SG-SST in Colombia under Decree 1072: requirements and management
Many companies in Colombia have their Occupational Health and Safety Management System (SG-SST) “set up.” They have the documents, the policy, and the designated person in charge. But when the Ministry of Labor visits or when an accident occurs, the real problem emerges: the system exists on paper, not in practice.
Decree 1072 of 2015 doesn’t require documents. It requires a functioning management system. And that difference, which may seem small, is what separates the companies that pass audits from those that receive penalties.
In this article we explain what Decree 1072 actually requires, what fails in practice, and how to structure an SG-SST that does not depend on a single person or live in a Google Drive folder.
What is the SG-SST and why is Decree 1072 the central standard?
The Occupational Health and Safety Management System (SG-SST) is the set of elements that a company must have in place to identify, assess, and control risks that may affect the health of its workers. For an overview, first review the OHS regulations in Colombia .
Decree 1072 of 2015 is the Single Regulatory Decree for the Labor Sector. Chapter 6—dedicated entirely to the Occupational Health and Safety Management System (SG-SST)—is the reference standard for any company operating in Colombia, regardless of its size or sector.
What makes Decree 1072 different from previous regulations is that it doesn’t just require documents. It requires a dynamic system, with a PDCA cycle (Plan, Do, Check, Act), with defined responsibilities, evidence of implementation, and demonstrable continuous improvement.
Resolution 0312 of 2019 complements the decree by establishing minimum standards based on company size and risk level. While not all companies have the same obligations, they all do.
Which companies does it apply to?
To all. Without exception. Every company with employees in Colombia must implement the SG-SST in accordance with Decree 1072, regardless of whether it has 5 employees or 5,000.
The difference lies in the level of requirements. Resolution 0312 classifies companies into three categories:
Companies with 10 or fewer employees and risk levels I, II, or III must comply with 7 minimum standards. The employer may be responsible for this.
Companies with between 11 and 50 employees and risk levels I, II, or III must comply with 21 minimum standards. They require a licensed occupational health and safety technician.
Companies with more than 50 employees or with risk levels IV or V must comply with the 60 minimum standards. They require a licensed occupational health and safety professional with a postgraduate degree in the field.
The most common mistake is that medium-sized or large companies try to manage their SG-SST with the resources and structure of a small company. And that, sooner or later, shows.
What exactly does Decree 1072 require?
Chapter 6 of Decree 1072 establishes the elements that the SG-SST (Occupational Health and Safety Management System) must have. These are the most critical in practice: Other countries face the same challenge with different approaches, such as NOM-035 in Mexico .
OSH Policy
It must be documented, signed by senior management, communicated to all employees, and reviewed periodically. It’s not just a formality. It’s the organization’s formal commitment to safety.
Hazard identification and risk assessment (IPER)
It is the heart of the system. The company must identify all the hazards to which its workers are exposed, assess the associated risks, and define control measures. The IPER ( Identification of Hazards and Risk Assessment ) is not a document that is created once and filed away. It must be updated when processes change, when accidents occur, or when new equipment or tasks are introduced.
Annual work plan in OSH
It must include objectives, goals, activities, responsible parties, resources, and a timeline. It is the instrument that transforms policy into concrete action. Without an updated and implemented work plan, the system lacks direction.
Training and development program
All workers must receive occupational safety and health (OSH) training before starting their job and on a regular basis. The company must keep records of this training: attendance lists, evaluations, and certificates.
Change management
When a company introduces a new process, piece of equipment, chemical, or job position, it must assess the new risks before implementing the change, not after.
Accident and incident investigation
Every workplace accident and every incident with the potential to cause harm must be investigated. The investigation is not about assigning blame; it’s about identifying root causes to prevent recurrence. The FURAT (Single Workplace Accident Report Form) must be submitted to the ARL (Occupational Risk Administrator) within the established deadlines.
COPASST or OSH Representative
Companies with 10 or more employees must have a Joint Occupational Health and Safety Committee (COPASST). Companies with fewer than 10 employees must have an Occupational Health and Safety Representative. Both roles have defined functions and must meet regularly. Their procedures must be documented.
Internal audit and management review
The system must be audited at least once a year. The results must reach senior management and generate improvement actions. Without this cycle, the SG-SST does not improve; it merely remains the same.
What usually goes wrong in practice?
Working with companies from different sectors allows you to identify the same mistakes time and time again:
The system exists only in a file, not in practice. The documents are there, but no one updates them. The IPER (Identification of Hazards and Risk Assessment) hasn’t been reviewed in three years. Last year’s work plan was never finalized. Training sessions were held, but there’s no evidence of them.
It depends on a single person. When the person responsible for occupational health and safety leaves or goes on vacation, the system grinds to a halt. There are no defined processes, no shared tools, no continuity.
Contractors are not integrated. Many companies manage their Occupational Health and Safety Management System (SG-SST) for their direct employees but ignore contractors and subcontractors. Decree 1072 is clear: the main company is responsible for ensuring safe working conditions for them as well.
Corrective actions are never completed. Problems are identified, measures are proposed, but no one follows up. The same causes lead to the same accidents.
There’s no traceability. When an audit comes in, the health and safety manager has to search through emails, folders, spreadsheets, and meeting minutes to piece together what happened. That’s not a system; it’s a historical archive.
What are the consequences of not complying?
Penalties for non-compliance with the Occupational Health and Safety Management System (SG-SST) in Colombia can be significant. The Ministry of Labor can impose fines of up to 500 times the current monthly minimum wage for serious violations of occupational health and safety regulations.
But beyond the fines, the real consequences are different:
- Accidents that could have been prevented
- Occupational diseases that develop without anyone detecting them in time
- Joint and several liability for contractor accidents
- Impact on reputation with clients and tenders that require SG-SST certification
- Increased accident rates result in direct and indirect costs for the company
How should it be managed correctly?
A functioning SG-SST has three characteristics that distinguish it from one that only exists on paper:
It’s continuous, not sporadic. It doesn’t only activate when an audit is coming. It works every day because there are clear processes, tools, and responsibilities.
It automatically generates evidence. Every activity leaves a trace: training is recorded, inspections generate reports, and corrective actions are tracked. Evidence isn’t built after the fact; it’s produced in real time.
It connects all stakeholders. The OSH manager, area managers, workers, contractors, and senior management all have relevant information for their roles and can act upon it.
The PDCA cycle required by Decree 1072 is not a mere formality. It is the structure that allows the system to improve instead of stagnating.
How an OSH Platform helps to comply with Decree 1072
Managing the Occupational Health and Safety Management System (SG-SST) with spreadsheets and emails might work for very small businesses. However, in medium-sized or large companies with multiple locations, contractors, and more than one safety manager, this model leads to inconsistencies, loss of information, and a lack of traceability.
An OHS Platform allows centralizing management in a single environment: the updated IPER, the work plan with real-time monitoring, training with evidence, accident investigations with cause analysis, the COPASST with minutes and commitments, and contractors with their verified documentation.
The result is not just regulatory compliance. It’s a system that generates useful information for decision-making: where the most critical risks are, what actions are pending, which workers need training, and which contractors have expired documentation.
If you want to better understand how this approach works, you can read this article about the OSH Platform .
How Sabentis fits into this context
Sabentis is an occupational health and safety (OHS) management platform with over 20 years in the market and an active presence in Colombia. It is designed to enable companies to implement and maintain their OHS management system in accordance with Decree 1072 of 2015 and Resolution 0312 of 2019, covering the entire PDCA cycle.
It allows you to manage hazard identification and risk assessment (IPER), the annual work plan, evidence-based training, accident investigations, the COPASST (Joint Committee on Occupational Health and Safety), contractor management, and internal audits, all in one environment with complete traceability.
For Colombian companies with operations in several countries, it also offers multinational regulatory coverage: the same system manages the SG-SST in Colombia, the PRL in Spain, or the SST requirements in Chile, Argentina or Peru.
Decree 1072 is not difficult to understand. What is difficult is maintaining a system that works in practice, generates real evidence, and improves over time.
Companies that have problems with their occupational health and safety management systems (SG-SST) don’t usually have problems with regulatory knowledge. They have management problems: a lack of clear processes, scattered tools, dependence on a single person, and a lack of traceability.
A well-structured system, with the right tools, makes compliance with Decree 1072 manageable. And most importantly: it makes it something that truly protects workers, which is its purpose.
Want to see how Sabentis can help you structure your company’s Occupational Health and Safety Management System (SG-SST) in accordance with Decree 1072? Request a demo and we’ll show you the system adapted to Colombian regulations.
