What ISO 45001 is
ISO 45001 is the international standard that sets out the requirements for an occupational health and safety management system. Published in 2018, it replaced BS OHSAS 18001 and adopts the same ten-clause structure as the ISO standards on quality and environment, which makes integration into a single management system easier. It is currently under revision: the comment period on the ISO/DIS 45001 draft closed in September 2026 and the new edition is expected in the first half of 2027.
The standard does not impose technical measures: that choice belongs to the organization, within the hierarchy of controls. What it establishes is the method for getting there: identifying hazards and risks, planning the measures, verifying their effectiveness, and improving over time, with the participation of workers and direct responsibility on the part of top management.
Adoption is voluntary, as is certification, which is issued by an accredited body at the end of an audit.
What it brings to organizations
An example comes from Italy, where INAIL, the national workplace injury insurance institute, and Accredia, the national accreditation body, published a study in 2024. Across roughly 26,000 ISO 45001-certified companies, over the period 2017-2021, the injury frequency index is 22.6% lower and the severity ratio 29.2% lower than in an equal number of non-certified companies matched by region, size, insurance tariff class, and year. It is a statistical comparison: it measures a difference between the two groups, without establishing how much of it depends on certification and how much on the characteristics of the companies that choose it.
Certification also has a commercial value. It is a requirement that clients may ask for during supplier qualification, and in companies already certified to ISO 9001 or ISO 14001 it fits into the same audit and review cycle.
Why it matters for safety
ISO 45001 does not add obligations to those set by law, but it provides a method for keeping them under control over time, including when people, activities, or risks change.
Three elements of the standard have a direct effect on prevention.
- The definition of incident also covers events that could have caused injury or ill health without causing it. Near misses therefore enter the same investigation and action process as injuries.
- Worker participation is required at specific points, including hazard identification and incident investigation. People working in the field see risks that are not visible from the office.
- Every corrective action has to be verified for its effectiveness. The cycle closes when it is demonstrated that the problem does not recur.
What it requires: documented information
ISO 45001 uses the term “documented information” for everything the system has to keep in writing, and it uses two different verbs. Information to be maintained describes the system: policy, procedures, risk assessment, objectives. It is updated when the organization changes.
Information to be retained consists of records. They capture a fact on a date, such as training delivered, an inspection, or an incident investigation. Once produced they are not updated, because their value lies in stating what the situation was at that moment.
These are the main points at which the standard requires evidence to be retained.
| Clause | What has to be retained | Examples of records |
|---|---|---|
| 6.1.3 Legal and other requirements | The applicable requirements and their updating | Register of requirements with revision date |
| 6.2.2 Objectives and planning | The objectives and the plans to achieve them | Improvement plan with owners and deadlines |
| 7.2 Competence | Evidence of people’s competence | Certificates, training records, toolbox talks |
| 7.4 Communication | Evidence of communications, as appropriate | Meeting minutes, communications to workers |
| 8.1 Operational planning and control | What is needed to demonstrate that processes are carried out as planned | Work permits, checklists |
| 8.2 Emergencies | The process and the response plans | Emergency plans, evacuation drill reports |
| 9.1 Monitoring and evaluation of compliance | The results of monitoring and evaluation | Inspection and measurement results, calibration records |
| 9.2 Internal audit | Implementation of the program and its results | Audit reports |
| 9.3 Management review | The results of the review | Management review minutes |
| 10.2 Incidents, nonconformities, and corrective actions | The nature of the event, the actions taken and their results, including effectiveness | Near miss reports, investigations, action plans, effectiveness checks |
To be usable, a record has to be identifiable, for example by date and author, available when needed, and protected against loss of integrity (clauses 7.5.2 and 7.5.3). In practice it has to say when the fact occurred, who is accountable for it, and remain as it was on the day it was signed.
Where day-to-day organization matters
These are the requirements that depend most on day-to-day organization, because they involve several people, develop over long periods, or start from those working in the field.
Near miss reports. A near miss leaves no visible damage and is often mentioned verbally to the supervisor. Without a quick way to record it from the field, the event stays outside the system, and so do the investigation and the actions it would have required.
The clause 10.2 cycle. After the report, the standard calls for a timely reaction, an investigation with the participation of workers, a review of the risk assessment, corrective actions following the hierarchy of controls, and verification of their effectiveness. These steps are assigned to different people and can be months apart. The difficulty lies in maintaining the link between the initial event and the final verification.
Legal requirements. Applicable requirements change and the evaluation of compliance has to be repeated over time (clauses 6.1.3 and 9.1.2). The register needs updating, and every evaluation has to stay recorded with its date.
The integrity of records. With spreadsheets and shared folders, anyone with access can modify a file. Even where version history exists, reconstructing what a report said on the date it was signed takes time.
An operational view
When ISO 45001 forms are integrated into the safety management software, they are filled in within the same environment where people, equipment, deadlines, and events are managed. There is no need to build them from scratch or to keep them in a separate archive.
4HSE is integrating the ISO 45001 forms. Whoever manages safety will be able to link the relevant form to each event that requires one: a near miss report, an incident investigation, a nonconformity with its corrective action, an effectiveness check.
The forms will be provided ready to use, with an indication of the clause they refer to, and each organization will be able to adapt them to its own structure. Once completed and saved, the form becomes a dated document that is no longer modified. Subsequent developments are recorded in a new form linked to the first, so that the path from the event to the final verification remains traceable.
Sources and further reading
Standards and studies
- ISO 45001:2018, in particular 3.35, 5.4, 6.1.3, 6.2.2, 7.5, 8.1.2, 9.1, 10.2
- ISO/DIS 45001, ISO page on the revision
- INAIL-Accredia, The effectiveness of accredited certifications for occupational health and safety management systems (2024)
Further reading on 4HSE
- Near miss: what they are, why they matter and how to manage them
- Near miss management: why it’s becoming a global compliance requirement
- Configurable by design: what a safety management system needs from its software
- Operational compliance: the inspection is the preventive action, the record is its proof
- Leading and lagging indicators: measuring prevention, not just recording outcomes
- Mobile app and HSE in the field
- Events registry
- Nonconformities
- Preventive actions
