Occupational health and safety
ISO 45001: safety that works on the floor, not just in the file
The law requires a risk assessment. ISO 45001 requires something more — a working mechanism in which the people doing the job take part, hazards are found before the incident, and controls are verified. We build a system that fits your real operations.
3–6 mo.typical implementation
3 yearscertificate validity
Clause 5.4worker participation
2027next version expected
In short
What ISO 45001 is
Short answer
ISO 45001 is the international standard for an occupational health and safety management system. It sets requirements for how an organisation identifies hazards, assesses risks, applies controls in a defined hierarchy and involves workers in the process — not merely for the paperwork the law already demands.
The most common misconception is that the standard duplicates occupational safety legislation. It does not duplicate it — it builds on it. The law says what you must have. The standard says how to manage it so that it works: objectives, measurement, incident investigation and demonstrated effectiveness of controls.
What is distinctive about ISO 45001 is clause 5.4 — consultation and participation of workers. It requires the people who do the work to take part in identifying hazards and choosing controls. Auditors verify this by talking to operators, not by reading minutes. That is why systems written by a consultant alone do not survive.
Relationship with the law
ISO 45001 and statutory requirements
The standard does not replace legal requirements. It organises them into a system and adds the management layer on top.
| What the law requires | What ISO 45001 adds |
|---|---|
| Workplace risk assessment | Hierarchy of controls, review at every change, verification that the control worked |
| Instruction and training | Defined competence by role and evidence of awareness, not only a signature in a register |
| Occupational health service | Use of its data as an input to objectives and to the management review |
| Health and safety committee | Extended consultation and genuine worker participation at all levels |
| Accident investigation | Root cause analysis and measures against recurrence in similar activities |
| Emergency plans | Testing of the plan, records from drills and correction afterwards |
The practical result: a company already complying properly with safety law is roughly halfway to the certificate. What remains is the management part — objectives, measurement, audit and review.
Why it pays
What you actually get
Fewer incidents
Systematic hazard identification and the hierarchy of controls reduce the frequency of events, not only their severity.
Lower direct costs
Fewer days lost, fewer emergency replacements and better terms when negotiating insurance.
A position at inspection
A documented system demonstrates due care before the authorities and during accident investigation.
A client requirement
In construction and industry ISO 45001 is often a condition for site access or for bidding.
Lower turnover
People stay where safety is not for show. Involvement under clause 5.4 is noticed.
The social side of ESG
Safety indicators are among the most frequently requested in the social section of sustainability reports.
Applicability
Who the standard suits
The more physical the work, the more obvious the benefit. But psychosocial risk makes the standard relevant to office organisations too.
Construction
Work at height, subcontractors, temporary sites and constantly changing conditions.
Manufacturing
Machinery, lockout procedures, noise, chemical agents and manual handling.
Transport and warehousing
Moving equipment, loading operations and driver fatigue.
Services and offices
Psychosocial risk, workload and burnout — risks with real consequences.
Two frequently underestimated risks: missing lockout procedures during machine servicing, and workplace burnout, now treated as an organisational rather than a personal problem.
What the standard contains
What ISO 45001 actually requires
| Clause | What it requires | What you show at the audit |
|---|---|---|
| 4. Context | Issues, interested parties, scope including subcontractors | Context analysis, scope listing the sites |
| 5. Leadership and participation | Commitment, policy, roles and consultation with workers | Consultation records, a functioning safety committee |
| 6. Planning | Hazard identification, risk assessment, legal requirements, objectives | Risk assessment by workplace, register of requirements |
| 7. Support | Resources, competence, awareness, communication | Competence matrix, training and instruction records |
| 8. Operation | Operational control by hierarchy, change management, contractors, emergency preparedness | Work instructions, permits to work, drill records |
| 9. Evaluation | Monitoring, compliance evaluation, internal audit, review | Safety indicators, audit reports, review record |
| 10. Improvement | Incident investigation, nonconformity, corrective action | Investigations with root cause analysis |
The hierarchy of controls is not a suggestion. The order is: eliminate the hazard, substitute, engineering controls, administrative controls, personal protective equipment. A risk assessment in which every control is “PPE and instruction” is the fastest route to a finding — it shows the first four levels were never considered.
How we work
The route to the certificate
- 1
Review of the current state
We review the risk assessment, instruction records, the occupational health service arrangement and records from recent inspections.
3–5 working days - 2
Hazards and risk assessment
We walk the workplaces with the people who do the work and rebuild the assessment against the hierarchy of controls.
2–3 weeks - 3
Consultation and participation
We establish how workers take part — meetings, suggestions, feedback — and document it so it holds up in conversation with an auditor.
1–2 weeks - 4
Operational control and emergency preparedness
Instructions for hazardous activities, contractor management, emergency plans and a rehearsal against them.
3–5 weeks - 5
Training, internal audit and review
We train the team and the internal auditors, run the audit and prepare the management review.
2–3 weeks - 6
Certification audit
Selection of an accredited body, preparation and attendance during the two-stage on-site audit.
4–8 weeks to certificate
Current
The forthcoming revision
ISO 45001 is being revised. The draft has reached DIS stage and publication is expected during 2027.
The themes under discussion are worker well-being, psychosocial risk, return to work after absence and management of external providers. This does not change your plan today: existing certificates stay valid and a transition period will begin after publication.
Practical conclusion: there is no reason to delay certification because of the revision. Systems already taking psychosocial risk and worker participation seriously will pass the transition with minimal additions.
Further reading
More on the topic
Risk assessmentWhat the law requires and what ISO 45001 adds
PsychosocialWorkplace burnout: signs, causes and prevention
IntegrationIntegrated management system 9001 + 14001 + 45001
FleetISO 39001 for transport and logistics firms
ImprovementCorrective actions and root cause analysis
TrainingInternal auditor training to ISO 19011:2026
Questions and answers
Frequently asked questions
Does ISO 45001 replace occupational safety legislation?
No. Statutory health and safety requirements remain mandatory regardless of certification. ISO 45001 requires them to be identified, met and periodically verified, and adds a management layer on top — objectives, measurement, internal audit and management review.
Is our existing risk assessment enough?
Usually not, although it is a good starting point. Assessments produced purely for legal compliance often list controls of the “PPE and instruction” type without showing that higher levels of the hierarchy were considered. The standard also requires review at every change and verification that the control actually worked.
What does consultation and participation of workers mean?
Clause 5.4 requires workers at all levels to take part in identifying hazards, assessing risks and selecting controls, and to be consulted on matters that affect them. In practice this means regular meetings, a working route for suggestions and feedback on what was done about them. Auditors verify this by speaking to operators.
How long does implementation take?
For an organisation with one site the typical timeline is three to six months. The longest part is rebuilding the risk assessment together with the people on site. For construction firms with many sites and subcontractors it takes longer, because the scope includes management of external providers.
Can it be combined with ISO 9001 and ISO 14001?
Yes, and that is the most common arrangement. The three standards share a common structure, so context, leadership, competence, internal audit and management review are built once. A combined audit is shorter than three separate ones and reduces the certification body’s fee.
Should we wait for the new version?
No. ISO 45001 is being revised with publication expected in 2027, but existing certificates will stay valid and there will be a transition period. A system built now moves to the new version through additions rather than rework. Delaying only delays the benefits.
How are subcontractors handled?
Subcontractors fall within scope when they work under your control or on your site. The standard requires selection criteria, agreement of safety rules before work starts and control of compliance with them. In construction this is one of the most heavily audited areas.
Which indicators does the standard expect?
Beyond lagging indicators such as accident counts and days lost, the standard points towards leading indicators: hazards identified, controls completed on time, safety walks conducted, training participation and suggestions from workers. Leading indicators show whether the system works before an incident happens.
Start with a review of your risk assessment
It shows fastest where you stand. One conversation is usually enough to say how much work remains to certification and where the real risks are.