Build the knowledge to understand ISO 45001 requirements, strengthen workplace safety systems, and support effective OH&S management practices.
Workplace safety cannot depend only on inspections after something goes wrong. Organizations need a structured way to identify hazards, control risks, involve workers and continually improve safety performance. That structure is exactly what ISO 45001 requirements provide. Published by the International Organization for Standardization, ISO 45001:2018 is the world's leading standard for occupational health and safety management systems. This guide explains ISO 45001 requirements, Clauses 4–10, implementation, documentation, audits and certification preparation.
ISO 45001 is the international standard for occupational health and safety (OH&S) management systems. It gives organizations of any size or industry a structured way to identify hazards, manage OH&S risks and improve safety performance over time.
The standard applies across sectors - from construction sites to hospitals - and is built on the Plan-Do-Check-Act (PDCA) cycle. ISO identifies leadership, worker participation, hazard identification, risk assessment, regulatory compliance, emergency planning, auditing and continual improvement as key elements of an effective OH&S management system (ISO 45001:2018 standard).
Which ISO 45001 Version Applies in 2026? As of August 2026, ISO 45001:2018 remains the current published edition. ISO has also published Amendment 1:2024, addressing climate-action considerations, while ISO/DIS 45001 - a proposed second edition - is still under development and has not replaced the 2018 standard.
ISO 45001 requirements are organized into Clauses 4 through 10, covering context, leadership, planning, support, operation, performance evaluation and improvement. Together, these clauses form a continual-improvement cycle rather than a one-time checklist.
|
Clause |
Focus |
|
4 |
Context of the organization |
|
5 |
Leadership and worker participation |
|
6 |
Planning |
|
7 |
Support |
|
8 |
Operation |
|
9 |
Performance evaluation |
|
10 |
Improvement |
Clause 4 requires an organization to understand itself, its stakeholders and the environment its OH&S management system operates in. A construction company, for example, must consider workers, subcontractors, clients, regulators and site-specific conditions when defining its scope. This clause also covers identifying internal and external issues, along with the needs and expectations of interested parties.
This clause centers on leadership commitment, a documented OH&S policy, clear responsibilities, and genuine worker consultation and participation. Management cannot simply delegate the entire system to the HSE department — top management must demonstrate visible ownership. This mirrors OSHA's emphasis on management leadership and worker participation as pillars of effective safety programs.
Clause 6 is where ISO 45001 risk assessment and ISO 45001 hazard identification take shape. Organizations must identify hazards, assess OH&S risks and opportunities, determine applicable legal and other requirements, and set measurable ISO 45001 objectives with action plans to achieve them.
A practical example: in a warehouse, forklift movements are identified as a hazard, the collision risk is assessed, controls such as pedestrian barriers and speed limits are introduced, and their effectiveness is monitored over time. OSHA similarly places systematic hazard identification and assessment at the center of preventive safety management.
Clause 7 covers the resources an OH&S management system needs to function: competence, awareness, communication and documented information. This is where organizations often ask, what documentation does ISO 45001 require? The honest answer is that the standard specifies certain documented information as mandatory, while organizations must also generate the evidence needed to demonstrate their own system is working - avoid treating a generic internet checklist as an official "mandatory documents" list.
Clause 8 is the practical "doing" stage: operational planning and control, eliminating hazards, reducing OH&S risks, managing change, and controlling procurement, contractors and outsourced work, alongside emergency preparedness and response. A construction contractor's onboarding process, or a machinery lockout/tagout procedure during maintenance, are typical examples of Clause 8 in action - core to ISO 45001 implementation and a genuine workplace safety management system.
Clause 9 asks organizations to monitor, measure, evaluate, audit and review their OH&S performance. An ISO 45001 internal audit asks whether the management system is both implemented and functioning as intended - not merely whether documents exist. Findings then feed into ISO 45001 management review, where top management assesses whether the system remains suitable and effective.
Clause 10 closes the loop: incidents and nonconformities are investigated, corrective actions are taken, and the system is adjusted to prevent recurrence. The narrative is simple - incident, investigate cause, correct problem, prevent recurrence, assess effectiveness, improve system - reflecting ISO 45001 continual improvement in practice.
Use this ISO 45001 requirements checklist as a quick self-assessment before deeper implementation or audit preparation:
ISO 45001 implementation typically follows this sequence: gap analysis, defining scope, securing leadership commitment, identifying hazards, assessing risks, establishing controls, training and involving workers, documenting the system, monitoring performance, auditing and improving.
Professionals who want to understand the standard before supporting implementation or audit preparation can build their foundation through the ISO 45001 Awareness & Preparation Course - self-paced training covering OH&S management systems, risk controls and certification-readiness concepts.
Implementation and certification are different - an organization can implement ISO 45001 without ever seeking third-party certification. For organizations that do pursue it, the usual journey runs: implement the system, complete an internal audit, hold a management review, choose a competent certification body, undergo external assessment, address any findings, receive a certification decision, then maintain surveillance audits and ongoing improvement.
Importantly, ISO develops the standard; it does not itself certify organizations. ISO explains that independent certification bodies conduct certification, and accreditation of those bodies can provide additional confidence in their competence (ISO guidance on certification).
No. ISO 45001 is an international voluntary management-system standard, while OSHA administers and enforces occupational safety and health requirements within the United States. Organizations can use ISO 45001's structured management practices while still needing to satisfy whatever national or local law applies to them - ISO 45001 does not replace legal compliance obligations.
OSHA's own recommended framework echoes similar principles: management leadership, worker participation, hazard identification, prevention and control, and training (OSHA Recommended Practices for Safety and Health Programs). For broader international guidance beyond any single country, the International Labour Organization's ILO-OSH framework similarly promotes systematic management and continual improvement of occupational safety and health performance.
ISO 45001 is not simply an audit checklist. Its purpose is to embed systematic hazard prevention, worker involvement, leadership accountability, performance evaluation and continual improvement into everyday operations.
Want to strengthen your understanding before supporting implementation or certification preparation? Explore the ISO 45001 Awareness & Preparation Course.
