ISO 45001:2018
ISO 45001 requirements in plain language
ISO 45001 asks you to find hazards before they cause an accident, to involve your workers and to make health and safety a task of senior management. The requirements sit in clauses 4 to 10. This page explains each one and shows what a business typically has on file.
01: Overview
What does ISO 45001 require?
The standard has ten clauses. Clauses 1 to 3 cover scope, normative references and terms. The requirements you have to meet are in clauses 4 to 10, which follow the same structure as ISO 9001 and ISO 14001. If you already run one of those systems, the layout will look familiar.
The content is specific to occupational health and safety. You identify and assess hazards, set a policy with a commitment to prevention, consult your workers, control risks, plan for emergencies and learn from incidents. The table shows the clauses and the documents that usually prove them.
| Clause | Topic | Typically documented |
|---|---|---|
| 4 | Context | Scope of the system, list of interested parties and their requirements |
| 5 | Leadership | OH&S policy, roles and responsibilities, records of worker consultation |
| 6 | Planning | Hazard register, risk assessments, register of legal requirements, objectives |
| 7 | Support | Training records, proof of competence, communication rules, document control |
| 8 | Operation | Work instructions, change records, contractor rules, emergency plans and drill records |
| 9 | Performance evaluation | Monitoring results, internal audit report, management review minutes |
| 10 | Improvement | Incident reports, root cause analysis, corrective action log |
The standard names some documented information explicitly. For the rest, the amount depends on the size of your business and the risks of your work.
02: Clauses 4 to 6
Context, leadership and planning: clauses 4 to 6
These three clauses set the frame. They decide who is responsible, what you look at and what you plan to do about it.
- Clause 4, Context
- You describe your business, the workers and other parties affected by your work, and what they expect from you. Then you fix the scope of the management system: which sites, activities and people it covers.
- Clause 5, Leadership
- Senior management takes responsibility for health and safety. It signs the OH&S policy, assigns roles and makes sure workers are consulted and can take part in decisions. The policy must include a commitment to prevent injury and ill health.
- Clause 6, Planning
- You identify hazards, assess the risks and list the legal and other requirements that apply to you. From this you set measurable OH&S objectives and plan how to reach them. A hazard register is the document auditors ask for first.
03: Clauses 7 to 10
Support, operation, evaluation and improvement: clauses 7 to 10
Here the system moves from paper to daily work. Most of the evidence is records of things your people actually did.
- Clause 7, Support
- You provide the resources, make sure people are competent for their tasks, and keep them aware of the policy, the hazards and their right to report. You also decide how to communicate internally and externally and how to control documents.
- Clause 8, Operation
- You put the controls from your risk assessment into practice, manage changes to processes or equipment, and set safety rules for contractors and purchased products. This clause also requires emergency plans, tested through drills where practical.
- Clause 9, Performance evaluation
- You monitor and measure results, check compliance with legal requirements, run an internal audit and hold a management review. The review minutes show that senior management looked at the numbers and made decisions.
- Clause 10, Improvement
- When an incident or near miss happens, you investigate it, find the cause and fix it. You record the actions and check that they worked. Over time this feeds back into the hazard register.
04: Hazard control
How does the hierarchy of controls work?
Clause 8 requires you to reduce risks in a fixed order of priority. You start at the top and move down only when the step above is not possible. Protective equipment comes last, not first.
Eliminate the hazard
Remove the dangerous task, substance or machine altogether.
Substitute
Replace a hazardous material or process with a less hazardous one.
Engineering controls and reorganised work
Fit guards, extraction or barriers, or change how the work is laid out.
Administrative controls
Use training, signage, procedures and shift planning to reduce exposure.
Personal protective equipment
Provide helmets, gloves, hearing protection and similar equipment where the risk remains.
05: With Zertify
How Zertify fits in
Zertify turns these requirements into 34 yes/no questions. Fourteen of them are mandatory requirements of the standard and must all be answered yes. Among the other 20 you need at least 14 yes answers. Each question points to what you would show in an audit, such as the hazard register or the management review minutes.
There is no on-site audit. The certificate is issued by G6 Agency AG under licence from SICE, and SICE reviews every assessment before issue. After you pass and pay, the certificate arrives within 4 hours. It carries a number and a QR code, so a customer or purchasing department can check it on the public verification page.
The price is CHF 699 (€699) in the first year, then CHF 469 (€469) per year including the yearly online re-audit. The certificate is valid for 3 years. You can buy without opening an account.
06: FAQ
Questions about the ISO 45001 requirements
07: Guide
Related pages
Check which ISO 45001 requirements you already meet
Answer 34 yes/no questions and see where your health and safety system stands.
Free and without registration.