What is ISO 45001?

Where ISO 45001 comes from

ISO 45001:2018 was published by the International Organization for Standardization in 2018. It replaced OHSAS 18001, the specification that many organizations had used for years, and gave occupational health and safety its own ISO management system standard.

It follows the same High Level Structure (Annex SL) as ISO 9001 and ISO 14001. That shared clause order and vocabulary is what lets an organization run quality, environmental and safety management as one joined-up system rather than three separate ones.

What is an OH&S management system?

An OH&S management system is the set of policies, responsibilities, processes and records an organization uses to prevent work-related injury and ill health. It covers how hazards are identified, how risks are assessed and controlled, how emergencies are handled and how incidents are investigated.

The system has to fit the organization. A software company's main risks (ergonomics, stress, fire, travel) differ from a factory's (machinery, chemicals, noise), so the standard sets requirements for the system, not a fixed list of controls.

Why businesses use ISO 45001

For most organizations the first driver is duty of care: people should go home safe. The practical drivers follow from that. These benefits depend on a system that is actually used; a certificate alone does not make a workplace safe.

• Fewer incidents, and less time lost to injury, sickness and rework
• Clearer evidence of legal compliance when regulators, insurers or customers ask
• Customer and tender requirements: some buyers expect certified safety management from suppliers and contractors
• Stronger worker trust, because the standard requires workers to be consulted and to take part
• One integrated approach alongside ISO 9001 and ISO 14001

The structure: clauses 4 to 10

The certifiable requirements sit in clauses 4 to 10. Clauses 1 to 3 cover scope, references and terms.

The clauses work as a Plan-Do-Check-Act cycle: plan the system, run it, check how it performs, and act on what you find.

• Clause 4, Context of the organization: understand internal and external issues, the needs of workers and other interested parties, and define the scope of the system
• Clause 5, Leadership and worker participation: top management owns the system, sets the OH&S policy, assigns roles, and makes sure workers are consulted and can take part
• Clause 6, Planning: identify hazards, assess OH&S risks and opportunities, determine legal and other requirements, and set objectives
• Clause 7, Support: resources, competence, awareness, communication and controlled documented information
• Clause 8, Operation: operational controls, management of change, procurement and contractors, and emergency preparedness and response
• Clause 9, Performance evaluation: monitoring, measurement, evaluation of legal compliance, internal audit and management review
• Clause 10, Improvement: incidents, nonconformities, corrective action and continual improvement

What makes ISO 45001 different

Several features set it apart from other management system standards.

• Worker consultation and participation is a stated requirement, including non-managerial workers, not just a management duty
• Hazard identification is explicit: the organization has to look at routine and non-routine activities, people, equipment and changes
• The hierarchy of controls applies: eliminate the hazard first, then substitute, engineer, use administrative controls, and rely on personal protective equipment last
• Contractors, outsourced work and visitors fall inside the system when they affect safety
• Leadership must be visible and accountable, not delegated entirely to a safety officer

How to implement ISO 45001 in a small or growing business

Start from how work really happens, not from templates. A practical sequence is:

• Get management commitment and agree the scope
• Identify applicable legal and other requirements
• Walk the workplace with workers, list hazards, then assess the risks
• Set the OH&S policy and measurable objectives
• Put operational controls, emergency plans and training in place
• Run the system and keep records of what happens
• Investigate incidents, hold an internal audit and a management review
• Fix what the audit finds, then book the certification audit if you want it

Which documents and records matter?

ISO 45001 uses the term documented information. The standard names items an organization must maintain or retain, including the scope of the system, the OH&S policy, the processes for hazard identification and risk assessment, legal requirements, objectives, evidence of competence, monitoring and measurement results, evaluation of legal compliance, the internal audit programme and results, management review results, and incident, nonconformity and corrective action records.

Beyond that, include only what your people need to work safely. Confirm the exact list against the current edition of the standard and any amendments before you finalize your set.

What does ISO 45001 certification mean?

An accredited certification body assesses whether your OH&S management system meets the standard within a defined scope. The initial assessment normally has two stages: a documentation and readiness review, then an on-site or remote audit of how the system works in practice. Surveillance audits follow, and the certificate is renewed through recertification.

Certification covers the management system, not every workplace outcome. ISO itself does not issue certificates. Cost and time depend on headcount, number of sites, risk level of the work and how mature your existing practices are.

Individual training and auditor qualifications

Individuals can also build ISO 45001 competence. Awareness and implementation courses help people who will run the system, internal auditor courses suit staff who audit their own organization, and lead auditor courses are for people who want to conduct audits professionally. Choose accredited or recognized providers and match the course to the role.

How ComplyEncrypt helps with ISO 45001

ISO 45001 is on the ComplyEncrypt pathway and is currently listed as coming soon. ComplyEncrypt is built to bring OH&S documentation, hazard and risk records, legal-requirements registers, internal-audit preparation and corrective-action tracking into an AI-assisted workflow, so your team organizes the work around its real processes rather than a folder of disconnected templates.

AI assistance applies to documentation work. People still walk the workplace, consult workers, judge risk, run emergency drills and implement corrective actions, and certification remains the decision of an accredited body. See the ISO 45001 framework page for current availability.