What Is a Health and Safety Management System? A Practical Guide for Alberta Employers
A safety manual is not a safety management system.
It can be an important part of one, but policies, procedures, and forms do not necessarily mean you have an effective health and safety management system.
A health and safety management system, or SMS, is how an organization identifies and controls risk, communicates expectations, develops competent workers, checks whether its controls are working, responds when they are not and uses what it learns to improve.
The paperwork supports that process.
The paperwork is not the process.
What is a health and safety management system?
A health and safety management system is the framework an organization uses to manage occupational health and safety.
In Alberta, a health and safety program is a coordinated system of procedures, processes, and other measures used to improve occupational health and safety and prevent workplace injury and illness.
For employers participating in Alberta's Partnerships in Injury Reduction program, the management system is also the foundation for obtaining a Certificate of Recognition, or COR.
An important idea underlies all of this: safety needs to operate as a system.
A policy connects to a program that includes a procedure. The procedure connects to training, competency, safe work practices and supervision. Training connects to how the work is actually performed. Inspections, incidents and worker feedback provide information about whether the controls are working. Corrective actions feed that information back into the system.
Done properly, one thing informs another.
Depending on the organization, an SMS may include:
policies, programs and safe work procedures
hazard identification, assessment and controls
worker orientation, competency and training
workplace inspections
emergency response
incident reporting and investigation
worker participation and safety meetings
corrective actions and follow-up
performance indicators and trend analysis
records showing what was completed
management oversight and continual improvement
The scope and complexity should reflect the workplace, the work being performed, and the risks involved.
The manual is not the system
A safety manual describes how an organization intends to manage health and safety.
The management system is what actually happens next.
Suppose the manual requires monthly workplace inspections.
Great.
Were the inspections completed?
What deficiencies were identified?
Who was responsible for correcting them?
Were the corrective actions completed?
Did the same deficiency show up on the next three inspections?
Did anybody notice?
Imagine that damaged extension cords are repeatedly identified during site inspections. Each time, the team removes the damaged cord and marks the corrective action complete.
Technically, something was corrected.
But if another damaged cord appears next month, and another one the month after that, the system should start asking a different question.
Why does this keep happening?
Maybe cords are being routed through an area where they are regularly damaged. Maybe storage is poor. Maybe the equipment being purchased is not appropriate for the conditions. Maybe workers are not inspecting cords before use. Maybe there is another cause entirely.
Replacing the cord addresses the immediate deficiency.
Identifying and addressing why the deficiency keeps recurring improves the system.
The inspection form is evidence that part of this process occurred. Filling it out is not the objective.
This distinction matters because you can have excellent documentation and a poor safety system.
A 300-page manual does not become more effective through sheer mass.
What does an effective safety management system include?
Alberta’s Partnerships in Injury Reduction program identifies multiple elements that contribute to an effective health and safety management system, including the following core components:
Identifying and assessing work site health and safety hazards
Implementing controls to eliminate or reduce worker risk
Demonstrating management commitment through a written company policy
Ensuring worker competency, orientation, and training
Maintaining a workplace inspection program
Planning for emergency response
Reporting and investigating incidents
Administering the health and safety management system
Establishing a joint work site health and safety committee where required
These components create a framework, but they do not require every company to use the same safety system.
A small contractor working from one location will manage safety differently than an organization with multiple divisions, work sites, and hundreds of workers.
Even companies of the same size may have very different safety needs.
For example, a company doing ground disturbance may need procedures irrelevant to an office-based employer. A workplace with significant occupational noise exposure may also need a noise management program and additional controls.
In short, different work creates different risks.
Templates can be useful. The goal is not to rewrite a sound policy just to say it was custom-written.
What matters is knowing where the template ends, and your operation begins.
What happens when the work changes?
This is where an otherwise decent safety system can develop gaps.
Imagine a contractor that has historically performed interior renovation work. Its program reflects its operations, workers are trained for the work they perform, and its existing controls generally make sense.
Then the company starts taking on projects involving regular concrete cutting.
The company still has the same safety manual.
It may still have COR.
It may still complete inspections, orientations and safety meetings.
But the work has changed.
Concrete cutting can introduce hazards and requirements that the existing system may not adequately address, including respirable crystalline silica exposure, noise, respiratory protection, equipment-specific controls and worker training.
A functioning management system should recognize that change.
The new work should trigger questions.
What hazards have been introduced?
What does the legislation require?
Can exposure be eliminated or reduced?
Are engineering controls required?
Does existing PPE remain appropriate?
Do workers need additional training?
Are existing procedures still adequate?
Is exposure monitoring or another form of verification required?
What records need to be maintained?
The answer is not necessarily to write another 40 pages of policy.
The answer is to determine what the new risk requires and make sure the appropriate parts of the system change with it.
This is one reason a safety program should never be treated as finished.
Operations change.
The system needs to change with them.
The system needs feedback from the people doing the work
A safety management system should not operate in one direction.
Management does not write a program, hand it to workers and declare the system complete.
Worker interaction, supervision and mentorship create feedback.
A worker identifies a hazard that was not considered during planning.
An inspection finds the same deficiency for the third time.
A supervisor realizes a procedure does not reflect how the task can actually be performed.
An incident investigation identifies a control that looked good on paper but did not work in the field.
A new employee repeatedly misunderstands the same part of an orientation.
Those are not just individual safety issues.
They are information.
Consider a worker who tells a supervisor that a written procedure requires a control that cannot practically be used in the space where the task is being performed.
Information can move in two ways.
The first is downward: the procedure says to do it this way, so follow the procedure.
The second is back through the system: stop, assess why the written procedure and the actual work conflict, determine whether the task, the control, or the procedure needs to change, and make sure the resulting solution is communicated.
That does not mean a worker can disregard a required control because it is inconvenient.
It means a conflict between the procedure and the work is information the organization needs to deal with.
An effective SMS gives that information somewhere to go.
The system informs the field.
The field informs the system.
That is continual improvement in practical terms.
Incident investigation should feed the system too
The same principle applies when something goes wrong.
Imagine a worker strains their shoulder while repeatedly moving heavy material.
The easy corrective action might be:
Review proper lifting techniques with workers.
Sometimes training is appropriate.
But before defaulting to retraining, a useful investigation should ask what actually contributed to the event.
How heavy was the material?
How frequently was it being moved?
Where was it being moved from and to?
Could the material have been staged differently?
Was mechanical assistance available?
Was the worker working in an awkward position?
Had the task changed?
Was the risk identified before work began?
Were existing controls actually effective?
If the investigation identifies a problem with material handling or work planning, another reminder about lifting technique may do very little to prevent the next injury.
The value of an incident investigation is not finding a sentence to put in the corrective-action box.
It is learning something useful enough to reduce the chance of it happening again.
That information should feed back into hazard assessments, procedures, training, planning or other parts of the management system where appropriate.
Otherwise, the investigation ends when the form does.
Records are evidence, not the objective
Safety creates a lot of records.
Training records. Inspection reports. Meeting minutes. Hazard assessments. Incident investigations. Corrective actions. Competency records. Preventive maintenance records.
There is a reason for that.
Records can help demonstrate what the organization actually did. They can show that hazards were identified, workers were trained, inspections occurred, incidents were investigated and deficiencies were followed through to corrective action.
They also give the organization something to learn from.
But there is an unfortunate reality here: having a form and doing the thing documented on the form are not necessarily the same thing.
A corrective action that is marked complete but does not correct anything is not particularly useful.
Neither is an inspection that identifies the same problem every month without escalation, or a safety meeting where information is delivered but nobody checks whether it was understood.
Good records should help answer practical questions:
What happened?
What did we identify?
What did we do about it?
Who was responsible?
Was it completed?
Did it work?
Is there anything here we need to apply somewhere else?
Records should be evidence created by a functioning system.
Creating records should not become the system.
Where does COR fit?
COR stands for Certificate of Recognition.
In Alberta, a COR demonstrates that an employer's health and safety management system has been evaluated and meets provincial standards.
Before obtaining COR, an employer must have a health and safety management system in place. For a standard COR, that system is evaluated by an external certified auditor through a Certifying Partner.
The audit does more than check whether documents exist.
Alberta's approved COR audit instruments use three methods of gathering evidence:
documentation review
employee interviews
workplace observations
That distinction is important.
If the manual says inspections happen, documentation can help establish whether they have been recorded.
Interviews can help establish whether people understand their roles and how the system operates.
Observations can help establish whether what is described in the system is reflected in actual workplace conditions and practices.
In other words, the question is not only:
Do you have a system?
It is also:
Is the system actually working?
That makes COR useful as both a framework for developing a health and safety management system and a method of evaluating it.
COR does not replace an organization's responsibility to understand the legislation and operational requirements that apply to its work.
A company can hold COR and still have a compliance problem.
That sounds contradictory until you separate what it measures.
COR evaluates the health and safety management system against an approved audit standard. Alberta's OHS legislation establishes legal duties and technical requirements.
There is substantial overlap, but they are not interchangeable.
An organization may have a functioning management system and still miss a requirement associated with a particular hazard or operation.
Noise exposure may create additional requirements. Ground disturbance may introduce others. Hazardous products, confined spaces, fall protection and other work can bring their own requirements into the picture.
COR gives you a framework for managing safety.
You still need to make sure the system addresses the work.
What does continual improvement actually look like?
"Continual improvement" sounds like something that belongs in a management presentation.
In practice, it is much less exciting.
Something happens.
You learn something.
You change something.
An incident identifies a weakness in a control, so the control changes.
Inspection data shows the same issue appearing repeatedly, so instead of closing the same corrective action for the fourth time, somebody asks why it keeps happening.
The company takes on a new type of work, so it reviews its hazard assessments, training requirements, and procedures.
Legislation changes, so the affected parts of the system are updated.
Workers find a better way to control a hazard, so that knowledge makes its way into the process.
That is continual improvement.
It is not necessarily a major annual initiative.
Often, it is a series of small corrections made because the organization is paying attention.
The system should respond to what the organization learns.
If the company, workforce and work have changed substantially but the safety system has remained untouched for years, there is probably a disconnect somewhere.
What does the whole system look like in practice?
Consider a contractor preparing to perform a type of work it has not done before.
The process might begin during planning, when somebody recognizes that the new scope introduces hazards the company does not normally encounter.
Those hazards are assessed.
Controls are selected.
The company determines whether its existing procedures adequately address the work.
Workers receive the information and training they need before performing the task.
The work begins.
During the job, a worker identifies a practical issue with a control and raises it with the supervisor.
The issue is assessed, and the control is adjusted.
During a later inspection, the supervisor verifies whether the revised control is being used and whether it is effective.
The change is documented.
If the lesson applies to future projects, the relevant procedure, hazard assessment, orientation, training material or planning process is updated.
The next crew does not have to rediscover the same problem from scratch.
That is a safety management system operating as a system.
Hazard identification did not live in one folder.
Training did not live in another.
Inspections were not an unrelated monthly exercise.
Worker feedback did not disappear at the end of the shift.
Information moved through the organization and changed what happened next.
Does every Alberta employer need a formal health and safety program?
No.
Under Alberta's Occupational Health and Safety Act, an employer that regularly employs 20 or more workers must establish and implement a health and safety program.
When an employer operates multiple work sites, Alberta's guidance states that the total number of regularly employed workers across those work sites counts toward the 20-worker threshold.
Employers with fewer than 20 regularly employed workers are not subject to that same formal health and safety program requirement, but they still have occupational health and safety responsibilities and must maintain documentation required by the legislation.
Alberta specifically identifies hazard assessment and control and emergency response planning among the requirements that continue to apply to smaller employers.
That distinction is important.
Fewer than 20 workers does not mean no safety system.
It means the formal health and safety program requirement is different.
A smaller employer may still need hazard assessments, worker training, emergency procedures, inspections, exposure controls, records and other measures depending on its work and the applicable legislation.
The size of the organization can change how the system is structured.
It does not make the hazards disappear.
A useful test: follow the information
To know whether you have a functioning safety management system or just a collection of safety documents, follow a piece of information through the organization.
A worker reports a hazard.
What happens next?
Does someone assess it?
Is a control established?
Is somebody responsible for implementing it?
Is the worker told what happened?
If the issue affects a procedure or training material, is it updated?
If the same problem could exist somewhere else in the company, does the information get there?
Can you demonstrate what was done?
Now try the same exercise with an inspection deficiency, an incident investigation or a training issue.
If information consistently enters the safety system and disappears, the problem probably isn't the form.
The point of the system
A health and safety management system should make it easier for an organization to manage risk consistently.
It creates a structure for identifying hazards, establishing controls, developing competent workers, communicating information, verifying performance and learning from what happens.
Policies matter.
Procedures matter.
Training matters.
Records matter.
But they work best when they are connected.
The objective is not to produce the most impressive safety binder in the room.
The objective is to build a system that works when somebody leaves the room and the actual work starts.
Alberta Resources
For the legislation and government guidance referenced throughout this article:
Government of Alberta: Health and Safety Program
Government of Alberta: Partnerships in Injury Reduction
Government of Alberta: Get a Certificate of Recognition (COR)
Government of Alberta: Occupational Health and Safety Act, Regulation and Code
Last reviewed: September 2026.
This resource provides general information and is not legal advice. Occupational health and safety requirements vary depending on the work, workplace and circumstances.
