🦺 ISO 45001: The Complete Guide

ISO 45001:2018 is the international standard for occupational health and safety (OH&S) management systems, and if you're reading this you're probably trying to answer one of two questions: what does my organization actually have to do to get certified, or what do I need to know to pass an ISO 45001 exam or audit. The short answer is that ISO 45001 asks an organization to run health and safety the way it already runs quality or finance — with a documented system, clear accountability, planned risk controls, and a cycle of checking and improving that never really stops. This guide walks through the ten clauses in order, shows how they map onto the Plan-Do-Check-Act cycle, explains what actually happens during a certification audit, and lists the nonconformities that show up again and again in real audits — so you know exactly where organizations lose points before you ever sit one.

In this guide

• What ISO 45001 actually is
• The PDCA structure behind the standard
• Clause-by-clause requirements (4–10)
• The certification and audit process
• Common nonconformities auditors find
• Who needs ISO 45001, and is it mandatory?
• How to prepare — training path
• FAQs

What ISO 45001 actually is

ISO 45001:2018, Occupational health and safety management systems — Requirements with guidance for use, is published by the International Organization for Standardization and specifies requirements for an OH&S management system, together with guidance for using it. Its stated purpose is to enable an organization to provide safe and healthy workplaces by preventing work-related injury and ill health, and by proactively improving its OH&S performance — not merely reacting to incidents after they happen.

Two design choices matter more than anything else once you get into the clauses:

• It follows the Annex SL "harmonized structure." Since 2018, ISO writes its management-system standards to a common ten-clause skeleton, which is why ISO 45001's clause numbers and much of its language mirror ISO 9001 (quality) and ISO 14001 (environment). If you already know one of those standards, ISO 45001 will feel structurally familiar — the content is safety-specific, but the architecture is shared. This is also exactly why so many organizations run an Integrated Management System (IMS) across all three rather than three separate systems.
• It is risk-based and worker-centered, not prescriptive. ISO 45001 does not hand you a checklist of specific safety rules for your industry. It requires you to identify your own hazards, assess your own risks, and build controls proportionate to what you actually do — while giving OH&S committees and frontline workers a genuine, documented role in that process (Clause 5.4). This is a deliberate shift from OHSAS 18001, which was lighter on worker participation.

The PDCA structure behind the standard

ISO 45001 is built around Plan-Do-Check-Act (PDCA), a continual-improvement cycle borrowed from quality management. Every clause in the standard sits inside one loop of that cycle, and understanding this mapping makes the rest of the standard far easier to hold in your head:

PDCA stage	Clauses	What happens
Plan	4, 5, 6	Understand the organization's context, secure leadership commitment and worker participation, identify hazards, assess risks and opportunities, and set OH&S objectives.
Do	7, 8	Provide the resources, competence and communication needed (Support), then actually run operational controls and emergency preparedness (Operation).
Check	9	Monitor and measure performance, run internal audits, and hold a formal management review.
Act	10	Investigate incidents and nonconformities, take corrective action, and continually improve the system.

The cycle never terminates — an organization certified today is expected to keep planning, doing, checking and acting indefinitely, which is exactly why certification isn't a one-time event but a three-year cycle of surveillance and recertification audits (more on that below).

Clause-by-clause requirements (4–10)

Clauses 1–3 (scope, normative references, terms and definitions) contain no auditable requirements — an auditor will never write a finding against them. Everything an auditor can actually test lives in clauses 4 through 10.

Clause 4 — Context of the Organization

Before anything else, the organization must understand the environment it operates in. This clause has two operative sub-clauses:

• 4.1 Understanding the organization and its context — determining internal and external issues (regulatory environment, workforce demographics, contractor use, site conditions) that affect the OH&S management system.
• 4.2 Understanding the needs and expectations of workers and other interested parties — identifying who has a stake in OH&S performance (regulators, insurers, unions, clients) and what they require.
• 4.3 Determining the scope and 4.4 the OH&S management system itself — defining boundaries and confirming the organization establishes, implements, maintains and continually improves a system per the standard.

Clause 5 — Leadership and Worker Participation

This is where ISO 45001 visibly departs from a purely paperwork exercise. Clause 5.1 requires top management — not a delegated safety officer — to demonstrate leadership and commitment, including taking overall accountability for preventing work-related injury and ill health. Clause 5.2 requires an OH&S policy; 5.3 requires clearly assigned roles, responsibilities and authorities. Clause 5.4, Consultation and participation of workers, is one of the standard's signature requirements: workers at all levels, including non-managerial staff, must have a documented mechanism to be consulted on OH&S matters that affect them and to participate in hazard identification, incident investigation and policy development. Auditors specifically look for evidence workers can point to — committee minutes, toolbox-talk records, near-miss reporting logs — not just a policy statement claiming participation exists.

Clause 6 — Planning

Clause 6 is the engine room of the standard, and the clause most heavily tested in both real audits and exam-prep courses.

• 6.1.1 requires the organization to plan actions to address risks and opportunities generally.
• 6.1.2.1 Hazard identification — a systematic, ongoing process to identify hazards arising from routine and non-routine activities, human factors, past incidents, emergency situations and changes to the organization.
• 6.1.2.2 Assessment of OH&S risks and other risks — evaluating the likelihood and severity of harm from each identified hazard, using a documented methodology.
• 6.1.2.3 Assessment of OH&S opportunities and other opportunities — the standard explicitly requires organizations to look for opportunities to improve OH&S performance, not only to control downside risk.
• 6.1.3 Determination of legal requirements and other requirements — maintaining a legal/regulatory register relevant to the organization's hazards.
• 6.1.4 Planning action — deciding how identified risks, opportunities and legal requirements will actually be addressed, integrated into the management system, and evaluated for effectiveness.
• 6.2 OH&S objectives and planning to achieve them — setting measurable objectives consistent with the policy and tracking progress.

Clause 7 — Support

Five sub-clauses cover the infrastructure the system needs to function: 7.1 Resources (people, budget, equipment), 7.2 Competence (ensuring people doing safety-critical work are trained and qualified, with records to prove it), 7.3 Awareness (workers understand the policy, their contribution, and the consequences of not following procedures), 7.4 Communication (internal and external, including what, when, with whom and how), and 7.5 Documented information (creating, updating and controlling the records and procedures the system depends on).

Clause 8 — Operation

This is where planning becomes action on the ground. 8.1 Operational planning and control requires the organization to establish, implement and control the processes needed to meet system requirements — and, critically, 8.1.2 Eliminating hazards and reducing OH&S risks mandates a specific hierarchy of controls, applied in this priority order:

1. Eliminate the hazard entirely.
2. Substitute with less hazardous processes, materials or equipment.
3. Use engineering controls and reorganize work (guarding, ventilation, isolation).
4. Use administrative controls, including training, signage and procedures.
5. Use personal protective equipment (PPE) — the last resort, not the first response.

Auditors are trained to push back hard when an organization's control for a hazard jumps straight to PPE without documented evidence that elimination, substitution or engineering controls were genuinely considered first. Clause 8.1 also covers management of change and procurement; 8.2 Emergency preparedness and response requires the organization to plan, test (via periodic drills or simulations) and review its response to potential emergency situations.

Clause 9 — Performance Evaluation

The "Check" stage. 9.1.1 Monitoring, measurement, analysis and performance evaluation requires the organization to decide what needs to be measured, how, and how often — typically incident rates, near-miss reporting, inspection completion and training compliance. 9.1.2 Evaluation of compliance checks legal and other requirements are actually being met. 9.2 Internal audit requires a planned program of audits at defined intervals, conducted by people who are objective and impartial (often, but not always, meaning they don't audit their own area of direct responsibility). 9.3 Management review requires top management to periodically review the whole system's suitability, adequacy and effectiveness — with defined inputs (audit results, incident trends, worker feedback) and outputs (decisions on changes, resource needs).

Clause 10 — Improvement

The "Act" stage closes the loop. 10.1 General sets the expectation of continual improvement. 10.2 Incident, nonconformity and corrective action requires a documented process to react to incidents and nonconformities: control and correct them, evaluate the need for action to eliminate root causes, implement any action needed, review its effectiveness, and make changes to the OH&S management system if necessary. 10.3 Continual improvement requires the organization to keep improving the suitability, adequacy and effectiveness of the system over time — the clause that, in effect, restarts the PDCA cycle.

The certification and audit process

Certification is carried out by an independent, accredited certification body — not by ISO itself, which only publishes the standard. The process nearly always runs in the following sequence:

1. Gap analysis (optional but recommended). An internal or consultant-led review against the ten clauses, identifying what already exists versus what still needs to be built or documented.
2. System build-out. Writing the OH&S policy, building the hazard/risk register, legal register, procedures, training records and the rest of the documented information the standard requires.
3. Internal audit and management review. The organization must complete at least one full internal audit cycle and a documented management review before the certification body will proceed — this is not optional evidence.
4. Stage 1 audit. The certification body's auditor reviews documentation, confirms the scope is correctly defined, checks the policy and key procedures exist, and identifies major gaps that must close before Stage 2 can proceed. This is largely desk-based (documents, sometimes a short site visit) and typically takes half a day to two days depending on scope.
5. Stage 2 audit. The substantive on-site (or, increasingly, hybrid remote/on-site) audit. The auditor samples processes across the defined scope, interviews workers at different levels (not just managers), observes work being carried out, and reviews records — training logs, incident investigations, permit-to-work records, emergency drill reports — to confirm the system is not just documented but actually operating and effective.
6. Certification decision. Any nonconformities raised during Stage 2 must be corrected (or have an accepted corrective action plan) before the certificate is issued. Certification is typically valid for three years.
7. Surveillance audits. Shorter audits, usually annual, during years one and two of the three-year cycle, checking continuing compliance and following up on any previous corrective actions.
8. Recertification audit. Before the three-year certificate expires, a full audit similar in depth to Stage 2 is conducted to renew certification for another cycle. Best practice is to schedule this a few months before expiry so there's time to close any findings without a lapse in certification.

Common nonconformities auditors find

Having sat on both sides of the audit table, the same handful of gaps show up again and again — often in organizations that otherwise look well-prepared on paper. Knowing these in advance is the single highest-leverage thing you can do before an audit:

• Documentation that exists but isn't followed. A hazard register or procedure that hasn't been updated in years, or that doesn't match what workers actually do on the floor, is a classic finding — auditors cross-check documents against interviews and observation, not just the paperwork itself.
• Weak worker consultation evidence (Clause 5.4). A written participation policy with no minutes, no logged near-miss reports, and workers who can't describe how they're consulted is one of the most frequently cited gaps, because it's easy to write a policy and hard to prove it's lived.
• Internal audits that lack objectivity or follow-through. Internal audits performed by someone auditing their own area, with no evidence of independent review, or with the same finding recurring audit after audit with no effective corrective action — a strong signal the corrective-action process in Clause 10.2 isn't actually closing root causes.
• Corrective actions closed without verifying effectiveness. Marking a corrective action "complete" the moment a fix is implemented, without a later check that the root cause actually stopped recurring, is one of the most consistently cited nonconformities across certification bodies.
• Hierarchy of controls skipped straight to PPE. Risk assessments that list "wear gloves / wear a hard hat" as the primary control for a hazard, with no evidence elimination, substitution or engineering controls were seriously evaluated first, directly conflicts with Clause 8.1.2.
• Outdated or incomplete legal register (Clause 6.1.3). Regulations change; a register with no review date, no named owner, and no evidence of periodic re-checks is a frequent finding, especially in jurisdictions with active regulatory change.
• Untested emergency plans (Clause 8.2). A written emergency response plan that has never been drilled or simulated is, functionally, just a document — auditors expect at least periodic simulation exercises with documented outcomes and lessons learned.
• Management review missing required inputs or outputs (Clause 9.3). A management review meeting that happened, but skipped required inputs like incident trends or audit results, or produced no documented decisions, is a common minor finding that's easy to prevent with a simple agenda template.

Most of these have a common root: a system built to look complete on paper, without the operational habits (consultation, drills, effectiveness checks) that make it real. The fix is rarely more documentation — it's making the existing documentation match what people actually do.

Who needs ISO 45001, and is it mandatory?

ISO 45001 certification is voluntary in the large majority of jurisdictions — it sits alongside national occupational health and safety law, not in place of it. Employers remain legally bound by whatever OH&S regulations apply in their country (OSHA regulations in the US, for example, or equivalent national frameworks elsewhere) regardless of whether they hold ISO 45001 certification. What certification adds is a structured, independently verified management system layered on top of legal compliance — and, in practice, a credential that increasingly shows up as a contractual requirement in construction, oil & gas, manufacturing, logistics and other higher-hazard sectors, where clients and insurers use it as a proxy for safety maturity when selecting contractors.

How to prepare — free training path

You don't need to buy an expensive course to build a genuine, working understanding of ISO 45001 before you sit an internal audit, support a certification project, or move toward a formal Lead Auditor qualification. AMAADOR ACADEMY offers a free, structured path through the standard:

Related courses worth pairing with these: Incident Investigation (feeds directly into Clause 10.2 corrective action), Permit-to-Work (a common Clause 8.1 operational control), Behaviour-Based Safety, and ISO 14001 Awareness if you're heading toward an integrated management system. You can browse the complete list on the Occupational Safety field page, or see how ISO 45001 fits into a broader learning track on Learning Paths. Every course ends with a graded exam and a free, signed, QR-verifiable certificate — you can check any certificate's authenticity anytime on the verification page.

Frequently asked questions

---

Keep going