Standard status
- Current published edition
- ISO 45001:2018, incorporating Amendment 1:2024
- Assessments conducted against
- The 2018 edition as amended.
- Scheme type
- Management systems (occupational health and safety)
ISO 45001 is the international standard for an occupational health and safety management system, the way an organization organizes itself to keep workplaces safe and healthy. The system assists in ensuring that work-related injury and ill health are prevented and that health and safety performance improves over time. An organization certified to ISO 45001 has had that system assessed against the standard by a certification body. The current edition is ISO 45001:2018, together with a 2024 amendment. Whether a buyer can rely on an ISO 45001 certificate depends on more than the standard: it depends on whether the certification body that issued it was independently accredited.
What an occupational health and safety management system is
An occupational health and safety management system is the set of policies, processes and responsibilities through which an organization finds the hazards in its work, judges and treats the risks they create, meets its legal duties, and keeps making the work safer. ISO 45001 does not set safety performance levels of its own and does not prescribe how the system must be designed. It defines what a capable system has to address, and leaves each organization to meet those requirements in a way that fits its size, sector and risk.
The standard's stated aim is a system whose results are continual improvement of health and safety performance, legal and other requirements met, and the organization's own health and safety objectives achieved. It applies to any organization, of any size and in any sector, and to the health and safety risks under that organization's control. It superseded OHSAS 18001, with migration completed in 2021, so a current accredited occupational health and safety certificate is an ISO 45001 certificate.
What makes ISO 45001 unlike the other widely held management system standards is the place it gives to workers. Consultation and participation of workers, at every applicable level and function, is a requirement running through the whole system, from setting the policy and identifying hazards to investigating incidents and deciding controls. A system designed without the input of the people doing the work does not meet this standard.
What ISO 45001 requires
The requirements are set out across seven areas, clauses 4 to 10, using the harmonized structure ISO now applies to its management system standards, with the plan-do-check-act cycle underneath. The subject matter threaded through them is hazards, risks and the people exposed to them.
Context of the organization
The organization works out which internal and external issues affect what it is trying to achieve and what its health and safety management system is meant to deliver. It identifies its workers and the other interested parties who matter to the system, what they need and expect, and which of those needs and expectations become requirements it takes on. It then draws the system's boundaries and establishes the processes the system is made of.
Leadership and worker participation
The clause title itself signals the difference from the other standards. Top management takes overall responsibility and accountability for preventing work-related injury and ill health, sets a health and safety policy with specific commitments including eliminating hazards, reducing risks and consulting workers, and assigns roles and authorities. Alongside leadership sits the worker-participation requirement, a process for consulting workers and their representatives in developing, planning, running, evaluating and improving the system. That process must provide:
• the mechanisms, time, training and resources that make participation possible;
• timely access to clear, understandable and relevant information about the system;
• identification and removal of the obstacles that stop people taking part, from language and literacy barriers to fear of reprisal;
• particular emphasis on consulting non-managerial workers, on named topics running from the policy and objectives to the controls applied to outsourcing, procurement and contractors.
Planning
Planning starts from the work itself. The organization:
• identifies its hazards on an ongoing basis, rather than as a one-off exercise;
• assesses the health and safety risks the hazards create, along with the other risks to the system, and identifies its opportunities to improve;
• establishes which legal requirements and other requirements apply to it;
• plans action on all of it, weighing best practice, what technology allows and its financial, operational and business circumstances;
• sets measurable health and safety objectives and plans how each will be reached.
Support
The resources the system needs, the competence of people whose work affects health and safety performance, their awareness of the hazards and risks that concern them and of their own role in the system, the internal and external communication the system depends on, and the records the standard and the organization require.
Operation
The operational clause carries four of the standard's most distinctive requirements:
• Controls follow a fixed hierarchy: eliminate the hazard first, then substitute something less hazardous, then engineering controls and work reorganization, then administrative controls including training, and personal protective equipment last, not first.
• Change is managed: a planned change to work, processes or equipment is assessed for the new hazards it could introduce before it goes ahead.
• Procurement is controlled, with the health and safety requirements extended to contractors and to outsourced functions and processes.
• The organization prepares for and responds to potential emergency situations, testing its planned response where practicable.
Performance evaluation
Monitoring, measuring, analyzing and evaluating health and safety performance, including evaluating whether legal requirements and other requirements are actually being met; internal audit; and management review by top management.
Improvement
The standard treats incidents as first-class events, not just nonconformities. Incidents and nonconformities are reported, investigated and acted on in a timely way, with workers participating in the evaluation and root causes determined so the event does not recur or occur elsewhere, existing risk assessments reviewed in light of it, and the system continually improved.
The 2024 amendment and the next edition
The current edition of the standard is ISO 45001:2018 as amended in 2024. The amendment concerns climate change considerations, in line with the change ISO made across its management system standards, which ask an organization to consider whether climate change is relevant to its context and to its interested parties' requirements. An organization certified to ISO 45001 meets the current edition including the amendment.
A revision of the whole standard is under development at ISO, with the next edition expected to replace ISO 45001:2018 in 2027. Nothing changes for certified organizations until it publishes, after which a transition period applies in the usual way. The status of the revision can be checked at iso.org.
Certification is not the whole story
An ISO 45001 certificate states that a certification body examined an organization's occupational health and safety management system and found it to meet the standard, within the certificate's scope and as matters stood at assessment. What it cannot show is the checking behind the certifier itself.
That is accreditation's job. ASCB assesses the certification bodies that certify OH&S management systems against ISO/IEC 17021-1, together with the sector-specific requirements that apply to a given scope, and works to ISO/IEC 17011, the international standard for accreditation bodies, in doing so.
An accredited ISO 45001 certificate therefore carries two independent checks: one on the organization, one on the body that certified it. An unaccredited certificate carries only the first, with nothing independent behind the certifier that issued it.
Accreditation is a periodic, risk-based assessment of a certification body against the requirements of the relevant standard, carried out by sampling and reflecting what was found at the time of assessment. It is not a continuous or exhaustive check, and it is not a guarantee of any individual certification decision or of any certified organization's products, services or outcomes. What it provides is independent, repeated assessment of the body issuing certificates against the requirements of ISO/IEC 17021-1, including its impartiality and the consistency of its decisions.
Why an accredited ISO 45001 certificate carries more weight
Health and safety certification is relied on where the stakes are highest: prequalification for construction and industrial work, supply chains where a contractor's safety record is the buyer's risk, and sectors where a certificate is often required to bid. An ISO 45001 certificate is itself a claim about how an organization manages danger to people, and the certificate is only as credible as the body that issued it. With accreditation, each layer can be confirmed rather than assumed: the certificate’s current status on IRQAO, the independent register and validation service recording certificates issued by ASCB-accredited bodies, and the certifier’s accreditation, with its scope, on ASCB’s verify page. None of it has to be accepted unverified.
In the sectors where a certificate is often required to bid, the wording that matters in prequalification is accredited certification, not certification alone. That is the difference between a credential a buyer can verify at both levels and a claim that cannot be independently checked.
Is ISO 45001 certification the same as accreditation?
No, and the two words are often used as if they mean the same thing. Certification applies to the organization: a certification body certifies that an organization's occupational health and safety management system meets ISO 45001. Accreditation applies to the certification body: an accreditation body assesses the certification body against ISO/IEC 17021-1. An organization is certified to ISO 45001. A certification body is accredited against ISO/IEC 17021-1. Accreditation is the last level of checking: accreditation bodies are not themselves accredited by a higher body, and what stands behind an accreditation body is the standard it works to. ASCB works to ISO/IEC 17011, the international standard setting the requirements for accreditation bodies.
How to check an ISO 45001 certificate
There are two separate checks, and they answer different questions. To confirm a specific certificate, verify it on the register on which the issuing body records its certificates; for ISO 45001 certificates issued by ASCB-accredited bodies, that is IRQAO. To confirm that the certification body itself is accredited, and to see the full scope of its accreditation, use ASCB's verify page. The two checks together are stronger than either alone: the first confirms the certificate is current, the second confirms the body that issued it was independently assessed and for what.
Where ISO 45001 sits among the standards
ISO 45001 is the certifiable requirements standard for occupational health and safety management:
• ISO/IEC 17021-1: the standard a certification body is assessed against to certify ISO 45001, and the accreditation behind an accredited ISO 45001 certificate.
• ISO 45002: general guidance on implementing an occupational health and safety management system; guidance, not a certification standard.
• ISO 45003: guidance on managing psychosocial risk within an ISO 45001 system, covering the psychological side of health and safety at work.
• ISO 19011: guidance for auditing management systems, which informs how an ISO 45001 system is audited.
• ISO 9001, ISO 14001 and ISO/IEC 27001: other widely held management system standards that share the same high-level structure, so an organization can run them as one integrated system.
Common questions
What is ISO 45001?
ISO 45001 is the international standard for an occupational health and safety management system. It sets out what an organization's system for keeping workplaces safe and healthy and keeping work-related injury and ill health from happening must address, without setting safety performance levels of its own.
What does ISO 45001 certification mean?
It means a certification body has assessed an organization's occupational health and safety management system and judged it to meet the requirements of ISO 45001, at the scope stated on the certificate and at the time of assessment.
What is the latest version of ISO 45001?
ISO 45001:2018, the first edition, as amended in 2024. A revision is under development at ISO, with the next edition expected in 2027; until it publishes, the 2018 edition as amended is the one organizations are certified to.
Did ISO 45001 replace OHSAS 18001?
Yes. ISO 45001 superseded OHSAS 18001, and the migration period ended in 2021. A current, accredited occupational health and safety certificate is an ISO 45001 certificate.
Does ISO 45001 certification guarantee a safe workplace?
No. Certification concerns the organization's management system, assessed against the standard at a point in time. It is evidence that a system meeting the standard's requirements was in place and operating, not a guarantee that no incident will occur.
What is the hierarchy of controls?
The order in which the standard requires risk to be treated: remove the hazard altogether first; failing that, swap in something less hazardous; then engineering controls and reorganizing the work; then administrative controls such as training; and personal protective equipment as the last layer rather than the first resort.
What is the difference between ISO 45001 certification and accreditation?
Certification is of the organization against ISO 45001. Accreditation is of the certification body against ISO/IEC 17021-1. Accreditation is the independent check on the certifier behind the certificate.
How do I check an ISO 45001 certificate is genuine?
Verify the certificate on the register on which the issuing body records it, and separately confirm on
ASCB's verify page that the certification body is accredited and for what scope.
How to apply
How to apply for accreditation to certify other organizations against ISO 45001, under ISO/IEC 17021-1, including the process, the fees and the application documents, is set out on Become Accredited.