_1762866128417-DS2_OO1j.png)
What ISO 45001 means
ISO 45001 is the international standard for occupational health and safety (OH&S) management systems. In 2018 it replaced the British standard OHSAS 18001. Its aim is to prevent work-related injury and ill health and to provide safe and healthy workplaces.
The standard follows the Harmonized Structure and therefore combines well with ISO 9001 and ISO 14001. It places particular emphasis on leadership by top management, consultation and participation of workers and a consistent approach to hazards following the hierarchy of controls.
The most important requirements
| Clause | Requirement | Typical evidence |
|---|---|---|
| 5.1 | Leadership and commitment of top management | Management review, objectives |
| 5.2 | OH&S policy | Approved policy |
| 5.4 | Consultation and participation of workers | Minutes, participation process |
| 6.1.2 | Hazard identification, assessment of risks and opportunities | Risk assessments |
| 6.1.3 | Legal and other requirements | Legal register |
| 7.2, 7.3 | Competence and awareness | Briefing records, training matrix |
| 8.1.2 | Eliminating hazards and reducing risks | Action plans following the hierarchy of controls |
| 8.2 | Emergency preparedness and response | Emergency plans, drill records |
| 10.2 | Incidents, nonconformities and corrective action | Accident and near-miss reports, CAPA |
Risk assessment at the core
Risk assessment is the central tool of occupational safety. ISO 45001 requires an ongoing, proactive process – not a one-off assessment. Routine and non-routine activities, human factors, contractors and psychosocial risks are all considered.
- 1
Define work areas and activities
Map workplaces, activities and the people involved.
- 2
Identify hazards
Systematically check mechanical, electrical, chemical, physical, biological and psychosocial hazards.
- 3
Assess risks
Estimate likelihood and severity and set priorities.
- 4
Define controls following the hierarchy
Elimination, substitution, engineering, administrative and personal protective controls – in that order.
- 5
Check effectiveness and update
Implement controls, let them take effect, review them and update the assessment.
The "Hazard identification and risk assessment" template in docxpert follows these steps and covers clauses 6.1.2 and 8.1.2.
How docxpert supports your OH&S management
Involving workers effectively
ISO 45001 distinguishes between consultation (seeking views before a decision) and participation (involvement in decision-making). Both apply especially to risk assessments, planning controls, investigating incidents and determining training needs. Barriers to participation – such as language barriers or fear of reprisals – should be removed.
- Comments and suggestions directly on operating instructions allow feedback without detours.
- Make reporting near misses easy and evaluate them consistently.
- Involve the health and safety committee and safety representatives in the management review.
Implementing ISO 45001: the typical path
- 1
Take stock
Which risk assessments, briefings, operating instructions and inspection records already exist? Often there is more than expected – but systematic control is missing.
- 2
Define policy, roles and participation
Top management adopts the OH&S policy, appoints owners and defines how workers are consulted and involved.
- 3
Capture hazards and obligations
Complete risk assessments, build the legal register and set objectives with actions.
- 4
Brief and control
Plan and record briefings, organise emergency preparedness and include contractors and procurement.
- 5
Monitor and improve
Investigate incidents, carry out internal audits and the management review. The two-stage certification audit follows.
Documented information auditors expect
- Scope, OH&S policy and OH&S objectives
- Risk assessments with risks, opportunities and controls
- Legal and other requirements and the evaluation of compliance
- Evidence of competence and briefings
- Emergency plans and drill records
- Incident investigations and corrective actions
- Results of monitoring, internal audit and management review
Practical tips
- Count near misses: they are the most valuable leading indicators and deserve the same attention as accidents.
- Keep briefings short and specific: regular short, task-related briefings beat one long annual lecture.
- Don't forget contractors: contractors on site must be included in risk assessment and briefings.
- Meaningful KPIs: besides accident figures, track leading indicators such as completed actions or briefing completion rates.
Frequently asked questions
Are psychosocial risks part of ISO 45001?
Yes. The standard explicitly mentions psychosocial factors such as workload, working hours, leadership and work culture. They should therefore be part of your risk assessment – many national laws require this anyway.
Who is responsible for OH&S management?
Overall responsibility lies with top management and cannot be delegated. Tasks such as maintaining risk assessments or organising briefings can be taken on by managers, safety professionals and safety representatives.
What is the difference between ISO 45001 and OHSAS 18001?
ISO 45001 replaced OHSAS 18001. It follows the Harmonized Structure, puts more emphasis on top management and requires worker participation and consideration of the organisation's context.
Can docxpert provide evidence of safety briefings?
docxpert records briefings with content, date, participants and confirmation – digitally as a training with quiz or as a classroom session. You define which content and intervals apply to you.
How often must a risk assessment be updated?
Whenever working conditions change, after accidents or near misses and at regular intervals you define. ISO 45001 requires an ongoing process.
Can ISO 45001 be combined with ISO 14001?
Yes. Many companies run environment and safety as a joint EHS management system. In docxpert, templates such as the legal register, operational control and emergency preparedness cover both standards.
Is there a gap analysis for ISO 45001 in docxpert?
There is currently no dedicated requirement catalogue for ISO 45001 in the automatic gap analysis. The templates do show which clauses they cover, which helps with the comparison.
How can I involve workers meaningfully in a risk assessment?
Involve the people who perform the work before deciding on controls. They often know where written instructions differ from reality, including time pressure, difficult access or near misses. Discuss tasks, equipment, shifts and particularly exposed groups together, then check observations at the workplace. Record who took part, which hazards were raised and why actions were prioritised or rejected. Give workers a way to report later when a control proves ineffective. Review the assessment after a change, incident or new evidence. Participation does not transfer responsibility to employees: managers still need to provide resources, ensure agreed actions are implemented and evaluate whether they work.