Health and safety management

Strategic risk chapter

4. Continuous improvement

Components

Using RM3 to drive continuous improvement (current)

RM3 should be used as a strategic improvement tool, not simply for compliance. Regular maturity assessments help dutyholders identify gaps, prioritise actions and track improvements.  RM3 is designed to comprehensively assess all elements of the HSMS.

A circular diagram of the Risk Management Maturity Model (RM3) for health and safety management. The model is made up of five interconnected themes comprising 26 criteria in total.​  ​  At the centre are the five themes: Health and Safety Policy, Leadership and Board Governance (SP), which includes 4 criteria; Organising for Control and Communication (OC), which includes 7 criteria; Securing Cooperation and Competence (OP), which includes 2 criteria; Planning and Implementing Risk Controls (PI & RCS), which includes 8 criteria; and Monitoring, Audit and Review (MRA), which includes 5 criteria. Each theme is shown as a coloured segment and subdivided into its individual RM3 criteria.​  ​  A continuous outer ring labelled Organisational culture surrounds the diagram, indicating that culture underpins and influences all 26 RM3 criteria rather than being a separate element.​  ​  Overall, the diagram illustrates RM3 as an integrated, system‑based model where leadership, organisation, competence, risk control and assurance are interconnected and supported by organisational culture.​

RM3 defines criteria for achieving different levels of maturity against each HSMS element. ORR encourages dutyholders to show measurable progress in RM3 maturity, moving from Standardised toward Predictable and, ultimately, Excellence. Improvement should be visible in leadership, assurance, governance and operational delivery.

Vertical ribbon diagram showing the five RM³ maturity levels arranged from bottom to top. The levels are labelled, in ascending order: Ad‑hoc, Managed, Standardised, Predictable, and Excellence. A green arrow at the top indicates progression and continual improvement from lower to higher maturity. The figure illustrates increasing organisational capability in health and safety risk management.​

SMS must reflect the realities of day-to-day work, not only documented procedures. Continuous improvement should demonstrate that controls are applied consistently in practice.

Improvement should follow the Plan–Do–Check–Act (PDCA) cycle to ensure changes are embedded, evaluated and refined.

RM3 is used to support continuous improvement through regular review and action. Achieved through annual RM3 self-assessment, prioritising improvement areas, setting improvement plans with evidence, and regular updates to RM3 maturity.

Targeted actions to strengthen SMS

ORR expects dutyholders to focus improvement efforts on the areas where weaknesses are most frequently identified:

Checklist of actions to strengthen safety management systems. These include: risk assessments, fatigue management, change control, assurance and audits, asset integrity, and contractor & supplier oversight.

More robust arrangements bring clear benefits: stronger decision-making, more effective responses to emerging risks and improved organisational resilience.

Preparing for future ROGS developments (future)

ORR’s work to update ROGS guidance and digitise permissioning will clarify expectations and modernise processes. Dutyholders should monitor developments and consider early adjustments to their SMS.

The ongoing RM3 review will strengthen cultural maturity measures and Human & Organisational Factors. Dutyholders should plan to incorporate updated RM3 criteria into future improvement plans.

Strengthening safety culture and learning

Effective continuous improvement relies on a mature safety culture, where safety is a shared organisational value and staff feel confident raising concerns.

Dutyholders should:

  • Assess and strengthen safety culture regularly
  • Encourage open reporting of incidents and near-misses
  • Demonstrate learning through changes to SMS and controls
  • Communicate clearly “what has changed and why”

Recommended resources

Dutyholders should make use of ORR’s improvement resources, including:

Participation in ORR-supported industry forums, working groups and learning networks provides further opportunities to share learning and strengthen maturity.