Requirements of ISO 45001

What does ISO 45001  actually ask of your organisation? In the Netherlands, NEN  publishes the standard as NEN-EN-ISO 45001, the Dutch-language version. On this page, we go through the chapters and explain what you need to do. We focus on practical application, not on repeating the standard’s wording. If you get stuck on technical terms, check the terms and definitions of ISO 45001, or jump straight to the Dutch checklist.

The structure of ISO 45001: High Level Structure

ISO 45001 follows the High Level Structure (HLS) , the same structure as ISO 9001, ISO 14001 and ISO 27001. This makes it easier to combine several management systems.

The structure is based on the PDCA cycle:

The principle is simple. You plan what you will do about occupational health and safety, carry it out, check whether it works, and adjust where needed. You repeat this continuously.

ISO 45001 checklist (Dutch)

Want to see at a glance what the standard asks per chapter? The readiness checklist below summarises the requirements in plain Dutch. Fill in the status column with “Yes”, “Partly” or “No”, so you can quickly see where gaps remain. Each row shows the chapter and the core question you should be able to answer.

Chapter 4: Context of the organisation

This chapter asks for insight into your organisation and its environment before you set up the OH&S management system.

Internal and external factors

You identify which factors affect your ability to achieve safe and healthy working conditions.

External factors can include the applicable laws and regulations, such as the Dutch Working Conditions Act (Arbowet), the labour market and the availability of qualified staff, technological developments that affect risks, and the expectations of clients and principals on safety.

Internal factors include the culture and attitude towards safety in the organisation, the competences and knowledge of employees, the available resources and infrastructure, and the nature of the work and the risks that come with it.

Needs of workers and interested parties

You determine who the relevant interested parties are and what they expect. What is unique to ISO 45001 is the explicit attention to workers as interested parties. Their needs and expectations on health and safety must be taken into account.

Other interested parties can include supervisory bodies such as the Netherlands Labour Authority (Nederlandse Arbeidsinspectie), principals with safety requirements, suppliers and subcontractors, and trade unions or works councils.

Defining the scope

You describe what your OH&S management system covers. Which activities, processes, locations and functions fall under it? The scope must cover all work that is under your control or influence.

You cannot arbitrarily exclude parts to avoid difficult risks. The auditor assesses whether the scope is logical and complete.

Chapter 5: Leadership and worker participation

This chapter is crucial. It sets ISO 45001 apart from many other standards because of its strong emphasis on both leadership and worker participation.

Leadership and commitment

Top management must be demonstrably involved in the OH&S management system. This is not a formality. The auditor asks for concrete evidence of involvement.

In practice, top management takes ultimate responsibility for preventing injury and ill health. They make sure the policy and objectives fit the strategic direction and provide the necessary resources. They also communicate the importance of safety and encourage a supportive culture.

OH&S policy

You write a health and safety policy that fits your organisation. The policy states that you provide safe working conditions and prevent injury and ill health. It also includes commitments to eliminating hazards, complying with laws and regulations, worker participation and continual improvement. For what exactly must be in it and how to link it to the Dutch Working Conditions Act, see the page Arbo policy under ISO 45001.

The policy is documented, communicated to all employees and made available to interested parties.

Worker participation

This is a key difference from other ISO standards. ISO 45001 requires workers to be actively involved in the management system, not only informed.

Workers must be consulted when determining needs and expectations, setting policy and objectives, identifying hazards and assessing risks, determining control measures, and investigating incidents.

Workers must also be able to take part in reporting dangerous situations, making improvement proposals and evaluating the effectiveness of measures.

Chapter 6: Planning

This chapter is about looking ahead: identifying hazards, assessing risks, identifying opportunities and setting objectives.

Risks and opportunities

You identify the risks and opportunities related to your OH&S management system. This covers risks that could lead to unwanted outcomes, but also opportunities to improve occupational health and safety.

An example of a risk is that new employees are not trained well enough before they do dangerous work. An example of an opportunity is that new technology can eliminate certain hazardous tasks.

Identifying hazards

This is the heart of ISO 45001. You systematically map the hazards present in your organisation.

The standard specifically mentions routine and non-routine activities, activities of everyone who has access to the workplace, emergencies, factors arising outside the workplace that affect workers, infrastructure, equipment and materials, changes to processes or activities, and human factors.

Hazards can be physical, such as machines, noise and vibration. They can be chemical, such as hazardous substances. They can be biological, such as pathogens. They can be ergonomic, such as lifting and screen work. Or they can be psychosocial, such as work pressure and aggression.

Assessing risks

For each hazard, you assess the risk by looking at the likelihood that something goes wrong and the severity of the possible consequences. You decide which risks get priority.

This process is similar to the legally required risk inventory and evaluation (RI&E), but in some respects it goes further. ISO 45001 also asks you to identify opportunities and to assess the risks of the management system itself.

OH&S objectives

You set objectives that are consistent with the policy and measurable where this is practical. The objectives apply to relevant functions and levels in the organisation.

Each objective needs a plan: what will you do, who is responsible, when must it be done, what resources are needed, and how will you evaluate the result?

An example of an objective is reducing sickness absence due to workplace accidents by 30% within 12 months, by introducing an improved workplace inspection programme.

Chapter 7: Support

This chapter covers the resources and support needed to make the system work.

Resources

You provide the resources needed: people, time, money, infrastructure and materials. Occupational safety costs resources, and there must be room for them.

Competence

Employees whose work can affect OH&S performance must be competent, based on education, training or experience. You determine which competences are needed, make sure people have them, and keep evidence.

This applies not only to operators who work with machines, but also to managers with safety responsibilities and to internal auditors.

Awareness

All employees must know the policy, the relevant objectives, their contribution to the system, the consequences of not meeting requirements, and the incidents reported and the outcomes of investigations.

Communication

You determine what you communicate, when, with whom and how, about the OH&S management system. This covers internal communication to employees and external communication to interested parties such as supervisory bodies and contractors.

Documented information

You keep the documentation that the standard requires and that you find necessary yourself. The standard leaves the form open: it can be a manual, but also a digital system, flowcharts or work instructions.

You manage this documentation so that it is up to date, available where needed and protected against unintended changes.

Chapter 8: Operation

This chapter is about carrying out your occupational health and safety approach in practice.

Operational planning and control

You plan and control the processes needed to meet the requirements and to control the risks you have identified.

This means setting criteria for processes, implementing control measures according to those criteria, and keeping documented information as evidence.

The standard specifically mentions the hierarchy of control measures: first eliminate the hazard, then substitute it with less dangerous alternatives, then apply technical measures, then administrative measures and warnings, and only as a last resort personal protective equipment.

Management of change

You control planned changes and assess the consequences of unintended changes. Before you introduce a new process or a new machine, you assess the impact on occupational health and safety.

Outsourcing and contractors

Processes you outsource must also be controlled. You determine which OH&S requirements you set for suppliers and contractors, and how you make sure they are met.

Procurement

You make sure that the purchase of products and services meets your OH&S requirements. Think of the purchase of machines, tools, hazardous substances and personal protective equipment.

Emergencies

You identify potential emergencies and prepare for them. Think of fire, explosion, leaks of hazardous substances or a serious accident.

You have plans to respond to emergencies, including first aid. You test these plans regularly through exercises, and after an emergency or incident you evaluate what can be learned. Read how to approach this on the page emergencies and ISO 45001, including a sample table with scenarios and exercise frequencies.

Chapter 9: Performance evaluation

This chapter is about measuring, analysing and evaluating.

Monitoring and measurement

You decide what you need to monitor and measure to know whether your system works and whether you achieve your objectives. This covers the extent to which legal requirements are met, progress towards objectives, the effectiveness of control measures, and proactive and reactive indicators.

Proactive indicators include, for example, the number of workplace inspections carried out or the percentage of employees who have had safety training. Reactive indicators include the number of accidents, sickness absence due to workplace accidents and the number of dangerous situations reported.

Evaluation of compliance

You periodically evaluate whether you comply with laws and regulations and other obligations you have committed to. This is more than knowing which rules apply. You actively check whether you follow them.

Internal audit

You carry out internal audits regularly to check whether the system meets the requirements of the standard and your own requirements, and whether it is implemented effectively.

The auditor must be independent and must not audit their own work. The results are reported to management.

Management review

Top management reviews the OH&S management system at planned intervals. The input includes the status of earlier actions, changes in context and needs, OH&S performance, results of worker participation, audit findings and opportunities for improvement.

The output includes conclusions about the system, decisions on improvements and on the resources needed.

Chapter 10: Improvement

The final chapter is about getting better continually.

Incidents and nonconformities

When something goes wrong, you investigate what happened and take measures to prevent it from happening again. The standard asks for a structured process for incident investigation and corrective action.

This applies not only to accidents with injury, but also to near misses and other nonconformities. You involve workers in the investigation.

Continual improvement

You continually improve the suitability, adequacy and effectiveness of the OH&S management system. This is not a one-off action but an ongoing process.

Improvement comes from meeting and tightening objectives, resolving nonconformities, seizing opportunities and learning from incidents.

Mandatory documentation under ISO 45001

The standard explicitly requires you to document the following:

Next step

Now that you know the requirements, read how the audit works, look at the overview of mandatory documents per chapter, or see the difference with VCA.