ISO 45001 is the international standard that sets requirements for an occupational health and safety (OH&S) management system. Published by the International Organization for Standardization in 2018, ISO 45001 gives organizations of any size or industry a framework to prevent work-related injury and ill health and to improve safety performance over time.
It does not tell you which hazards to control or what injury rate to hit. Instead, it defines how a well-run safety program should be planned, operated, measured, and improved, and it can be certified by an independent auditor.
What Is ISO 45001?
The official title is ISO 45001:2018, Occupational health and safety management systems: Requirements with guidance for use. According to ISO, the standard specifies requirements for an OH&S management system so organizations can provide safe and healthy workplaces by preventing work-related injury and ill health and by proactively improving OH&S performance.
A few points from the standard's scope are worth knowing:
- It applies to any organization, regardless of size, type, or activities.
- It does not state specific OH&S performance criteria or prescribe how the management system must be designed.
- It does not address product safety, property damage, or environmental impacts beyond the risks they create for workers and other relevant interested parties.
- It can be used in whole or in part, but a claim of conformity requires all requirements to be fulfilled without exclusion.
ISO 45001 replaced the British-origin OHSAS 18001 specification. When it was published, ISO announced that organizations certified to OHSAS 18001 would have three years to migrate. In 2024, ISO issued Amendment 1 (ISO 45001:2018/Amd 1:2024), which adds climate change to the issues an organization must consider when determining its context. ISO is also developing a second edition of the standard, so check iso.org for its current status.
Why ISO 45001 Matters
ISO cited International Labour Organization figures when it launched the standard, noting that the ILO estimated about 2.78 million work-related deaths each year. ISO 45001 was designed to give organizations worldwide a common, structured way to reduce that toll.
For individual employers, the practical benefits include:
- A consistent safety program across multiple sites or countries.
- Clear leadership accountability and documented worker participation.
- A system that catches problems through audits and reviews instead of waiting for injuries.
- Credibility with customers and contractors who require or prefer certified suppliers.
- Easier integration with ISO 9001 (quality) and ISO 14001 (environmental), which share the same high-level structure.
The Structure of ISO 45001
ISO 45001 follows ISO's common structure for management system standards and the Plan-Do-Check-Act (PDCA) cycle. Clauses 1 to 3 cover scope, references, and definitions. The requirements sit in clauses 4 to 10:
- Clause 4, Context of the organization: internal and external issues, the needs of workers and other interested parties, and the scope of the system.
- Clause 5, Leadership and worker participation: top management commitment, the OH&S policy, roles, and consultation and participation of workers.
- Clause 6, Planning: hazard identification, assessment of risks and opportunities, legal and other requirements, and OH&S objectives.
- Clause 7, Support: resources, competence, awareness, communication, and documented information.
- Clause 8, Operation: operational planning and control, eliminating hazards and reducing risks, management of change, procurement, contractors, and emergency preparedness.
- Clause 9, Performance evaluation: monitoring and measurement, compliance evaluation, internal audit, and management review.
- Clause 10, Improvement: incidents, nonconformities, corrective action, and continual improvement.
Key Requirements of ISO 45001
Leadership and Worker Participation
Top management must take overall responsibility for preventing work-related injury and ill health. ISO 45001 also places strong emphasis on consulting non-managerial workers, including on hazard identification, determining controls, and investigating incidents.
Hazard Identification and Risk Assessment
Organizations need ongoing, proactive processes to identify hazards and evaluate OH&S risks. This includes routine and non-routine activities, contractors and visitors, and human factors. A documented risk assessment process is the foundation for most of the standard.
Hierarchy of Controls
Clause 8.1.2 requires organizations to eliminate hazards and reduce risks using the hierarchy of controls: elimination, substitution, engineering controls and reorganization of work, administrative controls including training, and personal protective equipment.
Management of Change
Clause 8.1.3 requires a process for planned temporary and permanent changes that affect OH&S performance, such as new equipment, processes, or legal requirements. A formal management of change procedure is the usual way to meet it.
Performance Evaluation and Improvement
Organizations must monitor and measure performance, conduct internal audits at planned intervals, and hold management reviews. When incidents or nonconformities occur, they must investigate, determine root causes, and take corrective action, then check that it worked.
ISO 45001 vs. OHSAS 18001 and OSHA Compliance
Compared with OHSAS 18001, ISO 45001 adds the context of the organization, stronger leadership requirements, more emphasis on worker participation, and a focus on risks and opportunities rather than only hazards.
ISO 45001 is also not a substitute for regulatory compliance. In the United States, OSHA standards are law, and ISO 45001 is voluntary. The two work together: ISO 45001 requires you to identify and meet your legal requirements, and the management system makes it more likely that OSHA obligations are met consistently.
How to Implement ISO 45001
- Secure leadership commitment. Assign a sponsor, budget, and timeline, and agree on the scope (sites, activities, workers).
- Run a gap analysis. Compare current practices against each clause to find what is missing.
- Define context and policy. Document internal and external issues, interested parties, and an OH&S policy signed by top management.
- Build core processes. Set up hazard identification, risk assessment, legal register, objectives, training, and document control.
- Implement operational controls. Apply the hierarchy of controls, contractor management, change management, and emergency preparedness.
- Involve workers. Create a safety committee or similar channel and document consultation.
- Measure and audit. Track objectives and run a full internal audit cycle.
- Hold a management review and close the actions it generates.
- Pursue certification if desired, through an accredited third-party certification body.
ISO 45001 Certification
ISO develops standards but does not certify organizations. Certification is performed by independent certification bodies, ideally ones accredited by a recognized accreditation body. A typical process includes a stage 1 readiness review, a stage 2 certification audit, annual surveillance audits, and a recertification audit every three years. Certification is optional: an organization can follow ISO 45001 without being certified.
Common Mistakes to Avoid
- Treating it as paperwork. Auditors look for evidence that processes work on the floor, not just binders of procedures.
- Leaving it to the safety manager. The standard explicitly requires top management leadership and worker participation.
- Weak objectives. Objectives should be measurable and monitored, not vague statements.
- Ignoring contractors. Contractors and outsourced processes are within scope where they affect your OH&S risks.
- Not closing actions. Open corrective actions from audits and incidents are a frequent source of nonconformities.
How SMS360 Helps
ISO 45001 depends on connected processes and reliable records. SMS360 safety management software brings risk assessments, incident reporting, audits and inspections, corrective actions, training records, management of change, and document control into one system. Teams can assign actions with due dates and reminders, access forms on mobile devices, and review performance on dashboards, which makes it easier to show auditors how each requirement is met.
Frequently Asked Questions
Is ISO 45001 mandatory?
No. ISO 45001 is a voluntary international standard. No US federal law requires it, although some customers, government contracts, or industry programs may require suppliers to be certified. Even when it is not required, many organizations use it as a framework because it organizes legal compliance, risk management, and continual improvement into a single, auditable management system.
How long does ISO 45001 certification take?
It depends on the size of the organization and how mature its existing safety program is. Organizations with established procedures, risk assessments, and audits often move faster, while those starting from scratch need more time to build processes and generate records. Certification bodies generally want to see the system operating, including internal audits and a management review, before the stage 2 audit.
What is the difference between ISO 45001 and a safety management system?
A safety management system is the general concept of managing safety through policies, processes, and continual improvement. ISO 45001 is a specific international standard that defines requirements for that system. An organization can have a safety management system without following ISO 45001, but ISO 45001 provides a recognized, certifiable benchmark.
Does ISO 45001 replace OSHA requirements?
No. ISO 45001 does not replace OSHA standards or any other law. It requires organizations to identify their legal requirements and evaluate compliance with them, so OSHA rules remain the minimum. The management system helps ensure those obligations are met consistently, documented properly, and reviewed when operations or regulations change.
