ISO 45001 explained | DSQA Consultants

What ISO 45001 is

ISO 45001 sets out what an occupational health and safety (OH&S) management system needs so that an organisation can provide safe and healthy workplaces, prevent work-related injury and ill health and keep improving its OH&S performance.

Edition status

ISO 45001:2018 replaced the British standard OHSAS 18001 as the international OH&S management system standard.
The 2024 amendment asks organisations to consider whether climate change is a relevant issue for their context and interested parties.
ISO's standard page says a revision is planned for publication as ISO 45001:2027. Until a new edition is published, ISO 45001:2018 remains the current standard. We'll update this guide when it changes.

Clause-by-clause summary

Like other ISO management system standards, ISO 45001 follows the Harmonized Structure. Clauses 1 to 3 cover scope, references and terms. The requirements are in clauses 4 to 10, summarised below in our own words.

4 Context of the organization

Understand the issues that affect your OH&S results, the needs of workers and other interested parties, and the scope of the system.

5 Leadership

Top management takes overall responsibility for preventing harm, sets an OH&S policy, assigns roles and makes sure workers are consulted and can take part in decisions.

6 Planning

Identify hazards, assess OH&S risks and opportunities, identify legal and other requirements, and plan actions and objectives to deal with them.

7 Support

Provide resources, make sure people are competent and aware of hazards and their right to remove themselves from danger, communicate clearly and control your documented information.

8 Operation

Remove hazards and reduce risks using the hierarchy of controls, manage change, control procurement and contractors, and prepare for emergencies.

9 Performance evaluation

Monitor and measure OH&S performance, evaluate compliance with legal and other requirements, run internal audits and hold management reviews.

10 Improvement

Investigate incidents and nonconformities, act on their causes and keep improving OH&S performance.

Documented information you'll usually need

The standard expects you to keep certain information documented (maintained) or as records (retained). This is our summary of what's commonly expected. Check it against your own copy of the standard, and add anything else your organisation needs to run the system well.

Scope of the OH&S management system
OH&S policy
Roles, responsibilities and authorities
OH&S risks and opportunities, and the processes and actions for them
Methods and criteria for assessing OH&S risks
Legal and other requirements
OH&S objectives and plans to achieve them
Evidence of competence
Evidence of communication, where appropriate
Information needed to be confident that processes ran as planned
Emergency preparedness and response processes and plans
Monitoring, measurement, analysis and performance evaluation results
Maintenance, calibration or verification of measuring equipment
Results of evaluating compliance
Internal audit programme and audit results
Results of management reviews
Incidents, nonconformities, the actions taken and their results
Evidence of continual improvement

How certification works

Certification is optional. If you want it, an independent certification body audits your management system and decides whether to issue a certificate. In the UK, check that the certification body holds UKAS accreditation for ISO 45001.

DSQA Consultants isn't a certification body and doesn't issue certificates. Our toolkits and virtual support help you prepare for certification.

ISO 45001:2018 explained