Updated RMP 2026: psychosocial risks in practice

Executive TL;DR

The Risk Management Program (RMP) is the instrument where the company systematically demonstrates how it identifies, assesses, and controls occupational risks — now including psychosocial factors in the same framework as Occupational Risk Management (ORO) under NR-1. In 2026, mid-size and large companies must go beyond attaching a climate report: the RMP must show how the inventory was built, which homogeneous exposure groups were considered, which severity and probability criteria were adopted, and how measure effectiveness is verified over time. This article describes a typical enterprise architecture and where ACSMT supports integrated compliance across safety engineering, occupational medicine, and operations (contact).

Q&A (snippet): An RMP updated for 2026 must include psychosocial risks in the inventory with explicit assessment criteria, an action plan with owners and deadlines, integration with NR-1 ORO, and evidence of periodic review; otherwise, the company risks having a formally existing document that is technically fragile under inspection or labor due diligence.

Table of contents

1. RMP and ORO: what is a document and what is a system
2. Document architecture in economic groups
3. Inventory: psychosocial exposures and HEG
4. Risk matrix and acceptability criteria
5. Action plan: hierarchy and effectiveness verification
6. Integration with PCMSO, ergonomics, and compliance
7. Errors that fail internal audits
8. FAQ
9. References

RMP and ORO: what is a document and what is a system

Operational definition: in the NR-1 context, ORO is the continuous process of managing occupational risks; the RMP is the documented program that materializes that process in company reality. When people speak of “updating the RMP,” correct work usually implies reviewing policy, organization, identification methods, assessment criteria, controls, monitoring, and review — not merely attaching a new PDF to the same process as before.

In enterprise operations, the RMP usually exists at three levels: corporate (guidelines and risk taxonomy), branch/site (local inventory and plan), and projects/construction sites (when applicable). Without coherence across levels, inconsistencies easily appear: risk mapped at one site and ignored at another with a similar process, or corporate controls that never reach the floor.

For complementary reading on the regulatory basis of psychosocial factors in ORO, see the NR-1 enterprise guide.

Document architecture in economic groups

Definition: in an economic group, OHS governance must balance standardization (for audit and culture) and local fit (CNAE, process, third parties, regional culture). The minimum set usually includes: corporate ORO manual, RMP review procedure, SESMT/HR/operations role matrix, versioned change log, and internal audit calendar.

Table: RMP maturity signals at enterprise scale

Indicator	Fragile	Mature
Inventory	Generic list	HEG + evidence sources
Criteria	Subjective without scale	Defined and calibrated scale
Measures	“Train leaders”	Work redesign + follow-up
Review	Occasional	Dated, with triggers (process change, incident)
Evidence	Static PDF	Trail with versions and minutes

Inventory: psychosocial exposures and HEG

Homogeneous Exposure Group (HEG) is, in principle, a set of workers exposed to agents and situations with similar risk. In enterprise practice, the psychosocial challenge is avoiding HEGs “invented” only to simplify spreadsheets. A mature approach combines role, work hours, goals, shift, work modality, relationship with third parties, and exposure to violence or pressure — always with documented criteria.

Quantitative and qualitative instruments can coexist: a well-designed questionnaire does not replace observation and interview in critical areas. LGPD requires minimal collection design and clear purpose; this is not “extra bureaucracy,” it is a condition of data credibility.

Risk matrix and acceptability criteria

The matrix must be explicit: severity and probability scales, definition of what is “acceptable” for the organization, and how that relates to risk tolerance. Mature companies also explain how they treat low-probability, high-severity risks (rare events with systemic impact), common in organizational crises or violence.

Without this, the RMP becomes a checklist of “high/medium/low” without decision lock — and internal audit cannot reproduce the reasoning.

Action plan: hierarchy and effectiveness verification

Psychosocial measures require correct reading of the control hierarchy: eliminate or reduce at source (work organization) before patching with training. For each measure, the plan must include: owner, deadline, effectiveness indicator, verification date, and escalation if it fails.

In ACSMT compliance projects, work usually includes follow-up cadence with operational indicators (not just “satisfaction”), always respecting PCMSO limits on clinical interpretation.

Integration with PCMSO, ergonomics, and compliance

The RMP does not “replace” PCMSO or ergonomics reports (NR-17): it connects. Absenteeism, turnover, and ergonomic complaints can feed the psychosocial inventory, but health diagnosis remains medical competence. Ergonomists and safety engineers consolidate physical and organizational exposures.

For integration with events and data consistency in digital OHS, we also link the article eSocial OHS 2026: S-2210, S-2220, and S-2240 in the series.

Errors that fail internal audits

1. Generic RMP copied from another segment without proof of fit.
2. Phantom owners (roles without operational authority).
3. Review without triggers — the document ages while operations change.
4. Productivity goals in commercial silo without SESMT counterbalance.
5. Critical third parties outside the psychosocial risk inventory.

Reading by segment (logistics, industry, intensive services)

In logistics, a robust RMP usually captures SLA goals, seasonal headcount variation, external yard violence, and checking pressure — factors that change exposure even without a “role” change. In continuous industry, line pace, fixed versus rotating shift, and outsourced maintenance model change the exposure map. In services with commercial goals, psychosocial risk is often linked to commissioning, public ranking, and short-term metric supervision. The RMP must reflect where revenue drives: not to question strategy, but to show the risk was recognized and mitigated within work engineering.

Role of internal audit and “second line of defense”

Companies with good corporate governance treat the RMP as a confirmation point for the second line of defense (risk/compliance), not only the first (operations). This means sampling evidence: dated meeting minutes, decision emails, work orders changing method, effectiveness verification records. When the second line finds a “gap,” escalation must be formal: non-conformity record, corrective plan, and deadline. This behavior separates an RMP “for filing” from an RMP “for external audit.”

Relationship with other management system “people” elements

If the company has or aspires to ISO 45001, the RMP is a natural point where the standard connects with performance, worker consultation and participation, and OHS indicators. Although NR-1 and ISO are not identical documents, contradicting a risk record and a corporate objective without a documented bridge is a recipe for audit findings (certification or internal). When planning psychosocial controls, aligning RMP review cadence with the management cycle (plan-do-check-act) avoids two different clocks in the same economic group.

Mini-guide: annual review that “closes” the cycle

A useful RMP review does not start with “update appendix.” The typical enterprise script includes: (1) validation of organizational changes since the last version (M&A, restructuring, critical third-party change, layout change); (2) reconciliation with incidents, near-misses, and complaint channels; (3) comparing indicators with action plan goals; (4) recording decisions and distributing numbered version; (5) training site focal points. Repeated discipline transforms the RMP into a governance instrument, not a sporadic project. Also document who participated in the review and which trainings were updated — this closes the cycle for auditors who ask not only “what changed,” but “how the change was operationalized.” To consolidate initial regulatory reading, return to the NR-1 guide with enterprise focus and validate whether psychosocial risk criteria are mirrored in your matrix model and board approval flow.

FAQ

Must the RMP be a single document?

Not necessarily. In large companies, policy + manual + RMP per site is common, provided there is version governance and criteria consistency.

Who approves the RMP?

Structure varies, but the organization must make explicit who signs, with what authority level, and how often it is reviewed.

Does a climate survey replace risk assessment?

Not as sole evidence. It can contribute, provided methodology and sampling support the inventory.

What is the difference between risk and discomfort?

Risk, in ORO, must be treated with defined criteria; “discomfort” without structure becomes opinion. That is why criteria and sources matter.

How to integrate complaints and ethics channel?

As a data source and as an administrative control in the action plan, always respecting investigation and privacy.

Is digital RMP valid?

Valid as a record system, not as a method substitute. Platform without method becomes an electronic PDF archive.

Conclusion

A “2026-ready” RMP is one that proves process, decision, and outcome — with psychosocial integrated without rhetoric. In parallel, maintaining an evidence map (evidence → owner → date) speeds audit response and integration with digital EHS systems — without confusing software with method. ACSMT supports companies in turning guidelines into auditable documentation, with a trail between operations and SESMT. To move forward, request a technical conversation at /contato and an RMP maturity review.

References

1. Brazil. Ministry of Labor and Employment. NR-1 (Consolidation and amendments in force). Consult: gov.br — official text.
2. Brazil. MTP Ordinance No. 1.419 of August 27, 2024 — amends NR-1 provisions (consult DOU).
3. International Labour Organization (ILO). Documents on risk management and prevention. https://www.ilo.org
4. European Agency for Safety and Health at Work (EU-OSHA). Resources on risk assessment and management. https://osha.europa.eu
5. ABNT. Management system standards and associated vocabularies (consult collection in force at publication date). https://www.abntcatalogo.com.br
6. SciELO — use systematic reviews and national studies on psychosocial risks and assessment instruments, with full bibliographic citation chosen by the company's technical board (avoid generic citation without target article).