Mandatory documents for ISO 45001: overview by clause
ISO 45001 refers to “documented information”: documents you control (procedures, policies, plans) and records you keep as evidence (measurement results, training lists, incident reports). The ISO 45001 standard states per clause what you must record. The full Dutch-language standard can be consulted via NEN . On this page you will find the complete overview. Do you want the explanation per clause first? Read the requirements of ISO 45001, or use the checklist to assess your readiness. In this page, G&VW stands for safety, health and wellbeing (in Dutch: gezondheid, veiligheid en welzijn).
The standard requires that you document something, not the form it takes. A digital system, a Word document or a structured folder: all are fine, as long as the information is controlled, current and demonstrable.
Documented information vs records
ISO 45001 distinguishes two types of documented information.
Documents are information you control and keep up to date: policies, procedures, scope, risk assessments. They describe how you work or what you plan to do.
Records are evidence that something has taken place: training lists, audit reports, incident forms, measurement results. They are historical and are not changed (at most they are supplemented when an action is completed).
Mandatory documents by clause
Clause 4: context
| Document | Clause | Explanation |
|---|---|---|
| Scope of the G&VW management system | 4.3 | Description of which activities, locations and functions fall under the system |
| Description of the management system and its processes | 4.4 | Recording of the processes and how they interact |
Clause 5: leadership
| Document | Clause | Explanation |
|---|---|---|
| G&VW policy | 5.2 | Written Arbo policy adopted by the management |
| Roles, responsibilities and authorities | 5.3 | Who does what, and who has which authority in the area of safety |
Clause 6: planning
| Document | Clause | Explanation |
|---|---|---|
| Risks and opportunities of the system, and actions | 6.1.1 | Overview of the risks and opportunities that affect the management system |
| Hazards and G&VW risks | 6.1.2.1 | Hazard register with a risk assessment per hazard (overlaps with the RI&E) |
| Legal and other requirements | 6.1.3 | Current overview of the laws and regulations that apply to you |
| G&VW objectives and plans | 6.2.1, 6.2.2 | Measurable objectives with who, what, when and how |
Clause 7: support
| Document | Clause | Explanation |
|---|---|---|
| Competence information | 7.2 | Job profile plus evidence of education, training and diplomas per employee |
| Communication information | 7.4 | Overview of what you communicate, to whom, when and how |
In practice, the competence records are the most labour-intensive to keep up to date. Start early with collecting copies of diplomas and training certificates for each employee.
Clause 8: operation
| Document | Clause | Explanation |
|---|---|---|
| Operational control | 8.1 | Procedures or work instructions for activities with significant risk |
| Emergency preparedness and response | 8.2 | Emergency plan(s): scenarios, procedures, contact persons, drill dates |
Clause 9: performance evaluation
| Document | Clause | Explanation |
|---|---|---|
| Results of monitoring and measurement | 9.1.1 | Records of measurements: workplace inspections, indicators, compliance checks |
| Results of the evaluation of compliance | 9.1.2 | Evidence that you have periodically checked whether you comply with the law |
| Internal audit programme and results | 9.2.2 | Audit planning and audit reports |
| Results of the management review | 9.3 | Minutes or report of the management review |
Clause 10: improvement
| Document | Clause | Explanation |
|---|---|---|
| Incidents, nonconformities and corrective actions | 10.2 | Incident reports including root cause analysis and actions |
Records: the most common in practice
Alongside the formally required documents, there are records you will need in practice anyway to make the system work and to show evidence at an audit.
| Record | Why keep it? | Retention period |
|---|---|---|
| Training and courses | Evidence of competence per employee | At least the length of employment + 2 years |
| Workplace inspections | Evidence of proactive monitoring | At least 3 years (audit period) |
| Near misses | Input for improvement, evidence of a reporting culture | At least 3 years |
| Toolbox meetings (attendance lists) | Evidence of communication and awareness | At least 3 years |
| RI&E and action plan | Required by law and by ISO 45001 | Keep up to date; historical versions 5 years |
| PPE provision (PBM, personal protective equipment) | Evidence that equipment has been made available | At least 3 years |
| Emergency drills | Evidence of testing and evaluation | At least 3 years |
The Arbowet sometimes sets longer retention periods than the standard. For specific situations, such as exposure to hazardous substances, check the current laws and regulations. The retention obligation for exposure records can run up to 40 years.
Incident records
ISO 45001 requires you to record and investigate incidents and near misses (clause 10.2). A good incident record contains at least:
- Date, time and location of the incident
- Description of what happened
- Persons involved (employees, visitors, contractors)
- Direct and underlying causes
- Immediate measures taken
- Corrective action with a responsible person and a deadline
- Evaluation of whether the action was effective
It is not only about actual accidents with injury. The standard also requires you to report and record near misses. A culture in which people report near misses is a sign of a well-functioning system. For how to set up the register with fields and an example, read incident records under ISO 45001.
The RI&E as a mandatory document
The risk inventory and evaluation (RI&E) is, under ISO 45001, the elaboration of the hazard identification and risk assessment from clause 6.1.2. The RI&E is therefore a mandatory document under both the standard and the Arbowet (Dutch Working Conditions Act) . Read more about how they relate in the article on RI&E and ISO 45001.
Training records
Demonstrating competence (clause 7.2) requires evidence: diplomas, certificates, attendance lists for courses and toolbox meetings. For each employee, keep track of:
- Which role they have
- Which competences are required for that role
- Which evidence is available (copies of diplomas, training certificates)
- When recertification or refresher training is required
A simple spreadsheet or HR system is enough for small organisations. As you grow, a dedicated system is more user-friendly.
What you do NOT need to document
The standard does not require you to have an extensive handbook. Many organisations make things unnecessarily difficult for themselves by trying to record everything. The standard asks for documented information to the extent needed for the system to be effective.
A small organisation with clear processes may need only a policy, a hazard register, a few work instructions for hazardous work, and the records mentioned above. That is sufficient if the system demonstrably works.
Next step
Now that you know which documents you need, see how the requirements of ISO 45001 relate per clause, or use the checklist to assess your readiness.