Occupational Health and the Risk Management Maturity Model (RM3)


An explanation of how the Risk Management Maturity Model (RM3) can be used to measure the maturity of management of occupational health risk. 

We have also produced guidance on how bow tie analysis can be used together with RM3 to assess and manage health risks.

The overall maturity of health risk management and the effectiveness of the supporting elements of the management system can be assessed using RM3.

The criteria used in RM3 apply equally to both health and safety management systems and occupational health issues should be considered alongside safety issues when looking for excellence in risk management.

ORR  Inspectors now routinely use  the RM3 model  to explore and assess the maturity of duty holders' management of health risks.

RM3 guidance

The detailed guidance on use of RM3 applies to health risk management as well as safety. Demonstrating excellence in occupational ill-health management requires high performance across a wide range of RM3 criteria including for example:

  • SP1, SP2 – leaders should clearly recognise the importance of occupational health and develop policies to control occupational health risks
  • SP3 – occupational health performance should be reported as part of the governance arrangements
  • OP1 – workers should be involved in deciding on control measures such as PPE and systems of work
  • OP2 – all involved in managing occupational health risk should be competent to carry out their roles. When specialist help is needed, care should be taken to ensure that the right competencies are brought in
  • OC1, OC2 – responsibilities on health should be clear, allocated and accepted and those with responsibilities held accountable
  • OC4, OC5 – the specialist nature of some occupational health issues means that clear communication is needed inside and between organisations to ensure that risks are managed
  • OC7 –some health records are legally required to be kept for long periods, the arrangements should take this into account
  • PI1 – risk assessments should explicitly include occupational ill-health risks
  • PI2 – specific targets should be set to ensure that risk from occupational ill-health is being controlled
  • MRA1, MRA2, MRA4, MRA5 – the risk control system for management of occupational health should include appropriate monitoring arrangements, audit, review and if necessary corrective action to ensure it is delivering management of risks from occupational ill-health