ISO 45001 Health and Safety Management Support

ISO 45001 specifies requirements for an occupational health and safety management system. It can be used by organisations of different sizes and sectors to manage OH&S risks, improve performance, involve workers and provide a structured approach to continual improvement.

ISO 45001:2018 remains the current published edition and is supplemented by Amendment 1:2024 concerning climate-action considerations. A revised standard is under development and has reached Draft International Standard stage, but the draft is not a published certification requirement and no formal transition programme to it currently exists.

The amendment requires organisations to consider whether climate change is a relevant issue within their context and recognises that interested parties may have climate-related requirements. The significance and resulting action depend on the organisation, its activities, workforce and operating environment.

Certification is generally voluntary, but it may be required by a customer, tender, framework, contract or supply-chain arrangement. An organisation can implement ISO 45001 without seeking certification where its objective is improved health and safety management rather than an external certificate.

No. Certification may support a structured approach to managing legal requirements but does not prove that every legal duty is being met at all times. Employers remain legally responsible for controlling health and safety risks and must ensure suitable competent health and safety assistance is available in accordance with their legal duties. Certification does not transfer or remove those duties.

Workers and, where they exist, worker representatives should be consulted on relevant health and safety matters and enabled to participate in developing, implementing and improving the management system. Arrangements should reflect the workforce, work activities, risks, communication needs and any barriers to effective participation.

The system requires a planned method for identifying hazards, assessing OH&S risks and opportunities and selecting suitable controls. Risk reduction should follow the hierarchy of controls, prioritising elimination and more effective control measures before relying on administrative controls or personal protective equipment.

The organisation must establish proportionate controls for procurement, contractors and outsourced activities where they affect its occupational health and safety performance. The controls depend on the work, risk, contractual arrangements and degree of control or influence available.

Yes. Existing policies, risk assessments, procedures, registers and records are reviewed first and retained where suitable. ISO 45001 can also be integrated with ISO 9001 or ISO 14001 through shared arrangements for leadership, documented information, competence, audit, management review and corrective action while retaining the requirements specific to occupational health and safety.

Internal audits assess whether the occupational health and safety management system conforms to planned arrangements and applicable ISO 45001 requirements and whether it is operating effectively. Management review is senior management’s formal evaluation of OH&S performance, incidents, worker consultation and participation, legal compliance, objectives, audit results, organisational changes, risks and opportunities and improvement needs.

Timescales depend on the organisation’s size, locations, hazards, risk profile, operational complexity, available resources, existing controls and required certification date. Morgan Compliance Group can help identify gaps, implement proportionate arrangements and prepare for assessment but cannot guarantee certification.

Where recognised accredited certification is required, the certification body should hold suitable UKAS accreditation for ISO 45001 and the relevant technical scope, or equivalent recognised accreditation. Following certification, the organisation must continue operating, auditing, reviewing and improving its system and will normally undergo surveillance and later recertification audits.