Knowledge base

ISO 45001 Documentation: What You Actually Need

A simple guide to the documentation required for ISO 45001.

Neha Dvivedi · 16 August 2026

ISO 45001 does not require organisations to create excessive paperwork. The focus is on keeping the right documents and records that show how health and safety risks are managed.

Documents You Must Maintain

Your organisation should have documented information covering :-

• OH&S Management System Scope – Define what areas, locations and activities are covered by your system.

• Health & Safety Policy – State your organisation’s commitment to protecting workers and improving workplace safety.

• Hazard Identification and Risk Assessment Process – Explain how you identify hazards, assess risks and decide on appropriate controls.

• Health & Safety Objectives and Plans – Define your safety goals and how you plan to achieve them.

• Legal and Other Requirements – Identify the laws, regulations and other safety requirements that apply to your organisation.

• Key Management System Information – Keep the information needed to make sure the OH&S management system works effectively.

Records You Must Keep

You should retain evidence showing that your safety management processes are actually being implemented. This includes:-

• Training and competence records

• Records of important communications

• Evidence that planned processes were properly carried out

• Monitoring, measurement and safety performance records

• Maintenance, calibration and verification records for monitoring equipment

• Results of legal and regulatory compliance evaluations

• Internal audit plans and results

• Management review records

• Records of incidents, nonconformities and actions taken

• Records showing that corrective actions were completed and effective

Documents Most Organisations Also Need

Some documents may not be directly listed as individual requirements, but they are normally needed to demonstrate that the controls in your system are working.

These may include:

• Risk assessments for different activities and tasks

• Safe work procedures for hazardous activities

• Permit-to-work procedures, where applicable

• Contractor management procedures and records

• Emergency response plans and emergency drill records

• Incident investigation reports

• Worker consultation and participation records, including safety committee meeting minutes

• Statutory inspection and certification records for equipment

• Training records and statutory competency certificates

• Health surveillance records, where applicable

What Should the Health & Safety Policy Include?

Your OH&S policy should clearly demonstrate the organisation’s commitment to:

• Providing safe and healthy working conditions

• Preventing work-related injuries and ill health

• Meeting applicable legal and other requirements

• Eliminating hazards and reducing OH&S risks

• Continually improving the OH&S management system

• Consulting and involving workers in health and safety matters

Worker consultation and participation is particularly important. It is sometimes missing from older policies, which can become a point of concern during an audit.

Practical Tips for ISO 45001 Documentation

1. Make Risk Assessments Practical

Write risk assessments in a way that workers can actually understand and use.

A risk assessment that workers have never seen or understood will not help control workplace risks.

2. Track Legal and Statutory Records

Keep statutory documents properly organised and monitor their expiry dates.

For example:

• Pressure vessel certificates

• Lifting equipment inspection certificates

• Electrical inspection records

• Factory licences and renewals

A simple tracker showing the document, responsible person and expiry date can help prevent avoidable nonconformities.

3. Document Worker Consultation

Keep records of safety meetings, consultations and worker participation.

However, remember that documents alone are not enough.

Auditors may speak directly with workers to confirm whether they are actually involved in safety-related activities.

4. Document Emergency Drills Properly

Do not simply record that an emergency drill was successfully completed.

Document:

• What happened

• How people responded

• What worked well

• What problems were identified

• What improvements are required

A drill report with no observations may suggest that the exercise was not properly evaluated.

Common ISO 45001 Findings

Some common issues identified during audits include:

1. The health and safety policy does not mention worker consultation and participation.

2. Risk assessments rely mainly on PPE and administrative controls instead of considering stronger controls such as elimination, substitution or engineering controls.

3. The legal register lists laws and regulations but does not include the organisation’s own licences, certificates and statutory approvals.

4. Statutory inspection or certification records have expired.

5. Safety committee meetings are documented, but there is little evidence of wider worker participation.

6. Incident investigations simply blame operator error and recommend retraining as the only corrective action.

The Key Point

ISO 45001 documentation is not about creating paperwork for the sake of paperwork.

The purpose is to demonstrate that your organisation understands its workplace hazards, controls its risks, meets legal requirements, involves workers and continually improves its health and safety performance.

What this covers

ISO 45001

See how this looks as a working system

Reading about a requirement and seeing the documentation that satisfies it are different things. In a short demo we open the actual manual, procedures and records set for ISO 45001, show you how each clause is answered and where your existing way of working already fits. You will know what implementation involves before you commit to it.