ISO 45001: How to Build an Occupational Health and Safety Management System
What does ISO 45001:2018 require, and what does this guide cover?
ISO 45001:2018 (the international standard for occupational health and safety management systems) specifies requirements that help an organisation prevent work-related injury and ill health, and provide safe and healthy workplaces. It replaced OHSAS 18001 and introduced a stronger emphasis on worker participation and the organisational context.
Like all recent ISO management system standards, ISO 45001 follows the High Level Structure, so its clause architecture aligns with ISO 14001, ISO 9001, and ISO 50001. This alignment makes it practical to integrate an OHSMS with an existing quality or environmental management system.
Building an OHSMS starts with identifying hazards, assessing the OH&S risks arising from those hazards, and planning controls. Clause 6.2 then requires measurable OH&S objectives and documented action plans. Clause 9 requires monitoring, measurement, and periodic internal audits. Worker participation runs through every stage as a mandatory requirement, not an optional good practice.
This guide covers the four main steps and explains how OHSMS software addresses each clause.
How do you identify hazards and assess OH&S risks under ISO 45001?
ISO 45001:2018 clause 6.1.2 requires the organisation to establish, implement, and maintain processes for hazard identification and OH&S risk assessment. Hazard identification must be proactive, covering routine and non-routine activities, emergency situations, human factors, and the work environment itself.
For each identified hazard, the organisation assesses the OH&S risk and determines appropriate controls using the hierarchy: elimination, substitution, engineering controls, administrative controls, and personal protective equipment, in that order. The outputs feed the planning of objectives and operational controls.
OHSMS software provides a structured register for hazards, their associated risks, and the controls assigned to each. When a significant near-miss or incident occurs, the software links it back to the relevant hazard entry, enabling root cause analysis without manual cross-referencing. For enterprise risk management that encompasses health and safety risks, the OHSMS risk register can feed into the organisation-wide risk picture.
How do you set OH&S objectives and action plans under ISO 45001?
ISO 45001:2018 clause 6.2 requires OH&S objectives to be consistent with the OH&S policy, measurable where practicable, and monitored. For each objective, the organisation must document what it will do, the resources required, who is responsible, when the action will be completed, and how results will be evaluated.
Objectives typically derive from the OH&S risk assessment, from incident patterns, from legal obligations, or from worker consultation. Examples include reducing the rate of near-misses reported in a specific department, completing mandatory safety training for all affected roles by a set date, or eliminating a particular hazard through an engineering change.
OHSMS software keeps the chain intact: each objective traces back to its source risk or incident and forward to the action plan assigned to it. Dashboard views show progress and flag overdue actions before audit.
How does worker participation and consultation work under ISO 45001?
ISO 45001:2018 is distinctive among management system standards in placing worker participation (clause 5.4) as a top-level requirement, not a support activity. Workers must be consulted on hazard identification, risk assessment, incident investigation, determination of controls, and the planning and review of the OHSMS itself.
In practice, this means the system must provide a mechanism for workers to raise hazard reports, contribute to risk assessments, and see the outcomes of their contributions. OHSMS software supports this by providing a worker-facing portal or mobile interface for hazard and near-miss reporting, and by recording which consultation steps were completed at each stage of the process.
Evidence of worker consultation is a common area of interest for certification auditors. Software captures timestamps, who was consulted, and how the inputs were considered, which forms the documentary evidence expected under clause 5.4.
How does OHSMS software cover ISO 45001:2018 requirements?
An OHSMS software tool structured around ISO 45001:2018 provides dedicated modules for: hazard identification and risk assessment register, legal and other requirements, OH&S objectives and action plans, operational controls, emergency preparedness, incident and near-miss management, internal audit management, worker participation records, nonconformity and corrective action, and management review preparation.
The Optivalue.ai platform operates 85 specialised agents (72 business agents, 12 sector agents, and 1 librarian agent, as documented in the platform's own product description [lu: logiciel-iso-45001.com/index.md]), which train on the organisation's compliance documents to cross-reference each clause of the standard against actual evidence. As a GRC platform that integrates the ISO 45001 OHSMS alongside other standards, it allows organisations certified to ISO 9001 or ISO 14001 to manage shared requirements once, without duplicating documentation.
The key selection criterion is whether the software closes the loop from hazard identification through risk control to incident learning, with audit-ready evidence at each step.
See how Optivalue.ai guides your ISO 45001 OHSMS. Book a demonstration
Frequently asked questions
What is ISO 45001:2018 and what replaced it?
ISO 45001:2018 is the current international standard for occupational health and safety management systems. It replaced OHSAS 18001, which was a British Standard rather than an ISO standard, and added stronger requirements for worker participation, organisational context, and integration with strategic direction.
What is the difference between a hazard and an OH&S risk under ISO 45001?
A hazard is any source with the potential to cause injury or ill health. An OH&S risk is the combination of the likelihood of that harm occurring and the severity of the consequence. ISO 45001:2018 clause 6.1.2 requires both identification of hazards and assessment of the associated risks as separate but linked activities.
Is worker participation a legal requirement under ISO 45001?
Worker participation is a requirement of ISO 45001:2018 clause 5.4, not merely a recommendation. Organisations must consult workers on hazard identification, risk assessment, incident investigation, determination of controls, and OHSMS planning and review. Failure to evidence this consultation is a common audit finding.
How does ISO 45001 relate to national health and safety legislation?
ISO 45001 provides a framework for managing OH&S risks systematically. It does not replace national legislation. Clause 6.1.3 requires the organisation to identify all applicable legal requirements and to demonstrate compliance. The standard is designed to be compatible with most national frameworks, but legal obligations take precedence where they are stricter.
Can ISO 45001 be managed within the same software tool as ISO 14001 and ISO 9001?
Yes. ISO 45001, ISO 14001, and ISO 9001 all follow the High Level Structure, so their common requirements (context, planning, support, performance evaluation, improvement) can be managed in one integrated system. A multi-standard platform avoids duplication of documents, audit schedules, and corrective action records.
<!-- JSON-LD -->
Back to top