ISO 45001 standards: ISO 45003 for psychosocial risks
Alongside ISO 45001 itself, there are two guidance documents you can use: ISO 45002 for introducing the system, and ISO 45003 for psychosocial risks. These are guidance documents, not requirements you certify against. ISO 45003 helps you address psychosocial risks, such as work pressure, bullying and uncertainty about your job, within a management system based on ISO 45001. The ISO page on the 45000 family names ISO 45001 as the flagship of that family. ISO 45003 was announced on 11 June 2021 by ISO committee TC 283. You use it alongside ISO 45001, not instead of it. For what the Arbowet itself requires, read psychosocial workload and work pressure. PSA stands for psychosociale arbeidsbelasting (psychosocial workload).
On this page
We first show which standards belong to ISO 45001. Then we explain what ISO 45003 does and does not do, which three sources of psychosocial risk it distinguishes, and how to include them in your risk analysis. The example is a medium-sized office. The common mistakes follow after that.
Which standards belong to ISO 45001?
| Document | What it is | Certifiable? |
|---|---|---|
| ISO 45001:2018 | Requirements for the management system | Yes |
| ISO 45002:2023 | Guidance on implementing ISO 45001, with practical examples | No, guidance |
| ISO 45003:2021 | Guidance on psychosocial risks within an ISO 45001 system | No, guidance |
| ISO/PAS 45005:2020 | Guidance on safe working during the COVID-19 pandemic | No, guidance |
ISO 45001 and ISO 45005 appear on the ISO page for the family. ISO 45002 and ISO 45003 do not appear there, but they have been published. That they are guidance is clear from the wording: they give advice and do not set requirements. The national edition in the Netherlands is handled through NEN . Check the title and the current edition there.
What ISO 45003 is and is not
ISO 45003 gives practical steps for recognising hazards and reducing psychosocial risks. It is aimed at the employer who runs the system, not at the individual employee.
| Question | Answer |
|---|---|
| Is it a certification standard? | No. It is guidance with advice, not requirements. You certify against ISO 45001. |
| Does it belong to ISO 45001? | Yes, it builds on the requirements of ISO 45001. |
| Who is it for? | According to ISO, suitable for any organisation, including those without expertise in this area and very small organisations. |
| Does it replace the Arbowet? | No. The legal duty to carry out a risk inventory and evaluation (RI&E) and to address psychosocial workload still applies. See psychosocial workload under ISO 45001. |
You certify against ISO 45001, not ISO 45003. The auditor does check whether your psychosocial risks are included in your hazard analysis and control measures.
Three sources of psychosocial risk
ISO 45003 groups the sources into three areas. This makes them easier to search for.
- The organisation of work. Think of work pressure, unclear roles, little influence over your work, and shift work.
- Social factors. Think of bullying, discrimination, poor communication and a lack of support from colleagues or managers.
- The work environment. Think of noise, heat or an unsafe workplace, which cause stress and harm wellbeing.
The document also emphasises that you address the cause, not only the effect. An employee who drops out because of work pressure gains little from a stress management course if the planning stays unachievable.
Example: an office of 30 people
A consultancy firm with 30 employees sees that its sickness absence is above the sector average. A short survey and conversations with the works council (OR) show three themes: long working days around deadlines, an unclear division of client work, and little room to say no.
This is how the firm translates that into the risk register of ISO 45001:
| Source | Hazard | Consequence | Control measure | Owner | Check |
|---|---|---|---|---|---|
| Organisation of work | Deadlines peak each quarter | Overtime, dropout | Capacity planning per quarter, an agreed maximum number of hours per week | Team leaders | Quarterly hours report |
| Organisation of work | Unclear division of roles on client files | Duplicated work, frustration | Fixed account manager per client, role description | Management | Annual role check |
| Social factors | Little room to set boundaries | Silent stress | Fixed consultation on work pressure, confidential adviser known | HR | Half-yearly pulse survey |
The figures in this example are fictional. The point is the structure: source, hazard, consequence, measure, owner and check.
How to apply it in four steps
- Map the sources. Use the three areas above as a checklist. Involve employees and the works council (OR). See worker participation.
- Assess the risks. Place them in the same matrix as your other risks. A psychosocial risk has the same likelihood and consequence scoring as a machine risk.
- Choose measures in the right order. First remove the source, then adjust the organisation, and only then provide personal support. This follows the hierarchy of control measures.
- Evaluate and record. Measure again after six months. Note what you did and what it delivered. The auditor asks for that evidence.
What do you show at the audit?
The ISO 45001 auditor does not check whether you followed ISO 45003 to the letter. They check whether you have systematically included psychosocial risks. Show the following:
- A hazard register that includes psychosocial sources, with a review date.
- Minutes of consultation with employees or the works council about work pressure and safety. See worker participation.
- An overview of the measures per source, with owner and check.
- The result of a measurement, such as a pulse survey or questionnaire, and what you did with it.
- An example of a report or conversation, anonymised, and what happened afterwards.
You do not need to run large surveys. What matters is that it is clear you know what the issue is and that you respond to what you hear.
Link with the legal approach
In the Netherlands, the Arbowet requires employers to map and address psychosocial workload. ISO 45003 helps you work out that duty within a management system. It does not replace the legal approach. An RI&E that does not include psychosocial risks does not comply, even if you use ISO 45003.
So check whether your RI&E covers the three sources. Use the RI&E page to see where the overlap lies and where the RI&E goes further.
A practical sequence for the first year
- Months 1 to 2. Identify the sources through three or four conversations with team leaders and the OR.
- Month 3. Enter the sources in the hazard register and assess them for likelihood and consequence.
- Months 4 to 6. Choose the first two measures, each with a clear owner. Start with the source that has the greatest consequence.
- Months 7 to 9. Run a pulse survey and compare with the first measurement.
- Months 10 to 12. Evaluate, adjust the measures and feed this into the management review.
This sequence is an example. A small company can do it faster, a large company more slowly. What matters is the cycle: measure, act, measure again.
Common mistakes
- Keeping psychosocial risks outside the system. A separate plan alongside the RI&E is often seen by auditors as a loose add-on. Include the risks in the same hazard analysis.
- Running only a survey. A survey is a measuring point, not a control measure. Link the outcome to a concrete action and an owner.
- Confusing psychosocial issues with conflicts. A quarrel between two colleagues is an incident. A structural pattern of bullying or work pressure is a risk.
- Treating the guidance as a mandatory checklist. ISO 45003 leaves room. Choose what suits your business and explain why.
Frequently asked questions
Do I need to use ISO 45003 to get ISO 45001? No. ISO 45001 does require you to include psychosocial risks where they affect safety and health. ISO 45003 helps you do that well.
Is ISO 45003 too heavy for a small company? ISO says the guidance is also suitable for very small organisations. Start with the three areas and a short list. You do not have to tackle everything at once.
Does ISO 45003 replace the RI&E? No. The RI&E remains the legal basis. See RI&E and ISO 45001.
Where do I start? With the requirements of ISO 45001 on hazards and risks. The psychosocial approach fits in there as a fixed part.
Sources
- ISO: the 45000 family : the position of ISO 45001 within the family.
- ISO TC 283: ISO 45003 published : announcement of 11 June 2021, purpose and target audience.
- ISO/TC 283: ISO 45002 : guidance on implementing ISO 45001.
The status of ISO 45003 may change. According to ISO information we found elsewhere, the guidance is under systematic review. Check the current status with ISO or NEN before you refer to the guidance in a document for your client.