Community safety is not a subset of worker safety

The people most likely to be killed by a large civil works project running through populated land are not the people building it. They are pedestrians, cyclists and schoolchildren on a route that now carries forty heavy vehicle movements a day where it previously carried none.

Worker safety is measured, reported, and often incentivised through contract mechanisms. Third-party road risk frequently is not measured at all — and a project's incident statistics with no third-party denominator is not a good safety record. It is an incomplete one.

Community exposure belongs in this plan

Community health, safety and security is a distinct requirement from occupational health and safety, and it covers project traffic through settlements, exposure to excavations and stored materials, and the conduct of security personnel toward people who do not work for the project.[1]

Two sections carry it in practice: traffic and road safety, and emergency preparedness including off-site medical routes. Both should be written to produce a community figure, not a workforce figure. If a project has assessed road-safety risk only for its own drivers, it has assessed the wrong population.

Define "major incident" before the first one

Twenty-four-hour notification of major incidents is a standard lender requirement. The failure is not usually late reporting; it is having no written definition of "major", so severity is classified after the fact by the party who has to do the reporting. Classified that way, it is always classified downwards.

Fatalities, life-changing injuries, incidents involving community members, and security incidents involving use of force are a reasonable floor. Put the definition in the plan, before an incident makes it contentious.

Records are the plan; prose is the packaging

An OHS plan is written during mobilisation and read properly once — in the days after a serious incident, by people establishing what the project committed to and whether it did it. Write it for that reading. Any clause saying a control will be applied "as appropriate" will be quoted back with the question of who judged appropriateness, and when.

Toolbox talks, daily risk assessments, PPE issue, drills, inspections: each needs a named artefact, because a control with no artefact cannot afterwards be distinguished from a control that was never applied. Records signed in bulk at week's end are the same problem wearing a signature.

Security is the risk nobody procured against

Guards on a project site are, to the surrounding community, part of the project. Their conduct is attributed to it, their use of force becomes its liability, and any interaction with public security forces is the highest-consequence safeguard risk most projects carry without assessing it.[2]

Security is usually bought as a service, and the contract commonly specifies headcount and hours with nothing about screening, training in proportionate use of force, or the code of conduct binding the rest of the workforce. State those in the plan and flow them into the security subcontract. "That is the provider's matter" is an attempt to outsource a risk that does not transfer.

Drills certify a workforce that has since left

A drill run once at mobilisation certifies people who have been replaced twice over. The more useful test is whether an unannounced check would find trained first aiders on the current shift, stocked kits, and a route to a hospital that can actually receive trauma cases — rather than the nearest facility on a map.