ISO 45001 vs OHSAS 18001: what changed and what to do

ISO 45001:2018 replaced OHSAS 18001. OHSAS 18001 can no longer be used for certification, so a business that wants a recognised occupational health and safety certificate now works against ISO 45001.

The two standards share the same goal: fewer accidents and fewer work-related illnesses. They differ in structure, in how much responsibility sits with management and in how far the system reaches beyond your own staff. This article sets out those differences and the steps to take if you still work with OHSAS 18001.

What OHSAS 18001 was

OHSAS 18001 was an occupational health and safety assessment specification, developed by a group of national standards bodies and certification bodies. It was never an ISO standard. For many years it was the usual reference when a customer, an insurer or a purchasing department asked for proof of a working safety system.

Because it was not an ISO standard, it had its own layout and its own terms. It did not fit well with ISO 9001 or ISO 14001. A company that ran all three had to maintain separate structures and often separate documents.

Why ISO 45001 replaced it

ISO published ISO 45001 in March 2018 as the first international standard for occupational health and safety management. It was written to give one global reference instead of a national one. It also follows the high level structure that ISO uses for its management system standards, the same skeleton as ISO 9001 and ISO 14001.

A transition period of three years followed. It ended in March 2021. Certificates against OHSAS 18001 ceased to be valid after that, and the standard itself was withdrawn.

The main differences

Structure

ISO 45001 uses the ten clauses of the high level structure: 4 Context of the organization, 5 Leadership, 6 Planning, 7 Support, 8 Operation, 9 Performance evaluation and 10 Improvement. OHSAS 18001 had a different order, built around policy, planning, implementation, checking and management review.

If you already run an ISO 9001 or ISO 14001 system, ISO 45001 will feel familiar. Management review, internal audit and corrective action can be shared across the standards instead of being kept three times.

Context of the organization

OHSAS 18001 started with the policy. ISO 45001 starts with clause 4: you must understand your organisation, its surroundings and the needs of interested parties. For a small business, interested parties are the people and bodies that care about safety at your sites: employees, temporary staff, clients on whose premises you work, insurers, authorities.

This is a new requirement. It forces you to write down who is affected by your activities and which legal and other requirements follow from that.

Leadership and accountability

Under OHSAS 18001 the management representative carried much of the system. ISO 45001 removes that figure and puts accountability on top management. In a company with ten people, this means the owner or managing director. You can delegate tasks, but you cannot delegate responsibility.

The owner is expected to show involvement: setting the policy, providing resources, taking part in management review, and making sure that safety is part of daily business decisions.

Worker participation

Clause 5 of ISO 45001 contains a requirement on consultation and participation of workers. Employees must be involved in identifying hazards, assessing risks and investigating incidents. Non-managerial workers take part in decisions; managers do not decide alone on their behalf.

OHSAS 18001 asked for consultation as well, but with less weight. In ISO 45001 it is a core element, and an assessor will look for evidence: minutes of safety meetings, suggestions raised by staff, feedback after an incident.

Risks and opportunities

OHSAS 18001 focused on hazards and risks. ISO 45001 adds the risks and opportunities of the management system itself, in clause 6. You consider what could stop the system from working, and what could improve it. Examples are a high turnover of temporary staff, a new machine, or a planned move to larger premises.

Hierarchy of controls and change

ISO 45001 names the order in which you must reduce risk: eliminate the hazard first, then substitute, then use engineering controls, then administrative controls, and personal protective equipment last. Handing out gloves is no longer enough if the hazard could have been removed.

The standard also requires a process for managing change in clause 8. New equipment, new materials, a changed shift pattern or a new working method must be assessed before it starts.

Contractors, suppliers and outsourcing

ISO 45001 reaches further than your payroll. You must control how procurement, contractors and outsourced processes affect safety. If a subcontractor works on your site, or your staff work on a client's site, you need to coordinate the risks. OHSAS 18001 covered contractors only in a limited way.

Documentation

OHSAS 18001 spoke of documents and records. ISO 45001 uses the term documented information and does not prescribe a fixed set of procedures. You keep what you need to run the system and to show that it works. For a small company this often means a shorter document set than before.

Overview

What this means if you still have an OHSAS 18001 certificate

A certificate issued against OHSAS 18001 is no longer valid. If a customer questionnaire still lists it, or your own website mentions it, the reference is out of date and can cost you credibility in a tender.

Your existing work is not wasted. Hazard registers, risk assessments, incident logs, training records and emergency plans carry over. What is missing is usually the context analysis, the evidence of worker participation, the contractor controls and the link to top management. Closing those gaps is a matter of weeks for a small business, not of a new project from zero.

The smaller your company, the lighter the system can be. The guide on ISO certification for small and medium businesses explains how to scale a management system to ten or fifty people without building an apparatus you will not maintain.

Checklist: moving from OHSAS 18001 to ISO 45001

• Write down your organisation, its activities and its sites (clause 4)
• List interested parties and their safety expectations: staff, temporary workers, clients, insurers, authorities
• Identify the legal safety requirements that apply to your trade
• Name the owner or managing director as accountable for the system and record this in the policy
• Review the OH&S policy and have top management sign it
• Set up a way for employees to take part in hazard identification and incident review, and keep minutes
• Update the hazard register and apply the hierarchy of controls to each significant risk
• Define how changes in equipment, materials or work methods are assessed before they start
• Include contractors, suppliers and temporary staff in your risk assessment
• Check emergency plans and run a drill
• Plan an internal audit and a management review
• Replace OHSAS 18001 references in quotes, tender documents and on your website

Do you need an on-site audit?

The classic route with an on-site audit by a certification body is still how many large organisations certify. For a small business, it brings travel days, audit fees and scheduling effort. Some customers or public tenders ask for exactly that route, and in that case you should follow what the customer specifies.

Other customers only want a verifiable certificate against the current standard. If that is your situation, the article on ISO certification without an audit explains how an online self-assessment works and where it fits.

How Zertify fits in

Zertify issues certificates against ISO 45001:2018 based on an online self-assessment. There is no on-site audit. You answer the questions about your safety management system, and a member of the SICE Certification Board reviews every assessment before the certificate is issued. The certificate is issued by G6 Agency AG under licence from SICE.

After a passed assessment and payment, the certificate arrives within 4 hours. The PDF carries a QR code that leads to a public verification page, so a purchasing department or a customer auditor can check it without contacting you.

The certificate is valid for three years and is confirmed every year with a short online re-audit, which is a yearly subscription. The pricing page shows the current conditions. When your documents are ready, you can start the assessment.

A practical tip: run through the checklist above first. The questions follow the structure of ISO 45001, so the work you do on context, participation and contractor control is the work the assessment asks about.

Which one should you reference today?

Only ISO 45001. OHSAS 18001 is withdrawn, and no body can issue a valid certificate against it. If you hold an old certificate, treat it as history and move to the current standard. If you never held one, there is no reason to look back at it.