ISO 45001 is the international standard for Occupational Health and Safety (OH&S) management systems, and it applies to any organisation — not just heavy industry or construction. An office-based software company still has OH&S obligations (ergonomics, fire safety, mental health, emergency preparedness), and ISO 45001 gives a structured way to manage them, not just a checklist for physically hazardous workplaces.
Built on the same structure as ISO 9001 and ISO 27001
ISO 45001 follows ISO's High-Level Structure (Annex SL), the same overall clause pattern shared with ISO 9001, ISO 27001, and ISO 22301. For an organisation already running one of those, integrating an OH&S management system alongside it is meaningfully easier than building a standalone safety program from scratch.
Worker participation is a defining feature, not an afterthought
This is what genuinely distinguishes ISO 45001 from a typical top-down safety policy: it explicitly requires the participation and consultation of workers (and, where they exist, worker representatives) in developing, planning, implementing, and evaluating the OH&S management system — not just being told about decisions after the fact. Auditors specifically look for evidence that workers were actually consulted, not just that a safety committee exists on paper.
Hazard identification and risk assessment
The core ongoing process is identifying hazards — anything with the potential to cause injury or ill health — across routine and non-routine activities, and assessing the associated OH&S risk. This has to be a continuous process, not a one-time exercise: new equipment, new processes, or a changed workspace all introduce new hazards that need to be assessed as they arise.
The hierarchy of controls
Once a hazard is identified, ISO 45001 expects controls to be selected using the well-established hierarchy of controls, applied in order of preference:
- Elimination — remove the hazard entirely.
- Substitution — replace the hazard with something less dangerous.
- Engineering controls — isolate people from the hazard (guarding, ventilation, etc.).
- Administrative controls — change the way people work (procedures, signage, training, job rotation).
- Personal protective equipment (PPE) — the last line of defence, not the first.
A program that jumps straight to PPE without considering elimination or engineering controls first is a common finding in real audits — it's treating the hierarchy as a checklist rather than a genuine order of preference.
Legal and other requirements
ISO 45001 requires the organisation to determine and keep up to date with the legal and other requirements applicable to its OH&S risks — occupational health and safety legislation, industry codes of practice, and any other commitments the organisation has made. This has to feed back into how hazards are managed, not sit as a separate compliance register nobody reconciles against actual practice.
Incident investigation and continual improvement
When incidents, nonconformities, or near-misses occur, the standard requires investigating them, determining root causes, and taking corrective action to prevent recurrence — and crucially, evaluating the need for similar controls elsewhere in the organisation where the same hazard could plausibly exist, not just fixing the one instance.
Certification and ongoing maintenance
Certification follows the familiar ISO pattern: an external audit by an accredited certification body, followed by annual surveillance audits and recertification on a multi-year cycle. Between audits, the real test is whether hazard identification, worker consultation, and incident investigation are genuinely ongoing practices — a safety manual that hasn't changed since the last audit is itself a red flag.
This guide is general information, not a substitute for guidance from an accredited certification body or occupational health and safety professional — specific legal requirements vary significantly by jurisdiction and industry.
Keeping hazard records and consultations evidenced
ComplianceDesk's ISO 45001 framework gives you the standard's requirements pre-built as trackable controls, with an evidence vault for hazard assessments, worker consultation records, and incident investigations — so the evidence an auditor asks for is already organised rather than reconstructed from memory right before the audit.