RI&E and ISO 45001

The risk inventory and evaluation (RI&E) is legally required under the Arbowet (Dutch Working Conditions Act) . ISO 45001  also asks you to identify hazards and assess risks. The Nederlandse Arbeidsinspectie (Netherlands Labour Authority)  supervises compliance. How do the RI&E and ISO 45001 relate to each other? On this page we explain the overlap and the differences.

What is the RI&E?

The RI&E is a legal obligation under the Arbowet (Dutch Working Conditions Act) . Every employer must inventory and evaluate the risks in the business. The result is a document that describes which hazards are present, what the risks are, and which measures are needed.

The RI&E comes with an action plan (plan van aanpak): an overview of the measures you will take, with priorities and a timetable. The RI&E must be checked by a certified occupational health service or occupational health expert (arbodeskundige), unless you qualify for an exemption for small businesses.

The Nederlandse Arbeidsinspectie (Netherlands Labour Authority)  checks whether businesses have a current RI&E. If it is missing, you risk a fine.

What does ISO 45001 require?

Clause 6.1.2 of ISO 45001 asks you to identify hazards and assess occupational safety, health and wellbeing (G&VW) risks. This must be an ongoing, proactive process.

The standard specifically asks you to consider routine and non-routine activities, the activities of everyone at the workplace including visitors and contractors, emergencies, factors outside the workplace that can affect employees, infrastructure and equipment, changes to processes and activities, and human factors.

The standard also asks you to identify opportunities: possibilities to improve G&VW performance.

The overlap between the RI&E and ISO 45001

The RI&E and the hazard identification for ISO 45001 overlap considerably. Both require you to map hazards systematically, assess their severity and likelihood, prioritise risks, and decide on measures.

If you have a good, current RI&E, you have a solid basis for ISO 45001. You do not need to reinvent the wheel.

The differences between the RI&E and ISO 45001

Despite the overlap, there are important differences.

Scope

The legal RI&E focuses on the workplace and the work your employees do. ISO 45001 looks more broadly. The standard also asks you to look at factors outside the immediate workplace that can affect employees, such as home working or business travel. The risks of the management system itself must also be assessed.

Process approach

The RI&E is often a snapshot: you make it, have it checked, and finish the action plan. ISO 45001 requires an ongoing process. Hazard identification is not something you do once every few years. It is a continuous part of your management system.

The standard explicitly requires you to review the risk assessment when changes occur, after incidents, and at planned intervals.

Opportunities

The RI&E focuses on risks: what can go wrong, and how serious would it be? ISO 45001 also asks you to identify opportunities. What are the possibilities to improve safety, apart from the existing risks?

Worker participation

For the RI&E, employee involvement is legally required through the works council (ondernemingsraad) or staff representation body, which has a right of consent. ISO 45001 goes further. It asks for active participation by workers in the identification process itself, not only consent afterwards.

Management system context

The RI&E stands on its own as a legal obligation. In ISO 45001, hazard identification is part of a bigger whole. The outcomes must be linked to objectives, operational controls, monitoring and continual improvement.

Using your RI&E for ISO 45001

You can and should use your existing RI&E as a basis. Making two separate inventories would make no sense. In five steps, you turn your existing RI&E into a document that also meets ISO 45001.

We explain each step below.

Step 1: Check completeness

Go through your RI&E and check whether all the categories that ISO 45001 requires are covered. Have psychosocial workload (PSA) and work pressure been included? Have non-routine activities been assessed? Has the presence of third parties at the workplace been considered?

Fill in any gaps.

Step 2: Add opportunities

The RI&E focuses on risks. Add a section on opportunities. Which possibilities do you see to improve safety? These could be technological developments, redesigns, new working methods or partnerships.

Step 3: Keep it current

Make sure your RI&E does not end up in a drawer. Plan periodic reviews. Decide when you will revise the inventory: annually, after changes, or after incidents. Make this part of your management system.

Step 4: Link to the system

Connect the outcomes of your RI&E to the rest of your G&VW management system. Translate significant risks into objectives. Make sure operational controls are implemented and monitored. Include the status in the management review.

Step 5: Document worker participation

Record how workers were involved in the inventory. Who contributed ideas? How was their input taken into account? You will need this evidence during the audit.

The RI&E check and ISO 45001

The legal check of the RI&E by an occupational health service or occupational health expert is separate from ISO 45001 certification. They are two different assessments.

The RI&E check verifies whether your RI&E meets the legal requirements. The ISO 45001 audit assesses whether your G&VW management system meets the standard.

You need both. A checked RI&E is a legal requirement and also input for ISO 45001. But a checked RI&E alone is not enough for ISO 45001 certification.

Practical example

A medium-sized manufacturing company has an RI&E that was made and checked three years ago. For ISO 45001 certification, they approach it as follows.

They update the RI&E with recent changes: new machines, adjusted processes, and experiences from incidents. They add a section on psychosocial risks, which was only covered in limited detail in the original RI&E.

They organise working sessions with employees to go through the inventory. Do they see hazards that were missed? Do they recognise the assessments? This produces new insights and builds support.

They identify opportunities: a new machine that can eliminate dangerous manual work, and a redesign that reduces transport movements.

They link the top risks to objectives for the coming year and translate these into concrete actions with owners and deadlines.

The result is a document that complies with the Arbowet and with ISO 45001. No duplicate work, but a more complete picture.

Sector-specific RI&E tools

For many sectors, digital RI&E tools are available, often developed by trade associations. These tools are tailored to the specific risks of the sector.

Examples include the checked sector-specific Arbo catalogues (arbocatalogi) and sector tools provided through umbrella organisations. You can read how to use an arbocatalogue in your ISO 45001 system on a separate page.

These tools can help with both the legal RI&E and the input for ISO 45001. Check whether they are complete enough for the requirements of the standard.

Frequently asked questions

Is my RI&E enough for ISO 45001?

Probably not without changes. The RI&E is a good basis, but you need to embed it in a management system, link it to objectives, and maintain it continuously. You also need to be able to show that workers actively participated.

Do I need two separate documents?

No, you can have one integrated document that meets both the Arbowet and ISO 45001. Just make sure all elements of both are covered.

How often should I update the RI&E?

The Arbowet requires a current RI&E but does not prescribe a specific frequency. ISO 45001 requires periodic review, and review after changes or incidents. In practice, this means at least annually and additionally after relevant events.

Next step

Read more about identifying hazards and assessing risks for the practical approach, see how to draft your Arbo policy (arbobeleid) as an umbrella over the RI&E, or review the requirements of the standard.