B.M. Health and Safety Management System

Code 8.0 Management Systems Preamble

Participants shall adopt or establish a management system with a scope that is related to the content of this Code. The management system shall be designed to ensure: (a) compliance with applicable laws, regulations and customer requirements related to the participant's operations and products; (b) conformance with this Code; and (c) identification and mitigation of operational risks related to this Code. It shall also facilitate continual improvement.

B.M.1 Risk Assessment – Health and Safety

Elements to Demonstrate Compliance to RBA Code

B.M.1.1 An adequate and effective health and safety compliance process is established to monitor, identify, understand, and ensure compliance with applicable laws, regulations, and customer requirements.

1. Policy, Practices, Controls:

Establish a quarterly process to update and maintain a current understanding of and compliance to all applicable legal and customer requirements. The process should include:

• a. Identification of requirements which apply to the company; be sure to look for emerging and new requirements. This can be done via a legal department with an understanding of the RBA Code, subscriptions to 3rd party reports on regulations, sales & marketing who agree to customer terms, etc.
• b. A means to track these requirements, staying current as:
• c. The requirements may change (including the RBA Code of Conduct).
• d. Your operations may change and bring the facility in scope of requirements or create a gap.
• e. Assess facility operations against these requirements to identify gaps.
• f. Develop updated policy, procedure, training, communication, recording and reporting to close the gaps.
• g. Implement the changes and test them for compliance.

NOTE: Ensure the facility adds any new and changed permitting, licensing, testing, reporting and disclosure requirements to the compliance register noting sufficient time to renew or publish before they expire or are due.

2. Records are maintained including:

• a. A compliance calendar with owner, reminders, calendar appointments via e-mail.
• b. Summaries of applicable laws and regulations and requirements and how they apply to facility operations.
• c. Review of the key customer requirements that apply to or impact facility's operations.
• d. Analysis of recent RBA code of conduct changes.
• e. Minutes from meetings or other that demonstrate process is conducted quarterly.

B.M.1.2 An adequate and effective due diligence process is established to identify and assess the most significant actual and potential health and safety risks where the facility caused or contributed to adverse impacts (including applicable requirements).

1. Policy, Practices, Controls:

A due diligence process focused on health and safety. It should be designed to identify and assess the most significant actual and potential health and safety risks where the facility could cause or contribute to adverse health and safety impacts of internal and external rights holders.

• a. It must include specific risks of relevant demographics, such as gender and age, where the facility may experience, cause, or contribute to adverse health and safety impacts for internal and external stakeholders (including compliance with applicable requirements)
• b. The scope of risks should include at a minimum:
  • i. Harm to life or property
  • ii. Fire
  • iii. Earthquake (if in an earthquake zone)
  • iv. Chemical spills (if large quantities or especially hazardous chemicals are used)
  • v. Severe weather impacts (e.g., rain, flood, typhoon, frost, snow, or other conditions appropriate to the facility location, etc.).
  • vi. Workplace violence
  • vii. Strike
  • viii. Ensure the location, impact and stakeholder scope is broad including: Every site task/operation/process to produce products or provide company services.
• c. Chemical, biological, or physical agents.
  • i. Asbestos/lead
  • ii. Based on associated industrial hygiene sampling and testing.
  • iii. Risk assessment shall include exposure to multiple chemicals.

NOTE: Exposure to multiple chemicals can be either exposure to multiple chemicals by a single route or exposure to multiple chemicals by multiple routes. A route can be inhalation, ingestion, skin exposure, etc.

• a. Machine risk assessment
  • i. A method to identify machine safeguarding needs (pre-purchase/pre-installation hazard review of all machinery.)
• b. All identified internal and external rightsholders, including at a minimum:
  • i. Direct and indirect workers
  • ii. Young workers, Learners
  • iii. Foreign and internal migrant workers
  • iv. Worker representatives
  • v. Staff functions
  • vi. On-site service providers, Suppliers
  • vii. Customers
  • viii. Stakeholders in the community next to or near the facility which may be impacted.
• c. Risks are addressed through the Hierarchy of Controls in this order:
  • i. Elimination
  • ii. Substitution
  • iii. Engineering controls
  • iv. Process and Administrative controls
  • v. Adequate and effective PPE
• d. The risk assessment is updated when there is a Significant Change

2. Records are maintained including:

• a. Stakeholder identification reports.
• b. Risk assessment reports.
• c. Mitigation plans.

B.M.2 Control Processes – Health and Safety

Elements to Demonstrate Compliance to RBA Code

B.M.2.1 Health and safety responsibilities and authorities are adequately and effectively defined and assigned for all employee levels (senior managers to workers) for the implementation of management systems, and for compliance with laws, regulations, and codes.

1. Policy, Practices, Controls:

1. Have a senior representative assigned responsibility for implementing social responsibility programs in the facility and supply chain. Their scope should include:

   • a. Understanding and assessing facility's compliance with laws and regulations, customer requirements and the RBA Code of Conduct.
   • b. Developing and implementing (likely with other subject matter experts) necessary changes to policies, programs, processes, training, reporting and disclosure as needed to be in legal and customer compliance and RBA Code of Conduct conformance.

2. Responsibilities and authority of each organizational level are recorded in position plans, job descriptions and/or the facility's management system documentation.

   • a. For normal situations.
   • b. For emergency situations, including where serious adverse impact has been identified.

3. An emergency response team (ERT) is formed at each facility that shall be available during all working shifts.

   • a. The ERT shall have the obligation and authority to direct the reviewee's response to emergencies to protection of worker health and safety, the environment, and property.

NOTE: It is possible that the role of trained/certified first responders is performed by an onsite medical professional team.

B.M.2.2 Adequate and effective health and safety policies and control processes are established.

1. Policy, Practices, Controls:

1. Policies: Aligned with law, the RBA Code of Conduct and facility policy statements are in place

2. Effective Control processes:

   • a. Each of the policy requirements has an effective implementation control process.
   • b. Mitigating processes are in place for all significant actual and potential risks identified, tracking implementation, and resulting adverse impact reduction identified in the risk assessment.
   • c. Workers can remove themselves from imminent harm and return once the situation is mitigated without fear of retaliation.
   • d. Adequate policies and adequate and effective processes are in place to minimize the occupational health and safety impact on pregnant women and nursing mothers including removal of responsibilities that may be harmful to the mother or child, proper accommodations for nursing and health checks.
   • e. Selection processes for all new chemicals include thoroughly evaluating less hazardous or non-hazardous alternatives, including Greenhouse Gas and ozone depletion impact.

3. Records are maintained including:

• a. Current and past policies and procedures, specifications.
• b. Results and reports from review and control steps.
• c. Corrective action plans, plans for improvement.

B.M.2.3 An adequate and effective training process is established for all managers/workers on all policy/process/job-related aspects and performance targets.

1. Policy, Practices, Controls:

1. Process: An adequate and effective training program for workers/managers:
   • a. New employee orientation plan
   • b. Training needs analysis
   • c. Training plan with frequency
   • d. Training material
   • e. Training records with effectiveness evaluation or verification

NOTE: Ensure these minimum training topics are included: risk, policy, process, controls, responsibilities, grievance are covered.

2. Minimum Training Topics should include:
   • a. Mechanical, electrical, chemical, fire, and physical hazards
   • b. The correct use of appropriate PPE
   • c. Types of potential emergencies that may occur at their work location and what to do during an emergency, including Internal and external muster points.
   • d. Machine safety and the use of safeguards and emergency stops.
   • e. Reporting injuries and illnesses
   • f. Hazardous atmospheres and confined⁶ space work process before entry of confined spaces
   • g. Lock out-tag out process.
   • h. Specific training for ERT, first responders, and medical professionals
     • i. Emergency responders are trained on an annual basis.
     • ii. Training shall be dependent on responsibilities during an emergency.
     • iii. Training is provided to all workers before the beginning of work and regularly thereafter as per the training program.

⁶ Confined space: a space with limited or restricted entry or exit means and is not designed for continuous occupancy.

3. Occupational health and safety training shall include content on specific risks to relevant demographics, such as gender and age, if applicable.

4. Workers responsible for storage, clean up, or disposal of chemical releases must receive specialized training.

5. Occupational health professionals and first responders should be trained by external agencies or trained and certified by internally qualified occupational health professionals such as a medical doctor, where local law permits.

2. Records are maintained including:

• a. Training records include a verification of training effectiveness.
• b. Educational materials.

3. Serious conditions that will result in a severe finding:

• If it is required (by law or risk assessment) to have an ERT and it is not in place.
• There are no first responders present or process to respond to emergency situations.

B.M.3 Communications – Health and Safety

Elements to Demonstrate Compliance to RBA Code

B.M.3.1 An adequate and effective ongoing two-way communication process with workers, and internal and external stakeholders, where relevant or necessary, is established to obtain feedback on operational health and safety practices and conditions and to foster continuous improvement.

1. Policy, Practices, Controls:

1. A healthy and effective ongoing two-way communication process with workers, other internal and external stakeholders, where relevant or necessary, to obtain their feedback on operational health and safety practices and conditions and to foster continuous improvement.
   • a. Examples of worker participation mechanisms: worker surveys, suggestions boxes, worker focus groups, joint worker-management committees, worker/union representatives, process improvement teams.
   • b. Examples of two-way communication: face-to-face meetings, town halls, worker focus groups, joint worker-management committees, process improvement team, message groups (WhatsApp, Line, WeChat, etc.), brown bag lunches
   • c. Examples of stakeholder engagement mechanisms: newsletters with request for feedback, message groups (WhatsApp, Line, WeChat, etc.), social media, neighborhood or community meetings, drop-in sessions, focus groups, feedback, and impact discussions (data/study driven)

NOTE: Ensure these minimum topics are included or asked about to promote comprehensive dialogue: risk, policy, process, controls, responsibilities, grievance are covered.

2. Minimum internal and external stakeholders:
   • a. Direct and indirect workers
   • b. Young workers, Learners
   • c. (Foreign and internal) migrant workers
   • d. Worker representatives
   • e. Staff functions
   • f. On-site service providers, Suppliers
   • g. Customers.

NOTE: Submitting SAQ to customers does not qualify as communication with customers

3. Health and safety communication is clearly posted in the facility or placed in a location identifiable and accessible by workers including:
   • a. Appropriate signs, placards, and labels identifying hazards (chemical, physical, biological, vehicular)
   • b. Potential workplace hazards that workers are exposed to.
   • c. PPE requirements.
   • d. Emergency number(s), emergency team, and emergency evacuation and response plan.
   • e. Maps throughout the facility clearly identify exit routes and muster points in the correct orientation.

2. Records are maintained including:

• a. Communications records include a verification of communication effectiveness.
• b. Input/feedback records.
• c. Written information to workers on how to provide input/feedback for improvement.
• d. Correspondence to supplier management.
• e. Communications/Presentations to internal and external stakeholders.

B.M.3.2 An adequate and effective process is established to anonymously report grievances confidentially without fear of reprisal or intimidation.

1. Policy, Practices, Controls:

1. Process:

   • a. Comprehensive functioning process to anonymously report grievances without fear of reprisal, which is internal (for workers and staff) and external (for workers of suppliers, local community, or interested actors and Whistleblowers).
   • b. Clear grievance channels so anyone is comfortable reporting grievances and so that reporting is encouraged.
   • c. Workers shall be encouraged to raise safety concerns, including early reporting of discomfort.

2. Investigation and actions:

   • a. Promptly investigate the validity of any grievance.
   • b. Ensure the investigation and remediation is impartial, non-discriminatory, and where applicable, consistent with previous actions.
   • c. Communicate back to those involved, where possible, the outcome of the investigation and next steps, while maintaining appropriate privacy for those involved.
   • d. Remind participants that there is to be no retribution for making the grievance.

2. Records are maintained including:

• a. Grievance records
• b. Investigation records
• c. Workers are provided with written information on how to report grievances.

3. Serious conditions that will result in a severe finding:

• Grievances not being investigated and addressed within 3 months of being received.
• Not putting in place and actioning a corrective action plan after confirming a grievance.

B.M.4 Performance Review and Continuous Improvement – Health and Safety

Elements to Demonstrate Compliance to RBA Code

B.M.4.1 An adequate and effective health and safety management performance review and continuous improvement process is established.

1. Policy, Practices, Controls:

1. Process elements should include:

   • a. Annual or more frequent review of objectives and systems.
     • i. Management system review
     • ii. Performance review
   • b. Formal and communicated goals, indicators, objectives, and targets.
   • c. Goals shall clearly define the period considered; each goal shall include:
     • i. Time Period: (between base date and target date) shall be forward-looking.
     • ii. Base date: Date from which the goal is being measured.
     • iii. Target date: Date in the future when the goal is intended to be achieved.
     • iv. Baseline: the value of what is being measured at the start
     • v. Targeted improvement value: The quantitative value of the goal (numeric and greater than 0)
   • d. Assignment of owners, implementation plans with completion dates.
   • e. Additional action plans if goal, indicator, objective, or target is off track.
   • f. Communication of the goals and progress to workers (as appropriate).

2. Evaluation:

   • a. Regularly not exceeding 2 years but earlier if there is a Significant Change.
   • b. Effectiveness of controls (including control processes).
   • c. Should include every related program whose scope include:
     • i. Consideration of risk assessment results.
     • ii. Legal and regulatory requirements.
     • iii. Company standards/requirements.
     • iv. Achieving continual improvement.
   • d. Evaluation reports should include:
     • i. Accidents, incidents, medical surveillance, and trend analysis
     • ii. ERP drill plan
     • iii. Control effectiveness (PPE, physically demanding work, machine safety, chemical, physical and biological agents, etc.)
     • iv. Training & Communication
     • v. Grievances related to safety concerns

2. Records are maintained including:

• a. System review meetings.
• b. Management review meeting presentation materials/analysis/data. Be sure to include:
  • i. Date, agenda, attendees (including senior manager).
  • ii. Presentation material (references).
  • iii. Progress towards objectives.
  • iv. Results of assessments.
  • v. Completion of corrective/preventive actions.
  • vi. Risks/issues.
  • vii. Other information that was used to determine the effectiveness of the management system and identify improvement opportunities.
  • viii. Agreed preventive/corrective actions.
• c. Formal target, indicator, and objective tracking.
• d. Regular progress reporting.
• e. Evaluation reports for (at least):
  • i. Control effectiveness.
  • ii. Training and Communication.
  • iii. Grievances related to safety concerns

B.M.4.2 An adequate and effective health and safety self-assessment process is established to assess conformance with the RBA Code and customer requirements periodically.

1. Policy, Practices, Controls:

1. An adequate and effective self-assessment process to periodically assess conformance with:

   • a. Applicable legal regulatory requirements.
   • b. Customer requirements.
   • c. RBA Code requirements.
   • d. Own policies, standards, management system, requirements to which the facility subscribes to.

2. The assessment scope should include:

   • a. All areas of the facility.
   • b. All policies, processes, physical conditions, and work practices.
   • c. Review of records.
   • d. Interviews with individuals responsible for compliance and conformance
     • i. Workers (direct and indirect)
     • ii. Staff and management
     • iii. Supplier management

3. Assessment findings should be reviewed by senior management.

2. Records are maintained including:

• a. Self-assessment Reports
• b. Results of management reviews
• c. Corrective action plans

B.M.4.3 An adequate and effective health and safety corrective action process is established to rectify and close non-conformances.

1. Policy, Practices, Controls:

1. Ensure there is a Corrective action process (CAP) in place, which contains the following:

   • a. Core elements of root cause analysis, specific corrective actions, owners, due dates, tracking process.
   • b. Additional actions when a corrective action is off-track.
   • c. A link demonstrated between the CAP and the performance management objectives and targets.
   • d. Review action items by management representative after verification by the appropriate person.
   • e. Any issues/concerns noted in the insurance inspection report regarding people, fire, or facility have an agreed corrective action plan.

2. Specific health and safety elements include:

   • a. Any issues/concerns noted in the insurance inspection report regarding people, fire, or facility have an agreed corrective action plan.
   • b. Appropriate preventive action because of medical surveillance or injury related to workplace risks and injuries should occur including moving to another role.
   • c. In addition, where there are workplace related injuries, the facility must:
     • i. Provide medical treatment to the worker.
     • ii. Cover the worker's medical treatment, re-examination, and rehabilitation cost.
     • iii. Provide a re-examination to the worker.
     • iv. Do not terminate the labor contract with a worker due to medical surveillance results.

2. Records are maintained including:

• a. Original non-conformance.
• b. CAP for each non-conformance.
• c. Progress reports.
• d. Closure verification reports (with management confirmation)
• e. Copies of any regulatory citations/violation notices received in the past three years, including any communications with the agencies, and follow-up review or inspection.

1.0.0 (2024-01-01)

Initial release.