ISO 45001

ISO 45001 is the international standard for managing occupational health and safety. It replaced OHSAS 18001, which was withdrawn in 2021, and it is now the only recognised international standard in this area.

It applies to any organisation with workers, and its scope is broader than employees alone: contractors, agency staff, visitors and anyone else who could be affected by your activities fall within it.

Certification is often driven commercially. Health and safety certification appears regularly in construction, manufacturing, facilities and logistics tenders, and holding it shortens pre-qualification questionnaires considerably. But the standard is unusual among ISO standards in that failure has consequences beyond a lost contract.

Health and safety law, and where the standard sits

ISO 45001 is not a substitute for compliance with the Health and Safety at Work etc. Act 1974 or the regulations made under it. Certification does not discharge your legal duties, and a certificate is not a defence.

What the standard does is require you to identify your legal requirements, using something like a legal compliance audit, evaluate compliance with them, and manage the risks systematically. Organisations that implement it properly usually find their legal compliance improves, because the discipline of evaluation surfaces gaps that had gone unnoticed.

Worker consultation and participation

This is the clause that most distinguishes ISO 45001 from what came before, and the one auditors probe hardest.

The standard requires consultation and participation of workers at all levels, and specifically requires you to remove obstacles to that participation. It also requires arrangements for workers to report hazards and incidents without fear of reprisal.

A health and safety system designed entirely by management, with no evidence that the people doing the work contributed to it, will attract a finding. This is a genuine change from OHSAS 18001, and it is the area organisations most often underestimate.

Hazards, risks and opportunities

The standard distinguishes carefully between hazards and risks. A hazard is something with the potential to cause harm. Risk is the likelihood of harm occurring and its severity.

You are required to identify hazards on an ongoing basis, including those arising from work organisation, social factors, leadership and workload. That last group is worth noting: psychosocial risk sits within ISO 45001, not outside it, and stress, fatigue and bullying are within scope.

You are also required to identify opportunities to improve health and safety performance, not merely to control what is already going wrong.

What ISO 45001 requires

The standard follows the common structure shared across ISO management system standards, so it integrates cleanly with ISO 9001 and ISO 14001.

Context and interested parties, including the needs of workers and regulators.

Leadership and worker participation. Top management accountability, an OH&S policy, assigned responsibilities and the consultation arrangements described above.

Planning. Hazard identification, risk and opportunity assessment, legal requirements, and OH&S objectives.

Support. Resources, competence, awareness, communication and documented information.

Operation. Operational controls, management of change, procurement and contractor control, and emergency preparedness and response.

Performance evaluation. Monitoring, compliance evaluation, internal audit and management review.

Improvement. Incident investigation, nonconformity, corrective action and continual improvement.

Incident investigation

ISO 45001 requires you to investigate incidents and determine their root causes, not merely record them.

This is where systems commonly fail an audit. An incident log showing "employee was careless, reminded of procedure" as the outcome demonstrates that a cause was not identified. Auditors read investigation records closely, and an accident book with no analysis behind it is a reliable source of findings.

The 2024 climate change amendment

In February 2024, ISO amended 31 management system standards including ISO 45001, requiring organisations to determine whether climate change is a relevant issue in their context. For health and safety this is less abstract than it sounds: heat stress, extreme weather affecting outdoor work and changes in workplace conditions are all legitimate considerations.

What certification involves

Certification comes from an independent certification body accredited by UKAS, not from a consultancy. Assessment runs in two stages, with Stage 1 covering documentation and readiness and Stage 2 covering implementation.

Before either, you need a completed internal audit and a documented management review.

Combining with other standards

ISO 45001 is usually held alongside ISO 9001, ISO 14001 or both, and they share around two thirds of their requirements. An integrated system gives you one document set, one internal audit programme, one management review and generally one combined certification audit, which reduces both effort and certification body fees.