Safe Work Method Statements: when a SWMS is required, what it must contain, and how to keep it current

The short answer

A Safe Work Method Statement is legally required, before the work starts, for every activity that falls within the 18 categories of high risk construction work defined in regulation 291 of the WHS Regulations — falls of more than two metres, work near energised electrical services, trenches deeper than 1.5 metres, demolition of load-bearing elements, asbestos, confined spaces, tilt-up concrete, work near traffic and powered mobile plant, and the rest. The person conducting the business or undertaking that carries out the work must ensure it is prepared, must make the work follow it, must stop the work if it doesn't, must review it when the controls change, and must keep it until the work is finished or for two years after a notifiable incident.

It must contain exactly four things: the high risk work identified, the hazards and risks, the control measures, and how those controls will be implemented, monitored and reviewed. Everything else on the form is optional. The reason so many SWMS fail is not that they miss those four things — most templates include them — but that they describe a generic job rather than this site, and nobody on the crew has read them. The rest of this page is the requirements with their regulation numbers, and then the practical part.

What a SWMS is, and what it is not

A SWMS is a short written document, required by law, that sets out how a specific piece of high risk construction work will be done safely at a specific workplace — the hazards, the controls, and who does what to keep the controls in place. It exists so that the people doing the work and the people supervising it are working from the same plan, and so that an inspector, or a court, can see what the plan was. SafeWork NSW describes it as "a simple safe system planning and implementation tool, used by supervisors and workers to stay safe on construction sites".

It is not a risk assessment, a job safety analysis or a safe work procedure, although it draws on all three. Those are management tools you choose to use; a SWMS is a document the Regulations require, with prescribed content, for a prescribed list of activities. It is also not required for construction work outside the 18 categories — the Code of Practice is explicit that for other construction activities a SWMS is not required, though the general duty to manage risk still applies. And it is not a site-wide safety plan: on a construction project that is the principal contractor's WHS management plan, which the SWMS must take into account but does not replace.

One clarification that saves arguments: the requirement is about the work, not the contract. A one-day job for a homeowner that involves a person working at a height of more than two metres is high risk construction work, and a SWMS is required. The value of the contract and whether the job is a "construction project" (which under the Regulations means construction work costing $250,000 or more) affect the principal-contractor duties, not whether the SWMS is needed.

The 18 categories that require a SWMS

Regulation 291 defines high risk construction work as construction work that falls into any of 18 categories, and regulation 299 requires a SWMS before any of it commences. The list below is the regulation's own, in its own order and wording, lightly trimmed; the examples in brackets are from the Code of Practice.

1. 1.Involves a risk of a person falling more than 2 metres (installing roof trusses, tiles or sheeting; working beside a pit or opening with a fall of more than 2 metres).
2. 2.Is carried out on a telecommunication tower.
3. 3.Involves demolition of an element of a structure that is load-bearing or otherwise related to the physical integrity of the structure (knocking down a load-bearing wall; removing bracing during a renovation).
4. 4.Involves, or is likely to involve, the disturbance of asbestos (removing asbestos floor tiles; drilling into an asbestos cement sheet wall).
5. 5.Involves structural alterations or repairs that require temporary support to prevent collapse (propping a ceiling while a load-bearing wall is removed).
6. 6.Is carried out in or near a confined space.
7. 7.Is carried out in or near a shaft or trench with an excavated depth greater than 1.5 metres, or a tunnel.
8. 8.Involves the use of explosives (the Code notes that explosive power tools are not "the use of explosives").
9. 9.Is carried out on or near pressurised gas distribution mains or piping.
10. 10.Is carried out on or near chemical, fuel or refrigerant lines.
11. 11.Is carried out on or near energised electrical installations or services (drilling into a wall where live wiring may be present; working near overhead or underground power lines — but not power leads and powered tools).
12. 12.Is carried out in an area that may have a contaminated or flammable atmosphere (removing tanks or pipework that may hold residues; demolishing a service station).
13. 13.Involves tilt-up or precast concrete.
14. 14.Is carried out on, in or adjacent to a road, railway, shipping lane or other traffic corridor that is in use by traffic other than pedestrians (using part of the road to deliver materials; digging up a kerb).
15. 15.Is carried out in an area at a workplace in which there is movement of powered mobile plant (an area of a site not isolated from skid steers, backhoes, mobile cranes or trucks).
16. 16.Is carried out in an area in which there are artificial extremes of temperature (enclosed roof cavities; an operating cool room or freezer; beside an operating boiler).
17. 17.Is carried out in or near water or other liquid that involves a risk of drowning (shade sails over a pool; a bridge over a river; wharf restoration).
18. 18.Involves diving work.

Three of these catch far more work than people expect. Category 15, powered mobile plant, applies to almost every open site with an excavator or a delivery truck moving through it, not only to the operator. Category 11, energised electrical services, is engaged by drilling into most existing walls. And category 1, falls of more than two metres, includes working next to an opening, not only on a roof. If you are deciding whether a job needs a SWMS, run the whole list against the whole job, including the parts a subcontractor will do, rather than asking whether the main task sounds dangerous.

Who must prepare it

The person conducting a business or undertaking that includes the carrying out of the high risk construction work must, before the work commences, ensure that a SWMS for the proposed work is prepared, or has already been prepared by another person (regulation 299(1)). The duty sits with the business doing the work — usually the subcontractor whose crew will perform it — and the Code of Practice says that person is best placed to prepare it, in consultation with the workers who will be directly engaged.

Where more than one PCBU has the duty, they must consult and cooperate to coordinate who actually writes it. Where the work is part of a construction project, two further duties apply: the PCBU carrying out the work must give a copy of the SWMS to the principal contractor before the work starts (regulation 301), and the principal contractor must take all reasonable steps to obtain it (regulation 312). SafeWork NSW's guidance adds that the SWMS should be developed in consultation with the principal contractor so that the agreed controls are appropriate and in place before the activity begins.

Consultation is not a formality here. Workers and their health and safety representatives must be consulted when the SWMS is prepared, and again when it is reviewed. If no workers are engaged at the planning stage, the Code says consultation must happen when the SWMS is first made available to them — a toolbox talk, or workplace-specific training. A SWMS may record who was consulted, when, and their signatures; that record is the evidence you will want later.

What it must contain

Regulation 299(2) requires four things and nothing more: the SWMS must identify the work that is high risk construction work; specify the hazards relating to it and the risks to health and safety associated with those hazards; describe the measures to be implemented to control the risks; and describe how the control measures are to be implemented, monitored and reviewed. Regulation 299(3) adds two conditions on how it is written: it must be prepared taking into account all relevant matters, including the circumstances at the workplace that may affect how the work is carried out and, on a construction project, the WHS management plan; and it must be set out and expressed in a way that is readily accessible and understandable to the people who use it.

The fourth element is where most templates are weakest and where an inspector reads most closely, because it is the part that turns a list of controls into a system. A SWMS that names the roof rails but not the person responsible for them, or the check that they are in place before the first worker goes up, has described a control it cannot show was implemented.

Site-specific means site-specific. The Code lists what to consider: site access and egress, proximity to other structures or powerlines, ground conditions, other trades or activities happening at the same time, and access to safety equipment. A generic SWMS is allowed for work done regularly, but it must be reviewed against the specific workplace and revised where necessary — and the review has to be visible on the document.

Working to it, and stopping when the work departs from it

Regulation 300 has two limbs. The PCBU must put in place arrangements for ensuring the high risk construction work is carried out in accordance with the SWMS; and if it is not, the PCBU must ensure the work is stopped immediately or as soon as it is safe to do so, and is resumed only in accordance with the statement. In New South Wales each limb carries a maximum penalty of 73 penalty units for an individual or 364 for a body corporate.

"Arrangements" means a system, not a signature. The Code suggests routine or random inspections — observing workers and supervisors to see whether the controls in the SWMS are being used — and allows the day-to-day responsibility to be given to a leading hand or supervisor, while making clear that the PCBU's duty is not transferable. A builder must have a system to monitor compliance with subcontractors' SWMS, which may be as simple as checking the documented controls are in use each time the builder's representative attends the site.

When work stops, the Code's expectation is that the work and the SWMS are both reviewed to find out why the method was not followed and whether it was the most practical and safest way of doing the task. If a better method emerges, the SWMS is revised before work restarts. Workers must know what to do if the work is not being conducted in accordance with the SWMS — which is the part of the toolbox talk most often skipped.

Reviewing a SWMS

A SWMS must be reviewed, and revised as necessary, whenever the relevant control measures are revised under regulation 38 (regulation 302). Regulation 38 in turn requires a duty holder to review control measures when a control does not control the risk it was implemented for (a notifiable incident is the regulation's own example), before a change at the workplace that is likely to give rise to a new or different risk, when a new hazard or risk is identified, when consultation indicates a review is necessary, or when a health and safety representative requests one. A change at the workplace includes a change to the workplace itself or the work environment, and a change to a system of work, process or procedure.

SafeWork NSW reduces that to three triggers that cover most cases: a change to the high risk construction work process, a change to the site work environment where new or unforeseen hazards and risks appear, and a change to the controls. The review is carried out in consultation with the workers, including contractors and subcontractors who may be affected, and their representatives. After a revision, everyone involved should be told that a revision has been made and how to access it, and on a construction project the principal contractor must be given a copy of the revised SWMS.

Keeping it: until completion, or two years after a notifiable incident

Regulation 303 sets four requirements. The PCBU must keep a copy of the SWMS until the high risk construction work to which it relates is completed. If a notifiable incident occurs in connection with that work, the SWMS must be kept for at least two years after the incident. For the whole period the SWMS must be kept, a copy must be readily accessible to any worker engaged to carry out the work, and a copy must be available for inspection under the Act. The Code adds that if the SWMS is not kept at the workplace it should be stored where it can be delivered to the workplace quickly, that it can be kept electronically, and that where a SWMS is revised, every version should be kept.

The last point is the one that matters after an incident. The question an inspector asks is not "do you have a SWMS for that work" but "which version was in force at the time, who had read it, and what did it say about the control that failed". A filing system, paper or digital, that keeps only the current version cannot answer that; one that overwrites the document on each revision has destroyed the evidence it was required to keep.

Why SWMS fail on site

Almost every failure traces to one of the requirements above being treated as paperwork rather than as a description of what will actually happen. The pattern is consistent enough to list.

• The generic template, unreviewed. The company name is filled in, the site is not. No mention of the powerline over the boundary, the neighbouring trade, or the ground conditions. Fails regulation 299(3)(a) and the Code's explicit condition on generic SWMS.
• Controls that are decisions. "Use appropriate PPE." "Ensure safe access." "Take care near plant." The Code names this failure directly: the control measures should be clearly specified, with no statements requiring a decision by supervisors or workers.
• Nobody owns the control. The rails are listed; the person who installs them and the person who checks them are not. Element four of regulation 299(2) is missing even though the form has a column for it.
• The crew has not read it. Signatures collected in the ute at 6.50am. Consultation under the Code means the workers helped prepare or were taken through the SWMS, and can say what to do if the work departs from it.
• Not readily accessible. The SWMS is in the site office, or on a laptop, or with the principal contractor, and the crew doing the work cannot produce it. Regulation 303(3) requires it to be readily accessible to the workers engaged to carry out the work.
• The work changed and the SWMS did not. The job moved onto a section with skylights, a trench went deeper than planned, a crane arrived. Each is a regulation 38 trigger, and the SWMS on site still describes the original job.
• Work continued while the paperwork caught up. Someone noticed the departure and started revising the document, and the crew kept going. Regulation 300(2) requires the work to stop first.
• The old version is gone. The SWMS was revised twice, and only the latest copy exists. After an incident, nobody can show what the controls were on the day.
• The principal contractor never received it. Regulation 301 puts the duty to provide it on the subcontractor; regulation 312 puts the duty to obtain it on the principal contractor. Both have failed when the first time the builder sees the SWMS is at the incident investigation.

Keeping SWMS current across sites

A contractor running high risk construction work on several sites at once has, in effect, several live documents that each have to be site-specific, accessible to the crew, reviewed on defined triggers, supplied to a principal contractor, and retained with every version. That is a version-control problem before it is a safety problem, and the way to solve it is to design the process around the four regulatory events rather than around the form.

1. 1.Start from a controlled library, not a shared drive. Hold one reviewed master per high risk activity, with the controls written as specific measures and the implementation column already filled with roles rather than names. Every site copy is created from the master and marked as a site version.
2. 2.Make the site review a required step, not a checkbox. The site version is not complete until the site-specific factors from the Code — access, adjacent structures and services, ground conditions, concurrent trades, equipment — have been written in and the people responsible for each control have been named. If that step can be skipped, it will be.
3. 3.Record the consultation on the document. Who was taken through it, when, and their acknowledgement. Add the principal contractor's receipt for a construction project. This is the evidence for regulation 301 and for the Code's consultation requirement, and it should be generated at the toolbox talk, not reconstructed later.
4. 4.Keep it where the crew is. Regulation 303(3) is a test of access at the work face. If the crew works where there is no signal, the document has to be available offline on the device they carry, and any revision has to reach them the next time they connect.
5. 5.Tie revisions to the triggers. A notifiable incident, a change to the site, the plant or the process, a new hazard, or a request from a health and safety representative should each open a review of the affected SWMS, with the reason recorded. If your incident and change records live in a different system from your SWMS, the trigger fires and nothing happens.
6. 6.Never overwrite. Each revision is a new version with a date; the previous one stays readable. Retention runs to the end of the work or two years past any notifiable incident, whichever is later, and applies to every version.

None of that requires software. All of it is easier with a system that holds the master, generates the site version, records the acknowledgements, works offline and keeps history automatically — because each of those is a step a busy supervisor will skip on paper on the day it matters most.

Where we come in

Teammate App is our product, so treat this section as what it is. The SWMS obligations above resolve into a controlled document with version history, a site-specific review, recorded consultation, access at the work face without a connection, review triggers wired to incident and change records, and retention that keeps every version. That is what our platform is built to hold — 15 modules across documents, risk, incidents, audits, actions, training, contractors and assets, aligned to ISO 45001, 9001 and 14001, on web, iOS and Android, and working offline. Our own information security management system is certified to ISO/IEC 27001:2022 by Telarc under JAS-ANZ accreditation, and customer data is hosted in Australia on AWS Sydney.

What software cannot do is make the work follow the statement. Regulation 300 is satisfied by supervision on site, not by a document in a system, and no product can put the roof rails up. A records system keeps the SWMS site-specific, current, accessible and retained. The method it describes is still yours to follow.

Questions we get asked