ISO 45001 LI cheat sheet

ISO 45001 follows the Harmonized Structure (Annex SL): clauses 4-10 plus clauses 1-3 (scope, normative references, terms and definitions). Only clauses 4-10 contain auditable requirements.

The standard is built on the Plan-Do-Check-Act cycle: Clause 4 and 6 = Plan; Clause 7 and 8 = Do; Clause 9 = Check; Clause 10 = Act.

'Worker' means a person performing work under the organization's control, including contractors, temporary staff, and self-employed persons; 'workplace' is where work is performed under the organization's control.

'Hazard' is a source with potential to cause injury and ill health; 'risk' is the combination of likelihood and severity of that harm; an 'opportunity' is a circumstance that can lead to improved OH&S performance.

'OH&S opportunity' in ISO 45001 addresses improvement of OH&S performance (not merely mitigation of harm), e.g. adapting work to workers, eliminating hazards, or introducing safer technology.

Consultation is a two-way exchange with workers before decisions; participation means workers are involved in decision-making. Both are required (Clause 5.4), with resources and barriers to participation addressed.

Hierarchy of controls (Clause 8.1.2), most to least effective: eliminate the hazard, substitute, use engineering controls and reorganize work, use administrative controls, then PPE.

'Injury and ill health' covers physical or psychological harm, acute or chronic, including fatalities; the definition is not limited to recordable injuries.

'Conformity' is fulfilment of a requirement; 'nonconformity' is non-fulfilment. 'Continual improvement' is recurring activity to enhance performance, distinct from corrective action.

Gap analysis compares current practice against each ISO 45001 requirement (clauses 4-10) and produces a prioritized action list; it is not a certification audit and yields no certificate.

Context analysis (Clause 4.1) must consider internal and external issues, including legal, technological, competitive, market, cultural, and social/economic environments relevant to OH&S.

Interested parties (Clause 4.2) must be identified with their relevant needs and expectations; determine which become compliance obligations. Workers and their representatives are always interested parties.

The scope statement (Clause 4.3) must be available as documented information, state the activities/products/services, and consider the context, compliance obligations, and shared control arrangements.

Top management must demonstrate leadership by establishing the OH&S policy and objectives, integrating OH&S into business processes, and ensuring resources; leadership cannot be delegated to the OH&S manager.

The OH&S policy (Clause 5.2) must include a commitment to provide safe and healthy working conditions for prevention of injury and ill health, fulfil legal requirements, and consult/participate workers.

A project plan for implementation typically sequences: gap analysis, leadership and policy, risk/legal planning, operational controls, evaluation, internal audit, and management review before certification.

Roles, responsibilities, and authorities (Clause 5.3) must be assigned and communicated; the organization must appoint an OH&S management representative function, but accountability stays with top management.

Clause 6.1.1 requires planning to address risks and opportunities for the OH&S MS, plus risks and opportunities arising from the organization's context and interested parties.

Hazard identification (6.1.2.1) must be proactive and consider: routine and non-routine activities, human factors, emergency situations, and how work is organized and performed.

Hazard identification must also cover: infrastructure, equipment, materials, substances; work design and change; contractor activities; and the actual or proposed changes to the OH&S MS.

Risk assessment methodology (6.1.2.2) must be defined and retained as documented information, with criteria for evaluating OH&S risks and for identifying opportunities.

Legal and other requirements (6.1.3): identify, access, and determine how compliance obligations apply, and determine how to apply them; keep documented information updated.

OH&S objectives (6.2.1) must be measurable where practicable, monitored, communicated, and consistent with the policy; they must be updated as appropriate.

Planning to achieve objectives (6.2.2) must specify what will be done, resources needed, responsible person, completion date, how results will be evaluated, and how progress is monitored.

The hierarchy of controls must inform planning: eliminate, substitute, engineering, administrative, and PPE; PPE is the last line of defense, not a substitute for elimination.

Clause 7.1 requires resources sufficient for the OH&S MS, including competent people, infrastructure, and technology; resource decisions should reflect risk and objectives.

Competence (7.2) requires determining necessary competence, ensuring persons are competent (education, training, experience), and retaining documented evidence of competence.

Awareness (7.3) covers the policy, significant hazards and risks, contribution to the system, and the consequences of non-conformity; awareness is not the same as training.

Communication (7.4) requires internal and external communication plans: what, when, with whom, and how; internal communication must include workers and their representatives.

Documented information (7.5) must be created and updated with appropriate identification, format, and review/approval; control it for availability, protection, and retention.

Operational planning and control (8.1) requires criteria for processes and implementation of controls per the hierarchy; controls must be applied to outsourced processes and contractors.

Emergency preparedness (8.2) requires planned responses, training, testing, and review, and communication of relevant information to workers, contractors, visitors, and emergency responders.

Management of change (8.1.3) must be planned and controlled for new products, processes, equipment, or organizational changes; unintended changes must be reviewed and action taken.

Procurement and contractors (8.1.4): control outsourced functions, ensure contractors' workers meet OH&S criteria, and verify purchased goods and services meet OH&S requirements.

Monitoring and measurement (9.1.1) must determine what is monitored, methods, criteria, when, and who evaluates/analyzes results; retain documented evidence of results.

Calibration or verification of monitoring equipment must be retained as documented information where equipment is used for monitoring and measurement.

Evaluation of compliance (9.1.2) requires evaluating fulfilment of legal and other requirements, with frequency defined; results must be retained as documented information.

Internal audit (9.2) requires an audit programme with frequency, methods, responsibilities, and requirements; the programme must consider the importance of processes and previous results.

Auditors must be objective and impartial; they cannot audit their own work. Audit criteria and scope must be defined per audit, and results reported to top management.

Management review (9.3) must be conducted at planned intervals and consider: status of actions from prior reviews, changes in context, performance data, adequacy of resources, and relevant communication.

Management review inputs include: nonconformities and corrective actions, monitoring results, compliance evaluation, audit results, consultation/participation, risks and opportunities, and opportunities for improvement.

Management review outputs must include decisions on opportunities for improvement, changes needed to the OH&S MS, and resource needs; documented information must be retained.

Clause 10.1 defines continual improvement as recurring activity to enhance performance; the organization must determine opportunities and implement actions to achieve intended outcomes.

Clause 10.2 (incident, nonconformity, corrective action) requires reacting to the event, evaluating the need for corrective action, implementing it, and reviewing effectiveness.

Corrective action must address root cause where applicable; the extent of action is proportionate to the effect of the nonconformity and the OH&S risk.

Incidents, nonconformities, and corrective actions must be retained as documented information, including the nature, actions taken, and results.

Improvement can be incremental or breakthrough, and may involve innovation and reorganization; it is not limited to fixing nonconformities.

Performance indicators should be meaningful and tied to objectives; lagging indicators (incidents) and leading indicators (near misses, inspections, training completion) are both used.

Lessons learned from incidents, near misses, and audits feed into updated risk assessments and revised operational controls.

Top management must promote continual improvement and demonstrate commitment through resources, recognition, and integration into business planning.

Certification follows ISO/IEC 17021-1; the certification body must be accredited, and the audit is a two-stage initial certification audit (Stage 1 readiness, Stage 2 implementation).

Stage 1 typically reviews documentation, scope, context, internal audit and management review readiness, and identifies concerns for Stage 2.

Stage 2 verifies implementation and effectiveness across clauses 4-10, including operational controls, monitoring, and legal compliance evaluation.

The organization must have completed at least one full internal audit cycle and one management review covering the whole system before Stage 2.

Audit duration depends on effective number of personnel, complexity, and scope; certification bodies calculate audit time using IAF MD 5 principles.

Nonconformities are graded (major/minor); major nonconformities generally require correction and verification before certification is granted, while minors may be closed via a plan.

A certificate is valid for three years, with surveillance audits typically at 12 months and recertification before expiry; the certificate must state scope and standard.

Preparation includes: document control, evidence of competence, calibrated equipment records, legal register, incident records, and worker interviews demonstrating consultation and participation.

Audit findings are evidence-based; auditors sample records and interview workers. Objective evidence must be traceable to a requirement, not just to good practice.

ISO 45001 follows the Harmonized Structure (Annex SL): clauses 4-10 plus clauses 1-3 (scope, normative references, terms and definitions). Only clauses 4-10 contain auditable requirements.

The standard is built on the Plan-Do-Check-Act cycle: Clause 4 and 6 = Plan; Clause 7 and 8 = Do; Clause 9 = Check; Clause 10 = Act.

'Worker' means a person performing work under the organization's control, including contractors, temporary staff, and self-employed persons; 'workplace' is where work is performed under the organization's control.

'Hazard' is a source with potential to cause injury and ill health; 'risk' is the combination of likelihood and severity of that harm; an 'opportunity' is a circumstance that can lead to improved OH&S performance.

'OH&S opportunity' in ISO 45001 addresses improvement of OH&S performance (not merely mitigation of harm), e.g. adapting work to workers, eliminating hazards, or introducing safer technology.

Consultation is a two-way exchange with workers before decisions; participation means workers are involved in decision-making. Both are required (Clause 5.4), with resources and barriers to participation addressed.

Hierarchy of controls (Clause 8.1.2), most to least effective: eliminate the hazard, substitute, use engineering controls and reorganize work, use administrative controls, then PPE.

'Injury and ill health' covers physical or psychological harm, acute or chronic, including fatalities; the definition is not limited to recordable injuries.

'Conformity' is fulfilment of a requirement; 'nonconformity' is non-fulfilment. 'Continual improvement' is recurring activity to enhance performance, distinct from corrective action.

Gap analysis compares current practice against each ISO 45001 requirement (clauses 4-10) and produces a prioritized action list; it is not a certification audit and yields no certificate.

Context analysis (Clause 4.1) must consider internal and external issues, including legal, technological, competitive, market, cultural, and social/economic environments relevant to OH&S.

Interested parties (Clause 4.2) must be identified with their relevant needs and expectations; determine which become compliance obligations. Workers and their representatives are always interested parties.

The scope statement (Clause 4.3) must be available as documented information, state the activities/products/services, and consider the context, compliance obligations, and shared control arrangements.

Top management must demonstrate leadership by establishing the OH&S policy and objectives, integrating OH&S into business processes, and ensuring resources; leadership cannot be delegated to the OH&S manager.

The OH&S policy (Clause 5.2) must include a commitment to provide safe and healthy working conditions for prevention of injury and ill health, fulfil legal requirements, and consult/participate workers.

A project plan for implementation typically sequences: gap analysis, leadership and policy, risk/legal planning, operational controls, evaluation, internal audit, and management review before certification.

Roles, responsibilities, and authorities (Clause 5.3) must be assigned and communicated; the organization must appoint an OH&S management representative function, but accountability stays with top management.

Clause 6.1.1 requires planning to address risks and opportunities for the OH&S MS, plus risks and opportunities arising from the organization's context and interested parties.

Hazard identification (6.1.2.1) must be proactive and consider: routine and non-routine activities, human factors, emergency situations, and how work is organized and performed.

Hazard identification must also cover: infrastructure, equipment, materials, substances; work design and change; contractor activities; and the actual or proposed changes to the OH&S MS.

Risk assessment methodology (6.1.2.2) must be defined and retained as documented information, with criteria for evaluating OH&S risks and for identifying opportunities.

Legal and other requirements (6.1.3): identify, access, and determine how compliance obligations apply, and determine how to apply them; keep documented information updated.

OH&S objectives (6.2.1) must be measurable where practicable, monitored, communicated, and consistent with the policy; they must be updated as appropriate.

Planning to achieve objectives (6.2.2) must specify what will be done, resources needed, responsible person, completion date, how results will be evaluated, and how progress is monitored.

The hierarchy of controls must inform planning: eliminate, substitute, engineering, administrative, and PPE; PPE is the last line of defense, not a substitute for elimination.

Clause 7.1 requires resources sufficient for the OH&S MS, including competent people, infrastructure, and technology; resource decisions should reflect risk and objectives.

Competence (7.2) requires determining necessary competence, ensuring persons are competent (education, training, experience), and retaining documented evidence of competence.

Awareness (7.3) covers the policy, significant hazards and risks, contribution to the system, and the consequences of non-conformity; awareness is not the same as training.

Communication (7.4) requires internal and external communication plans: what, when, with whom, and how; internal communication must include workers and their representatives.

Documented information (7.5) must be created and updated with appropriate identification, format, and review/approval; control it for availability, protection, and retention.

Operational planning and control (8.1) requires criteria for processes and implementation of controls per the hierarchy; controls must be applied to outsourced processes and contractors.

Emergency preparedness (8.2) requires planned responses, training, testing, and review, and communication of relevant information to workers, contractors, visitors, and emergency responders.

Management of change (8.1.3) must be planned and controlled for new products, processes, equipment, or organizational changes; unintended changes must be reviewed and action taken.

Procurement and contractors (8.1.4): control outsourced functions, ensure contractors' workers meet OH&S criteria, and verify purchased goods and services meet OH&S requirements.

Monitoring and measurement (9.1.1) must determine what is monitored, methods, criteria, when, and who evaluates/analyzes results; retain documented evidence of results.

Calibration or verification of monitoring equipment must be retained as documented information where equipment is used for monitoring and measurement.

Evaluation of compliance (9.1.2) requires evaluating fulfilment of legal and other requirements, with frequency defined; results must be retained as documented information.

Internal audit (9.2) requires an audit programme with frequency, methods, responsibilities, and requirements; the programme must consider the importance of processes and previous results.

Auditors must be objective and impartial; they cannot audit their own work. Audit criteria and scope must be defined per audit, and results reported to top management.

Management review (9.3) must be conducted at planned intervals and consider: status of actions from prior reviews, changes in context, performance data, adequacy of resources, and relevant communication.

Management review inputs include: nonconformities and corrective actions, monitoring results, compliance evaluation, audit results, consultation/participation, risks and opportunities, and opportunities for improvement.

Management review outputs must include decisions on opportunities for improvement, changes needed to the OH&S MS, and resource needs; documented information must be retained.

Clause 10.1 defines continual improvement as recurring activity to enhance performance; the organization must determine opportunities and implement actions to achieve intended outcomes.

Clause 10.2 (incident, nonconformity, corrective action) requires reacting to the event, evaluating the need for corrective action, implementing it, and reviewing effectiveness.

Corrective action must address root cause where applicable; the extent of action is proportionate to the effect of the nonconformity and the OH&S risk.

Incidents, nonconformities, and corrective actions must be retained as documented information, including the nature, actions taken, and results.

Improvement can be incremental or breakthrough, and may involve innovation and reorganization; it is not limited to fixing nonconformities.

Performance indicators should be meaningful and tied to objectives; lagging indicators (incidents) and leading indicators (near misses, inspections, training completion) are both used.

Lessons learned from incidents, near misses, and audits feed into updated risk assessments and revised operational controls.

Top management must promote continual improvement and demonstrate commitment through resources, recognition, and integration into business planning.

Certification follows ISO/IEC 17021-1; the certification body must be accredited, and the audit is a two-stage initial certification audit (Stage 1 readiness, Stage 2 implementation).

Stage 1 typically reviews documentation, scope, context, internal audit and management review readiness, and identifies concerns for Stage 2.

Stage 2 verifies implementation and effectiveness across clauses 4-10, including operational controls, monitoring, and legal compliance evaluation.

The organization must have completed at least one full internal audit cycle and one management review covering the whole system before Stage 2.

Audit duration depends on effective number of personnel, complexity, and scope; certification bodies calculate audit time using IAF MD 5 principles.

Nonconformities are graded (major/minor); major nonconformities generally require correction and verification before certification is granted, while minors may be closed via a plan.

A certificate is valid for three years, with surveillance audits typically at 12 months and recertification before expiry; the certificate must state scope and standard.

Preparation includes: document control, evidence of competence, calibrated equipment records, legal register, incident records, and worker interviews demonstrating consultation and participation.

Audit findings are evidence-based; auditors sample records and interview workers. Objective evidence must be traceable to a requirement, not just to good practice.