Health and safety policy under ISO 45001: what should it include?
ISO 45001 requires a written health and safety policy in clause 5.2 of the standard. The ISO 45001 standard sets clear requirements for its content: the policy records top management’s intentions on health and safety and forms the foundation of your management system. At the same time, the Arbowet (Dutch Working Conditions Act) requires employers to have a written health and safety policy as part of the RI&E (risk inventory and evaluation). The Nederlandse Arbeidsinspectie (Netherlands Labour Authority) checks whether this policy is in place and up to date. On this page we explain what should be in it, how it relates to the Arbowet and how to make a good link with your RI&E.
What does ISO 45001 require from your health and safety policy?
Clause 5.2 of ISO 45001 sets a number of specific requirements for the health and safety policy. The policy must:
- Include a commitment to provide safe and healthy working conditions and to prevent injury and ill health
- Provide a framework for setting health and safety objectives
- Include a commitment to eliminate hazards and reduce health and safety risks
- Include a commitment to comply with legal and other requirements
- Include a commitment to worker participation
- Include a commitment to continual improvement
Alongside these content requirements, the standard also sets process requirements. The policy must be documented, communicated to all employees and made available to relevant interested parties. Top management approves the policy and holds final responsibility for it.
A one-page policy that covers every element is better than three pages of vague text that circles the standard without saying anything concrete. The auditor checks whether the policy applies to your organisation and whether it is lived in practice.
Health and safety policy in the Arbowet
The Arbowet (Dutch Working Conditions Act) requires employers to have a written health and safety policy. This policy is part of the obligation to carry out an RI&E and an action plan. It describes how you, as an employer, handle working conditions.
The Arbowet requirements largely overlap with ISO 45001, but there are differences:
| Aspect | ISO 45001 (5.2) | Arbowet |
|---|---|---|
| Written policy | Required | Required |
| Safe working conditions | Required | Required |
| Worker participation | Required | Via OR/PVT consent right |
| Legal compliance | Required | Self-evident (it is the law itself) |
| Continual improvement | Required | Not explicitly required |
| Linking objectives | Required | Not explicitly required |
| Eliminating hazards (hierarchy) | Explicit | Implicit via the RI&E |
In practice you can create one policy document that meets both the Arbowet and ISO 45001. You do not need to keep two separate policy documents.
Link with the RI&E
Your health and safety policy does not stand alone. It is the umbrella over your RI&E and ISO 45001 system. The policy sets the frame, the RI&E makes the risks concrete, and the objectives in clause 6.2 turn the RI&E outcomes into action.
The link looks like this:
- Policy: “We aim to eliminate hazards and reduce risks”
- RI&E: identifies the hazards and assesses the risks (priority list)
- Objectives: “Address hazard X before [date], responsible: [name]”
- Monitoring: has the measure been taken? Does it work?
Make sure your policy reflects this connection. A policy that floats above practice, with no link to the RI&E and objectives, will not convince the auditor.
Auditors check whether the policy “applies to the organisation”. A generic policy that any organisation could have written is not enough. State the nature of your work and the specific risks in your sector.
Sample structure: health and safety policy for ISO 45001
Below is a structure that meets all the requirements of clause 5.2. Adapt the text to your own organisation.
Introduction and scope
Briefly describe who you are and what you do. State which activities, locations and employees the policy covers.
Example: “[Organisation name] is an installation company with 45 employees, active in industrial projects in the Benelux. This policy applies to all employees, temporary workers and contractors working on behalf of [name].”
Top management’s intent
Put top management’s commitment into your own words. Make it concrete, not vague.
Example: “The management of [name] aims to prevent injury and occupational illness. We provide safe and healthy working conditions and comply with applicable legislation, including the Arbowet and the Arbobesluit (Dutch Working Conditions Decree).”
Approach to hazards
Describe how you deal with hazards. Refer to the hierarchy of control measures.
Example: “We identify hazards systematically through our RI&E and assess the related risks. When determining measures, we follow the hierarchy: first eliminate, then substitute, then apply engineering controls, then administrative controls. Personal protective equipment supplements other measures and does not replace them.”
Worker participation
Record how employees are involved.
Example: “Employees are actively involved in identifying hazards, assessing risks and evaluating measures. They can report dangerous situations via [reporting system]. Results are fed back to them.”
Continual improvement
State the commitment to ongoing improvement.
Example: “We continually improve our management system based on the outcomes of internal audits, incident investigations, the management review and employee feedback.”
Signature
Top management adopts the policy. A date and signature make it demonstrable.
Communicating and making the policy available
The policy must be communicated to all employees. This does not mean everyone has to know it by heart. It means they know it exists, know where to find it and understand what it means for them.
Practical methods include discussing it in a team meeting when it is introduced, referring to it in the staff handbook, posting it on the intranet or in the workplace, and giving new employees a short introduction during onboarding.
External interested parties, such as clients or regulators, must be able to inspect the policy on request. It does not have to be published on your website, unless you want it to be.
How often should the policy be reviewed?
The standard does not set a minimum frequency, but it requires the policy to stay up to date. A review is needed when:
- Your activities or risk profile change significantly
- Legislation or regulations change
- The management review gives reason to make changes
- An incident shows that the policy does not fit practice well
In practice, most organisations review their policy every year, during the management review. That is a logical moment.
Next step
Your health and safety policy never stands alone. See how it connects with the requirements of ISO 45001, the RI&E and ISO 45001, and the mandatory documents you need to keep.