ISO 45001: When “Be Careful” Is No Longer Enough

Understanding why every organization needs a system for protecting people at work

It is 8:15 on a Monday morning.

In a construction company, a technician climbs a ladder to repair a faulty fitting. In a hospital, a nurse begins another busy shift. In a laboratory, a scientist opens a container of potentially infectious material. Somewhere else, a driver starts a six-hour journey, a factory operator switches on a machine, a cleaner prepares a chemical solution, while an accountant settles into a workstation where she may remain seated for most of the day.

These people work in completely different industries.

Yet they have something important in common:

Their work can affect their health and safety.

The danger may be obvious—a fall from height, moving machinery, electricity, a chemical spill or an infectious specimen. Or it may be less visible: poor ergonomics, excessive noise, fatigue, workplace stress, repetitive movement or an emergency for which nobody is adequately prepared.

Now imagine that something goes wrong.

The first questions usually come quickly:

Was the hazard known? Had anyone assessed the risk? Was there a safer way to do the work? Was the worker properly trained? Was the equipment maintained? Who was responsible? Had workers raised the concern before? And, perhaps most importantly, could this have been prevented?

Those questions take us directly to the reason ISO 45001 exists.

Safety should not depend on luck

Most organizations want their people to be safe. Posters may say “Safety First.” Workers may receive personal protective equipment. Fire extinguishers hang on walls. Safety instructions may even be included during induction.

But good intentions, PPE and safety slogans do not constitute a management system.

A workplace can have hard hats and still have poor safety management.

ISO 45001:2018 was developed around a much more fundamental idea: occupational health and safety should be systematically managed as part of how an organization is led and operated.

The attached standard describes the purpose of an OH&S management system in terms of providing a framework for managing OH&S risks and opportunities, with the intended outcomes of improving OH&S performance, fulfilling legal and other requirements, and achieving OH&S objectives.

In simpler terms:

Don’t wait for someone to get hurt before discovering what was unsafe. Build a system that continually asks what could cause harm, controls it, checks whether those controls work, and learns from what happens.

That is ISO 45001.

So, what exactly is ISO 45001?

ISO 45001:2018 – Occupational health and safety management systems — Requirements with guidance for use is the international standard for establishing, implementing, maintaining and continually improving an occupational health and safety management system.

It provides a framework through which an organization can systematically identify hazards, assess OH&S risks, determine applicable requirements, establish controls, prepare for emergencies, monitor performance, investigate incidents and continually improve.

Importantly, ISO 45001 is not restricted to factories, construction companies or oil and gas operations. The standard states that it is applicable to organizations regardless of size, type and activities. ISO similarly describes it as applicable across sectors and geographical locations.

That makes the standard relevant to considerably more workplaces than people sometimes imagine.

“But we work in an office. Why would we need ISO 45001?”

Because hazard does not mean only heavy machinery.

Consider how the same ISO 45001 thinking translates across very different workplaces.

Different hazards.

Same management question: How do we prevent work from harming people?

This systems approach is also emphasized by the International Labour Organization: workplace hazards need to be identified and their associated risks assessed and controlled, while occupational safety and health is integrated into organizational planning and management.

ISO 45001 moves us from reacting to preventing

Imagine an employee slips on a wet floor.

A purely reactive organization may:

Clean the floor → treat the injured employee → complete an incident form → tell everyone to be more careful.

ISO 45001 thinking goes further.

Why was the floor wet?

Perhaps a pipe leaks repeatedly.

Why hasn’t the leak been permanently repaired?

Perhaps maintenance requests are poorly managed.

Who else is exposed?

Employees, contractors, customers and visitors.

Can the hazard be eliminated?

Repair the leaking pipe.

Can the workplace be redesigned?

Improve drainage or flooring.

What should be monitored?

Inspections, near misses and recurrence.

Now one incident has become an opportunity to improve the system.

That distinction is fundamental.

ISO 45001 specifically requires organizations to use a hierarchy when eliminating hazards and reducing OH&S risks: elimination first, followed by substitution, engineering controls/reorganization of work, administrative controls including training, and finally appropriate PPE.

So sometimes the weakest answer to a safety problem is:

“We trained the workers.”

Training may be necessary, but if the hazard can reasonably be removed altogether, remove it.

It is not the HSE Officer’s management system

Another powerful idea in ISO 45001 is that occupational health and safety cannot simply be delegated to the Safety Officer.

Leadership matters.

The standard places responsibility and accountability on top management for preventing work-related injury and ill health and providing safe and healthy workplaces. It also expects OH&S requirements to be integrated into the organization’s business processes.

That has important practical implications.

When management purchases a new machine, OH&S matters.

When HR changes shift arrangements, OH&S matters.

When Procurement appoints a contractor, OH&S matters.

When Operations changes a process, OH&S matters.

When Finance determines whether resources will be available for an important control, OH&S matters.

And when strategic decisions change how people work, OH&S matters.

Safety therefore becomes part of management, rather than an activity performed by one department after everybody else has made their decisions.

Workers are not just people to be protected

They are also people to be heard.

ISO 45001 gives particular importance to consultation and participation of workers.

Why?

Because the person who performs a task every day often knows things about that task that a manager sitting in an office does not.

Workers should therefore participate in identifying hazards, assessing risks, determining controls, identifying training needs and investigating incidents and nonconformities.

Imagine a machine operator repeatedly reporting:

“This guard makes the machine difficult to clean, so people sometimes remove it.”

That statement is valuable safety information.

A mature system does not merely ask whether the worker violated a rule. It asks why the work is being performed that way and whether the equipment, procedure, training, supervision or design needs improvement.

That is how a safety culture begins to develop.

ISO 45001 is much more than preventing “accidents”

The language matters.

Occupational health and safety includes both injury and ill health.

Some workplace harm happens dramatically.

A fall.
A fire.
A chemical splash.
A vehicle collision.

Other harm develops quietly.

Repeated exposure to excessive noise.

Poor ergonomics.

Respiratory exposure.

Unhealthy working hours.

Fatigue.

Work-related psychosocial hazards.

ISO 45001’s guidance on operational controls recognizes issues such as ergonomics, unhealthy working hours, workload and other aspects of work organization alongside traditional physical hazards.

So the question is not simply:

“Did anyone have an accident today?”

A better question is:

“Could the way we organize and perform work cause injury or ill health—and what are we doing about it?”

How ISO 45001 works: Plan → Do → Check → Act

The architecture becomes easier to understand when we stop seeing ISO 45001 as a collection of clauses and instead see a management cycle.

PLAN: Understand the organization. Identify hazards. Assess risks and opportunities. Determine legal and other requirements. Establish OH&S objectives and decide what needs to be done.

DO: Provide resources. Ensure competence and awareness. Communicate. Control operations. Manage changes, procurement, contractors and outsourcing. Prepare for emergencies.

CHECK: Monitor and measure performance. Evaluate compliance. Conduct internal audits. Have top management review whether the system is working.

ACT: Investigate incidents and nonconformities. Correct problems. Address causes. Learn. Continually improve.

ISO identifies this Plan-Do-Check-Act (PDCA) methodology as the underlying approach for systematically managing OH&S risks.

And the cycle never really ends.

Because workplaces change.

People change.

Equipment changes.

Technology changes.

Laws change.

Processes change.

New hazards emerge.

That is why an effective OHSMS cannot be a file prepared for an auditor and revisited once a year.

What does an organization actually gain?

The most important benefit is human:

People should be able to come to work, do their jobs and return home without their work unnecessarily causing injury or ill health.

But the benefits extend beyond that.

ISO identifies potential benefits including systematic management of OH&S risks, fewer workplace incidents and injuries, stronger regulatory compliance, organizational resilience and continual improvement. Its practical guidance also highlights worker engagement, morale, recruitment and retention, and organizational reputation among potential benefits.

In practice, a well-implemented OHSMS can therefore contribute to:

1. fewer injuries, illnesses and dangerous occurrences;
2. reduced disruption and downtime;
3. stronger understanding of legal and other obligations;
4. better emergency readiness;
5. improved worker participation and safety culture;
6. better control of contractors and outsourced activities;
7. more informed purchasing and change decisions;
8. stronger organizational learning from incidents and near misses;
9. greater stakeholder confidence; and
10. continual improvement in OH&S performance.

But there is an important qualification:

The benefits come from implementing the system, not merely obtaining the certificate.

Certification can provide independent assurance, but ISO confirms that organizations may implement ISO 45001 whether or not they choose certification.

Perhaps the simplest way to understand ISO 45001

ISO 45001 asks an organization to develop the habit of asking good questions:

What could hurt people here?

Who could be affected?

What laws and other requirements apply?

Can we eliminate the hazard?

If we cannot eliminate it, how far can we reduce the risk?

Do our people have the resources and competence to work safely?

Have we listened to the people actually doing the work?

What happens when something changes?

Are our contractors working safely too?

What would we do if an emergency occurred today?

How do we know our controls are working?

When something goes wrong, do we simply blame someone, or do we learn from it?

And finally:

Are we safer today than we were yesterday?

That is the real value of ISO 45001.

It transforms occupational health and safety from a collection of signs, PPE, instructions and reactions into a management system for continually protecting people from work-related injury and ill health.

The ultimate evidence of a good OHSMS is therefore not the ISO 45001 certificate hanging in reception.

It is what happens before the accident that never happens.