Occupational health and safety management in Colombia: what the law requires from a small business

Occupational health and safety management in Colombia: what the law requires from a small business

For many small businesses, the OHS management system became a folder put together in a hurry when the ARL asks for paperwork. That is the underlying mistake: the occupational health and safety management system does not exist to fill a filing cabinet, it exists to prevent the accident that stops operations and can close the business. The law requires it from every employer, with demands proportional to size and risk, and it punishes the company with nothing just as it punishes the one that bought templates it never executed. Here is what must exist, who is accountable, what evidence is kept, and what a realistic annual plan looks like for twelve workers.

What the OHS management system is and why it applies to any employer

The OHS management system is the organized set of policy, plans, documents and practices with which a company identifies the hazards of its operation, controls risks and responds when something goes wrong. It is defined in Decree 1072 of 2015 and is mandatory for every employer, regardless of size or whether it has one or fifty people on payroll.

The key word is proportional: demands correspond to the size of the company and the risk of the activity. A welding shop does not have the same system as a three-person office selling online. What does not change with size is the logic: identify hazards, control them, keep evidence and review every year.

Confusing the system with the filing cabinet is expensive. A complete set of folders over an operation that is as dangerous as before proves, in an inspection, that the system exists only on paper; and after a serious accident, that the company knew about the risk and did nothing.

The minimum components it must have, without decoration

Eight components hold up any OHS management system. They are not a menu: they are the floor. If one is missing, the gap shows in the first review.

Two warnings. Evidence is not the document, it is the document with a date and something behind it: an attendance list for a training session nobody taught is worse than having nothing. And the eight components feed each other: the matrix defines what is taught, what PPE is bought and which exams are performed. If it is empty or copied, the other seven have no foundation.

The PDCA cycle: what gets done and what gets documented

The system runs on a four-stage cycle that repeats every year. It is not theory: it is the order in which tasks are executed and the source of the dates in the annual plan.

The cycle explains why a one-time OHS system does not work. It can be built in three weeks, but if nobody looked at it again in twelve months, checking and acting never happened. The annual review, with the employer facing the results, is what turns paperwork into management.

The risk matrix: the document that orders everything else

If only one document could be kept, it would be this one. The hazard identification and risk assessment matrix answers three questions for each position: what can cause harm, how likely it is and how serious it would be.

It is built by walking the operation, not at the computer. Go through each area, write down the real tasks, including maintenance and cleaning, ask the worker what has happened to them, and rank risks by probability and consequence. From there come the controls: eliminate the hazard, replace it with a lesser one, isolate it and, only at the end, protect with personal equipment.

The matrix defines the rest. If the risk is manual handling of loads, training is about lifting technique and the exam looks at the lower back. If the risk is noise, training is about hearing protection and the exam includes audiometry. Without that connection the company buys a generic package and pays for things it does not need.

A copied matrix is the most expensive mistake and the most common: it describes risks that do not exist in your operation and omits the ones that do. It is updated when the process changes, a machine arrives, a person is transferred or a new chemical appears, always with a date and an owner. Symptom: fifteen risks identical to those of a friend's company. Consequence: the real hazard is not identified and the accident happens in the blind spot.

Who is accountable: designated officer, COPASST or safety watch

The system needs a name. The law requires a designated responsible person, who in small companies can be the employer. It is not a decorative title: it implies written duties, assigned time and competence to discuss risks with the ARL and with workers.

Alongside that person there must be a participation body: a COPASST (the joint occupational health and safety committee) or a safety watch, depending on the number of workers. Confirm with the ARL which one applies to the current payroll size. What is not open to discussion is that it must be constituted, meet and keep minutes: a committee that exists on paper but never met is non-compliance with better presentation.

In a twelve-person business the realistic split is this: the employer signs the policy and takes responsibility; someone on payroll, an operations or warehouse manager, serves as system owner with two or three hours a week; and the watch or committee meets with a minimum agenda: accidents, pending controls, training and the drill.

Occupational medical exams and the limit of confidentiality

Entry, periodic and exit exams are part of the system, not a hiring formality, and their content is defined by the matrix: the same package is not given to someone who carries sacks all day and to someone who spends eight hours in front of a screen. Cost is covered per worker and per year, according to the job-exam profile.

One rule is broken often: the company receives the worker's fitness result, that is, whether they are fit, fit with restrictions or unfit for the position, and not their diagnosis. The medical record belongs to the worker and is handled with confidentiality. Storing the full result in an open HR folder, visible to anyone, is a data leak with labor consequences.

The exit exam is almost always skipped and it is the one that protects the company most. It documents health status at the end of the employment relationship and separates a pre-existing condition from a work-related illness. Without that certificate, any later discussion becomes a clash of opinions.

Training and PPE: without a matrix they are decoration

Training is measured by what changes at the workstation, not by the number of talks. A session on load handling works if the next day the person lifts the box with the technique they were taught; if not, it was an hour lost with an attendance list.

Every training session must leave a record with date, topic, owner and signatures, and must answer to a risk in the matrix. Scheduling road safety at a company with no vehicles and no staff on the street is filling a form, not managing a risk.

Personal protective equipment works the same way: issued according to the risk, replaced when worn, with instruction on use and a signed record. PPE kept in the warehouse for when the inspection arrives protects nobody, and its issuance record is the first piece of evidence that falls apart.

Symptom: ten training sessions a year, all on different topics and none related to the matrix. Consequence: workers remain exposed to the real risk and the company cannot show it addressed the risk it identified.

Accidents and incidents: report, investigate, close

Every accident must be reported, and every incident too. An incident is the event that left no injury but could have: the box that fell next to the foot, the slip without a fall. It is the cheapest warning a company gets.

The investigation looks for causes, not culprits. It asks what failed in the control: whether the procedure existed and was not followed, whether PPE was unavailable, whether the task was rushed to hit a shipping target. The result is an action plan with an owner and a date, reviewed at the next committee meeting.

Under-reporting incidents is the silent failure. A company reporting zero incidents in a year of heavy operation is not healthy: it is blind. Today's incident is the accident investigated tomorrow with an injured person.

What the ARL can ask for and what the Ministry can ask for

The ARL is not just the entity that receives the monthly payment. It supports, advises and can demand evidence: matrix, annual plan, training records, PPE issuance, exams and accident reports. It also verifies enrollment and contributions. When there is nothing, advice becomes a requirement.

The Ministry of Labor oversees compliance and can impose penalties. The penalty is not calculated with a fixed rate anyone can memorize: it depends on size, conduct and severity, and it changes with current regulation, so verify the year's rules before doing the math.

A serious accident brings the other front: civil liability for damages and, depending on the case, criminal liability. There the discussion is no longer about a form but about a person's life and the continuity of the business. That is the scenario the OHS system exists to prevent.

How the annual work plan is built and what a real one looks like

The annual plan is the system's calendar: what is done, by whom, when and with what budget. It comes from the matrix and from what was left pending last year, not from a list of nice activities. The example assumes twelve workers and risk class II.

Three rules make it useful. At least one activity per month, with nothing piled up in December. An owner with a first and last name, not a generic title. And evidence defined in advance: if you do not know which paper will remain, the activity is poorly designed.

The sum is $2,400,000 + $1,500,000 + $1,500,000 + $300,000 + $300,000 = $6,000,000 a year, about $500,000 a month. For twelve workers it fits in the budget when planned; and it is the same figure that appears suddenly when the ARL issues a requirement and three weeks are left to solve what was not done in twelve months.

The plan is not rigid: if a new machine arrives in July, the matrix is updated and the plan adjusted. What cannot happen is postponing the update to next year. A plan without follow-up ages in a folder.

What the system costs against what an accident costs

The comparison uses numbers, not fear. Take the same twelve-worker business and a fall from a platform with a long disability.

Sixteen million without counting the Ministry penalty, which is defined case by case, or the commercial effect: a client that audits suppliers asks for the OHS system before signing. The year's program costs less than three days stopped.

The math has an honest limit: the OHS system does not guarantee zero accidents. It reduces probability and changes what happens afterwards. A company with a matrix, training and reports can show it managed the risk; one with nothing has to explain why it did not.

Common mistakes seen in a visit

• Buying the template and never implementing it. Symptom: spotless documents dated two years ago. Consequence: obvious non-compliance and no risk under control.
• Copied matrix. Symptom: risks that do not match the operation. Consequence: the real hazard stays outside the system.
• Training unrelated to the matrix. Symptom: varied, generic topics. Consequence: spending with no reduction in exposure.
• Unreported incidents. Symptom: zero incidents in the year. Consequence: the accident arrives with no prior signals.
• COPASST constituted and never convened. Symptom: a constitution document with no meeting minutes. Consequence: participation exists only on paper.
• System owner with no assigned time. Symptom: whoever can handles the system. Consequence: the plan runs halfway and nobody answers for it.

Telework and the workstation at home

The OHS system also covers those who work from home. Self-assessment of the home workstation (chair, desk, screen, lighting, noise, connection) is part of hazard identification and must be documented, as must training on breaks and work organization.

The mistake is treating telework as a benefit without conditions. If the company does not assess the workstation or record the self-assessment, the risk exists off the radar, and when back pain appears the discussion about its origin is lost for lack of evidence.

An honest closing before you start

None of this replaces advice from an occupational health and safety professional or a review by your accountant and lawyer. What the law requires depends on the activity, the payroll size and the risk classification assigned by the ARL. Confirm your case before buying a package of documents.

With three workers and an office the system is simpler, but not non-existent: policy, matrix, exams, training and accident reporting remain mandatory. With twenty workers and machinery, the matrix and engineering controls weigh far more than any folder.

Start with the matrix. It decides everything else and it is the only thing that cannot be copied. Once it is alive and the annual plan follows it, training, PPE, exams and drills stop being an expense for the ARL and become what they always were: the way the accident does not close the business. If you also need to cross those costs with the company budget, Kardex Tauro brings inventory, invoicing and accounting together in one system.

Keep reading

• Workplace risk insurance in Colombia (ARL): risk levels and how premiums are calculated
• Remote work and telework in Colombia: what changes in payroll and social security