3. Compliance expectations

How law, systems and maturity link to safer outcomes

The elements described below operate as a joined-up pathway from legal duties to real-world safety outcomes:

Four connected elements showing a pathway to safer outcomes: ROGS sets the legal requirements for an effective safety management system. SMS translates those duties into organisational systems and responsibilities. RM3 assesses how well those systems operate in practice and their maturity. Continuous improvement helps ensure learning is applied and embedded.

Together, these elements determine whether dutyholders deliver safer outcomes for passengers, staff, contractors and the public.

What ORR expects to see as good practice

Good practice means SMS are proactive, adaptive and capable of learning, going beyond minimum compliance.

Four areas that together define good practice in safety management systems. Leadership focuses on accountable safety leadership, clear governance, and risk-based decisions. Improvement covers managing risk, controlling change, and managing fatigue and asset integrity. Culture emphasises safety as a shared value, open communication, and learning from experience. Measurement uses RM3 to assess maturity and track progress toward safer outcomes.

Legal requirements for SMS

The Railways and Other Guided Transport Systems (Safety) Regulations 2006 (ROGS) set the mandatory legal foundation for Safety Management Systems. Dutyholders must establish and maintain systems that:

•    Identify, assess and control risks
•    Manage competence, monitoring, review and control of change
•    Support learning from incidents
•    Are proportionate to the nature and complexity of operations
•    Remain effective during operational and organisational change
•    Are not only documented, but implemented in practice to secure safe outcomes

Where serious deficiencies are identified, ORR may use statutory powers under the Health and Safety at Work etc. Act 1974 and ROGS, including Improvement Notices, Prohibition Notices and prosecutions.

Find out more information on ORR’s enforcement policy.

Supporting frameworks

ORR recognises the value of established frameworks such as HSG65 (Managing for Health and Safety) and ISO 45001 (Occupational Health & Safety Management Systems), which promote integration of safety into business processes and support organisational resilience and maturity.

ORR’s oversight, supervision and enforcement

ORR’s overarching goal is a safer railway, with zero workforce and industry-caused passenger fatalities. Achieving this requires more than minimum compliance – it demands SMS that are proactive, adaptive and capable of learning. By operating consistently above the minimum threshold, dutyholders can ensure they remain compliant, even under circumstances that might put the application of the HSSM under stress.

The Risk Management Maturity Model (RM3) defines the key components of an effective SMS and provides a structured framework for evaluating organisational capability. It supports both regulatory assessment and industry self-evaluation, helping dutyholders identify strengths, target improvements and plan strategically.

ORR combines proactive supervision with reactive investigation, using inspections, audits, RAIB reports, industry data and risk profiling to shape its annual supervision plan and benchmark performance against RM3.

To strengthen oversight, ORR is also investing in digital tools such as the Inspection App, enabling real-time data capture and better integration with risk intelligence systems. These innovations support targeted supervision and help identify systemic risks across sectors.

ORR’s regulatory priorities for the year ahead

To ensure SMS deliver consistent, effective risk control and continuous improvement, ORR’s focus for the coming year is to:

Three regulatory priorities for the year ahead: Strengthening SMS maturity and leadership. Updating ROGS guidance and digitising permissioning. Reviewing and improving RM3.

Health and safety management