guidance is explicit that you are not required by law to implement a formal system at all. What the law wants is control of the risk, and a formal framework is one route to it. Both standards put leadership, worker involvement, and continual improvement at the centre, and both break down into the same four core elements of policy, risk management, assurance, and promotion.
Option 1: Designing an Internal Safety Management System
Considered the more traditional solution, internal safety management systems are designed to either eliminate or mitigate the worker/environment interface through a number of different processes. Adoption normally involves creating new staff roles or departments to ably manage and maintain internal H&S standards at the different levels.
The general approach to modern safety management can be described as emphasising regulatory compliance and motivation programmes during the interaction of three primary components of the workplace:
Work Environment
The location where workers are exposed to risk. Companies must consider the geographic location, existing environmental conditions, and the different hazards present such as moving equipment or high pressure systems.
People
Those who are either at risk or whose behaviours are capable of putting others at risk. A fundamental component of the safety programme is making people aware of what risks exist, getting them to self-identify and mitigate the risks. Programmes will involve education, assessment, verification, and observation.
Management Systems
Formalised work practices which outline roles and responsibilities. They necessitate accountability to guarantee programmes are implemented effectively and where continual advancement is taking place.
Organisations that choose to design their own internal SMS will enjoy some of the following benefits:
- Consistency: with a dedicated in-house SMS, there ideally will be more time and personnel to analyse and study the way workers operate, as well as easy provision of training for the staff.
- New Safety Training Approaches: through the help of safety management systems vendors, organisations can recruit trained HSE professionals that follow and examine safety in the workplace in new and improved ways.
- Conformity with Company Beliefs: hiring in-house SMS staff presents the advantage of having someone who understands the company’s brand, and aligns their job with the company and regulated H&S standards.
The common thread across those three is control. An internal system is the route to take when your risk profile is unusual enough that a generic framework would need heavy adaptation anyway, and when you have the headcount to keep it current.
Option 2: Purchasing a Safety Management System (Software)
Companies that choose to purchase an SMS are essentially choosing to outsource their SMS to a third-party service vendor, commonly with a running software package. The choice to adopt SMS software empowers safety officers and employees in proactively keeping the workplace safe and compliant with H&S regulations through powerful customisable inspections, real-time corrective actions, efficient recordkeeping, and insightful analytics.
Other additional benefits of purchasing an SMS include:
- Reduced Time and Costs: with an SMS, the work-hours and costs dedicated to managing safety, document handling, and paperwork are cut down by automated services. Prevention almost always costs far less than the accidents, claims, and downtime it avoids.
- Higher Quality Data: SMS software improves data collection and significantly enhances data handling with seamless information gathering.
- Streamlined Communication: SMS software provides a centralised platform where all H&S assessment, data, reports, and more are readily accessible.
- Secure Data Storage: SMS software securely stores safety and compliance data in a manner that allows for easy retrieval of older staff information or easy onboarding of new staff.
- Flexible resources: adoption of an SMS software service creates an adjustable workload that allows for better resource allocation in response to business changes.
- Improved employee safety and welfare compliance: you can measure employee knowledge on safety-related issues and assess the level of compliance on an individual basis.
What you are really buying here is maintenance. The vendor absorbs the work of tracking regulatory change and keeping templates current, which is the part of an in-house system that quietly consumes the most time.
How to Decide: Designing In-house SMS vs Purchasing Third-party SMS?
For any business, the choice comes down to 3 criteria: what the system will cost to adopt, whether you have the skilled safety resource to run it, and what your business will require of it as it grows. They are set out below, and they rarely all point the same way.
The Cost of Adopting an SMS
In the past, internal IT resources and safety experts designed, built, and maintained the in-house SMS. However, given today’s economic climate, this is not sustainable for most organisations. Investing in SMS software and working with an SMS service partner controls your time and costs that would otherwise be spent on maintaining an in-house SMS, which can potentially run into the hundreds of thousands of pounds for extra IT staff alone.
Availability of Skilled Safety Resources
In today’s digital world, every department requires assistance from IT. This can leave your safety department waiting in a long queue for IT resources, yet any SMS must keep up to date with the most current regulations or management changes. Outsourcing the design and management of your SMS saves time and IT resources throughout your organisation.
Business Requirements
Growth requires change, and as your business evolves the safety process requirements must evolve along with it. It makes business sense to purchase and outsource the management of your SMS to safety vendors who already have the most up-to-date technology.
Score all three honestly and the answer is rarely unanimous. Where cost and skilled resource point one way while business requirements point the other, weight the factor that will still be true in three years.
Making the Build or Buy Decision
While designing an internal SMS promotes conformity of company safety, having to recruit safety personnel at different levels to accommodate constant management system changes often requires a hefty investment of money. Strategic use of third-party safety services can provide for better personnel and resource management.
Whichever route you choose, regular safety audits keep the system honest, there are plenty of free tools to help smaller firms get started, and our HSE recruitment team can source the safety personnel an in-house system needs.
The system matters less than whether it holds up when an inspector, a client or an insurer asks to see it. Book a compliance consultation and we will tell you which route your risk profile actually justifies.
Frequently Asked Questions
What is an SMS?
An SMS, or safety management system, is the structured set of policies, processes, and procedures an organisation uses to manage health and safety risk and drive continual improvement. It brings hazard identification, risk control, incident reporting, and monitoring together under one framework.
What are the elements of a safety management system?
Most systems, whether based on ISO 45001 or the HSE's HSG65, share four core elements: policy and leadership, planning and risk assessment, implementation and operation, and monitoring with continual improvement. People, the work environment, and formal management processes all sit within these.
What is the difference between ISO 45001 and HSG65?
ISO 45001 is the international standard for occupational health and safety management, structured to Annex SL so it integrates cleanly with ISO 9001 and ISO 14001. HSG65 is the HSE's own guidance and follows a Plan, Do, Check, Act cycle. The content overlaps heavily. ISO 45001 is the one to choose if you need certification a client or insurer will recognise; HSG65 is the cheaper route if you only need a defensible framework.
Is a safety management system a legal requirement in the UK?
No. The HSE states plainly that you are not required by law to implement a formal management system. What the law requires is that you control your risks, and a formal system is one route to that. This matters commercially: certification is often driven by client and insurer requirements rather than by regulation, so check who is actually asking before you budget for it.
How much does a safety management system cost?
Software subscriptions typically run from a few hundred to a few thousand pounds a year depending on headcount and modules. Building in-house is where costs escalate, because you are funding safety and IT staff time to maintain the system against changing regulation, which can reach six figures once dedicated headcount is included. Compare the total cost of ownership over 3 years rather than the licence fee.
How long does it take to implement a safety management system?
A purchased system can be running in weeks, since the framework and templates already exist and the work is configuration and data migration. Building in-house, or working towards ISO 45001 certification, more commonly takes 6 to 18 months because it involves writing procedures, training people and generating enough records to demonstrate the system is being followed.
