A guide for companies
What is the SG-SST? The Occupational Safety and Health Management System, explained
Every company in Colombia must have an SG-SST, also written SGSST. Here we explain what it is, who must have one, how it is organized and which minimum standards your company must meet based on its size and risk level.
Updated on · Extandar team
In a nutshell
The SG-SST is the organized way a company looks after the safety and health of the people who work for it. It is not a folder of documents: it is a step-by-step process based on continuous improvement, with a policy, an organization, planning, execution, evaluation of results, auditing and improvement actions. Its goal is to anticipate, recognize, evaluate and control the risks that can affect safety and health at work.
Decreto 1072 de 2015, art. 2.2.4.6.4
You will see it written as SG-SST, SGSST or SG SST. They are the same: the Spanish acronym for Occupational Safety and Health Management System. It replaced the old “occupational health program”.
Who must have an SG-SST?
Decreto 1072 de 2015 (book 2, part 2, title 4, chapter 6) requires it from every employer and contracting party in the country, regardless of size or activity:
- Public and private employers, from the very first worker.
- Anyone who hires people under civil, commercial or administrative contracts.
- Solidarity economy organizations and cooperatives.
- Temporary staffing companies.
It must cover employees, contractors, cooperative members and workers on assignment.
If your company has even one worker, it is already required. What changes with size and risk is how many minimum standards you must meet.
See the plansHow it is organized
How it works: the PDCA cycle
The system follows the continuous improvement cycle of plan, do, check and act. Each stage has specific activities the company must be able to prove.
- 01
Plan
Define the OSH policy and objectives, assign responsibilities and resources, identify hazards and assess risks, and draw up the annual work plan.
- 02
Do
Carry out the plan: train and onboard staff, apply prevention and control measures, prepare the emergency response, manage medical exams, and report and investigate accidents.
- 03
Check
Measure with indicators, run the annual audit and the management review, and evaluate compliance with the minimum standards.
- 04
Act
Fix what went wrong with corrective and preventive actions, and update the improvement plan for the next cycle.
Resolución 0312 de 2019
Which minimum standards must your company meet?
Resolución 0312 de 2019 defines the minimum standards of the SG-SST: the basic requirements the Ministry of Labor checks. How many apply depends on the number of workers and the company’s risk class (from I, the lowest, to V, the highest).
| Company | Minimum standards | Examples of what it requires |
|---|---|---|
| Up to 10 workers, risk I, II or III | 7 | A person in charge of the system, social security enrollment, training, an annual work plan, medical exams, hazard identification and prevention measures. |
| 11 to 50 workers, risk I, II or III | 21 | All of the above plus an OSH policy, a COPASST or Vigía, a workplace harmony committee, accident investigation, an emergency plan and environmental measurements where applicable. |
| More than 50 workers, or risk IV or V | 60 | The full system: objectives and indicators, budget, accountability, change management, auditing, management review and improvement actions. |
The standards are grouped in the PDCA cycle and add up to 100 points (plan 25, do 60, check 5 and act 10). The self-assessment is done every December and its result is critical (below 60%), moderately acceptable (60% to 85%) or acceptable (above 85%); together with the improvement plan, it is sent to the ARL (occupational risk insurer) and registered on the Ministry of Labor’s platform (arts. 26 to 28 of Resolución 0312 de 2019 and Circular 027 de 2026).
What happens if a company does not comply?
The Ministry of Labor can fine anyone who breaks occupational safety and health rules from 1 to 500 monthly minimum wages (SMMLV), scaled by company size, and up to 1,000 SMMLV if the breach causes a fatal accident. It can also order the temporary or permanent closure of the premises when workers face a serious risk.
Ley 1562 de 2012, art. 13; Decreto 472 de 2015
⚠Beyond the fine, an accident without a system to prevent it exposes the company to labor and civil lawsuits, and to losing contracts with clients that require an up-to-date SG-SST.
- Micro company: 1 to 5 SMMLV (20 to 24 if there is a fatal accident).
- Small company: 6 to 20 SMMLV (25 to 150 if there is a fatal accident).
- Medium company: 21 to 100 SMMLV (151 to 400 if there is a fatal accident).
- Large company: 101 to 500 SMMLV (401 to 1,000 if there is a fatal accident).
Getting started
How to get started in 4 steps
- Step 1
Initial assessment
Measure your company against the minimum standards that apply to it. It is your starting point: what you have, what is missing and what is urgent.
- Step 2
Improvement plan and annual plan
With the result, decide what you will do, who does it and when, and assign the resources.
- Step 3
Document design
Policy, objectives, hazard matrix, training program, emergency plan, procedures and forms, tailored to your activity.
- Step 4
Implementation and follow-up
Carry out the activities, keep the records, measure the indicators and repeat the self-assessment every year.
Extandar takes these steps with you: our specialists design and implement the system, and the platform keeps documents, deadlines and records up to date.
Learn about the SG-SST compliance service21 questions
Frequently asked questions about the SG-SST
The questions companies ask us most, answered without jargon.
What is the SG-SST and what is it for?
It is a set of organized actions that help protect workers’ health and safety. It serves to prevent workplace accidents and occupational diseases, and to create a safer and healthier work environment.
Must every company implement the SG-SST?
Yes. Every company in Colombia, regardless of its size or activity, must implement the SG-SST. This includes small businesses, self-employed people with staff and contractors.
When must a company comply with the SG-SST?
From the moment it hires its first worker. It does not matter whether it is a micro company, a family business or a startup with a few employees: as soon as someone works for you, you must start complying with the SG-SST.
Also, if the company wants to bid for tenders or work with the government or large companies, an up-to-date SG-SST is usually a mandatory requirement.
What happens if a company does not comply with the SG-SST?
It can be fined from 1 to 1,000 monthly minimum wages, depending on the company’s size and the seriousness of the breach. It can also be closed temporarily or permanently if the risk to workers is very high.
How does the SG-SST affect a company’s image?
A well-implemented SG-SST improves the company’s reputation, shows social responsibility and builds trust among clients, partners and employees.
Can the SG-SST help win more contracts or tenders?
Yes. Many large companies and government bodies only hire suppliers that comply with the SG-SST. Having it properly implemented can be a requirement to do business.
What are the financial benefits of the SG-SST?
It reduces the costs of accidents, sick leave, lawsuits and fines. It also improves productivity, because employees feel safer and more motivated.
What does a company need to have an SG-SST?
It needs a plan with clear policies, to identify workplace risks, to train its people, to apply controls and to record everything it does to protect workers’ health and safety.
What is the difference between designing and implementing the SG-SST?
Designing the SG-SST is like drawing the plans of a house: you analyze the company, define the risks, set the policy and objectives, and plan the activities and resources. Implementing is building the house: carrying out the activities, training, doing the medical exams, recording and measuring. A system that is designed but not implemented protects no one and does not pass an inspection.
How do you start designing the SG-SST in a company?
First, a diagnosis shows which risks exist and what is already being done well or badly. Then a plan is created with objectives, owners, activities and timelines to put it in motion.
Can a standard template be used for every company?
No. Each SG-SST must fit the company’s reality: its size, its activities, its number of employees and its specific risks. It is not copy and paste: it is tailor-made.
Is it mandatory to hire an occupational safety and health professional?
It depends on the company’s size and risk level. Resolución 0312 de 2019 sets the minimum profile of whoever designs the system: in companies with up to 10 workers and risk I, II or III, it can be an OSH technician with a valid license, one year of experience and the 50-hour online course (arts. 3 and 4); with 11 to 50 workers, an OSH technologist with a license and two years of experience (arts. 9 and 10); and in companies with more than 50 workers or risk IV or V, a licensed OSH professional (arts. 16 and 17). In every case the company can rely on external advisors with that profile.
Can the SG-SST be outsourced to an external company?
Yes, especially in micro and small companies. External advice can be hired, but the employer remains legally responsible for the system working properly.
Which documents are part of the SG-SST design?
Some of the main ones are:
- the occupational safety and health policy;
- hazard identification and risk assessment;
- the annual work plan;
- emergency procedures;
- records of training, inspections and accidents;
- follow-up indicators.
How long does it take to implement a full SG-SST?
It depends on the size of the company, but it is usually done in stages over a year. What matters is having a plan, making steady progress and documenting the processes. A small office business can have the basics in a few weeks.
How often should the SG-SST be reviewed?
At least once a year: the self-assessment of the minimum standards, the audit and the management review are annual. It should also be reviewed whenever there are major changes in the company, such as new activities, equipment or staff.
Who is responsible for the SG-SST in the company?
The employer is primarily responsible, but must involve the workers and the Joint Occupational Safety and Health Committee (COPASST) or, in companies with fewer than ten workers, the OSH Vigía. Everyone must take part.
How are workplace risks identified?
By observing the tasks each worker performs, analyzing the hazards and measuring the level of risk. This makes it possible to take measures to prevent accidents or illnesses.
What are psychosocial risks and how are they managed?
They are risks related to stress, overwork and a poor work environment, among others. They are managed by assessing the work climate, running surveys and taking action to improve working conditions.
How do you check whether the SG-SST is working?
Through internal audits, tracking indicators (such as the number of accidents) and annual reviews. If something is not working, adjustments are made.
What happens if the SG-SST is poorly designed or does not fit the company?
It may fail to prevent risks, which raises the chance of accidents, fines and financial losses. It can also hurt team morale if people do not feel protected.
Does your company already comply with the SG-SST?
Tell us how many workers you have and what your company does. We will tell you which standards apply and how we can help.
Or leave us your details and we will write to you →
We reply on business days, with no commitment.