Implementing ISO 45001: a practical guide to an OH&S management system

ISO 45001 specifies requirements for an occupational health and safety management system. Its purpose is to prevent work-related injury and ill health and to provide safe and healthy workplaces.

The standard was published in March 2018 and replaced the British standard OHSAS 18001. An amendment issued in 2024 additionally requires organisations to consider whether climate change is a relevant issue when analysing their context.

ISO 45001 applies regardless of sector and size. It describes what a system must achieve, not exactly how it should look, which leaves room for small businesses and multi-site groups alike.

Like other ISO management system standards, ISO 45001 follows a common high-level structure. The auditable requirements are found in clauses 4 to 10:

Clauses 0 to 3 contain the introduction, scope, normative references and definitions. They do not contain auditable requirements.

In most European countries the operational building blocks are already mandatory: risk assessment, training, equipment inspections and access to competent safety advice. The standard mainly adds management elements:

• a documented OH&S policy and measurable objectives with plans to achieve them
• a regular evaluation of whether all legal requirements are being met
• consultation and participation of non-managerial workers – explicitly including hazard identification and the choice of controls
• internal audits and a regular management review by top management
• defined processes for management of change, procurement and contractors

These management elements make the difference between a set of fulfilled duties and a system that keeps working through staff changes, growth and new sites.

1. 1

   Secure leadership and define the scope

   Top management carries overall responsibility and must visibly support the project. Decide which sites and activities the system covers and appoint a project lead with enough time.

2. 2

   Assess the starting point

   Compare the current situation with clauses 4 to 10. Operational practice is often well developed, while policy, objectives, internal audits and management review are missing.

3. 3

   Determine context and legal requirements

   Analyse internal and external factors and the expectations of interested parties – workers, authorities, insurers, customers. Build a register of applicable legislation and define how compliance is evaluated.

4. 4

   Set policy, roles and participation

   Write the OH&S policy, delegate responsibilities in writing and define how workers are consulted and involved. A safety committee is a natural forum for this.

5. 5

   Assess risks and set objectives

   Risk assessment is the core of the system. Add a review of opportunities and derive measurable objectives, such as on-time completion of actions or training coverage.

6. 6

   Control operations

   Define processes for inspections, training, operating instructions, procurement, contractors, change and emergencies. Document as much as effective control requires – no more.

7. 7

   Measure, audit and review

   Track KPIs, carry out internal audits and have top management evaluate the system in a management review. Decisions and new actions follow from it.

8. 8

   Prepare for certification

   Choose an accredited certification body. The certification audit makes sense once the system has been running for a few months and at least one internal audit and management review have taken place.

ISO 45001 does not ask for manuals and procedures but for documented information. Required items include:

• the scope of the management system
• the OH&S policy
• roles, responsibilities and authorities
• risks and opportunities and the processes used to identify and assess them – in other words, the risk assessment
• legal and other requirements
• objectives and plans to achieve them
• evidence of competence, such as qualifications and training
• results of monitoring, measurement, compliance evaluation, internal audits and management review
• incidents, nonconformities and corrective actions, including their effectiveness

Auditors and authorities expect this information to be current, retrievable and traceable. Scattered spreadsheets and paper files quickly reach their limits, especially across several sites.

1. 1

   Stage 1 audit

   Review of documentation and readiness for certification, usually on site.

2. 2

   Stage 2 audit

   Assessment of implementation through interviews, site tours and sampling.

3. 3

   Certificate

   Valid for three years, provided no major nonconformities remain open.

4. 4

   Surveillance audits

   In the first and second year after certification.

5. 5

   Recertification

   In the third year, after which a new cycle begins.

The effort depends on headcount, number of sites and the risk profile of the activities. Certification bodies determine audit duration according to binding rules from the International Accreditation Forum.

• The system is written for the auditor rather than for operations, producing documents nobody uses.
• Risk assessments are out of date and not linked to actions and training.
• Objectives are not measurable or not followed up.
• Workers are informed but not involved.
• Actions from audits and inspections are recorded but never checked for effectiveness.

An EHS platform does not replace a management system, but it makes one manageable. In EHS Go, risk assessments, training and inspection records, hazardous substances, site inspections and corrective actions share one data set. KPIs for clause 9 come out of day-to-day work, corrective actions for clause 10 are tracked with owners, deadlines and effectiveness checks, and audit evidence can be exported per site.