Since the new NR-01 came into effect, security, legal, HR and senior management managers have come to deal with two acronyms that, at first glance, seem synonymous: GRO and PGR. They are not.
And understanding this distinction has gone from being a technical detail in the Occupational Safety and Health Department (SST) to becoming a matter of corporate governance, with legal, financial, and reputational implications for medium and large companies.
In this article, you will learn how to accurately decide where the GRO ends and the PGR begins, how to structure each of them, and why this occupational risk management architecture has definitively connected with the organization's strategic agenda.
Understand!
What is GRO?
Actio’s Occupational Risk Management (GRO) (GRO) is the management model established by NR-01 for every organization with employees governed by the CLT to systematically identify hazards, assess risks, and implement controls.
It is not a document, but a management culture: it defines guidelines, responsibilities, and how work safety is integrated into the company's routine.
In practice, the GRO relies on the PDCA cycle, the same logic of continuous improvement used in quality and management systems. This cyclical structure is what allows occupational safety to be treated not as a one-off project, but as a living process, compatible with broader governance systems.
What is PGR?
Actio’s Risk Management Program (RMP) it is the administrative tool that materializes the GRO.
It consists of two mandatory documents: the risk inventory, which details the physical, chemical, biological, ergonomic, accident and psychosocial hazards, and action plan, This document establishes the prevention and control measures. All of this process only has legal validity when conducted by qualified professionals and periodically reviewed.
What is the real difference between GRO and PGR?
The difference between PGR and GRO lies in the scope: the GRO is the macro view from the management of occupational safety and health, the set of guidelines and responsibilities of the company. The PGR is just one of the instruments who put this vision into practice.
During the 2008 financial crisis, Robert Kaplan argued that the risk management It should be treated as a third pillar of value creation, alongside revenue growth and productivity, a reasoning that applies precisely to GRO and PGR.
Understanding this relationship is the starting point for knowing how to develop PGRs and GROs in a coherent manner: first, the policy and governance (GRO) are defined; then, the instrument that verifies and implements them is built (PGR). Companies that follow this logic, treating the PGR as a separate form, tend to produce documents that do not survive an audit by the Ministry of Labor and Employment (MTE).
Step-by-step guide to structuring the GRO and PGR in the company
Understanding how to develop PGR and GRO in practice requires treating the process with the same discipline as any other risk management function within the company: as a continuous cycle, not as a single delivery.
Below are the 5 steps to structure the GRO and the PGR in your organization:
Step 1: Anticipation and identification of hazards
Conduct a complete scan by sector, function, and operational activity, mapping in detail not only traditional risks (physical, chemical, biological, ergonomic, and accident-related), but also incorporating, as a must, organizational and psychosocial factors.
This initial stage requires listening to workers at the front line, analyzing reports of previous incidents, and examining every step of the work routines. In this way, it is possible to ensure that no invisible danger goes unnoticed.
Step 2: Evaluation and classification of risks
Conduct a systematic cross-referencing between the severity of potential damage and the probability of its occurrence, adopting clear, documented, and easily auditable criteria. The use of standardized risk matrices and complementary tools, such as the effort-impact matrix, is indispensable at this time to categorize the criticality level of each threat and prioritize precisely which vulnerabilities require immediate intervention from management.
Also read: BCG matrix and strategic planning
Step 3: Drafting the risk inventory
Promote formal consolidation in a single, structured and auditable document of all hazards duly identified and evaluated within the organization. This inventory should detail the levels of exposure of each group of employees, the degree of risk, the control measures already implemented, and the technical criteria used for measurement, serving as the company’s official OHS database.
Step 4: Construction of the action plan
Establish a clear definition of direct responsibilities, feasible deadlines, allocated budget, and monitoring indicators for each necessary preventive or corrective measure in the PGR.
Remember: an effective action plan must go beyond mere generic recommendations, transforming prevention guidelines into measurable operational tasks.
This with continuous follow-up and well-aligned delivery dates.
Step 5: Continuous monitoring and review of the cycle
Maintain a consistent routine of periodic reassessment of the measures implemented, verifying their practical effectiveness in day-to-day operations. But that’s not all! In addition to scheduled reviews, the GRO and PGR cycles must be reopened and updated immediately in the face of any changes in production processes, the introduction of new technologies, changes in legislation, or the occurrence of accidents and near-accidents in the company.
What does NR-01 say in the GRO and PGR about psychosocial risks?
The update promoted by MTE Ordinance No. 1,419/2024 modified Chapter 1.5 of NR-01 to include, explicitly and mandatorily, the management of Psychosocial Risk Factors Related to Work in the PGR risk inventory. This requirement, which came into effect on May 25, 2026, requires that factors such as chronic occupational stress, task overload, goals that are out of alignment with reality, excessive work hours, moral or sexual harassment, and a lack of organizational support be mapped with the same technical rigor applied to physical, chemical, or biological risks.
This regulatory change responds to a critical scenario in public health and corporate productivity. In 2025, Brazil surpassed the mark of 546 thousand allowances for accidental benefits for mental and behavioral disorders (such as depression and anxiety), representing an increase of over 15% compared to the previous year, according to data from the Social Security Institute. Given this reality, mental health and the organizational climate have ceased to be exclusively behavioral issues for HR to become formal elements of compliance.
Technology and governance: from regulatory requirement to competitive advantage
Maintaining the management of the GRO and the updating of the PGR based on manual spreadsheets and decentralized documents compromises the traceability of actions and exposes the company to serious risks of non-compliance in any audits by the MTE. After all, in addition to the operational overload on the SST, HR and Legal teams, the lack of standardization makes it difficult to identify bottlenecks and prevents senior management from monitoring key risk indicators (KRIs) in real time.
In these cases, automation through an integrated management system transforms regulatory compliance into operational efficiency and competitive advantage. Risk Management solution from Actio It was developed to unify all this ecosystem into an intuitive platform, connecting the risk inventory, the development of the action plan, the monitoring of deadlines, and the auditable evidence into a single database.
With Actio, all involved parties gain clear visibility into the status of each mapped risk, eliminating gaps and ensuring legal certainty. Prepare your company to demonstrate strong and continuous governance in any inspection. Visit our website and schedule a demonstration with our experts!
Frequently asked questions about GRO and PGR
Check out some of the most common questions on the topic below:
The PGR must be prepared and monitored under the responsibility of the organization, and must be signed by professionals legally qualified in Occupational Safety and Health (such as Occupational Safety Engineers or Occupational Physicians), depending on the complexity of the risks assessed.
Yes. The PPRA (formerly NR-09) was completely discontinued and replaced by the PGR in the scope of NR-01. And unlike the PPRA, which focused only on environmental risks (physical, chemical, and biological), the PGR has a much broader scope, covering also risks of accidents, ergonomic, and psychosocial risks.
The failure to implement the GRO/PGR or the submission of outdated documents exposes the company to fines and penalties imposed by the MTE, the closure of operations, an increase in labor liabilities, and the civil and criminal liability of managers in the event of accidents or occupational illnesses.
