ISO 45001 for SMEs: organising proportionately
ISO 45001 can work in a small or medium-sized business, as long as the health, safety and wellbeing (G&VW) management system fits your risks and daily practice. ISO describes the standard as applicable to organisations of all sizes. Start with your risk inventory and evaluation (RI&E) and ISO 45001, record worker participation using the practical guide, and use the step-by-step plan as your order of work.
A proportionate system does not carry less responsibility. It has fewer handovers, shorter documents and a rhythm people can sustain. The question is always: which risk are we controlling, who decides, what evidence does this produce, and when do we check that it works?
There is no universal minimum number of employees, and no fixed folder structure, that gets you ISO 45001 automatically. The scope, risks, legislation and way of working determine what is appropriate and demonstrable.
Start with a clear scope
Write down in one paragraph which activities, locations, employees and contracted parties your G&VW management system covers. A small company with an office, a workshop and field staff may have different risks. Make those differences visible without writing a separate handbook for every task.
Link the scope to your legal RI&E. ISO 45001 requires a systematic approach to hazards, objectives, control measures, evaluation and improvement. The RI&E remains the legal basis. The management system also shows how you choose, carry out, check and adjust your measures.
Divide roles that fit a small team
An owner can carry overall responsibility without making every record personally. Define three roles: who decides on policy and resources, who coordinates the system, and who brings risks and improvements in from day-to-day work. One employee can hold two roles, as long as that combination does not create a conflict of interest during internal checks.
| Element | Practical owner | Evidence produced |
|---|---|---|
| Policy and objectives | Management or owner | Signed policy, objectives and discussion |
| RI&E and measures | Prevention officer or coordinator | Current risks, action owners and status |
| Worker participation | Team meeting with site staff | Agenda item, decisions and feedback |
| Operational instruction | Line manager | Instruction, observation or short evaluation |
| Internal audit | Independent colleague or external party | Audit findings and corrective actions |
| Management review | Management | Decisions on performance, resources and next steps |
Use the meetings you already have. A monthly team meeting can cover incidents, changes, open measures and signals from employees at the same time. Do not just record that a meeting took place. Record which decision came out of it.
Fictional example: maintenance company KadeTech
This is a fictional example. KadeTech has 18 technical maintenance staff. The owner has overall responsibility, a work planner keeps the action list, and two engineers bring risks from field work into the monthly meeting. Each month, the team discusses one current work situation. Every quarter, the owner checks that measures have been carried out. The format is small, but the chain is visible: an employee reports a hazard, the responsible person plans a fix, management decides, and the team receives feedback.
Keep documentation short and evidence-based
Only create documents that support a decision or an action. A list of responsibilities, a risk action with an owner and a short work instruction are often more useful than a general policy manual. Keep version control and remove old instructions from the daily work folder, so employees do not have to choose between two versions.
For worker participation, you must be able to show how people report hazards, are consulted and hear what happens with their input. This can be a digital reporting form, a team meeting or a site walk-round. The standard does not require every company to use the same method.
Plan a workable improvement cycle
Choose a fixed rhythm for four activities: updating risks when things change, following up on measures, carrying out an internal audit and holding the management review. Link the frequency to your risks and changes. A busy workshop with many different jobs may need a short check more often than a stable office.
Do not measure incidents alone. Also look at reports, open actions, instructions that are not followed and signals from workplace inspections. This shows management whether the system is working preventively.
Frequently asked questions about ISO 45001 for SMEs
Is ISO 45001 too heavy for a small business?
It depends on your risks, client requirements and the level of control you want. Start with a scope and roles that you can actually maintain. A small company with high-risk work may need more structure than a larger office with stable activities.
Do I need a separate safety manager?
No. You do need expertise, clear responsibilities and time. An internal coordinator can handle day-to-day follow-up. For specialist risks or an independent audit, external support may be appropriate.
Can worker participation be digital?
Yes. The format can fit your organisation. Make sure employees can have an influence, that their input is assessed and that you report back on what was done with it.
Related pages
- RI&E and ISO 45001: the legal basis and management system.
- Worker participation: involving people in a way you can demonstrate.
- ISO 45001 for contractors: points to watch in practical, on-site work.