There is some advice on the HSE website on this topic, not sure if you have seen this.

http://www.hse.gov.uk/managing/delivering/do/profiling/index.htm

During our ISO 45001 transistion audit it was noted that we didnt capitalise on identified oppurtunities in our risk matrix - what we need to identify is that because our new "business model" is a core team of shop floor staff from which we will man up and down as required.

We therefore need to have a programme ( profile ) to identify when in our work schedule we need to bring in sub contractors and how we control the risk as detailed in my initial post.

The audit report minor NC states:  

The organization shall establish, implement and maintain a process to assess:

a) OH&S opportunities to enhance OH&S performance, while taking into account planned changes to the organization, its policies, its processes or its activities and opportunities to adapt work, work organization and work environment to workers ,opportunities to eliminate hazards and reduce OH&S risks.

b) other opportunities for improving the OH&S management system.

The discussion with the auditor was to risk profile our workload and timetable so we can identifiy areas of upmanning and plan for it.

I just dont really understand how to do this - i will look at the HSE link posted above.

Thank you for the comments so far.

Edited by user 18 December 2018 13:31:19(UTC)  | Reason: spelling error

We've actually had a very similar thing here. We had an observation raised following a 14001 audit in respect to our aspects and impacts. Although we have clearly identified all aspects and impacts, rated them and looked further at adressing additional controls. The auditor asked us why we hadn't gone further and singled out our most significant aspects and then reviewed those from a life cycle perspective. 14001 does not require this level of detail and our system isn't mature enought yet to accomodate this. It fealt very much like the auditors flavour of the month suggestion to try at get us to continually improve without guiding use as to the information they expect to see. I'm not even sure what he expects to see.

i'd also suggest use of iso9000 as part of the system,and creating an integrated management system whilst you are at it, and think that could also be an underlying aspect to it, suggest you are looking to prepare to add in iso 9001 so it gives control of the business objectives. 

if reading correctly, perhaps they're suggecting that things could be less disjointed, that 9001 could help, and would also require customer feedback and contact as an integral part of the system, (again providing better forward visibility), suggestings for customer quality improvements, and ensuring that planinng is formalised. 

just a bif more reflection on it, after "not-thinking" about it. 

perhaps it's also about senior management involvement, (and your involvement with them), perhaps should have more visibility and trust. 

good luck in any case, and 

I can't talk for the auditor but asking you to develop a risk profile is a really useful way of getting a feel for how well you understand your risks.  A traffic light approach should do this very well.  You may have a red risk because of

1. The inherent hazard - something you cannot avoid so are constantly in a state of unease to make sure you always control the risks;

2. Exposure to the hazard - something less hazardous but because it is encountered so often or by so many people you have implemented a greater deal of control than may be considered normal;

3. Inadequate controls - an area where you know you are not achieving best practice and so you have a plan in place to improve.

The key message is that you should have a profile with a mixture of red, amber and green.  Also, can explain why issues are in the different regions and what you are doing about it.