Skip to main content
    QHSEtech
    Updated
    All glossary terms
    Content date: · No individual check logged· AI use

    ISO 45001

    Definition

    An international standard specifying requirements for an occupational health and safety management system.

    Editorial definition: The QHSE Standard, updated 3 October 2026 · https://qhsetech.com/glossary/iso-45001

    Scope: Software can support records and workflows; certification concerns the management system and its defined scope.

    Example for your evaluation: Follow a worker-reported hazard through consultation, control selection and review.

    Sources checked: . Examples are editorial illustrations.

    What ISO 45001 requires

    ISO 45001:2018 (first edition, March 2018) specifies requirements for an occupational health and safety (OH&S) management system. Its introduction states the intended outcomes: preventing work-related injury and ill health to workers and providing safe and healthy workplaces. Amendment 1:2024 added climate action changes. ISO's page lists the standard at stage 90.92, to be revised, with a draft (ISO/DIS 45001) under development and the revision planned for publication as ISO 45001:2027.

    Three features set it apart from its sister standards. Clause 5 is titled leadership and worker participation, and 5.4 covers consultation and participation of workers; the standard defines consultation as seeking views before making a decision and participation as involvement in decision-making. "Worker" covers anyone performing work under the organisation's control, including workers of contractors and agency workers. And clause 10.2 handles incidents together with nonconformities and corrective action.

    Other clauses a system has to evidence include 6.1.2 hazard identification and assessment of risks and opportunities, 6.1.3 determination of legal requirements and other requirements, 8.1.2 eliminating hazards and reducing OH&S risks, 8.1.3 management of change, 8.1.4.2 contractors and 9.1.2 evaluation of compliance.

    Sources opened :

    What an ISO 45001 record holds in software

    • Hazard register entries: activity or location, hazard, who is exposed (employees, contractors, visitors), existing controls, the assessed risk and the control chosen to eliminate or reduce it, with a review date.
    • A consultation and participation log that keeps the two apart: whose views were sought, on what and when, and which decisions workers or their representatives took part in.
    • A legal and other requirements register linked to the hazards and activities it applies to, with dated compliance evaluations.
    • Incident reports that feed the same investigation and corrective-action workflow as audit nonconformities, so clause 10.2 is one process rather than two.
    • Change requests and contractor records that reference the hazards they affect.

    ISO 45001, OHSAS 18001 and ISO 45003

    ISO describes ISO 45001 as replacing the British standard OHSAS 18001, with stronger emphasis on leadership, analysis of the organisation's context and alignment with other ISO management system standards. When moving from an OHSAS 18001 system, check that the records now cover worker consultation and the context analysis. ISO 45003:2021 is a different document: its title identifies it as guidelines for managing psychosocial risks, not requirements, so a product that "supports ISO 45003" supports guidance rather than a certifiable standard.

    A hypothetical example: a worker-raised hazard, end to end

    The following case is made up to show the shape of the records and is not drawn from any organisation. A warehouse picker mentions at a team briefing that a mezzanine gate does not latch when the pallet lift is raised. The supervisor logs it the same day as a hazard report, naming the location, who is exposed (pickers, agency staff and drivers collecting orders) and the potential outcome, a fall from height.

    The safety coordinator checks the report against the hazard register, finds no existing entry for this gate, and asks the picker and a worker representative which controls they would try first. They ask for the lift to be interlocked with the gate and, until that is done, for the mezzanine to be closed to agency staff. The coordinator records that view, the control chosen, an owner and a date, and puts the interim restriction in place. Weeks later a check confirms the interlock works, the hazard entry is reviewed, and the picker is told the outcome. The auditor can later follow the thread from report to consultation to control to verification without asking anyone to reconstruct it.

    Common misunderstandings about ISO 45001

    • Being certified is not the same as having no incidents, and certification does not prove legal compliance. It is an external judgement that a defined management system, within a stated scope, meets the standard's requirements when the audit takes place.
    • A system is not just a hazard register. A register shows that hazards were listed; the standard is also concerned with leadership involvement, worker participation, operational control, performance evaluation and improvement, and a tool that stores only the list covers a part of it.
    • Consultation is not an after-the-fact notice. Telling workers what was decided is different from asking for their views before a decision, and records should be able to show which of the two happened.
    • The standard does not set exposure limits or prescribe controls for specific hazards. Those come from law, industry practice and the organisation's own risk assessment; the standard asks that the process for choosing controls is defined and followed.
    • A software product cannot be certified to ISO 45001 as such. What a certification body audits is the organisation's system, including how it uses its tools.

    How ISO 45001 relates to other glossary terms

    Several glossary terms describe processes that an ISO 45001 system relies on rather than alternatives to it.

    • Management of change: the route by which new equipment, materials or work methods are reviewed for their health and safety effects before they start.
    • Near miss: one of the event types whose investigation feeds corrective action and the review of hazards.
    • Permit to work: an operational control for specific high-risk jobs, which the system should reference rather than replace.
    • QHSE: the wider scope in which an occupational health and safety system is often run alongside quality and environment.
    • ISO 14001: the environmental sister standard, built on the same high-level structure.

    Records and evidence that usually exist for ISO 45001

    • A written policy and a defined scope, with the roles, responsibilities and authorities assigned to named people.
    • Hazard identification and risk assessment records, with dates of review and what triggered a revisit.
    • Records of how workers and their representatives were consulted and involved, kept separate from simple announcements.
    • The legal and other requirements the organisation determined applies to it, and periodic checks against them.
    • Objectives, monitoring and measurement results, and the internal audit and management review records that examine them.
    • Competence records, emergency drill records and contractor arrangements.
    • Incident, nonconformity and corrective-action records, including any check that a corrective action actually worked.

    What a software tool needs to capture for ISO 45001

    • A way to distinguish a hazard report from an incident from a risk assessment entry, and to link them, so a single concern can be traced through all three.
    • Fields for who is exposed, covering employees, agency workers, contractors and visitors, since the system's reach is wider than direct employees.
    • A consultation log with who was asked, about what, when and what changed as a result, plus a record of which decisions involved workers.
    • Review dates and reminders on hazard and risk entries, and a visible history so earlier assessments are not overwritten.
    • Links from hazards to the legal requirements, procedures, training and controls that relate to them.
    • Reports that show open actions by owner and age, so a management review can use the output rather than rebuild it.
    • An export of the audit trail that an internal or external auditor can read without needing system access.

    Catalog profiles documenting hazard and OH&S system records

    Same rule for every product: tagged “EHS Management”, “Safety Management” or “ISO Management”, with a sourced hazard, risk-assessment, investigation or corrective-action capability in its record, or one the vendor stated to us, labelled as vendor-stated. Documented and conditional capabilities qualify; check the linked scope before treating a module as included.

    Tekmon pays for a sponsored placement (above); its place in this list follows the same rule as every entry. How lists are ordered

    All 40 matching profiles are shown. Documentation review, not hands-on testing or a claim of compliance.

    Related software

    Frequently asked questions

    Does software provide ISO 45001 certification?

    No. Certification evaluates an organisation's management system within a defined scope. Software can help maintain its records and processes.

    What should a demo include?

    Use a worker-reported hazard to inspect participation, assigned controls and review evidence.

    How long does preparation take?

    Assess the starting position, scope, resources and outstanding actions. A generic implementation duration is not a commitment from a certification body.

    More standards terms

    Related guides