ISO 45001: ISO 45001 – Tutorial (about 60 minutes)

ISO 45001 is the international standard that sets out the requirements for an occupational health and safety (OH&S) management system: an organised, repeatable way for an organisation to prevent people from being hurt or made ill by their work, and to keep improving its safety and health performance. Factories, construction firms, hospitals, logistics companies, software houses and public bodies all use it, whatever their size. After this tutorial you will be able to explain what ISO 45001 asks for, how its clauses fit together, how hazards and risks are handled in practice, how certification works, and where the standard is heading with its next revision.

Free tutorial · about 60 minutes · 7 lessons · 5 diagrams · then a 25-question knowledge check and a certificate.

Course overview

Edition and status: The current published edition is ISO 45001:2018, Occupational health and safety management systems — Requirements with guidance for use, the first edition, published in March 2018 and developed by ISO project committee ISO/PC 283 (today the technical committee ISO/TC 283, Occupational health and safety management). It is read together with Amendment 1:2024 (ISO 45001:2018/Amd 1:2024), which adds climate change to the issues an organisation considers when it analyses its context. ISO lists the 2018 edition as "to be revised": the draft of the second edition (ISO/DIS 45001) went to a 12-week Draft International Standard ballot among ISO national members that opened on 16 June 2026 and was due to close in early September 2026. Publication of the new edition is expected in 2027 (certification bodies variously report mid-2027 or the second half of 2027), but that is a target, not a fixed date, and no transition period has been announced. This course teaches the 2018 edition with its 2024 amendment, and describes the reported direction of the revision without treating draft text as final. Verified 2026-10-29 from ISO/TC 283 information and certification-body reports of the ISO project record (DNV, LRQA, Nemko).

Who this is for: engineers, site and operations managers, supervisors, HR and facilities staff, quality and compliance professionals, safety representatives, and anyone who has heard "we are going for ISO 45001" and wants to know what that will mean for daily work. It is also useful for people who will be interviewed by an auditor and want to understand what the auditor is looking for.

Prerequisites: none. Experience of any workplace, whether an office, a warehouse or a construction site, is enough. Every specialist term is explained when it first appears. Note that ISO 45001 does not replace your country's health and safety law; it is a management framework that helps you meet that law and go beyond it.

By the end of this tutorial:

You will be able to explain the purpose and intended outcomes of ISO 45001 and how it differs from health and safety legislation and from technical safety rules.
You will be able to use the core vocabulary correctly, including worker, hazard, OH&S risk, incident, consultation and participation.
You will be able to describe the ten-clause structure of ISO 45001 and what clauses 4 to 10 expect, mapped to the Plan-Do-Check-Act cycle.
You will be able to apply hazard identification, risk assessment and the hierarchy of controls to a real work situation.
You will be able to outline how certification audits, surveillance and recertification work, and who is allowed to certify.
You will be able to recognise common implementation mistakes and the practices that make an OH&S management system effective.
You will be able to place ISO 45001 alongside related standards and guidelines such as ISO 9001, ISO 14001, ISO 45003 and the ILO guidelines.

Lesson 1 – Origins, purpose and scope

Why a management system for health and safety?

Every year, very large numbers of people around the world are killed, injured or made ill by their work. Many of these harms come not from rare, unforeseeable events, but from familiar hazards that were known, written about and then poorly controlled: a guard removed from a machine to speed up production, a forklift route that crosses a pedestrian walkway, a night shift that is chronically understaffed, a contractor sent into a confined space without a permit. Rules and inspections alone rarely fix these problems for good, because the root causes sit in how work is planned, resourced, supervised and reviewed. That is where a management system helps.

A management system is a set of connected policies, processes, roles and records that an organisation uses to achieve its objectives. In a health and safety management system, the objective is to provide safe and healthy workplaces, prevent work-related injury and ill health, and continually improve performance. ISO 45001 does not tell you how high a guard rail must be or what the exposure limit for a solvent is; those details come from law, technical standards and manufacturers. Instead it tells you what an organisation must have in place so that it reliably finds its hazards, decides what to do about them, involves its workers, checks that its controls work and learns from failures.

From national schemes to an international standard

Before ISO 45001 there was no single international management system standard for occupational health and safety. In the 1990s the British Standards Institution published guidance such as BS 8800, and in 1999 a consortium of certification bodies and standards organisations published OHSAS 18001, a requirements specification that became the most widely certified OH&S scheme in the world. OHSAS 18001 was revised in 2007, but it was never an ISO standard, and many countries had their own variants. In parallel, the International Labour Organization (ILO), the UN agency for the world of work, published its guidelines on occupational safety and health management systems (ILO-OSH 2001).

ISO set up project committee ISO/PC 283 in 2013 to write a true international standard. Drafting took several years; an early draft did not gain enough votes, and a second draft was refined into the final text. ISO 45001 was published in March 2018. It drew on OHSAS 18001 and the ILO guidelines but rewrote the requirements using the common framework that ISO uses for all its management system standards. Organisations certified to OHSAS 18001 had three years to migrate (extended by a few months during the COVID-19 pandemic), and OHSAS 18001 was withdrawn in 2021.

Figure 1 – How ISO 45001 grew out of earlier national and international schemes and where its revision stands.

Purpose and intended outcomes

The standard states its purpose in terms of outcomes rather than paperwork. In summary, an OH&S management system that conforms to ISO 45001 is meant to help an organisation:

continually improve its OH&S performance;
fulfil its legal requirements and the other requirements it has chosen to adopt;
achieve its OH&S objectives.

Behind these sits a broader aim: preventing work-related injury and ill health, and providing safe and healthy workplaces. The standard also stresses that the organisation is responsible for the health and safety of its workers and of other people its activities can affect, such as visitors, contractors and members of the public near a site.

Scope: who can use it

ISO 45001 is written to be usable by any organisation, regardless of size, type, sector or activity. A ten-person design studio and a multinational mining company can both conform; what changes is the scale and complexity of the system, not the requirements. The organisation decides the scope of its system (which sites, activities and people it covers), but it cannot quietly leave out a high-risk activity just to make certification easier.

The standard is also explicit about what it does not do. It does not set specific performance criteria (for example, a maximum accident rate), and it does not prescribe how the system must be designed or documented. It does not deal with product safety, property damage or environmental impacts beyond their effect on workers and other relevant people. And it is fully voluntary: an organisation can use it as a framework without ever seeking a certificate.

Why organisations adopt it

Typical motives include reducing injuries and absence, meeting legal duties more reliably, satisfying customers and tender requirements that ask for a recognised system, lowering insurance and incident costs, and integrating health and safety with existing quality and environmental systems. The strongest motive, and the one that makes the system work, is a genuine leadership decision that nobody should be harmed by their work. When certification is the only motive, the result is often a thick binder that changes nothing on the shop floor.

Lesson 2 – Key concepts and vocabulary

ISO 45001 uses ordinary-sounding words with precise meanings. Misunderstanding them is one of the most common causes of weak systems, so it is worth learning them carefully. The definitions below are paraphrased explanations, not the standard's wording.

Worker – anyone who carries out work or work-related activities under the organisation's control. This includes top management, managers and non-managerial staff, and it can include agency workers, temporary staff and some contractors' personnel, depending on the degree of control.
Non-managerial worker – a worker who does not have management responsibilities. ISO 45001 gives these people a specific voice through consultation and participation, because they usually know the hazards best.
Workplace – any place under the organisation's control where a person needs to be or go for work. A client's site, a vehicle, a home office or a temporary roadside location can all be workplaces.
Hazard – a source with the potential to cause injury or ill health. Examples: a moving forklift, a wet floor, silica dust, a heavy load, long working hours, workplace bullying.
OH&S risk – the combination of how likely a work-related hazardous event or exposure is and how severe the resulting injury or ill health could be. A hazard is the thing; the risk is the chance and seriousness of harm from it.
Risk (general) – the effect of uncertainty. ISO 45001 distinguishes OH&S risks (harm to people) from other risks to the management system itself, such as losing a key safety adviser or a budget cut that delays training.
OH&S opportunity – a circumstance that can lead to better OH&S performance, for example a planned factory refit that can be used to design out manual handling.
Injury and ill health – adverse effects on a person's physical, mental or cognitive condition. Ill health includes occupational disease, illness and death. Mental health counts.
Incident – an occurrence arising out of or in the course of work that could, or does, result in injury and ill health. An incident with harm is often called an accident; one without harm but with potential for it is often called a near miss or close call.
Consultation – seeking workers' views before a decision is made. The decision stays with management, but it must be informed by what workers say.
Participation – involving workers in decision-making itself, for example in hazard identification, incident investigation or choosing controls.
Legal requirements and other requirements – the laws and regulations the organisation must comply with, plus commitments it chooses to adopt, such as collective agreements, customer requirements or industry codes.
Contractor – an external organisation providing services to the organisation according to agreed terms. Contractors' workers often face the highest risks, so they are covered explicitly.
Outsource – to make an arrangement where an external organisation performs part of the organisation's function or process. Responsibility for health and safety in that process is not outsourced.
Top management – the person or group who directs and controls the organisation at the highest level. ISO 45001 places overall responsibility and accountability for preventing work-related injury and ill health on this group.
Documented information – information the organisation must control and maintain, and the medium that holds it. It covers both what used to be called documents (procedures, plans) and records (evidence of what happened).
Nonconformity and corrective action – a nonconformity is a failure to meet a requirement; corrective action removes the cause so it does not happen again. A correction only deals with the immediate case.
Interested party – a person or organisation that can affect, be affected by, or perceive itself to be affected by a decision or activity, such as workers, unions, regulators, neighbours, insurers or customers.

Three ideas that run through the whole standard

Prevention first. The standard is built around stopping harm before it happens, not just reacting to injuries. That is why hazard identification is proactive and ongoing, and why near misses and unsafe conditions matter as much as actual accidents.

Worker involvement. ISO 45001 goes further than most management system standards in requiring the organisation to consult non-managerial workers and let them participate in key activities. It also expects the organisation to remove obstacles to participation, such as language barriers, fear of reprisal, lack of time or poor feedback, and to protect workers who report hazards or incidents.

Risk-based thinking with a fixed order of controls. Like other ISO management standards, ISO 45001 asks the organisation to identify risks and opportunities and plan actions. Uniquely, it then insists on a preferred order of control measures, the hierarchy of controls, covered in Lesson 4.

Lesson 3 – Structure of the standard

The Harmonized Structure

ISO 45001 follows the common framework that ISO uses for management system standards, originally set out in Annex SL of the ISO directives and now called the Harmonized Structure (formerly the High Level Structure). This framework gives every management system standard the same ten clause titles and much of the same core text. Because ISO 9001 (quality) and ISO 14001 (environment) use the same frame, an organisation can run one integrated management system with a single policy set, one internal audit programme and one management review, while still meeting each standard's specific requirements.

Clauses 1 to 3 are introductory: scope, normative references (ISO 45001 has none) and terms and definitions. Clauses 4 to 10 contain the requirements. Annex A gives guidance on how to interpret and apply them; it is informative, which means it helps you understand the requirements but does not add new ones.

Clauses 4 to 10 at a glance

Clause	Title	What it expects, in plain terms
4	Context of the organization	Understand internal and external issues (including, since the 2024 amendment, whether climate change is relevant), the needs of workers and other interested parties, define the scope of the system and establish the system itself.
5	Leadership and worker participation	Top management takes accountability, sets the OH&S policy, assigns roles and authorities, builds a supportive culture, and makes sure workers are consulted and participate.
6	Planning	Identify hazards, assess OH&S risks and opportunities and other risks to the system, determine legal and other requirements, plan actions, and set OH&S objectives with plans to achieve them.
7	Support	Provide resources, ensure competence and awareness, organise internal and external communication, and control documented information.
8	Operation	Plan and control operational processes, eliminate hazards and reduce risks using the hierarchy of controls, manage change, control procurement, contractors and outsourcing, and prepare for emergencies.
9	Performance evaluation	Monitor and measure performance, evaluate compliance with legal and other requirements, run internal audits and hold management reviews.
10	Improvement	Handle incidents and nonconformities, investigate causes, take corrective action and continually improve the system and its results.

What is distinctive compared with other ISO management standards

Most of the frame is shared, but several sub-clauses exist only in ISO 45001 or carry a much stronger OH&S flavour:

Clause 5.4 on consultation and participation of workers lists the topics on which non-managerial workers must be consulted (for example, determining interested parties' needs, the policy, legal requirements, objectives and controls for contractors and outsourcing) and the activities in which they must participate (for example, hazard identification, risk assessment, deciding on controls, competence needs and incident investigation).
Clause 6.1.2 on hazard identification and assessment of risks and opportunities is detailed: it expects hazard identification to cover routine and non-routine work, how work is organised, social factors such as workload and harassment, past incidents, emergencies, people in and around the workplace, and changes.
Clause 6.1.3 requires the organisation to determine its legal requirements and other requirements and how they apply.
Clause 8.1.2 requires the hierarchy of controls when eliminating hazards and reducing risks.
Clause 8.1.3 requires management of change for planned changes, both temporary and permanent, that affect OH&S performance.
Clause 8.1.4 covers procurement, including contractors and outsourced functions.
Clause 8.2 covers emergency preparedness and response, including planned response, training and periodic testing.
Clause 9.1.2 requires a formal evaluation of compliance with legal and other requirements.
Clause 10.2 combines incidents with nonconformities, so that near misses, injuries and system failures all feed the same learning process.

The PDCA engine

The clauses map onto the Plan-Do-Check-Act (PDCA) cycle, a simple improvement loop. Context and planning set direction (Plan), support and operation put plans into practice (Do), performance evaluation finds out whether it worked (Check), and improvement acts on what was learned (Act). Leadership and worker participation sit at the centre because they drive every stage.

Figure 2 – Clauses 4 to 10 of ISO 45001 arranged around the Plan-Do-Check-Act cycle, with leadership and worker participation driving every stage.

Lesson 4 – How it works in practice

Reading the clauses tells you what is required; this lesson explains how organisations actually make it work. The heart of ISO 45001 is a continuous loop: find hazards, judge the risks, choose controls in the right order, put them in place, check them, and learn when something goes wrong.

Step 1: understand the context and the people

The organisation starts by looking outwards and inwards. External issues include the legal framework, the labour market, technology, industry practice and, since 2024, climate-related factors such as heat stress for outdoor workers or flooding risks at sites. Internal issues include culture, structure, shift patterns, the age and condition of equipment and the use of contractors and agency staff. It then identifies interested parties, workers first, and what they need and expect, and decides which of these needs become requirements. These inputs define the scope of the system.

Step 2: leadership commitment and policy

Top management must show that it owns OH&S performance. In practice this means writing and signing a policy that commits to safe and healthy working conditions, to fulfilling legal and other requirements, to eliminating hazards and reducing risks, to continual improvement and to consulting and involving workers. It also means providing resources, assigning clear roles (who owns risk assessments, who can stop work, who investigates incidents) and building a culture where people report problems without fear. A policy that nobody below the board has read is a warning sign; a manager who visibly supports a worker who stopped an unsafe job is real evidence.

Step 3: identify hazards and assess risks

Hazard identification is the foundation. Good organisations use several methods together: task-based risk assessments, workplace inspections, job safety analysis for specific tasks, review of incident and absence data, occupational health surveillance, and simply asking the people who do the work. Hazards come from physical sources (machinery, vehicles, heights, electricity), chemical and biological agents, ergonomic factors (lifting, repetitive movements, posture) and psychosocial factors (workload, working hours, lone working, harassment, violence).

Each hazard is then assessed for risk. ISO 45001 does not prescribe a method; many organisations use a likelihood-by-severity matrix, others use qualitative ratings or more detailed quantitative methods for major hazards. What matters is that the method is defined, applied consistently, proactive rather than purely reactive, and reviewed when things change. The organisation also assesses other risks and opportunities for the management system itself, such as the risk that a merger disrupts safety roles, or the opportunity to share good practice between sites.

Step 4: legal and other requirements

The organisation must know which laws, regulations, permits and codes apply to its activities and how they apply, keep that knowledge up to date, and use it when planning. A common practice is a legal register that lists each requirement, where it applies, who owns it and how compliance is shown. ISO 45001 does not replace legal duties; an organisation can be certified and still be prosecuted if it breaks the law, and an auditor who sees a clear legal breach will raise it.

Step 5: choose controls using the hierarchy

The hierarchy of controls is the single most important practical idea in ISO 45001. It ranks control measures from most to least effective. The organisation is expected to work down the list, using the higher levels wherever they are reasonably practicable, and to combine levels where needed.

Figure 3 – The hierarchy of controls used in ISO 45001: work from the top, because higher levels protect people without depending on their behaviour.

Elimination removes the hazard altogether: doing work at ground level instead of at height, or stopping the use of a hazardous chemical.
Substitution replaces something hazardous with something less hazardous: a water-based paint instead of a solvent-based one, a lighter packaging format.
Engineering controls and reorganisation of work isolate people from the hazard or redesign the work: machine guards, local exhaust ventilation, physical barriers between pedestrians and vehicles, or reorganising shifts to reduce fatigue.
Administrative controls change how people work: procedures, permits to work, signage, rotation, supervision and training.
Personal protective equipment (PPE) protects the individual: gloves, hearing protection, respirators, harnesses. PPE is the last line of defence because it only works if it fits, is maintained and is worn correctly every time.

A classic weak response to a risk is to jump straight to training and PPE because they are quick and cheap. Auditors look for evidence that higher levels were considered first.

Step 6: objectives, competence and communication

OH&S objectives turn the policy into measurable targets, such as "complete pedestrian segregation in all three warehouses by June" or "reduce manual lifting above 20 kg on the packing line". Each objective needs an owner, resources, a deadline and a way to measure it. Support processes then make the plans workable: competence (people know how to do their job safely, including supervisors and those doing risk assessments), awareness (people know the policy, the hazards relevant to them, and that they can remove themselves from situations they reasonably believe present an imminent and serious danger), and communication (what is communicated, to whom, when and how, including to contractors and visitors).

Step 7: operational control, change, contractors and emergencies

Operational control means the agreed controls are actually built into daily work: maintenance schedules, permit-to-work systems, safe operating procedures, traffic management plans. Management of change makes sure that new equipment, new processes, new sites, reorganisations and even temporary changes are assessed before they happen. Procurement controls make sure that what the organisation buys, such as chemicals, machines, and services, does not bring new uncontrolled hazards, and that contractors are selected, briefed, coordinated and monitored. Emergency preparedness means planning for fires, chemical releases, medical emergencies or severe weather, training people, and testing the plans through drills.

Step 8: monitor, audit, review and improve

Monitoring uses a mix of indicators. Lagging indicators count harm after it happens, such as injury rates or lost days. Leading indicators measure the activities that prevent harm, such as inspections completed, actions closed on time, near misses reported or training delivered. A healthy system watches both. The organisation also evaluates its legal compliance, runs internal audits by competent and objective auditors, and holds management reviews in which top management looks at performance, incidents, audit results, worker consultation and changes, and decides on actions.

When an incident or nonconformity occurs, the organisation reacts promptly, investigates with the participation of workers, finds the root causes, takes corrective action following the hierarchy of controls, reviews existing risk assessments and checks whether the action worked. Figure 4 shows this loop.

Figure 4 – The everyday OH&S risk-management loop: hazards are identified with workers, controlled in priority order, monitored, and fed back into new hazard identification after every incident or review.

Documented information: how much paper?

ISO 45001 requires documented information in specific places, such as the scope, the policy, the risks and opportunities and how they are handled, the legal requirements, the objectives, evidence of competence, operational processes as needed, emergency plans, monitoring and compliance results, the audit programme, management review results, and incidents with their corrective actions. Beyond that, the organisation decides what it needs. There is no requirement for a safety manual. Organisations can use whatever tools suit them, from a shared drive to a dedicated safety software platform, as long as information is identified, approved, available where needed, protected and kept current.

Lesson 5 – Assessment, certification and compliance

Conformity versus certification

Conformity means meeting the requirements of ISO 45001. Certification means an independent body has audited the system and confirmed conformity. An organisation can conform without being certified, and some deliberately choose that route, using the standard as a framework and perhaps seeking second-party audits from major customers. Others make a self-declaration of conformity, sometimes confirmed by an external party. Certification is the most common route when customers, tenders, insurers or parent companies want independent evidence.

Who certifies

ISO writes standards; it does not audit organisations or issue certificates. Certificates are issued by certification bodies. For a certificate to be widely trusted, the certification body should be accredited by a national accreditation body that is a signatory to the International Accreditation Forum (IAF) multilateral recognition arrangement. Accreditation bodies assess certification bodies against ISO/IEC 17021-1, the general requirements for bodies that audit and certify management systems, supplemented by ISO/IEC TS 17021-10, which sets out the competence needed to audit and certify OH&S management systems, and by IAF mandatory guidance on how ISO/IEC 17021-1 applies to OH&S certification. Unaccredited certificates exist, but many customers and public buyers do not accept them.

The certification cycle

Preparation – the organisation implements its system and runs it long enough to produce evidence: at least one cycle of internal audits and a management review is normally expected before certification.
Stage 1 audit – the certification body reviews the documented system, the scope, the hazard and risk process, legal requirements and readiness, often including a site visit. It identifies areas of concern that could become findings at stage 2.
Stage 2 audit – an on-site evaluation of whether the system is implemented and effective. Auditors observe work, look at controls, review records, and interview top management, supervisors, workers and their representatives, and people responsible for legal compliance.
Findings and decision – a major nonconformity (for example, a requirement not implemented at all, or a failure that casts serious doubt on the system's effectiveness) must be corrected and verified before certification. Minor nonconformities need an accepted action plan. Opportunities for improvement are suggestions only.
Surveillance – audits at least once a year confirm that the system is maintained and improving.
Recertification – a fuller audit before the certificate expires, normally on a three-year cycle.

Figure 5 – The life of an accredited ISO 45001 certificate, from first audits through yearly surveillance to three-yearly recertification.

What a certificate does and does not prove

A certificate shows that, at the time of the audits, a competent independent body found a management system that met ISO 45001 and was working. It does not guarantee that no accidents will happen, that the organisation complies with every law, or that its performance is better than a non-certified competitor's. Serious incidents at certified sites happen, and certification bodies are expected to react when they become aware of them, for example by conducting a special audit. That is why customers increasingly ask for performance data alongside the certificate.

Transition to the next edition

When the revised ISO 45001 is published, certified organisations will need to move to it within a transition period set through the IAF. As of the verification date, no period has been announced. Certification bodies expect a three-year transition, similar to the approach reported for the 2026 revisions of ISO 9001 and ISO 14001, but that is an expectation, not a rule yet. Organisations certified to the 2018 edition remain validly certified in the meantime and should keep conforming to the 2024 climate amendment.

Reported themes in the draft include stronger attention to worker well-being and occupational health, psychosocial risk, return to work after injury or ill health, workforce diversity (including gender-related health and safety needs), modern ways of working such as hybrid and digital work, and tighter control of externally provided products and services. Because drafts can change before publication, treat these as signals of direction rather than requirements.

Lesson 6 – Worked example

This lesson follows a fictional but realistic organisation through its first ISO 45001 implementation to show how the pieces fit together.

The organisation

Harbourline Distribution operates two warehouses and a fleet of 40 delivery vans. It has about 320 workers: 210 permanent employees, around 70 agency workers during peak season, and contractors for racking inspection, cleaning and forklift maintenance. Its largest retail customer has told Harbourline that from next year all logistics suppliers must hold accredited ISO 45001 certification. Last year Harbourline recorded 14 lost-time injuries, mostly from manual handling and two forklift-pedestrian collisions, and several near misses that were discussed informally but never recorded.

Step 1: context and scope

The operations director forms a small steering group with the HR manager, a warehouse supervisor, a van driver and an elected safety representative. They list external issues (national health and safety law, road traffic rules for drivers, tight labour market, customer requirements, more frequent summer heatwaves in the warehouses) and internal issues (high agency turnover, older racking at one site, no near-miss reporting, supervisors promoted without safety training). Because of the 2024 amendment, they explicitly record climate change as relevant: heat in the upper mezzanine and van cabs is a real hazard. The scope covers both warehouses, the van fleet and all workers under Harbourline's control, including agency staff.

Step 2: leadership and participation

The managing director signs a short policy written with the steering group, then presents it at every shift briefing herself. She sets up a joint health and safety committee with elected worker representatives from each site and the drivers, gives them paid time for meetings, and announces that anyone who stops a job because they believe it is dangerous will be backed. Translation of key materials into the three most common languages among agency staff removes a barrier to participation.

Step 3: hazards, risks and legal requirements

Supervisors and workers walk every area together with a simple checklist, review the last three years of injury and first-aid records, and interview drivers about road risks. They identify the top hazards: forklifts operating near pedestrians, lifting heavy cartons from floor level, falls from mezzanine edges during picking, driver fatigue and time pressure on delivery routes, heat in summer, and verbal abuse of drivers by some customers' staff. Each is rated on a five-by-five likelihood-severity matrix. The HR manager builds a legal register listing the applicable workplace, vehicle, manual handling and working-time regulations, with owners for each.

Step 4: controls in the right order

For forklift-pedestrian conflict, the first instinct is to retrain staff and issue high-visibility vests. The safety committee pushes back and works through the hierarchy instead. Elimination: move the staff entrance so pedestrians no longer cross the loading yard. Engineering: install fixed barriers and dedicated walkways inside, and proximity warning systems on trucks. Administrative: one-way traffic routes, speed limits and supervision at shift change. PPE: high-visibility clothing stays, but as the last layer. For manual handling, the team redesigns the pick faces so heavy items sit between knee and shoulder height (reorganising the work), introduces lift-assist trolleys, and only then delivers handling training. For heat, they add ventilation and shaded break areas, adjust start times in heatwaves and provide water stations.

Step 5: objectives and support

Harbourline sets four objectives for the year: complete pedestrian segregation at both sites by the end of the second quarter; cut manual-handling injuries by half; get near-miss reporting going with at least one report per worker per quarter and feedback on each within two weeks; and train every supervisor in risk assessment and incident investigation. Agency workers receive the same site induction as employees, and the agency contract now requires that their workers have attended it before they start.

Step 6: contractors, change and emergencies

The racking inspection contractor must now provide method statements and evidence of competence, attend a site induction, and work under a permit when racking is unloaded. A planned conveyor installation goes through management of change: the project team and workers assess how it will alter traffic routes and noise before the contract is signed. Fire drills are held every six months at each site, and a heat emergency plan is tested before summer.

Step 7: check and act

After six months, leading indicators show 180 near-miss reports, most closed within two weeks, and segregation complete at one site. An internal audit by a trained supervisor from the other site finds that contractors' permits are not always closed out at shift end, a minor nonconformity. A forklift clips a racking upright with no injury; the investigation, which includes the driver and the safety representative, finds that a temporary pallet storage area narrowed an aisle without any change assessment. The corrective action removes the temporary storage, adds aisle-width checks to the weekly inspection and adds temporary layout changes to the management-of-change procedure. Management review reviews results, worker feedback from the committee and the audit report, and allocates budget for the second site's barriers.

Step 8: certification

Harbourline engages an accredited certification body. Stage 1 confirms readiness but notes that the legal register does not yet cover the van fleet's working-time rules. This is fixed before stage 2. During stage 2 the auditors spend more than half their time on the warehouse floor and in the yard, interview drivers, agency workers and the safety committee, and trace two incidents from report to corrective action. They raise one minor nonconformity about contractor permit close-out (already being addressed) and recommend certification. Harbourline's lost-time injuries fall noticeably in the following year, but the managing director is clear in her message to staff that the certificate is a milestone, not the goal.

What the example teaches

Worker participation shaped the most effective controls; management alone would have chosen training and vests.
The hierarchy of controls drove investment towards elimination and engineering, which protect people even when they are tired or rushed.
Agency workers and contractors were brought fully into the system rather than treated as someone else's problem.
Leading indicators and near-miss reporting revealed weaknesses before they caused injuries.
Management of change applied to small, temporary changes as well as big projects.

Lesson 7 – Relationship to other standards and frameworks

ISO 45001 sits within a family of standards and guidelines. Knowing the neighbours helps you avoid duplication and use the right tool for each job.

Standard or framework	What it covers	Relationship to ISO 45001
ISO 9001	Quality management systems: consistently meeting customer and legal requirements.	Same Harmonized Structure, so policy, audits, document control and management review can be shared in an integrated system.
ISO 14001	Environmental management systems: managing environmental aspects and compliance obligations.	Same structure and a similar approach to legal compliance and emergency preparedness; many organisations run combined health, safety and environment (HSE) systems.
ISO 45002	Guidance on implementing ISO 45001 (published 2023).	Not certifiable; explains each requirement in more depth with practical examples.
ISO 45003	Guidelines for managing psychosocial risks and psychological health and safety at work (published 2021).	Not certifiable; helps an organisation handle stress, workload, harassment and similar hazards within its ISO 45001 system.
OHSAS 18001	The earlier OH&S management system specification (1999, revised 2007).	Predecessor; withdrawn in 2021 after organisations migrated to ISO 45001.
ILO-OSH 2001	ILO guidelines on occupational safety and health management systems.	A tripartite framework from governments, employers and workers; influenced ISO 45001's emphasis on worker participation. Not a certification standard.
ISO 31000	General guidelines for risk management.	Useful background for designing risk processes; ISO 45001 adds OH&S-specific requirements such as the hierarchy of controls.
ISO/IEC 17021-1 and ISO/IEC TS 17021-10	Requirements for certification bodies and competence for OH&S management system auditing.	Govern how ISO 45001 certification audits are performed; they apply to certification bodies, not to the certified organisation.

National law and regulators

National and regional health and safety law always takes priority. In many jurisdictions the law already requires risk assessment, worker consultation and competent advice; ISO 45001 provides a structured way to meet those duties and show it. Some regulators publish their own management models, for example the UK Health and Safety Executive's guidance on managing for health and safety, which uses a Plan-Do-Check-Act approach compatible with ISO 45001. Certification does not change an organisation's legal duties or exempt it from inspection.

Integrated management systems

Because ISO 9001, ISO 14001 and ISO 45001 share their structure, many organisations build one integrated system. Shared elements typically include the context analysis, the policy framework, document control, competence management, internal audit and management review. Specific elements stay separate where they need to: hazard identification and the hierarchy of controls for safety, aspects and impacts for the environment, and product conformity for quality. Integration reduces duplicated effort and reflects the reality that the same processes create quality, environmental and safety outcomes at once. The risk is that safety gets diluted into generic business risk; keep worker participation and OH&S hazard analysis visible.

Specialised and sector schemes

Some industries layer sector schemes on top of ISO 45001, for example contractor pre-qualification schemes in construction or process safety requirements for major-hazard sites. These address risks, such as large-scale explosions or toxic releases, that need more specific technical controls than a general management system standard provides. ISO 45001 offers the management framework into which those technical controls fit.

Common pitfalls and best practices

Pitfalls

Certificate-first thinking. Treating certification as the goal produces impressive binders and unchanged working conditions. Auditors and workers both notice the gap.
Training and PPE as the default answer. Skipping the upper levels of the hierarchy of controls leaves people exposed whenever they are tired, rushed or new.
Consultation in name only. Inviting workers to a meeting after decisions are made, or only consulting supervisors, does not meet the intent of worker participation.
Ignoring contractors and agency workers. These groups often face the highest risks and the least induction; leaving them outside the system is a frequent cause of serious incidents.
Counting only injuries. Low injury rates can hide under-reporting and serious latent hazards; lagging indicators alone give false comfort.
Static risk assessments. Assessments written once and never revisited after changes, incidents or new information become fiction.
Blame-focused investigations. Stopping at "worker did not follow procedure" misses the design, supervision and pressure that made the error likely.
Neglecting health. Focusing only on visible safety hazards while ignoring noise, dust, fatigue and psychosocial risks leaves long-term ill health unmanaged.

Best practices

Start from the work, not the clauses. Walk the workplace with the people who do the job, map the real hazards, and then check which requirements this already satisfies.
Make leadership visible. Leaders who do safety walks, ask open questions and back people who stop unsafe work shape culture more than any policy.
Use a balanced set of indicators. Combine lagging measures with leading ones such as near-miss reports, inspection follow-up and action close-out times.
Close the feedback loop. Tell people what happened to their reports and suggestions; nothing kills reporting faster than silence.
Apply management of change to everything. Include temporary layouts, staffing changes and new software, not just big capital projects.
Treat contractors as part of the team. Select on competence, induct, coordinate work and monitor performance, and include them in incident learning.
Investigate for learning. Use structured root-cause methods, involve workers, and look at system factors such as design, workload and supervision.
Integrate sensibly. Share processes with quality and environmental systems where it helps, while keeping OH&S hazard analysis and worker participation distinct and visible.

Summary and key takeaways

ISO 45001 is the international requirements standard for OH&S management systems; the current edition is ISO 45001:2018 with Amendment 1:2024, and a revised edition, now at draft (DIS) stage, is expected in 2027.
Its purpose is to prevent work-related injury and ill health and provide safe and healthy workplaces, through continual improvement, legal compliance and objectives.
It follows the Harmonized Structure (clauses 4 to 10) and the Plan-Do-Check-Act cycle, which makes integration with ISO 9001 and ISO 14001 straightforward.
Worker consultation and participation, especially of non-managerial workers, is a defining feature, and top management holds overall accountability.
Hazard identification is proactive and broad, covering physical, chemical, biological, ergonomic and psychosocial hazards, routine and non-routine work, and changes.
Controls must follow the hierarchy: elimination, substitution, engineering and work reorganisation, administrative controls, then PPE.
Certification is voluntary, performed by accredited certification bodies through stage 1 and stage 2 audits, yearly surveillance and three-yearly recertification; ISO itself certifies no one.
A certificate is evidence of a working system, not a guarantee of zero harm or full legal compliance.

Reflection questions

Think of a workplace you know. Which three hazards there would you rank highest, and which level of the hierarchy of controls is currently used for each? What would moving one level higher look like?
How could non-managerial workers in your organisation be involved in hazard identification and incident investigation in a way that is genuine rather than symbolic? What obstacles would you need to remove first?
Which leading indicators would give your management team early warning that the system is weakening, and how would you prevent them from becoming box-ticking targets?
Your organisation relies heavily on contractors or agency staff. How would you make sure they are protected by your OH&S management system as fully as permanent employees?
If your organisation already runs ISO 9001 or ISO 14001, which processes would you share with an ISO 45001 system and which would you keep separate, and why?