How to write a SWMS, step by step

Under regulation 299(2) of the model WHS Regulations, a SWMS must do four things: identify the high risk construction work; state the hazards and the risks each one creates; describe the control measures; and describe how those control measures are implemented, monitored and reviewed. It must be set out in a way that is readily accessible and understandable to the people who use it (regulation 299(3)).

A risk score or matrix is not one of the four elements. The law wants concrete controls, not a colour-coded number. The four elements are what an inspector reads against, so write them plainly for each task step.

• Identify the high risk construction work the SWMS covers (reg 299(2)(a)).
• State the hazards and the risks each one creates (reg 299(2)(b)).
• Describe the control measures, listed in hierarchy-of-controls order (reg 299(2)(c)).
• Describe how the controls are implemented, monitored and reviewed (reg 299(2)(d)).
• For fall work over 2 metres relying only on admin or PPE, record every higher-order control you considered (reg 299(4)).

That fifth line is the one almost no template covers. Regulation 299(4) says that where a SWMS deals with a risk of falling more than 2 metres and relies only on administrative controls or PPE, it must also describe the higher-order controls that were considered. In plain terms: if you are going to work at height on a harness alone, you have to show you thought about edge protection or a scaffold first. You can start your SWMS draft in the free tool and fill these elements in for your own trade.

The four things a SWMS must contain

Reg 299(2)

Read it as a checklist

• Identify: name the high risk construction work.
• Hazards and risks: the hazard and the harm it can cause.
• Controls: in hierarchy order, eliminate first.
• Monitor and review: who checks, when, and the stop rule.

The hierarchy of controls is the order you must work through when choosing controls for a SWMS. Eliminate the hazard entirely first (regulation 35). If elimination is not reasonably practicable, minimise the risk by substitution, isolation or engineering controls, then administrative controls, then personal protective equipment as the last resort (regulation 36). The SWMS must list controls in that order, not lead with the hard hat.

PPE last does not mean PPE never. It means PPE is the bottom layer, used once you have removed or reduced the hazard as far as you reasonably can with the higher-order controls above it. Work down these four tiers for every hazard you listed in step 4.

1. Eliminate (reg 35). Remove the hazard entirely. Prefabricate at ground level, or re-sequence the work so nobody is exposed.
2. Substitute, isolate or engineer (reg 36). Edge protection, scaffolds, trench shields, machine guarding, a physical barrier between the worker and the hazard.
3. Administrative controls. Exclusion zones, spotters, a safe work sequence, permits, training and supervision.
4. Personal protective equipment. Harness, hard hat, hi-vis, safety glasses, boots. The last line, never the first.

Eliminate first, PPE last

Reg 35 & 36

Why the order matters

• Higher-order controls protect everyone, not just the worker wearing the gear.
• They do not rely on a person remembering to do the right thing every time.
• PPE fails quietly, so it sits last, backing up the controls above it.

Trench work shows the hierarchy at its clearest. A trench deeper than 1.5 metres is high risk construction work on depth alone (reg 291). You cannot fix a collapse with a hard hat, so the real controls are higher-order: confirm services with Dial Before You Dig and hand-potholing, then shield or batter the walls, keep spoil back from the edge, and control the plant around it. Once you have your trade’s draft, you can generate a draft for your trade, then adjust it on site with your crew.

Trench work: controls in order

Worked example

The quantified controls

• Eliminate: Dial Before You Dig plans and hand-potholing before mechanical digging.
• Engineer: trench shields or shoring rated to the soil for any excavation of 1.5 metres or more, so no one is in an unsupported trench.
• Administrative: keep spoil at least 0.9 metres back from the edge; two ladder access points for any trench section longer than 8 metres; a spotter for plant near the edge.
• PPE: hard hat, hi-vis and boots for everyone in or at the edge.

The most common SWMS failure regulators flag is a generic, non-site-specific document used unedited across every job. The second is vague controls such as “use appropriate PPE” that leave the decision to the worker on the day. A third, less obvious one is an overly long SWMS: a lengthy, padded document is harder to understand, apply, monitor and review than a short, specific one.

• A generic template used unedited, with nothing specific to the site.
• Vague controls that require an on-the-spot decision, like “use appropriate PPE”.
• An overly long, padded SWMS that no one can actually follow.
• No review when conditions change, and no stop-work when the work does not match the SWMS.
• A risk matrix in place of concrete controls, which the law does not ask for.

None of this means the paperwork has to be painful. You can get a head start on the paperwork with the free draft generator, no account needed and nothing you enter is uploaded or stored, the draft stays in your own browser. It is a starting point you make site-specific and consult your workers on before any work begins, not a finished document.