An HSE (health, safety and environment) (HMS) plan covers your business all the time. An SHA plan (safety, health and working environment plan) covers one construction project at a time. That's the core difference — and mixing them up is one of the most common reasons for deviations during an inspection. This guide explains what each plan is, which law governs them, who's responsible, and how they work together out on the construction site.

In short

  • HSE plan = business level, all the time, grounded in the Internal Control Regulations (internkontrollforskriften). SHA plan = project level, grounded in the Construction Client Regulations (byggherreforskriften).
  • Section 5 of the Internal Control Regulations sets eight requirements for HSE work — points 4 to 8 must be documented in writing.
  • The SHA plan is the construction client's (byggherre) responsibility and must be ready before work starts (the Construction Client Regulations, section 7).
  • As a subcontractor you need both: your own HSE in order, and you must work to the construction client's SHA plan on the project.

What is an HSE plan?

An HSE plan is the documentation of your systematic internal control work, and it's required of every Norwegian business under the Internal Control Regulations (internkontrollforskriften) (Lovdata, 1996). It follows the business — not the individual job — and applies regardless of sector and size.

Section 5 of the regulations sets eight concrete requirements for HSE work. The first three can be documented verbally, while points 4 to 8 must be in writing:

  1. Make the HSE rules available to everyone in the business.
  2. Ensure employees have enough knowledge and skills in HSE work.
  3. Ensure employees take part.
  4. Set targets for health, safety and the environment (in writing).
  5. Keep an overview of how the business is organised and how responsibility is divided (in writing).
  6. Map hazards, assess risk and put measures in place (in writing).
  7. Have routines for uncovering and correcting deviations (in writing).
  8. Monitor and review the internal control regularly (in writing).

The scope is tailored to the business: its nature, activities, risk and size determine how detailed the documentation needs to be. A sole trader doesn't need the same binder as a contracting firm — but the duty to work systematically applies from the very first employee.

What is an SHA plan?

SHA stands for sikkerhet, helse og arbeidsmiljø (safety, health and working environment), and an SHA plan is project-specific. Section 7 of the Construction Client Regulations (byggherreforskriften) requires a written SHA plan to be in place before work starts on a building or civil engineering site, that it's readily available on site, and that it's updated on a rolling basis whenever something changes (Lovdata, 2009).

The content is regulated in section 8. Among other things, the plan must contain:

  • An organisation chart — how the project is organised, and who is the construction client, SHA coordinator and any principal undertaking.
  • A progress plan — when and where the various work operations are to be carried out, built on risk assessments so that dangerous simultaneous activities are avoided.
  • Specific measures for the project-specific risk conditions that can't be removed during planning.
  • Routines for deviations on the project.

The responsibility lies with the construction client (byggherre), not with the individual tradesperson. The construction client must also appoint an independent coordinator who follows up the risk conditions throughout the project, and ensure that every employer and sole trader on site — including subcontractors — is made familiar with the contents of the plan (Arbeidstilsynet, 2026).

HSE plan vs SHA plan: the key differences

HSE planSHA plan
LevelThe business, all the timeOne project at a time
Legal basisThe Internal Control RegulationsThe Construction Client Regulations
ResponsibilityManaging director / employerThe construction client
WhenOngoing, from the first employeeReady before work starts, updated along the way
Core contentTargets, organisation, risk assessment, deviation routines, reviewOrganisation chart, progress plan, project-specific measures, deviation routines
Applies toAll businessesBuilding and civil engineering sites

The simplest rule of thumb: the HSE plan follows the business, the SHA plan follows the construction site.

How do they fit together on a construction site?

The two plans don't replace each other — they work together. As a trades business you have to keep your own HSE in order wherever you're working. Then, when you're a subcontractor on a construction project, the construction client's SHA plan sits on top: it coordinates safety between everyone on site.

In practice that means you still risk-assess your own work operations and report your own deviations through your HSE system, while at the same time following the shared rules, the schedule and the measures set out in the SHA plan. The construction client and the coordinator tie it all together, so that ten subcontractors aren't working to ten conflicting safety regimes.

For a fuller introduction to HSE work itself, see What is HSE, and why does it matter so much in the construction industry?.

Common slip-ups at inspections

  • Using the SHA plan as your HSE — or the other way round. They cover different levels; you need both.
  • Only documenting points 1–3. Remember that the Internal Control Regulations require written documentation of points 4 to 8.
  • An SHA plan that isn't updated. If conditions on site change, the plan should follow — not sit untouched from the start.
  • Subcontractors who never get to see the SHA plan. The construction client has a duty to make the contents known to everyone on site.

A digital system makes both easier: in ABAX Field Operations, risk assessments, checklists and deviations sit in one app, so the HSE documentation is traceable and ready — whether the inspector asks for the business's internal control or the project's SHA. Start free or book a short demo.

Frequently asked questions

Does a small trades business need both an HSE plan and an SHA plan?

An HSE plan (internal control) is required of every business, from the first employee. The SHA plan is tied to the individual building or civil engineering project and is the construction client's responsibility — but you must work to it when you're on such a project.

Who draws up the SHA plan?

The construction client. They can prepare it themselves or via a coordinator, but the responsibility can't be delegated away. The plan must be ready before work starts, per section 7 of the Construction Client Regulations.

Does the HSE plan have to be in writing?

Partly. Section 5 of the Internal Control Regulations requires that at least points 4 to 8 — targets, organisation, risk assessment, deviation routines and review — be documented in writing. The scope is tailored to the business's size and risk.

Does the SHA plan replace my HSE on the project?

No. The SHA plan coordinates safety on the construction site, but you're still responsible for your own internal control. The two apply at the same time.

Summary

The HSE plan and the SHA plan solve two different jobs: the HSE plan is the business's ongoing internal control under the Internal Control Regulations, while the SHA plan is the construction client's project plan under the Construction Client Regulations. Get both in place — and keep them apart — and you'll stand firm both at inspections and out on site.

Sources