Practical guide · Safety management
ISO 45001 in plain language: what each clause asks for and what an auditor looks at
Short answer
ISO 45001 is the international standard for an occupational health and safety (OH&S) management system: a way for an organization to find hazards, control risks, involve its workers, meet its legal requirements and keep improving. It is voluntary, and an organization can follow it without being certified.
ISO 45001 does not tell you which guard to fit or how many injuries are acceptable. It asks that you know your hazards and legal requirements, decide who is responsible, involve workers, control the work, check the results and fix the cause when something goes wrong. The current edition is ISO 45001:2018, the first edition, which ISO reviewed and confirmed in 2024. A 2024 amendment added climate action changes, and ISO lists a revision as under development with no publication date confirmed. The requirements sit in clauses 4 to 10, the same layout as ISO 9001 and ISO 14001. It is not a law: rules such as OSHA's apply on their own.
Last reviewed:
What is ISO 45001, and who is it for?
ISO 45001 sets requirements for an OH&S management system, with guidance for use. It covers the policy, objectives, planning, operation, audit and review of that system, and it follows plan, do, check, act. It suits any size of organization and can be combined with other ISO management system standards, such as ISO 9001 and ISO 14001, because they share the same ten-clause layout.
Two points are easy to miss. First, it is a management system standard, not a safety law. Following it does not replace compliance with OSHA rules in the United States or the safety rules where you operate, and a certificate is not proof of legal compliance. Check your local requirements. Second, conforming and certified are different. Conforming means you meet the requirements. Certified means an accredited outside body audited you and issued a certificate. The standard does not make certification compulsory. A customer or a tender is the usual reason to certify.
Workers are named in the standard itself: in the title of clause 4.2, in the title of clause 5 and in clause 5.4. A safety program built on safety tags, near miss reports and audits already does much of what the standard looks for, and the standard adds the management frame around it.
Which edition applies now, and is a new one coming?
ISO 45001:2018 is the current edition. It was published in March 2018 and is the first edition. ISO's page says the publication was last reviewed and confirmed in 2024, so the version remains current. One amendment exists: Amendment 1 of 2024, which makes climate action changes.
A revision is under way. ISO shows the standard at the stage called to be revised and lists a draft, ISO/DIS 45001, as the next version under development. A draft is not yet a standard, no publication date is shown, and nothing has replaced the 2018 edition. If you plan a certification or a recertification, ask your certification body in writing which edition it audits to and how it will handle a new one when it comes.
The clause walk below uses the ISO 45001:2018 numbering and titles, from the standard's contents page. The standard is paid, so buy the edition your auditor uses and read the clauses themselves. This page explains them in plain words and does not replace the text.
ISO 45001 clauses 4 to 10 in plain words
Clauses 1 to 3 cover scope, references and terms. The requirements are clauses 4 to 10, and they follow plan, do, check, act: 4 to 6 plan, 7 and 8 do, 9 checks and 10 acts.
Where clauses 4 to 10 sit in plan, do, check, act
- 1
Plan: clauses 4 to 6
- 2
Do: clauses 7 and 8
- 3
Check: clause 9
- 4
Act: clause 10
Back to planning with what the audit and review found
| Clause | Plain meaning | What an auditor looks at |
|---|---|---|
| 4 Context of the organization | Know what affects your OH&S system, what workers and other interested parties need, and set the scope (4.1 to 4.4). | The written scope, who is covered including contractors, a list of interested parties |
| 5 Leadership and worker participation | Top management owns the system, sets a policy, assigns roles and consults workers (5.1 to 5.4). | The posted policy, named responsibilities, minutes of safety committees, how workers are asked |
| 6 Planning | Find hazards, assess risks and opportunities, list legal and other requirements, set objectives (6.1.1 to 6.2.2). | A hazard register, a legal requirements list, objectives with owners |
| 7 Support | Resources, competence, awareness, communication and documented information (7.1 to 7.5). | Training records, how people know the hazards of their job, document control |
| 8 Operation | Control the work: eliminate hazards and reduce risk, manage change, control procurement, be ready for emergencies (8.1.1 to 8.2). | Machine guarding, lockout, contractor control, a change record, an emergency drill record |
| 9 Performance evaluation | Monitor and measure, evaluate compliance, audit, review as management (9.1.1 to 9.3). | Incident and inspection data, a compliance check, the audit programme, management review minutes |
| 10 Improvement | Investigate incidents, fix nonconformities with corrective action, and improve continually (10.1 to 10.3). | An incident investigation with the cause found and a closed action with an effectiveness check |
Clause 5 is where this standard differs most from a plain safety program: 5.4 asks for consultation and participation of workers, a requirement that sits beside leadership instead of under training.
Clause 4.2 asks about the needs and expectations of workers and other interested parties, and 4.3 sets the scope. Be clear whether temporary workers, contractors and visitors are in. Clause 5.2 is the OH&S policy, and 5.3 assigns organizational roles, responsibilities and authorities. People who can stop unsafe work need the authority to do it. See stop work authority.
Hazard identification and risk, clauses 6.1.2 and 8.1.2
Clause 6.1.2 is hazard identification and assessment of risks and opportunities. List the hazards by task and area, rate the risk, and decide what to do about it. Clause 8.1.2 is eliminating hazards and reducing OH&S risks: act in order of preference, from removing the hazard to protecting the worker. The order is set out in the hierarchy of controls. The standard does not prescribe a rating scale. This one is a common 5 by 5, and the risk matrix calculator and risk assessment guide show how it works.
| Hazard | Severity | Likelihood now | Risk now | Control added | Likelihood after | Risk after |
|---|---|---|---|---|---|---|
| Press brake nip point | 5 | 3 | 15 | Light curtain and two-hand control | 1 | 5 |
| Forklift and pedestrian crossing | 4 | 4 | 16 | Marked walkways and a barrier | 2 | 8 |
| Grinding noise | 3 | 4 | 12 | Enclosure around the station | 2 | 6 |
| Total | 43 | 19 |
Illustrative. 5 x 3 = 15, 4 x 4 = 16 and 3 x 4 = 12, so 15 + 16 + 12 = 43. After the controls, 5 x 1 = 5, 4 x 2 = 8 and 3 x 2 = 6, so 5 + 8 + 6 = 19. Severity does not change because the worst outcome is the same; the controls act on how likely it is. Where a hazard can be removed, that beats a guard.
Risk rating before and after controls (severity x likelihood, out of 25)
Example numbers- Press brake nip point: 15 risk points before, 5 after
- Forklift and pedestrian crossing: 16 risk points before, 8 after
- Grinding noise: 12 risk points before, 6 after
Risk ratings before and after controls: press brake nip point 15 to 5, forklift and pedestrian crossing 16 to 8, grinding noise 12 to 6.
Clause 6.1.3 is the determination of legal requirements and other requirements, which you list and keep current, and 9.1.2 asks you to evaluate compliance against them. Start from the OSHA compliance calendar if you are in the United States, and the risk register for the rest. Rules differ by country and region. This page is not legal advice.
Change, procurement and emergencies, clauses 8.1.3, 8.1.4 and 8.2
Clause 8.1.3 is management of change. When you add a machine, change a chemical, move a line or alter a shift pattern, assess the OH&S effect before you do it, not after. A short sheet signed before the change is enough. See the 4M change management sheet. Clause 8.1.4 is procurement, which includes contractors and what you buy: check that a supplier's equipment or a contractor's crew brings no new hazard onto your site.
Clause 8.2 is emergency preparedness and response. Decide what emergencies are possible on your site, such as a fire, a chemical release, a serious injury or a power loss, and have a plan, equipment and trained people for each. Run drills and record them. The emergency action plan guide and the template cover the plan.
Audit, review and improvement, clauses 9 and 10
Clause 9.2 covers the internal audit, with an audit programme in 9.2.2. Auditors do not audit their own work. Clause 9.3 is the management review: top management looks at the system at planned intervals and records its decisions. Use the ISO 45001 internal audit checklist and the safety audit checklist to run the checks, and the safety committee minutes as management review evidence.
Clause 10.2 is incident, nonconformity and corrective action. Report the incident, investigate it, find the cause, fix it, and check the fix. A near miss reported and closed is cheaper than an injury. See the incident investigation report, near miss reporting and CAPA. Clause 10.3 is continual improvement of the OH&S system.
How to start
Starting an OH&S management system in six steps
- 1
Set the scope and ask the workers
- 2
Build the hazard register
- 3
List your legal and other requirements
- 4
Control the highest risks first
- 5
Run one internal audit and one management review
- 6
Decide on certification
- 1
Set the scope and ask the workers
Decide who and what is covered, including contractors. Ask workers what hazards they see and what stops them reporting. This feeds clauses 4 and 5.4.
- 2
Build the hazard register
List hazards by area and task, rate the risk, and note the controls in place. A job hazard analysis is a good source. See the job hazard analysis guide.
- 3
List your legal and other requirements
Give each an owner and a review date.
- 4
Control the highest risks first
Use the order of preference in 8.1.2. Record who did what and when.
- 5
Run one internal audit and one management review
Do both before any outside audit. They show what the system looks like in use.
- 6
Decide on certification
Choose an accredited certification body, ask which edition it audits to, and agree it in writing.
Common ISO 45001 mistakes
- Treating worker participation as a suggestion box. Clause 5.4 is consultation and participation of workers, so ask them about hazards and act on what they say.
- Relying on PPE and training for every risk and skipping the controls above them.
- A hazard register written once for the audit and never updated when a process changes. Clause 8.1.3 is there to catch that.
- Forgetting contractors and visitors in the scope, then finding them in the incident log.
- Corrective actions that end with retraining and no check that the fix worked.
- Assuming certification means the site complies with safety law. It does not.
- Reporting only injury rates. Near misses and hazard reports show trouble sooner.
Safety Improvement
Report and control hazards in LeanSuite
Workplace safety in manufacturing, run from one platform: report hazards in seconds, fix them with tracked actions, train people and see safety KPIs on your tier boards.
Go deeper
This page is the short version. These guides cover each part in full.
- Top Five Common Manufacturing HazardsThe hazards that most often show up in the register for clause 6.1.2.
- Near Miss Reporting Prevents Future IncidentsHow reports of close calls feed incident investigation and corrective action in clause 10.2.
- Building a Proactive Safety Culture in ManufacturingLeadership and worker participation in practice, the intent behind clause 5.
- OSHA Audit Preparation: Reducing 40 Hours to 4 HoursHow keeping safety records current all year cuts the scramble before any external audit.
All our articles on this subject are in the safety management topic.
Free templates and tools
- PPE by zone posterWhat to wear in each area of the plant, for the entrances where PPE is the last control.
- ISO 45001 internal audit checklist44 audit questions for the plant floor in 16 safety topics, each with its ISO 45001:2018 clause, the evidence to look for and the sample to take, plus 12 worker interview prompts, a findings log and a summary by clause.
- Safety audit checklistThirty-four plant-wide safety checks answered Yes, No or N/A, scored by area, with a risk rating and an action for every No.
- Risk register templateOne scored list of operational risks with owners, actions and dates, a heat map and a review log.
- Job safety analysis (JSA) templateJob steps, hazards, risk scored before and after the controls, the hierarchy of controls, PPE and sign-off.
- Incident investigation report templateFacts and a sourced timeline, causes at three levels, actions by the hierarchy of controls, a US recordkeeping screen and a closure check.
- Near miss report formA two-page near miss report from the first report to closure, and an Excel log with status and days open.
- Emergency action plan templateA written emergency plan for a plant: site facts, roles and backups, warden coverage, scenario steps and a drill record.
- Safety committee meeting minutes templateMinutes for a safety committee: attendance, nine agenda items, an action log that carries open actions forward, and monthly numbers.
- OSHA compliance calendar (general industry)37 recurring federal OSHA duties with the paragraph, interval, owner, next due date and an overdue flag, plus a 12-month view and counts by owner.
- 4M change management sheet (change point)A shift log of every change to Man, Machine, Material, Method or Design, the extra checks after it and when normal checks resume, with a change point board.
- Training matrix template with expiry datesPeople by required trainings with expiry dates, OK, due, expired and missing flags, compliance by person and area, cover per training and a renewal list.
- Risk matrix calculatorSeverity times likelihood on a 3 x 3, 4 x 4 or 5 x 5 risk matrix, the band and its action, editable banding, and the score after further controls.
- TRIR and DART rate calculatorOSHA recordable and DART incident rates from your 300A case counts and hours, and what one more case does to them.
- Noise dose and TWA calculatorDose and 8-hour TWA for a shift of noise levels under OSHA and NIOSH, which limits are reached and how much loud time to cut.
Doing this in LeanSuite
Safety Improvement
Risk assessments start from the marketplace safety templates, every action on a hazard has an owner and a due date with delays flagged, and a floor-plan heat map shows where hazards cluster.
See Safety ImprovementSafety tags
Anyone on the floor reports a hazard, near miss or unsafe condition in seconds, it is routed to an owner and tracked until it is fixed.
See Safety tagsAudit Management
Build, schedule and run any shop floor audit or inspection, and turn every finding into a tracked action. Walk into any internal or external audit with a time-stamped record of every check and corrective action.
See Audit Management
See it on your own lines
Bring the problem you are working on to a 45-minute demo. Or look around with sample data first, or pilot LeanSuite on your own lines for 90 days, with the setup done by our team.
FAQ
Questions about iSO 45001
Not yet. ISO 45001:2018 is the current edition, and ISO reviewed and confirmed it in 2024. A 2024 amendment added climate action changes. ISO lists a revision as under development with a draft, ISO/DIS 45001, and shows no publication date. Ask your certification body how it will handle a new edition.
ISO 45001 is the international standard for an occupational health and safety management system. It asks an organization to find its hazards, control the risks, involve its workers, meet its legal requirements, check results and fix problems at the cause. It applies to any size and type of organization.
No. It is a voluntary standard. An organization can follow it without a certificate. Customers and tenders often ask for certification, and an accredited certification body then audits the organization against the standard.
No. ISO 45001 is a management system standard, not a law. OSHA rules in the United States and safety law elsewhere apply on their own. ISO 45001 asks you to find and meet your legal requirements, but a certificate is not proof that you comply. Check your local requirements.
The requirements are clauses 4 to 10: context of the organization, leadership and worker participation, planning, support, operation, performance evaluation and improvement. Clauses 1 to 3 cover scope, references and terms. These titles are from ISO 45001:2018.
Clause 5.4 is consultation and participation of workers. The clause title asks for workers to be consulted and to take part, so they are asked about the things that affect their safety, such as the hazards of their job, and what they say is used. A suggestion box on its own is a weak way to do it.
Related guides and tools
- ISO 9001 in plain language: the quality standard that shares the same clause layout
- ISO 14001 in plain language: the environmental standard, clause by clause
- Hierarchy of controls: the order of preference behind clause 8.1.2
- Risk assessment: a method for clause 6.1.2, with a 5 by 5 example
- Job hazard analysis: break a task into steps and find the hazard in each
More method guides
- The 6 Ms of production
- Poka-yoke
- Model area 90-day plans
- Moving from Excel to one system
- Reducing machine downtime: a worked month
- Andon
- Cycle time vs lead time, worked through
- Root cause analysis
- How many operators a line needs
- Reducing scrap and rework: a worked month
- Unsafe acts and unsafe conditions
- Just culture
- Stop-work authority
- Material review board (MRB)
- Nonconformance and NCRs
- Problem solving methods
- Quad chart
- OEE calculation
- Quality assurance vs quality control
- SOP meaning and format
- Job hazard analysis
- Near miss reporting
- Fishbone diagram
- Pareto chart
- Histogram
- Control chart
- What is a gemba walk
- What is lead time
- What is operational excellence
- How to improve product quality
- Preventive vs predictive maintenance
- Kanban
- FMEA
- PDSA cycle
- Safety moments
- Just-in-time manufacturing
- Kaizen
- 5S
- Total quality management (TQM)
- CAPA (corrective and preventive action)
- Layered process audit (LPA)
- Lean tools
- Lockout tagout (LOTO)
- A3 problem solving
- Preventive maintenance
- APQP
- High reliability organization (HRO)
- Manufacturing KPIs
- Quality metrics
- Practical problem solving
- CMMS
- Risk assessment
- Production efficiency
- Total productive maintenance (TPM)
- Reliability-centered maintenance (RCM)
- Hierarchy of controls
- Personal protective equipment (PPE)
- Emergency action plan
- Safety signs
- Warehouse safety
- ISO 9001
- SIPOC diagram
- Rolling action item list (RAIL)
- Pugh matrix
- Flowchart
- Project charter
- ISO 9001:2026
- Fleet maintenance
- IATF 16949
- AS9100
- ISO 14001
Or browse the topics, the full library and the lean glossary.
Rather see it on your own problem?
Bring the problem you are stuck on, and we will show you on a call how LeanSuite handles it.