OHSMS fundamentals and the ISO 45001 standard
This domain tests whether you can read an organisation's OH&S management system against the requirements and intent of ISO 45001:2018 - its Annex SL structure, its defined terms, and what changed when it replaced OHSAS 18001. Questions usually present a short scenario and ask which clause is engaged or what evidence would be sufficient.
Core rules and concepts
- The standard follows Annex SL: clause 4 context, 5 leadership and worker participation, 6 planning, 7 support, 8 operation, 9 performance evaluation, 10 improvement.
- The logic is PDCA - 4 to 6 Plan, 7 and 8 Do, 9 Check, 10 Act - with a process approach throughout. ISO 45001 does not prescribe a manual or a fixed set of procedures; it requires specified documented information only.
- Defined terms carry audit weight: worker includes non-managerial staff, contractors and agency personnel; hazard is a source of injury or ill health; OH&S risk combines likelihood and severity; incident includes near misses and ill health, not only injuries.
- 6.1.2 requires ongoing, proactive hazard identification covering routine and non-routine activities, human factors, emergency situations, and hazards arising from contractors, visitors and change.
- 8.1.2 sets the hierarchy of controls: eliminate, substitute, engineering controls and reorganisation of work, administrative controls including training, then PPE as the last barrier.
- 5.4 requires consultation and participation of workers and removal of barriers to participation; unlike OHSAS 18001 there is no 'management representative' role.
- 10.2 covers incidents as well as nonconformities; the old standalone preventive action clause disappeared because risk-based thinking sits in 6.1.
Worked example
An auditee argues: 'Three years without a lost-time injury proves the system works.' Absence of injury is an outcome, not evidence of a functioning system. Audit the paint shop's hazard identification against the solvent register and the last three near-miss reports (6.1.2.1), then test whether the new spray booth was risk-assessed before use (8.1.3). If the substitution to water-based paint has no recorded assessment, the organisation cannot show it identified and controlled the hazard, and 6.1.2.2 is not met regardless of the injury record.
Traps that cost marks
- Assuming a clean incident record means conformity with 6.1.
- Treating the existence of a risk assessment as proof it is adequate.
- Quoting 'ISO 45001 requires PPE' - the standard requires the hierarchy of controls.
- Confusing consultation and participation (5.4) with communication (7.4).