ISO 45001:2018: documentation and compliance requirements

This is what ISO 45001:2018 requires you to have, clause by clause, and what an auditor will ask to see for each of it. It covers 85 requirements across 7 areas.

It is deliberately not a checklist. A checklist asks whether you have something; this says what is required and what counts as evidence, which is the question that matters when you are building a system rather than testing one. If you would rather find out where you stand first, the same ground is covered by our free ISO 45001:2018 readiness assessment, which scores you out of 100.

4 Your organisation and who is covered

Clauses 4.1, 4.2, 4.3, 4.4.

You must have written down the outside things that affect health and safety here — laws, contractors, weather, the site, your industry.

Evidence: A short list of these issues, with a note of when you last looked at it.

You must have written down the inside things — equipment, skills, shift patterns, workload, culture, money.

Evidence: The same list, covering internal issues.

You must have thought about whether climate change affects your workers — heat, cold, storms, air quality.

Evidence: A recorded decision either way.

You must have listed everyone with an interest — workers, contractors, agency staff, visitors, regulator, neighbours, insurer.

Evidence: A list of these groups.

You must have written down what they need from you, and which of those become legal or other duties.

Evidence: Their expectations, and which you have accepted as duties.

You must have written down what your health and safety system covers — which sites, activities and which groups of workers.

Evidence: A scope statement naming the sites and saying clearly whether contractors, agency staff, home workers and drivers are inside it.

The scope must include everyone who works under your control, not just your direct employees.

Evidence: The reasoning. Note that ISO 45001 does not let you leave out any part of the standard.

You must know what your main processes are and how they fit together.

Evidence: A process map or a list of processes with owners.

5 Leadership and involving workers

Clauses 5.1, 5.2, 5.3, 5.4.

The owner must be able to or senior manager show they take overall responsibility for preventing injury and ill health.

Evidence: Management review notes. Money spent on safety. Site walks. Ask them directly.

Senior managers must make sure the system has the time, money, people and equipment it needs.

Evidence: Budget. Staffing. Evidence a safety request was granted.

Senior managers must protect workers from being punished for reporting an incident, a hazard or a near miss.

Evidence: A written commitment. Evidence nobody has been penalised. Ask workers.

You must have a written health and safety policy that fits what you do.

Evidence: The policy, signed and dated.

The policy must promise safe and healthy working conditions, to get rid of hazards and reduce risk, to meet legal duties, to keep improving, and to consult workers.

Evidence: All five promises visible in the text. The consultation promise is the one most often missing.

The must be policy shared with workers and available to others who need it.

Evidence: Where it is displayed. Ask workers whether they have seen it.

It must be clear who is responsible for what in health and safety.

Evidence: Organisation chart. Responsibility list or job descriptions.

You must be able to answer: Does everyone know they can stop work they believe is unsafe, without getting into trouble?

Evidence: Written stop-work authority. Ask workers — this is tested by conversation.

You must ask workers for their views before you make health and safety decisions.

Evidence: Safety committee minutes. Team meeting notes. Consultation records.

Workers must be involved in spotting hazards, assessing risk and investigating incidents.

Evidence: Their names on risk assessments and investigation reports.

Workers must be who are not managers specifically involved, not just supervisors and managers.

Evidence: Who sits on the committee. Who was consulted. The standard asks for non-managerial workers by name.

You must have removed the things that stop workers taking part — language, shift timing, literacy, fear of blame, no time.

Evidence: Translated material. Meetings held on all shifts. Evidence of what you changed to make taking part easier.

6 Planning — hazards, risks and legal duties

Clauses 6.1.1, 6.1.2.1, 6.1.2.2, 6.1.2.3, 6.1.3, 6.1.4, 6.2.1, 6.2.2.

You must have worked out what could stop the health and safety system doing its job, and what opportunities there are.

Evidence: A risk and opportunity list at system level, separate from the hazard risk assessments.

You must have a way of spotting hazards that runs all the time, not just once a year.

Evidence: Hazard reporting route. Inspections. Records of hazards raised and dealt with.

You must be able to answer: Does hazard spotting cover non-routine work as well as normal work — maintenance, breakdowns, cleaning, one-off jobs?

Evidence: Hazards identified for these situations. Permit to work systems.

You must have considered how work is organised — workload, hours, shift patterns, bullying and harassment, stress.

Evidence: These recorded as hazards. They are required, and they are the ones most often left out.

You must have considered people near your work who are not your workers — visitors, the public, neighbours, delivery drivers.

Evidence: Hazards covering these people.

You must look again at hazards after an incident, a change or a new piece of equipment.

Evidence: Reassessments with dates and the reason for them.

You must assess health and safety risks using a method you have written down.

Evidence: The method and the scoring you use. Risk assessments for each significant hazard.

The risk must assessments describe what people actually do, not what the procedure says they should do.

Evidence: Evidence someone watched the job being done. Worker input on the assessment.

You must also look for opportunities to improve health and safety — better layout, better equipment, adapting work to people.

Evidence: An opportunities list kept separately from the risk assessments.

You must know which health and safety laws and other duties apply to you, and how you keep the list current.

Evidence: A legal register. Statutory registrations and test certificates with expiry dates. An update service.

The people must who have to follow those duties know about them.

Evidence: Evidence the requirements reached the shop floor.

You must have planned what you will do about your significant risks, your legal duties and your opportunities.

Evidence: An action plan linking each to a control or an action, with owners and dates.

You must have set health and safety objectives, and they must be able to be measured.

Evidence: Objectives with a target and a number. Use leading measures as well as injury counts.

For each objective, it must be clear what will be done, by whom, by when, with what, and how you will judge the result.

Evidence: An action plan covering all five points. Progress updates.

7 Support — people, awareness and documents

Clauses 7.1, 7.2, 7.3, 7.4.1, 7.4.2, 7.4.3, 7.5.1, 7.5.2, 7.5.3.

You must provide the people, money, equipment and time the system needs.

Evidence: Budget. Staffing. Safety equipment bought.

You must know what skills and tickets each safety-critical job needs.

Evidence: A competence list by role, including any qualification the law requires.

You must be able to show the people doing that work hold those skills and tickets, and that they are still in date.

Evidence: Certificates with expiry tracking — plant, working at height, confined space, electrical, first aid.

You must check contractors are competent before they start work.

Evidence: Contractor approval records. Copies of their tickets and method statements.

Workers must know the policy, the hazards of their own job, and what to do if something goes wrong.

Evidence: Induction and refresher records. Toolbox talks. Ask workers — this is how it is tested.

You must have told workers they can walk away from a situation they believe is seriously dangerous, without being punished.

Evidence: Written communication of that right. Ask workers whether they know about it. This is a specific requirement of ISO 45001 and it is routinely missed.

Workers must be told about incidents that have happened, and what came out of them.

Evidence: Safety alerts. Briefings after an incident. Notice boards.

You must have decided what needs to be communicated about health and safety, to whom, when and by whom.

Evidence: A communication plan or table.

You must be able to answer: Does communication reach everyone — all shifts, agency staff, contractors, people whose first language is different, people who cannot read easily?

Evidence: Translated or pictorial material. Shift handover arrangements. Evidence it reaches nights and weekends.

You must handle communication with people outside — contractors, visitors, regulators, emergency services.

Evidence: Visitor and contractor inductions. Regulator correspondence. Signage.

You must have the documents and records the standard asks for, plus whatever else you need.

Evidence: A list of documents and records held.

When a document is created or changed, it must be checked and approved before people use it.

Evidence: Approval on the document.

People must be able to find the current version where they need it, and are old versions taken away.

Evidence: How documents are shared. Old copies removed from noticeboards.

Records must be kept for as long as required — including the long periods the law sets for health records and exposure monitoring.

Evidence: A retention list. Health records often have to be kept for decades. Health information kept confidential.

8 Doing the work safely

Clauses 8.1.1, 8.1.2, 8.1.3, 8.1.4.1, 8.1.4.2, 8.1.4.3, 8.2.

You must have set out how safety-critical work must be done, and you must check it is being done that way.

Evidence: Safe systems of work. Method statements. Supervision and inspection records.

You must adapt the work to the people doing it, rather than expecting people to cope.

Evidence: Ergonomic changes. Job rotation. Equipment chosen to suit the user.

When you control a hazard, you must try to get rid of it or replace it before you fall back on protective equipment.

Evidence: Risk assessments showing the order tried: remove it, replace it, engineer it out, change how the work is organised, then rules and training, and only last personal protective equipment. A control column that just says 'PPE and training' throughout is a finding on its own.

Where personal protective equipment is used, it must be issued, checked, replaced and actually worn.

Evidence: Issue records. Inspection records. Evidence from site walks that it is being used.

You must be able to answer: Before you change something — new equipment, new process, new layout, new staffing, a new law — do you look at the safety effects first?

Evidence: Change records with a safety assessment done BEFORE the change. Temporary changes included.

Workers must be consulted about changes that affect their health and safety.

Evidence: Consultation records for actual changes made.

You must control the safety of what you buy — equipment, substances, services.

Evidence: Purchase specifications including safety requirements. Checks on delivery.

You must control contractors working for you or on your site.

Evidence: Contractor approval. Site rules and inductions. Permits to work. Supervision records.

Where your workers and a contractor's workers share a workplace, it must be clear who controls what.

Evidence: A written coordination arrangement. Evidence it is discussed before work starts.

Where you outsource work, you must keep control of the health and safety risks that come with it.

Evidence: Contract terms. Monitoring of the outsourced work.

You must have worked out what emergencies could happen here.

Evidence: A list of possible emergencies — fire, medical, rescue, spill, structural, violence.

You must have plans, equipment and trained people to deal with them.

Evidence: Emergency plans. First aiders and fire wardens with in-date training. Equipment inspection records.

You must have tested the plans, and you must have change anything as a result.

Evidence: Drill records with dates, who took part and what went wrong. Plans updated afterwards.

The plans must cover visitors, contractors and anyone else who might be on site.

Evidence: Evidence they are included in drills and inductions.

9 Checking how you are doing

Clauses 9.1.1, 9.1.2, 9.2.1, 9.2.2, 9.3.

You must have decided what you will measure, why, and how often.

Evidence: A monitoring plan. Both leading measures (inspections, near misses, training done, actions closed) and lagging ones (injuries, lost time, ill health).

You must carry out workplace inspections, and act on what you find.

Evidence: Inspection records with findings closed out.

Where health could be affected, you must do health surveillance or exposure monitoring.

Evidence: Occupational health records. Noise, dust or chemical monitoring. Lab reports.

You must know your measurements are reliable.

Evidence: Calibration certificates for monitoring equipment.

You must check, on a set schedule, whether you are actually complying with every legal duty on your register.

Evidence: A compliance evaluation with dates and conclusions against each duty. Statutory inspection and test certificates — lifting, pressure, electrical, local exhaust ventilation.

When you find you are not complying, you must act on it and record what you did.

Evidence: Records of breaches or notices and the action taken. Regulator correspondence.

You must audit your own health and safety system, covering the whole standard over time.

Evidence: An audit programme. Audit reports. Findings raised.

The must be audit plan based on where the risk is and on past problems.

Evidence: The reasoning behind the programme.

The auditors must be independent of the work they audit, and competent.

Evidence: Auditor training. Who audited what. In a small firm: swap with a colleague or use an outsider.

Audit results must be given to managers, to workers and to worker representatives.

Evidence: Evidence results were shared with workers, not just filed. ISO 45001 asks for this specifically.

Senior management must review the system at planned intervals.

Evidence: Review dates and attendance.

The review must cover everything the standard asks for.

Evidence: An agenda covering: previous actions, changes, performance, incidents, consultation and participation, compliance status, audit results, risks and opportunities, resources, improvement.

The review must produce decisions and actions, not just minutes.

Evidence: Decisions and an action list with owners and dates.

The relevant results of the review must be shared with workers and their representatives.

Evidence: Evidence of communication after the review.

10 Putting things right and getting better

Clauses 10.1, 10.2, 10.3.

You must look for ways to improve, rather than waiting for someone to get hurt.

Evidence: Improvement register. Projects completed.

You must record incidents — including near misses and ill health, not just injuries.

Evidence: An incident log covering all four. A high near-miss count usually means people trust the system.

When an incident happens, you must deal with it and stop it getting worse.

Evidence: Immediate actions recorded.

You must investigate why it happened, with workers taking part.

Evidence: Investigation reports with worker names on them. Root cause, not just 'operator error'.

You must check whether the same thing could happen elsewhere — another machine, shift, site or job.

Evidence: Evidence you looked wider than the one incident.

You must check later that your fix worked, and update the risk assessment.

Evidence: Follow-up record with a date. Revised risk assessments.

You must report to the authorities when the law requires it.

Evidence: Statutory reports submitted, with dates.

You must keep records of what happened, why, what you did and the result.

Evidence: An incident and corrective action log with all four.

You must be able to show health and safety is better than last year.

Evidence: Trends in incidents, near miss reporting, ill health and action closure. Objectives achieved. Worker survey results.

Using this document

Nothing above asks for a manual, a template pack, or a filing system. It asks for decisions that have been taken deliberately and can be shown to have been taken — which is a far smaller job than most organisations expect, and a different one.

Length is not compliance. A procedure nobody follows is worse than no procedure, because an auditor finds the gap between the two. The test we apply is whether the person who has to do the job recognises their own work in what is written down.