B.M. Management System

Code 7.0 Management Systems

Participants shall adopt or establish a management system with a scope that is related to the content of this Code. The management system shall be designed to ensure: (a) compliance with applicable laws, regulations and customer requirements related to the participant's operations and products; (b) conformance with this Code; and (c) identification and mitigation of operational risks related to this Code. It shall also facilitate continual improvement.

NOTE (7.0.0): In RBA Code of Conduct 7.0 / VAP 7.0.0 there is a single, generic Management System assessed across all four components — A) Labor, B) Health & Safety, C) Environment, and D) Ethics (Appendix 10 provisions E2–E11). The requirements below are the generic management-system provisions, applied to and scoped for occupational health & safety. From VAP 7.1.2 this generic management system was split into four category-specific management criteria (AM Labor, BM Health & Safety, CM Environment, DM Ethics); this version is the Health & Safety ancestor of that split.

---

B.M.2 Management Accountability and Responsibility

The Participant clearly identifies senior executive and company representative[s] responsible for ensuring implementation of the management systems and associated programs. Senior management reviews the status of the management systems on a regular basis.

Elements to Demonstrate Compliance to RBA Code

B.M.2.1 Responsibilities and authorities are adequately and effectively defined and assigned for all employees/workers (senior managers to workers) for implementation of the health and safety management system, and for compliance with applicable laws, regulations and codes.

1. Policy, Practices, Controls:

1. Senior representative:

   • a. A senior representative is assigned responsibility for implementing programs.
     • i. To ensure compliance with laws and regulations and the requirements of the RBA.
     • ii. Is authorized to implement programs, procedures and corrective actions as needed for regulatory compliance and RBA conformance.

2. Assignment:

   • a. Responsibilities and authority of each organizational level are documented in position plans, job descriptions and/or the facility's management system documentation.
     • i. For normal situations.
     • ii. For emergency situations.

NOTE: Requirements apply for each component. Components are Labor, Health & Safety, Environmental and Ethics. If a component has a valid certification, then this is considered conformance for that component on this question (e.g., if a valid third-party ISO 14001 certificate is in place the Auditor will not verify the Environmental Management System).

2. Records are maintained including:

• a. The responsibilities and authorities of each level within the organization, including the senior executive for each component.
• b. How responsibilities and reporting lines are documented and communicated.
• c. Under what conditions an override for the management system would be allowed.

3. Serious conditions that will result in a severe finding:

• No identified management representative authorized to implement the management system of a component.

B.M.2.2 An adequate and effective management review and continuous improvement process for health and safety performance and management systems is established.

1. Policy, Practices, Controls:

1. Process:
   • a. Adequate and effective annual management system review process is in place.

NOTE: Senior management does not assessing annually is a non-conformance.

2. Records are maintained including:

• a. System review meetings.
• b. Preventive/corrective action plan following the review.
• c. Management review meeting presentation materials/analysis/data, including: agenda; presentation material (references); date; who was present (including senior manager); progress towards objectives; results of audits; completion of corrective/preventive actions; risks/issues; other information needed to determine the effectiveness of the management system and identify improvement opportunities; agreed preventive/corrective actions.

---

B.M.3 Legal and Customer Requirements

A process to identify, monitor and understand applicable laws, regulations and customer requirements, including the requirements of this Code.

Elements to Demonstrate Compliance to RBA Code

B.M.3.1 An adequate and effective compliance process to monitor, identify, understand and ensure compliance with applicable laws and regulations and customer requirements pertaining to health and safety is established.

1. Policy, Practices, Controls:

1. Process:
   • a. Adequate and effective quarterly compliance process to maintain a current understanding of applicable legal and customer requirements:
     • i. Identify
     • ii. Track
     • iii. Assess
     • iv. Integrate
     • v. Implement
     • vi. Records

NOTE: Requirements apply for each component. If a component has a valid certification, this is considered conformance for that component on this question.

2. Records are maintained including:

• a. Accurate and up-to-date compliance register.
• b. A compliance calendar or reminders/tasks/calendar appointments via an e-mail system.
• c. Summaries of applicable laws and regulations and the key customer requirements that impact the operations.
• d. New/changed operations/policies/procedures as a result of the review process for new requirements.

---

B.M.4 Risk Assessment and Risk Management

A process to identify the legal compliance, environmental, health and safety and labor practice and ethics risks associated with the Auditee's operations; determination of the relative significance for each risk; and implementation of appropriate procedural and physical controls to control the identified risks and ensure regulatory compliance.

Elements to Demonstrate Compliance to RBA Code

B.M.4.1 An adequate and effective risk management process to identify, assess, and minimize/mitigate/control its health and safety risks is in place.

1. Policy, Practices, Controls:

1. Process:

   • a. Adequate and effective risk assessment process using the Hierarchy of Controls or equivalent process is in place to identify the most significant risks (including applicable legal requirements and applicable customer requirements).
   • b. The risk assessment is updated when there is a Significant Change.
   • c. Any identified risk has an action plan to minimize such risk and procedural controls and/or improvement objective.
   • d. Effectiveness of controls is evaluated on a regular basis.

2. Control measures are in place for identified risks (site observation).

NOTE: Scope of the risk assessment: every site operation/process; physical location; consideration of multiple chemical exposures, combined physical and chemical exposure effects, and extended work periods (as applicable). Requirements apply for each component; if a component has a valid certification, this is considered conformance for that component.

2. Records are maintained including:

• a. Formal risk assessment reports.
• b. Corrective/preventive action plan for identified risks.
• c. Procedural controls are documented.
• d. Where controls are not yet in place, an implementation plan (with owners and due date) is in place and on track.

3. Serious conditions that will result in a severe finding:

• Imminent and significant impact is confirmed on the facility, life, limb or community without action (Priority).

---

B.M.5 Improvement Objectives

Written performance objectives, targets and implementation plans to improve the Participant's social, environmental, and health and safety performance, including a periodic assessment of the Participant's performance in achieving those objectives.

Elements to Demonstrate Compliance to RBA Code

B.M.5.1 An adequate and effective performance management process for health and safety, including setting performance (improvement) objectives and targets, developing and implementing improvement plans, regularly reviewing progress toward achieving targets, and making appropriate adjustments if needed, is in place.

1. Policy, Practices, Controls:

1. Process:
   • a. Adequate and effective annual performance management process with formal and communicated indicators, objectives and targets.
   • b. Additional action plans if an indicator, objective or target is off track.
   • c. Scope of indicators, objectives and targets considers: risk assessment results; legal and regulatory requirements; company standards/requirements.
   • d. Assignment of owners; implementation plans; completion dates; communication of objectives to workers (as appropriate); how frequently progress is reviewed; objectives and targets clearly designed to achieve continual improvement.

2. Records are maintained including:

• a. Formal target, indicator and objective tracking.
• b. Regular progress reporting.
• c. System review meetings.
• d. Preventive/corrective action plan following the review.
• e. Management review meeting presentation materials/analysis/data.

3. Serious conditions that will result in a severe finding:

• No targets established; no review takes place on progress; or senior management does not assess annually (Major).

---

B.M.6 Training

Programs for training managers and workers to implement the Participant's policies, procedures and improvement objectives and to meet applicable legal and regulatory requirements.

Elements to Demonstrate Compliance to RBA Code

B.M.6.1 An adequate and effective training process is established for all managers/workers on all policy/procedures/job-related aspects and performance targets related to health and safety.

1. Policy, Practices, Controls:

1. Process — adequate and effective training to workers/managers:

   • a. New employee orientation plan
   • b. Training needs analysis
   • c. Training plan
   • d. Training material
   • e. Training records
   • f. Training frequency
   • g. Training efficiency verification
   • h. Minimum training topics are covered.

2. Evaluation:

   • a. The training programs will be evaluated on a regular basis not exceeding 3 years or sooner if there is a Significant Change.

NOTE: This includes conformance-section training — this section must always be completed even if a valid systems certificate is available. Health & Safety training topics are listed in B8.

2. Records are maintained including:

• a. Training records include a verification of training effectiveness.
• b. Training evaluation reports and corrective action if required.
• c. Educational materials.

---

B.M.7 Communication

Process for communicating clear and accurate information about the Auditee's policies, practices, expectations and performance to workers, Suppliers and customers.

Elements to Demonstrate Compliance to RBA Code

B.M.7.1 An adequate and effective worker/manager, Supplier and customer communication/reporting process for health and safety policies, practices and performance is established.

1. Policy, Practices, Controls:

1. Process — adequate and effective worker/manager, Supplier and customer communication/reporting process:

   • a. Suppliers: correspondence to Supplier management; contract terms and conditions requiring Suppliers to conform to the RBA Code and comply with all applicable requirements.
   • b. Customers: communication of relevant practices and performance.
   • c. Workers/Managers: the minimum communication topics are covered.

2. Evaluation:

   • a. The communication programs will be evaluated on a regular basis not exceeding 3 years or sooner if there is a Significant Change.

NOTE: This includes conformance-section communications — this section must always be completed even if a valid systems certificate is available. Health & Safety communications are listed in B8. Submitting an SAQ to customers does not qualify as disclosure/communication to customers.

2. Records are maintained including:

• a. Communications records include a verification of communication effectiveness.
• b. Educational materials.
• c. Presentations to Suppliers.

---

B.M.8 Worker Feedback, Participation and Grievance

Ongoing processes, including an effective grievance mechanism, to assess workers' understanding of and obtain feedback on or violations against practices and conditions covered by this Code and to foster continuous improvement. Workers must be given a safe environment to provide grievance and feedback without fear of reprisal or retaliation.

Elements to Demonstrate Compliance to RBA Code

B.M.8.1 An adequate and effective grievance/complaint process where work-related and Code-related grievances or complaints can be confidentially communicated without fear of reprisal or intimidation is established.

1. Policy, Practices, Controls:

1. Process:

   • a. Adequate and effective process to anonymously report grievances and complaints without fear of reprisal, which is internal (for workers and staff) and external (for workers of suppliers, local community or interested actors and Whistleblowers).
   • b. Clear grievance channels so anyone is comfortable reporting grievances and so that reporting is encouraged.
   • c. Grievance and complaint channels are clearly communicated; internal communication of the grievance mechanism must be in workers' native language(s) and visible.

2. Investigation and actions:

   • a. The Auditee shall promptly investigate the validity of any grievance or complaint and take prompt remedial action if the claim is valid.
   • b. All who file a grievance or complaint shall have their identity protected and the Auditee will ensure a no-reprisal and no-intimidation approach.

2. Records are maintained including:

• a. Grievance/complaint records are in place for a period of at least 12 months.
• b. Workers are provided with written information on how to report grievances and complaints.

3. Serious conditions that will result in a severe finding:

• Confirmed case not investigated or without a corrective action plan (Priority).
• No anonymous reporting channels, or no action has been taken/recorded for the grievance/complaint for 3 months (Major).

B.M.8.2 An adequate and effective process to solicit and encourage worker participation, input and feedback for improvement.

1. Policy, Practices, Controls:

1. Process — adequate and effective process to obtain worker input and feedback such as:

   • a. Worker surveys
   • b. Suggestion boxes
   • c. Worker focus groups
   • d. Joint worker-management committees
   • e. Worker/union representatives
   • f. Process improvement teams
   • g. Feedback channels are clearly communicated and visible (suggestion box, etc.).

2. Evaluation and actions:

   • a. The Auditee shall promptly evaluate the validity of any input or feedback and take prompt action if the input/feedback is valid.

2. Records are maintained including:

• a. Input/feedback records are in place for a period of at least 12 months.
• b. Workers are provided with written information on how to provide input/feedback for improvement.
• c. Action plans are available, implemented or on track.

3. Serious conditions that will result in a severe finding:

• No feedback mechanism(s) in place (Major).

---

B.M.9 Audits and Assessments

Periodic self-evaluations to ensure conformity to legal and regulatory requirements, the content of the Code and customer contractual requirements related to social and environmental responsibility.

Elements to Demonstrate Compliance to RBA Code

B.M.9.1 An adequate and effective self-audit process to periodically assess conformance with the RBA Code pertaining to health and safety.

1. Policy, Practices, Controls:

1. Process:
   • a. Adequate and effective self-audit process to periodically assess conformance with:
     • i. Applicable regulatory requirements
     • ii. RBA Code requirements
     • iii. Own policies, standards and management system
     • iv. Other requirements to which the facility subscribes
   • b. Audit findings are reviewed by senior management.

NOTE: Audit scope: all areas of the facility; all processes, physical conditions and work practices; review of documents and records; interviews with individuals responsible for social and environmental responsibility.

2. Records are maintained including:

• a. Self-audit reports.
• b. Corrective action plans as a result of the self-audit, with additional actions if the corrective action plan is off track.

3. Serious conditions that will result in a severe finding:

• No audits carried out, or scope does not include regulatory compliance (Major).

---

B.M.10 Corrective Action Process

Process for timely correction of deficiencies identified by internal or external assessments, inspections, investigations and reviews.

Elements to Demonstrate Compliance to RBA Code

B.M.10.1 An adequate and effective corrective action process to rectify and close non-conformances for health and safety is established.

1. Policy, Practices, Controls:

1. Process — adequate and effective corrective action process which contains:
   • a. Corrective action reports/plans and tracking tables, including root cause analysis to ensure the system gap is addressed, specific corrective actions, owners of the action, and due dates to address all audit issues.
   • b. Additional actions are taken when a corrective action is off track.
   • c. A demonstrated link between the corrective action plan (CAP) and the performance management objectives and targets.
   • d. Closure of action items is confirmed by a management representative after verification by the appropriate person.

NOTE: Scope of the corrective action plan covers all non-conformances identified via internal or external audits, assessments, inspections, investigations and reviews against the RBA Code, including legal and customer requirements. If closure was not verified by an independent third party or the original government agency, the Auditor must verify closure.

2. Records are maintained including:

• a. Records documenting the non-conformance.
• b. Corrective action plan for each non-conformance.
• c. Progress reports on the corrective action plan.
• d. Closure verification reports (with management confirmation).
• e. Copies of any regulatory citations/violation notices received in the past three years, including any communications with the agencies.

3. Serious conditions that will result in a severe finding:

• One or more unaddressed regulatory actions or penalties (Major).

---

B.M.11 Documentation and Records

Creation and maintenance of documents and records to ensure regulatory compliance and conformity to company requirements along with appropriate confidentiality to protect privacy.

Elements to Demonstrate Compliance to RBA Code

B.M.11.1 Adequate and effective documentation and records process with appropriate levels of access to ensure privacy for health and safety.

1. Policy, Practices, Controls:

1. Process:
   • a. Adequate and effective documentation and records process with appropriate retention (on and off site) and appropriate levels of access to ensure privacy, conforming to regulatory requirements (including record retention laws).
   • b. Documents are securely stored with authorized access only (site observation).

NOTE: Minimum health-and-safety-relevant records include, among others: records of hours worked; risk assessments; work practices and procedures; performance in meeting objectives and targets; reports of inspections by regulatory agencies; incident investigations; worker complaints; training records; management system review minutes and action items; and corrective action records.

2. Records are maintained including:

• a. A listing/table of documents and records required is available for review.
• b. Record retention conforms to the requirements.
• c. Minimum records are available for review.

3. Serious conditions that will result in a severe finding:

• Documentation and records do not meet regulatory requirements (Major).

1.0.0 (2021-01-01)

Changed

• Initial historical baseline — generic 7.0.0 Management System scoped to health and safety (RBA Code of Conduct 7.0): Earliest imported version of the criterion. In RBA Code of Conduct 7.0 / VAP 7.0.0 there was a single, generic Management System assessed across all four components — Labor, Health & Safety, Environment and Ethics together (Appendix 10 provisions E2-E11). This version renders those generic management-system provisions scoped to occupational health and safety: Management Accountability and Responsibility (E2), Legal and Customer Requirements (E3), Risk Assessment and Risk Management (E4), Improvement Objectives (E5), Training (E6), Communication (E7), Worker Feedback, Participation and Grievance (E8), Audits and Assessments (E9), Corrective Action Process (E10), and Documentation and Records (E11). The generic risk-assessment (E4) used the Hierarchy of Controls without health-and-safety-specific demographic/young-worker categories, there was no dedicated emergency response team (ERT) provision, and the grievance provision required action within 3 months without a health-and-safety ERT/first-responder severe-finding trigger. This is the genuine 7.0.0 ancestor that VAP 7.1.2 split into the four category-specific management criteria.