ISO 45001 is the international standard for an Occupational Health and Safety Management System (OH&S). It provides organizations with a structured framework to identify hazards, assess and control OH&S risks, meet applicable requirements, involve workers, prepare for emergencies, monitor performance and continually improve workplace health and safety. ISO 45001:2018 remains the current published edition as of 2026, although ISO has a new ISO/DIS 45001 revision under development.
What is ISO 45001 Certification?
ISO 45001 certification demonstrates that an organization has established and implemented an Occupational Health and Safety Management System designed to systematically manage workplace hazards and OH&S risks.
The framework covers areas such as:
- Hazard identification
- OH&S risk assessment
- Legal and regulatory requirements
- Worker participation
- Operational controls
- Emergency preparedness
- Incident investigation
- Internal audits
- Management review
- Continual improvement
ISO states that the standard is applicable to organizations of any size, type or sector.
What Is ISO 45001?
ISO 45001 is an internationally recognized standard for Occupational Health and Safety Management Systems.
Its purpose is not simply to create safety procedures.
It establishes a management-system approach through which an organization can systematically:
Identify → Assess → Control → Monitor → Improve
its occupational health and safety risks.
ISO describes the standard as a framework for organizations to manage OH&S risks and improve OH&S performance, with key elements including leadership commitment, worker participation, hazard identification, risk assessment, compliance obligations, emergency planning, incident investigation and continual improvement.
ISO 45001:2018 — Current Status
This is an important point for organizations planning certification.
As of 2026, ISO 45001:2018 remains the current published International Standard. ISO’s official page says the 2018 edition was reviewed and confirmed in 2024 and currently remains valid.
However, ISO has also begun work on a revision. ISO/DIS 45001 is currently under development and is intended to replace ISO 45001:2018. Therefore, organizations should distinguish between the current published standard and the future revision under development.
There is also ISO 45001:2018/Amd 1:2024, an amendment concerning climate-action changes.
Consultant’s Note
This distinction is particularly important when preparing proposals, implementation plans and certification roadmaps.
Organizations should avoid referring to the draft revision as though it were already the applicable certification standard.
Why ISO 45001 Matters
Workplace safety cannot be effectively managed through isolated safety instructions alone.
A mature OH&S system connects safety with:
- Leadership
- Business processes
- Employee competence
- Risk management
- Procurement
- Contractor management
- Emergency preparedness
- Operational controls
- Performance monitoring
- Corrective action
This changes the approach from:
“Safety department responsibility”
to:
“Organizational management responsibility.”
That shift is one of the most important principles behind ISO 45001.
Who Can Implement ISO 45001?
ISO 45001 is not restricted to high-risk industries.
It can be implemented by organizations across sectors and sizes. ISO specifically states that the standard is applicable regardless of organizational size, type or nature of business.
Manufacturing
- Engineering
- Automotive
- Electronics
- Chemicals
- Machinery
- Fabrication
- Packaging
Construction
- Civil contractors
- EPC companies
- Infrastructure projects
- Real estate developers
- Project management organizations
Pharmaceuticals
- API manufacturing
- Formulations
- Biotechnology
- Research facilities
Healthcare
- Hospitals
- Diagnostic centres
- Laboratories
- Healthcare facilities
IT & Technology
Even technology companies can have OH&S risks involving:
- Electrical systems
- Data centres
- Fire safety
- Ergonomics
- Contractors
- Travel
- Emergency situations
- Workplace facilities
Logistics
- Warehousing
- Transportation
- Distribution
- Fleet operations
- Material handling
Education
- Schools
- Colleges
- Universities
- Training institutions
ISO 45001 Is More Than Workplace Safety
One common misconception is:
“We already have safety procedures, so we don’t need ISO 45001.”
This misses the management-system perspective.
A procedure may explain what employees should do.
ISO 45001 asks a broader set of questions:
- Have hazards been systematically identified?
- Are risks evaluated?
- Are controls effective?
- Are workers involved?
- Are responsibilities defined?
- Are legal requirements identified?
- Are emergency arrangements tested?
- Are incidents investigated?
- Are corrective actions effective?
- Does management review performance?
- Is the system continually improving?
The difference is significant.
The Core Philosophy of ISO 45001
ISO 45001 follows a management-system approach based on continual improvement.
A simplified model is:
PLAN
Identify:
- Hazards
- Risks
- Opportunities
- Legal requirements
- OH&S objectives
⬇️
DO
Implement:
- Controls
- Competence
- Awareness
- Communication
- Operational processes
⬇️
CHECK
Monitor:
- Performance
- Incidents
- Compliance
- Audit findings
- Objectives
⬇️
ACT
Improve:
- Corrective actions
- Risk controls
- Processes
- OH&S performance
This creates a continuous improvement cycle rather than a one-time safety exercise.
Worker Participation Is Critical
One of the important characteristics of ISO 45001 is its emphasis on worker participation.
The people performing the work often have direct knowledge of:
- Workplace hazards
- Unsafe conditions
- Operational challenges
- Near misses
- Equipment problems
- Practical control measures
ISO’s own briefing material highlights worker participation as an important element in establishing, implementing and maintaining an effective OH&S management system.
Therefore, an effective ISO 45001 system should not be developed entirely inside the management office.
It should involve the people who actually perform the work.
Hazard Identification and Risk Assessment
At the heart of ISO 45001 is the organization’s ability to identify hazards and manage OH&S risks.
Examples include:
Physical Hazards
- Moving machinery
- Noise
- Vibration
- Working at height
- Slips and falls
Chemical Hazards
- Toxic substances
- Solvents
- Cleaning chemicals
- Hazardous materials
Electrical Hazards
- Electrical equipment
- Exposed conductors
- Temporary electrical installations
Ergonomic Hazards
- Poor workstation design
- Manual handling
- Repetitive tasks
- Awkward postures
Operational Hazards
- Material handling
- Vehicle movement
- Contractor activities
- Maintenance activities
Emergency Hazards
- Fire
- Explosion
- Chemical release
- Natural disasters
- Medical emergencies
The organization must then determine appropriate controls and evaluate whether those controls are effective.
Legal and Other Requirements
ISO 45001 also requires organizations to understand applicable OH&S legal and other requirements relevant to their activities.
For Indian organizations, this can involve reviewing applicable requirements concerning areas such as:
- Occupational safety
- Working conditions
- Fire safety
- Electrical safety
- Hazardous substances
- Machinery safety
- Employee welfare
- Emergency preparedness
The exact legal register will depend on the organization’s industry, location, activities and risk profile.
This is why a copy-paste legal register is rarely an effective compliance strategy.
Leadership Responsibility
ISO 45001 places significant importance on leadership.
Top management should demonstrate responsibility for the effectiveness of the OH&S management system.
Safety should therefore be connected with business decisions involving:
- Resources
- Infrastructure
- Personnel
- Procurement
- Operations
- Contractors
- Risk management
- Business planning
An organization cannot build a strong safety culture if senior management treats OH&S as merely an audit requirement.
ISO 45001 and Business Performance
A well-designed OH&S management system can contribute to broader organizational performance.
Potential benefits include:
1. Better Risk Management
Organizations obtain a systematic approach to identifying and controlling workplace risks.
2. Stronger Safety Culture
Employees become more involved in identifying and managing hazards.
3. Improved Compliance Management
Applicable OH&S requirements can be systematically identified and monitored.
4. Greater Customer Confidence
Certification can provide external evidence of an organization’s structured approach to OH&S management.
5. Better Contractor Management
Organizations can incorporate OH&S expectations into contractor and supplier processes.
6. Continual Improvement
Performance monitoring, audits, incident investigation and corrective action create a mechanism for improvement.
ISO itself identifies benefits including systematic OH&S risk management, improved worker protection, regulatory compliance, organizational resilience and continual improvement.
ISO 45001 Certification vs. ISO 45001 Implementation
These terms are often used interchangeably, but they are different.
Implementation
The organization establishes and operates its OH&S Management System.
This may include:
- Gap analysis
- Documentation
- Risk assessment
- Training
- Implementation
- Internal audit
- Management review
Certification
An independent certification body audits the management system and, where conformity is demonstrated, issues certification.
ISO explains that certification is performed by independent certification bodies and can provide additional confidence to stakeholders; applying the standard itself can provide significant benefits even before certification.
ISO 45001 and Other Management Systems
ISO 45001 follows the common ISO management-system structure, making integration with other standards practical.
For example:
ISO 9001
Quality Management
ISO 14001
Environmental Management
ISO 45001
Occupational Health & Safety
=
Integrated Management System (IMS)
Organizations can potentially integrate common processes such as:
- Context analysis
- Risk management
- Document control
- Internal audit
- Management review
- Corrective action
- Training
- Continual improvement
This can reduce duplication and create a more coherent governance framework.
Why Hyderabad Businesses Should Pay Attention
Hyderabad has a diverse industrial and technology ecosystem covering:
- Pharmaceuticals
- Biotechnology
- Manufacturing
- Engineering
- Construction
- IT
- Data Centres
- Logistics
- Healthcare
- Food Processing
For organizations operating across these sectors, occupational health and safety can involve very different risk profiles.
A pharmaceutical manufacturer, construction company and SaaS organization cannot use identical OH&S risk assessments.
The management system must reflect the organization’s actual:
Activities + Hazards + Workforce + Workplace + Legal Context + Operational Risks.
That is where professional implementation becomes valuable.
Common ISO 45001 Misconceptions
❌ “ISO 45001 is only for factories.”
Reality: It can apply to organizations across sectors and sizes.
❌ “Certification means there will be no accidents.”
Reality: ISO 45001 provides a systematic framework for managing OH&S risks; it does not guarantee zero incidents.
❌ “We only need documentation.”
Reality: The system must be implemented and demonstrated through operational evidence.
❌ “The safety officer alone owns ISO 45001.”
Reality: Effective OH&S management requires leadership involvement and worker participation.
❌ “We can copy another company’s risk assessment.”
Reality: Hazard identification and risk controls should reflect the organization’s actual activities and circumstances.
Why Trust CK Associates?
CK Associates brings 20+ years of consulting experience and 450+ certification projects across multiple management-system disciplines.
Our approach focuses on practical implementation rather than creating documentation solely for an audit.
We support organizations through:
- Gap Analysis
- OH&S Risk Assessment
- Documentation
- Implementation
- Employee Awareness
- Internal Audit
- Management Review
- Certification Audit Preparation
Our experience across ISO 9001, ISO 14001, ISO 45001, ISO/IEC 27001, ISO/IEC 42001 and other management systems also enables organizations to explore integrated management-system approaches where appropriate.
ISO 45001 Certification Guide for Indian Businesses.
1. ISO 45001 Requirements at a Glance
ISO 45001:2018 follows the common ISO management-system structure.
The core clauses are:
| Clause | Area | Practical Focus |
|---|---|---|
| 4 | Context of the Organization | Understand the organization and OH&S environment |
| 5 | Leadership & Worker Participation | Management responsibility and employee involvement |
| 6 | Planning | Hazards, risks, opportunities and objectives |
| 7 | Support | Resources, competence, awareness and communication |
| 8 | Operation | Operational controls and emergency preparedness |
| 9 | Performance Evaluation | Monitoring, audits and management review |
| 10 | Improvement | Incidents, corrective action and continual improvement |
A certification auditor does not simply ask whether these clauses exist in a manual.
The auditor wants to see whether the system is actually implemented and effective.
2. Clause 4 — Context of the Organization
An organization must understand the internal and external factors that can affect its OH&S management system.
This can include:
Internal Issues
- Workforce competence
- Organizational structure
- Equipment
- Workplace conditions
- Existing safety culture
- Operational processes
External Issues
- Regulatory requirements
- Industry risks
- Technology
- Customer requirements
- Contractor environment
- Labour-market conditions
- Environmental conditions
The organization must also identify relevant interested parties.
Examples:
- Employees
- Contractors
- Customers
- Regulators
- Suppliers
- Visitors
- Local communities
3. Clause 5 — Leadership & Worker Participation
This is one of the areas where organizations sometimes create a disconnect between documentation and reality.
Top management needs to demonstrate genuine responsibility for OH&S.
Leadership should ensure that:
- OH&S objectives support business strategy.
- Resources are available.
- Responsibilities are defined.
- OH&S requirements are integrated into business processes.
- Workers are consulted.
- Workers can participate in relevant OH&S processes.
Worker Participation
Worker participation is particularly important.
Employees should have opportunities to contribute to:
- Hazard identification
- Risk assessment
- Incident investigation
- OH&S improvements
- Consultation activities
- Safety initiatives
What might an auditor ask?
“Show me how workers participated in the risk assessment.”
A documented procedure alone may not answer that question.
The organization needs objective evidence.
4. Clause 6 — Planning
Planning is at the heart of ISO 45001.
The organization needs to identify:
- Hazards
- OH&S risks
- OH&S opportunities
- Legal requirements
- Other applicable requirements
- OH&S objectives
5. Hazard Identification
A mature hazard-identification process considers routine and non-routine activities.
For example, a manufacturing organization may consider:
Routine Activities
- Production
- Machine operation
- Material handling
- Packaging
Non-Routine Activities
- Maintenance
- Equipment breakdown
- Cleaning
- Shutdown
- Installation
Emergency Situations
- Fire
- Chemical release
- Electrical incident
- Explosion
- Medical emergency
6. OH&S Risk Assessment
Risk assessment should not become a spreadsheet exercise.
A useful assessment considers:
Hazard → Risk → Existing Control → Additional Control → Responsible Person → Review
For example:
| Activity | Hazard | Potential Risk | Control |
|---|---|---|---|
| Machine operation | Moving parts | Injury | Machine guarding |
| Chemical handling | Chemical exposure | Health impact | PPE + engineering controls |
| Working at height | Fall | Serious injury | Fall protection |
| Forklift movement | Vehicle collision | Injury/property damage | Traffic management |
7. Hierarchy of Controls
ISO 45001 implementation should not rely exclusively on Personal Protective Equipment (PPE).
A stronger approach considers the hierarchy of controls.
1. Elimination
Remove the hazard.
2. Substitution
Replace the hazard with a safer alternative.
3. Engineering Controls
Isolate people from the hazard.
4. Administrative Controls
Change the way work is performed.
5. PPE
Protect the worker where residual risk remains.
This is an important distinction between a mature OH&S system and a purely documentation-driven system.
8. Legal and Other Requirements
Organizations need a structured process for identifying and evaluating applicable OH&S requirements.
The exact requirements depend on:
- Industry
- Location
- Activities
- Workforce
- Equipment
- Materials
- Regulatory environment
A legal register should therefore be organization-specific.
It should not simply be copied from another company.
9. OH&S Objectives
Objectives should provide measurable direction.
Weak objective:
“Improve safety.”
Better objective:
“Reduce recordable workplace incidents by X% during the defined measurement period.”
Other examples could include:
- Increase safety training completion.
- Reduce near-miss recurrence.
- Improve emergency drill performance.
- Increase workplace inspection closure rates.
- Reduce unsafe-condition observations.
Objectives should have appropriate:
- Responsibility
- Resources
- Measurement criteria
- Timeframes
- Monitoring
10. Clause 7 — Support
A management system cannot work without appropriate resources and competent people.
Organizations should establish processes for:
Competence
Employees performing work that affects OH&S should have appropriate competence.
Awareness
Workers should understand:
- OH&S policy
- Relevant hazards
- Their responsibilities
- Consequences of unsafe practices
- Emergency procedures
Communication
The organization should determine:
- What needs to be communicated
- When
- To whom
- How
Documented Information
Relevant information needs to be properly controlled.
11. Training Is Not the Same as Competence
This is an important audit distinction.
An organization may have:
Training Attendance Record
But an auditor may ask:
“How do you know the person is competent?”
Therefore, organizations should consider methods such as:
- Competency assessments
- Practical demonstrations
- Examinations
- Supervisor evaluation
- Observation
- Qualification verification
The objective is to demonstrate competence, not merely attendance.
12. Clause 8 — Operational Planning and Control
Operational controls translate the OH&S system into daily work.
Controls can apply to:
- Production
- Maintenance
- Procurement
- Contractors
- Visitors
- Outsourced processes
- Workplace changes
Examples include:
- Safe operating procedures
- Permit-to-work systems
- Lockout/tagout
- Machine guarding
- Chemical handling
- Traffic management
- Contractor controls
13. Management of Change
Changes can introduce new OH&S risks.
Examples:
- New machinery
- New chemicals
- New production processes
- Building modifications
- New contractors
- Organizational restructuring
- New working methods
Before implementing significant changes, organizations should consider the potential OH&S consequences.
This is where a mature management system moves beyond reacting to incidents and starts anticipating risk.
14. Procurement and Contractor Management
An organization’s OH&S risks don’t necessarily stop at its organizational boundary.
Contractors may introduce risks through:
- Construction activities
- Maintenance
- Transportation
- Electrical work
- Cleaning
- Security
- Equipment installation
Organizations should establish suitable criteria for:
- Contractor selection
- OH&S requirements
- Induction
- Monitoring
- Performance evaluation
15. Emergency Preparedness and Response
Organizations should identify potential emergency situations and establish appropriate response processes.
Depending on the organization, these may include:
- Fire
- Explosion
- Chemical spill
- Medical emergency
- Natural disaster
- Equipment failure
- Security incident
But having an emergency procedure isn’t enough.
Organizations should test their preparedness through appropriate:
- Drills
- Simulations
- Exercises
- Reviews
and retain evidence of the results and subsequent improvements.
16. Clause 9 — Performance Evaluation
How does management know whether the OH&S system is working?
Through monitoring and evaluation.
Potential indicators include:
- Incident rates
- Near misses
- Unsafe conditions
- Safety inspections
- Training performance
- Corrective-action closure
- Emergency drill results
- Legal compliance status
- OH&S objectives
The important question is not simply:
“Do you have KPIs?”
It is:
“What do the results tell management, and what action was taken?”
17. Internal Audit
Internal audits provide an important verification mechanism.
A good internal audit should evaluate:
Conformity
Is the organization meeting ISO 45001 requirements?
Implementation
Are documented processes actually being followed?
Effectiveness
Are the controls achieving their intended results?
An audit should not become a checklist exercise.
18. Management Review
Top management should periodically evaluate the performance and continuing suitability of the OH&S management system.
Inputs may include:
- Audit results
- Incident trends
- Compliance status
- OH&S objectives
- Worker consultation
- Risks and opportunities
- Resource requirements
- Improvement opportunities
The output should lead to decisions and actions.
19. Clause 10 — Improvement
ISO 45001 follows the principle of continual improvement.
When an incident or nonconformity occurs, the organization should determine:
- What happened?
- Why did it happen?
- What caused it?
- What action is required?
- Has the action been implemented?
- Was it effective?
Corrective Action vs Correction
These terms are often confused.
Correction
Immediate action to address the problem.
Corrective Action
Action to eliminate the cause of the problem and prevent recurrence.
Example:
Problem
Worker slips on an oily floor.
Correction
Clean the floor.
Corrective Action
Investigate why oil accumulation occurred and implement controls to prevent recurrence.
That difference is critical during an audit.
20. What Does an ISO 45001 Auditor Actually Look For?
An auditor typically wants to establish whether the management system is:
Documented
Are required processes and information established?
Implemented
Are employees actually following the processes?
Effective
Are the controls producing intended results?
Continually Improved
Does the organization learn from incidents, audits and performance results?
Evidence an Auditor May Examine
Depending on the organization’s scope and activities, evidence can include:
- OH&S Policy
- Hazard Identification Records
- Risk Assessments
- Legal Register
- Training Records
- Competence Evidence
- Worker Consultation Records
- Inspection Records
- Incident Reports
- Near-Miss Records
- Emergency Drill Reports
- Contractor Evaluation
- Operational Controls
- Internal Audit Reports
- Management Review Records
- Corrective Action Records
The Biggest ISO 45001 Implementation Mistake
The most common strategic mistake is treating ISO 45001 as:
“Prepare documents → conduct audit → obtain certificate.”
That approach may create a certification-ready folder, but it doesn’t necessarily create an effective OH&S management system.
A stronger approach is:
Understand the organization’s risks
↓
Design controls around actual operations
↓
Involve workers
↓
Implement
↓
Measure
↓
Audit
↓
Improve
This creates a system that can continue functioning after the certification audit is over.
ISO 45001 + ISO 9001 + ISO 14001
Organizations that already operate multiple ISO systems can consider an Integrated Management System (IMS).
ISO 9001
Quality
ISO 14001
Environment
ISO 45001
Occupational Health & Safety
Common elements can potentially be integrated across the three systems:
- Context
- Risk management
- Objectives
- Document control
- Training
- Internal audit
- Management review
- Corrective action
- Continual improvement
This can reduce duplication while creating a stronger enterprise governance framework.
Practical Implementation Roadmap
For a typical organization, the implementation can be structured as:
Phase 1 — Gap Analysis
Understand the current state.
Phase 2 — OH&S Risk Assessment
Identify hazards and evaluate risks.
Phase 3 — System Design
Develop processes, controls and documentation.
Phase 4 — Implementation
Put the system into operational practice.
Phase 5 — Awareness & Competence
Train and involve employees.
Phase 6 — Internal Audit
Verify conformity and effectiveness.
Phase 7 — Management Review
Evaluate overall system performance.
Phase 8 — Certification Audit
Prepare for independent certification assessment.
The actual duration varies according to organizational size, scope, risk profile, number of sites and management-system maturity.
Consultant’s Insight
ISO 45001 implementation should begin with the workplace—not the documentation.
Before writing procedures, understand:
- What work is actually being performed?
- Where can people be harmed?
- Which controls already exist?
- Which controls are ineffective?
- What do workers know that management may not?
- What incidents and near misses have occurred?
- What legal requirements apply?
Once these questions are answered, documentation becomes a representation of the organization’s actual management system rather than an artificial layer created for certification.
Why Trust CK Associates?
CK Associates brings 20+ years of consulting experience and 450+ certification projects across multiple industries and management-system standards.
Our experience includes:
- 45+ ISO 45001 implementations
- 400+ ISO 9001 implementations
- 45+ ISO 14001 implementations
- 25+ ISO/IEC 27001 projects
- 4+ ISO/IEC 42001 implementations
- 20+ years of consulting experience
- 450+ certification projects
Our approach focuses on practical implementation, audit readiness and management-system integration.
1. ISO 45001 Risk Assessment — Where Organizations Commonly Get It Wrong
Risk assessment is one of the most important components of an OH&S Management System.
Yet it is also one of the areas where organizations frequently create documentation that looks comprehensive but does not accurately represent their workplace risks.
A strong risk assessment should answer:
What can cause harm, who could be affected, how serious could the outcome be, what controls already exist, and what additional controls are required?
Common Mistake 1 — Copy-Paste Risk Assessments
A risk register copied from another organization may contain dozens of hazards but still fail to reflect the organization’s actual operations.
A pharmaceutical manufacturer, construction company and IT company should not have identical risk profiles.
Better approach: build the assessment around actual activities, workplaces, equipment and people.
Common Mistake 2 — Ignoring Non-Routine Activities
Organizations often assess normal production but overlook:
- Maintenance
- Shutdowns
- Cleaning
- Equipment installation
- Repairs
- Contractor activities
- Start-up and commissioning
These activities can introduce significantly different hazards.
Common Mistake 3 — Treating PPE as the First Control
PPE is important, but it should not automatically become the first response to every identified risk.
Organizations should consider the hierarchy of controls, including elimination, substitution and engineering controls before relying primarily on administrative controls and PPE.
Common Mistake 4 — Not Involving Workers
The person performing a task may understand its practical risks better than someone reviewing the process from an office.
Worker consultation can reveal:
- Hidden hazards
- Unsafe shortcuts
- Equipment problems
- Recurring near misses
- Ineffective controls
Worker participation is explicitly part of the ISO 45001 framework.
Common Mistake 5 — Ignoring Contractors
Contractors can introduce significant OH&S risks.
Risk assessment should consider activities such as:
- Electrical work
- Construction
- Maintenance
- Welding
- Cleaning
- Material handling
- Equipment installation
Common Mistake 6 — Failing to Review Risks After Changes
A risk assessment created two years ago may no longer represent today’s workplace.
Review should be triggered by changes such as:
- New machinery
- New chemicals
- New processes
- Workplace modifications
- New contractors
- Major incidents
- Organizational changes
Common Mistake 7 — Not Connecting Risk Assessment to Operational Controls
The risk register should not become a standalone Excel file.
The identified risks should influence:
- Procedures
- Training
- Engineering controls
- PPE
- Maintenance
- Emergency planning
- Procurement
- Contractor management
This is where risk assessment becomes an operational management tool.
2. A Practical ISO 45001 Risk-Assessment Model
A simple framework can be:
STEP 1 — Identify the Activity
Example:
Forklift movement inside warehouse
↓
STEP 2 — Identify the Hazard
Vehicle movement and pedestrian interaction.
↓
STEP 3 — Identify Potential Consequences
Collision, injury or property damage.
↓
STEP 4 — Evaluate the Risk
Consider appropriate likelihood and severity criteria.
↓
STEP 5 — Identify Existing Controls
For example:
- Marked pedestrian routes
- Speed limits
- Driver competence
- Warning systems
↓
STEP 6 — Determine Additional Controls
For example:
- Physical segregation
- Improved traffic management
- Additional monitoring
↓
STEP 7 — Assign Responsibility
Identify who is responsible for implementation.
↓
STEP 8 — Monitor Effectiveness
Verify whether the controls actually reduce the risk.
3. Incident Management and Near Misses
An effective OH&S system should not wait for a serious injury before learning from an event.
Near misses can provide valuable preventive information.
For example:
A worker almost falls from a platform but manages to regain balance.
There may be no injury.
But the event could reveal:
- Poor housekeeping
- Inadequate access
- Damaged equipment
- Weak procedures
- Insufficient training
The organization should investigate appropriately and determine whether corrective action is necessary.
4. Correction vs Corrective Action
This distinction is worth emphasizing.
Correction
Fix the immediate problem.
Corrective Action
Address the underlying cause to prevent recurrence.
Example:
Problem: Oil is found on a factory floor.
Correction: Clean the oil immediately.
Corrective action: Determine why the oil leak occurred, repair the source, review inspection controls and verify that the problem does not recur.
5. Certification Audit Readiness Checklist
Before inviting the certification body for the audit, organizations should verify:
Management System
☐ OH&S policy established
☐ Scope defined
☐ Context evaluated
☐ Interested parties identified
Risk Management
☐ Hazards identified
☐ OH&S risks assessed
☐ Controls implemented
☐ Risk assessments reviewed
Compliance
☐ Applicable requirements identified
☐ Compliance evaluation performed
☐ Actions tracked where necessary
Workforce
☐ Competence established
☐ Awareness completed
☐ Worker consultation demonstrated
Operations
☐ Operational controls implemented
☐ Contractor controls established
☐ Procurement controls considered
☐ Emergency arrangements tested
Performance
☐ OH&S objectives monitored
☐ Incidents investigated
☐ Corrective actions implemented
☐ Internal audit completed
☐ Management review completed
The goal is not to create evidence simply for the auditor.
The evidence should demonstrate that the management system is genuinely operating.
6. Is ISO 45001 Mandatory in India?
ISO 45001 certification itself is generally not a universal legal requirement for every organization in India.
However, organizations may face occupational health and safety obligations under applicable laws and regulations, and specific customers, tenders, contracts or supply chains may require evidence of an OH&S management system or certification.
Therefore, organizations should distinguish between:
Legal OH&S compliance
and
ISO 45001 certification.
ISO 45001 provides a structured management-system framework; it does not replace applicable statutory obligations.
7. ISO 45001 Certification — Who Issues the Certificate?
ISO develops and publishes the standard, but ISO itself does not certify organizations.
Certification is conducted by independent certification bodies.
The certification process typically involves assessment of the organization’s management system against the applicable requirements.
This distinction is important when selecting a consultant and certification body.
8. How Long Does ISO 45001 Certification Take?
There is no universal timeline.
The implementation period depends on:
- Employee strength
- Number of locations
- Industry
- Risk profile
- Existing systems
- Documentation maturity
- Regulatory complexity
- Management commitment
A small service organization with an existing management system may have a very different implementation timeline from a multi-site manufacturing organization.
A professional consultant should therefore assess the organization before promising a fixed certification timeline.
9. Can ISO 45001 Be Integrated With ISO 9001?
Yes.
This is one of the strongest strategic opportunities for organizations already operating multiple management systems.
ISO 9001
Quality
ISO 14001
Environment
ISO 45001
Occupational Health & Safety
Together they can form an:
Integrated Management System
Common processes can include:
- Risk management
- Document control
- Training
- Internal audits
- Management review
- Corrective action
- Objectives
- Continual improvement
10. ISO 45001 and the Future of Workplace Safety
Occupational health and safety is evolving.
Organizations are increasingly considering issues beyond traditional physical hazards, including:
- Psychosocial risks
- Remote work
- Contractor management
- Digitalization
- Climate-related workplace risks
- Workforce demographics
- Changing work patterns
The ISO 45000 family is also evolving. For example, ISO 45003 provides guidance on psychological health and safety at work, while ISO 45004 provides guidance on OH&S performance evaluation.
The ISO 45001 revision itself is currently under development, so organizations should distinguish between published requirements and draft requirements when planning their systems.
Frequently Asked Questions
What is ISO 45001?
ISO 45001 is an international standard specifying requirements for an Occupational Health and Safety Management System. It provides a framework for organizations to manage OH&S risks and improve performance.
What is the current version of ISO 45001?
As of 2026, the current published edition is ISO 45001:2018, with the 2024 climate-action amendment. A revised ISO/DIS 45001 is currently under development.
Is ISO 45001 mandatory?
Certification is not universally mandatory for all organizations. However, applicable legal requirements and customer or contractual requirements may create specific obligations.
Who needs ISO 45001?
Organizations of all sizes and sectors can implement ISO 45001.
What does ISO 45001 focus on?
It focuses on systematically managing occupational health and safety risks, preventing work-related injury and ill health, worker participation, compliance and continual improvement.
Does ISO 45001 guarantee zero accidents?
No. It provides a systematic framework for managing OH&S risks and improving performance. It cannot guarantee that incidents will never occur.
Can ISO 45001 integrate with ISO 9001?
Yes. Both use compatible management-system structures and can be integrated into an IMS.
How important is worker participation?
Very important. Worker consultation and participation are fundamental elements of ISO 45001.
Does ISO 45001 replace Indian safety laws?
No. ISO 45001 does not replace statutory requirements. Organizations must continue to identify and comply with applicable legal and regulatory requirements.
Can an IT company obtain ISO 45001?
Yes. ISO 45001 applies across sectors and can be relevant to IT organizations depending on their activities and OH&S risks.
What is the difference between ISO 45001 and OHSAS 18001?
ISO 45001 replaced OHSAS 18001 and introduced a modern management-system structure with stronger emphasis on leadership, worker participation, risk-based thinking and organizational context.
What is the role of internal audits?
Internal audits verify whether the OH&S management system conforms to requirements and is effectively implemented.
Q: What is ISO 45001 certification?
A: ISO 45001 certification demonstrates that an organization’s OH&S management system has been independently assessed against ISO 45001 requirements.
Q: What are the main requirements of ISO 45001?
A: The major requirements cover organizational context, leadership and worker participation, planning, support, operation, performance evaluation and improvement.
Q: Why should a company get ISO 45001 certified?
A: Organizations use ISO 45001 to systematically manage workplace risks, strengthen worker protection, improve OH&S performance, support compliance and demonstrate responsible safety management.
Q: Is ISO 45001 relevant to Indian companies?
A: Yes. Organizations operating in India can use ISO 45001 as an internationally recognized framework for managing occupational health and safety.
Q: What should an organization do before ISO 45001 certification?
A: Conduct a gap analysis, identify hazards and risks, establish controls, address applicable requirements, train personnel, implement the system, conduct an internal audit and complete management review before the certification audit.
Summary
ISO 45001 is an international Occupational Health and Safety Management System standard that helps organizations systematically identify hazards, assess OH&S risks, establish controls, involve workers, manage compliance, prepare for emergencies, monitor performance and continually improve. As of 2026, ISO 45001:2018 remains the current published edition, with a 2024 climate-action amendment, while a revised ISO/DIS 45001 is under development. Organizations considering certification should focus on practical implementation, evidence of effective risk controls, worker participation, internal auditing and management review rather than documentation alone.
