Does a QHSE policy have to be signed?

The standards ask management to establish the policy. A signature is not stated as an explicit requirement, but signing with name, position and date is common and makes the approval demonstrable. An approval route in your document management can record this digitally as well. If in doubt, ask your certification body.

May you write one integrated policy or do you need three separate ones?

Both are possible. One integrated policy is more practical for a small or mid-sized company, as long as the commitments per standard can be found in it, such as protecting the environment and consulting workers on safety. Ask your certification body whether additional requirements apply to the form.

How long should a policy be?

The standards prescribe no length. In practice a good policy fits on one A4 page with five to eight commitments. Longer texts are rarely read and harder to review. If it contains more than you can deliver, remove commitments instead of leaving them in.

Does the policy have to be public?

The standards expect the policy to be available to interested parties, for ISO 9001 and ISO 45001 as appropriate. What that means for you depends on your customers and sector. Many organisations put it on their website or attach it to quotes and tenders. Where needed, check what your client or certification body expects.

What is the difference between policy and objectives?

The policy is the direction and stays valid for years. Objectives are measurable, have an owner and a date and are adjusted regularly. The policy provides the framework and the objectives make it concrete, for example by translating a commitment into a measure.

QHSE policy example: how to write a policy statement

What is a QHSE policy, and what is it not?

A QHSE policy, also called a quality policy, VGM policy (the Dutch term for safety, health and environment) or policy statement, records the direction and the commitments of the organisation. QHSE stands for quality, health, safety and environment. ISO 9001, ISO 14001 and ISO 45001 each ask for a policy (clause 5.2) that top management establishes and that fits the organisation.

A policy is not a procedure, a plan or an advertising text. It does not describe how you work, but what you choose. It is also not a list of objectives: objectives are measurable and expire, while a policy stays valid for years. The policy does provide the framework within which you choose those objectives.

What belongs in a policy statement?

What the three standards ask for is largely the same, with a few additions per area. Fill in the points in your own words and adapt them to your activities and risks. A policy that looks like a copy rarely fits the organisation, and auditors spot that quickly.

Write in plain language and in the first person plural, with one commitment per sentence. Avoid phrases such as strive for and as far as possible: you cannot be held to them and no auditor can test them. A commitment that can be checked, such as setting measurable objectives every year, works better than a nice intention. The checklist follows below.

Purpose and context: what the organisation does, for whom and with which significant risks and opportunities
Meeting requirements: the requirements of customers, the law and other obligations you have committed to
Quality: delivering what was agreed and customer satisfaction
Safety and health: safe and healthy working conditions, eliminating hazards, reducing risks and consulting and involving workers (ISO 45001)
Environment: protection of the environment, including prevention of pollution, and fulfilling obligations (ISO 14001)
Framework for objectives: the commitments from which you derive measurable objectives
Continual improvement of the management system
Approval: name and position of the signatory, date and version

The role of management in the policy

Top management establishes the policy, not the quality manager. The standards place this with the top: whoever signs the policy must be able to explain it and be held to it. An HSE coordinator may write the draft, but management must make the commitments its own and also free up resources for them.

It goes further than a signature. Directors show that the policy counts when they mention it in work meetings, take decisions that are in line with it even when that costs money, and follow the safety rules themselves. ISO 45001 also expects top management to ensure that workers are not penalised for reporting incidents, hazards, risks or opportunities.

How to write the policy: steps and input from employees

For safety, ISO 45001 expects you to consult workers and involve them. For the policy that can be simple: put the draft to the works council or employee representatives, a safety committee or a group of shop-floor employees, and ask what they miss or do not recognise.

It brings two things. The policy fits the real work better and employees recognise the text as theirs. Record whom you consulted and what you did with the comments, because that is also evidence for an audit.

Collect the input: your context, interested parties, risks and opportunities, legal requirements and the outcome of the last management review
Write a draft of one A4 page in plain language, in the first person plural
Put the draft to employees and their representatives and process the comments
Have management establish and sign it
Communicate the policy and schedule the first review

Example QHSE policy of about 120 words

Below is an illustrative example of a policy statement. The organisation, the wording and the commitments are made up and meant as a starting point, not as a ready-made text. Adapt them to your own activities, customers and risks, and let management test each commitment against its own practice before signing.

Example: “[Company name] supplies [products or services] to [target group]. We want customers to get what we agree, everyone who works for us to get home safe and healthy, and our work to place as little burden on the environment as possible. That is why we commit to the following.”

We meet the requirements of customers, the law and other agreements that apply to us
We eliminate hazards, reduce risks and let employees take part in decisions on safety
We prevent pollution and use energy and raw materials sparingly
We learn from mistakes, near misses and complaints and never call anyone to account for reporting them
We set measurable objectives every year and continually improve our management system
Management reviews this policy every year and in the event of major changes

From policy to measurable objectives

The policy says what you want, objectives say how much and by when. The standards expect objectives to be consistent with the policy, measurable where practicable, monitored and updated in good time (clause 6.2). Choose one to three objectives per commitment with a measure, an owner and a date, and keep the total limited.

The list shows how a commitment becomes an objective and a measure. The figures are illustrative and belong to the fictional organisation, not to your situation. Choose five to ten objectives that you actually measure and discuss rather than thirty on paper. You will find more examples in our guide on KPIs and objectives.

Commitment: learning from reports. Objective: every report receives feedback within three working days. Measure: percentage of reports answered on time, target 90 percent
Commitment: reducing risks. Objective: workplace inspections are carried out as planned. Measure: percentage of inspections completed, target 100 percent
Commitment: meeting customer requirements. Objective: fewer repeated deviations. Measure: number of recurring NCRs per quarter, target a maximum of two
Commitment: limiting environmental impact. Objective: lower energy consumption. Measure: kWh per production unit, target 5 percent lower than last year

How to communicate the policy and make it accessible

The standards expect the policy to be available as documented information, to be communicated and understood within the organisation, and to be available to interested parties (for ISO 9001 and ISO 45001 as appropriate). A policy that sits in a drawer does not meet that. Test it with a simple question: can a fitter say in their own words what the policy means?

Make the policy available where people come across it: on the intranet or in the app, as a poster in the canteen and at the entrance, in the induction of new employees, in the toolbox talk and with temporary staff and subcontractors. Ask employees for read confirmation and, where it fits, show the policy on your website or in quotes and tenders.

When do you review the policy?

The standards name no fixed review period, but the policy must remain suitable. Many organisations test it every year during the management review, where it sits alongside the results, the audits and the objectives. Also review it in between if one of these situations occurs.

Put the version, the approval date and the next review date on the document, and keep earlier versions. A change that alters the commitments is approved again by management. Communicate that change again to employees, temporary staff and subcontractors, and have them confirm again that they know the policy.

A new strategy, activity, location or market
A merger, acquisition or major reorganisation
A new standard or a significant change in laws and regulations
A serious incident or audit finding that shows the policy no longer fits
Objectives that are missed year after year, which may point to a policy that does not work

Common mistakes with a QHSE policy

Most policy statements are not wrong but redundant: they are too long, too general or unknown. An auditor notices quickly, for example when employees cannot explain the policy. If you recognise any of these points, it pays to rewrite the policy together with the people who have to work with it.

Too long: nobody reads a four-page policy, one A4 is enough
A copy of an example or of another organisation, with commitments that do not fit you
Promises with no objectives, resources or owners behind them
Nobody knows the policy: it only sits in the folder for the auditor
Vague language such as striving for the highest quality, from which nothing follows
Separate policy documents per standard that repeat or contradict each other
A policy that is not reviewed or explained after a change of management

How BrydgeOne supports this

In Document management you record the policy with the document type Policy, with version control, an approval route and read confirmation per audience, so that you see per person who has read and understood it. You publish in the platform, in the employee app and on a public document portal, and with a periodic review you record whether the policy stays current. The next review date is scheduled automatically.

In Objectives & KPIs you link each objective to the policy it comes from. The policy tab shows the objectives, KPIs and improvement actions per policy document, and status, forecast and evaluations show whether the goals are being met. In the Management review, decisions become actions, CAPAs or new objectives. BrydgeOne helps you collect evidence for ISO 9001, ISO 14001 and ISO 45001, but it does not certify and does not guarantee that you comply.

Writing a QHSE policy: an example policy statement for ISO 9001, 14001 and 45001