ISO 45001:2018: Documentation and Compliance Requirements

This guide explains what ISO 45001:2018 requires, clause by clause, and what an auditor may ask you to show as evidence.
It covers 85 requirements across 7 key areas.

This is not designed as a simple checklist. A checklist only asks, “Do you have this?” This guide explains what is required and what evidence can demonstrate that you are actually doing it.

If you first want to understand where your organisation currently stands, you can use an ISO 45001:2018 readiness assessment to evaluate your level of preparedness.

4. Understanding Your Organisation and Who Is Covered

Clauses 4.1, 4.2, 4.3 and 4.4

You need to identify outside factors that can affect occupational health and safety, such as:
• Laws and regulations
• Contractors
• Weather conditions
• Your workplace or site
• Industry-related risks

Evidence an auditor may ask for:

A list of these external issues, along with evidence of when they were last reviewed.
Understand internal issues
You also need to identify internal factors that can affect health and safety, such as:
• Equipment
• Employee skills
• Shift patterns
• Workload
• Workplace culture
• Available resources and budget

Evidence:

A documented list of relevant internal issues.
Consider climate change
You should consider whether climate change can affect your workers, for example:
• Extreme heat or cold
• Storms
• Flooding
• Poor air quality

Evidence:
A documented decision explaining whether climate change is relevant to your organisation and why.
Identify interested parties
Identify people or organisations that can affect or be affected by your health and safety system, such as:
• Employees
• Contractors
• Temporary or agency workers
• Visitors
• Regulators
• Neighbours
• Insurers

Evidence:
A list of relevant interested parties.
Understand their requirements
You need to identify what these interested parties expect from you and which requirements become legal or other obligations.

Evidence:
Documented expectations and the requirements you have accepted as applicable obligations.
Define the scope of your OH&S system
Clearly define what your health and safety management system covers, including:
• Locations
• Activities
• Employees
• Contractors
• Agency workers
• Home workers
• Drivers

Evidence:
A clear scope statement identifying what is included.
The scope should cover everyone working under your organisation's control, not only direct employees.
Evidence:
Documented reasoning showing why the scope covers the relevant people and activities.
Identify your processes
You should understand the main processes within your organisation and how they are connected.
Evidence:
A process map or list of processes, including who is responsible for each one.
________________________________________

5. Leadership and Worker Participation
Clauses 5.1, 5.2, 5.3 and 5.4

Top management must take responsibility
Top management should be able to demonstrate that they take overall responsibility for preventing workplace injuries and ill health.

Evidence may include:
• Management review records
• Safety-related spending
• Workplace visits
• Safety decisions
• Direct discussions with management
Provide necessary resources
Management must ensure that the OH&S system has enough:
• People
• Time
• Money
• Equipment
• Other necessary resources

Evidence:
Budgets, staffing records and examples of approved safety requirements.
Protect workers who report problems
Workers must not be punished for reporting:
• Incidents
• Hazards
• Near misses
• Safety concerns

Evidence:
A written commitment and feedback from workers showing that they can report concerns without fear.
Have an OH&S policy
You must have a documented health and safety policy that is suitable for your organisation.

Evidence:
A signed and dated policy.
The policy should include commitments to:
1. Provide safe and healthy working conditions
2. Eliminate hazards and reduce risks
3. Meet legal and other requirements
4. Continually improve the OH&S system
5. Consult and involve workers
The commitment to worker consultation is particularly important.
Make the policy available
Workers should know about the policy, and it should be available to relevant external parties when necessary.

Evidence:
Notice boards, intranet, website or other communication methods.
Define responsibilities
Everyone should clearly understand their health and safety responsibilities.

Evidence:

Evidence:
A written stop-work procedure or authority. Auditors may also ask workers directly about this.
Consult workers
Workers should be consulted before important health and safety decisions are made.

Evidence:
• Safety committee meetings
• Team meeting records
• Consultation records
Involve workers in risk management
Workers should participate in:
• Hazard identification
• Risk assessment
• Incident investigations

Evidence:
Worker names or participation records in risk assessments and investigations.
Non-managerial workers should also be involved, not only supervisors and managers.
Remove barriers to participation
You should identify and remove anything that makes worker participation difficult, such as:
• Language barriers
• Different shifts
• Literacy issues
• Fear of blame
• Lack of time

Evidence:
Translated materials, meetings across different shifts and other actions taken to make participation easier.
________________________________________

6. Planning – Hazards, Risks and Legal Requirements

Identify risks and opportunities
Identify anything that could prevent your OH&S system from achieving its objectives, as well as opportunities to improve it.

Evidence:
A documented list of OH&S risks and opportunities. This is separate from individual workplace hazard risk assessments.
Identify hazards continuously Hazard identification should be an ongoing activity, not something done only once a year.

Evidence:
• Hazard reporting system
• Workplace inspections
• Hazard reports
• Corrective action records
Include non-routine activities
Hazard identification must also cover unusual or occasional activities, such as:
• Maintenance
• Equipment breakdowns
• Cleaning
• Repairs
• One-time jobs

Evidence:
Risk assessments for these activities and, where applicable, permit-to-work systems.
Consider work organisation
Consider risks related to how work is organised, including:
• Long working hours
• Workload
• Shift patterns
• Stress
• Bullying
• Harassment

Evidence:
These issues should be included where they are relevant hazards.
Consider people outside your organisation
Consider people who may be affected by your activities, including:
• Visitors
• Customers
• Members of the public
• Neighbours
• Delivery drivers

Evidence:
Risk assessments covering these people where applicable.
Review hazards when things change
Risk assessments should be reviewed after:
• An incident
• A significant change
• New equipment
• Changes in processes

Evidence:
Updated risk assessments showing the date and reason for the review.
Use a defined risk assessment method
You should have a documented method for assessing health and safety risks.

Evidence:
• Risk assessment methodology
• Risk scoring system
• Completed risk assessments
The assessments should reflect how work is actually performed, not only how a procedure says it should be performed.

Evidence:

Worker involvement, workplace observations and practical job information.
Identify opportunities for improvement
Look for ways to make work safer, such as:
• Better workplace layout
• Improved equipment
• Better working methods
• Adapting work to workers

Evidence:
An improvement or opportunity register.
Identify legal requirements
You must know which health and safety laws and other requirements apply to your organisation.

Evidence:
• Legal register
• Licences and registrations
• Inspection certificates
• Testing certificates
• Evidence that legal information is regularly updated
Relevant employees should know about the requirements that apply to their work.
Plan actions
You need to plan how you will address:
• Significant risks
• Legal requirements
• OH&S opportunities

Evidence:
An action plan showing:
• What needs to be done
• Who is responsible
• Target dates
• Required controls or actions
Set measurable OH&S objectives
Your health and safety objectives should be measurable.
For example, instead of simply saying “Improve safety,” establish a measurable target.
Use both:
• Leading indicators: inspections completed, training completed, actions closed
• Lagging indicators: injuries, lost-time incidents and occupational illness
Plan how objectives will be achieved
For each objective, clearly define:
• What will be done
• Who will do it
• When it will be completed
• What resources are required
• How success will be measured

Evidence:
Action plans and progress reports.
________________________________________

7. Support – People, Competence, Awareness and Documents

Provide resources
Provide the people, money, equipment and time required to operate the OH&S system.

Evidence:
Budgets, staffing and safety equipment records.
Define competence requirements
Identify the skills and qualifications required for safety-critical jobs.

Evidence:
A competence matrix by role, including legally required qualifications.
Maintain employee competence
You must be able to show that people performing safety-critical work are competent and that their qualifications remain valid.

Evidence:
• Training certificates
• Licence records
• Expiry-date tracking
• Competence assessments
This may include qualifications for:
• Working at height
• Confined spaces
• Electrical work
• First aid
• Plant operation
Check contractor competence
Before contractors start work, verify that they have the required competence and qualifications.

Evidence:
• Contractor approval records
• Qualification certificates
• Method statements
• Competence records
Make workers aware
Workers should understand:
• The OH&S policy
• Hazards related to their work
• Relevant risks
• What to do during an emergency

Evidence:

• Induction records
• Refresher training
• Toolbox talks
• Worker interviews
Workers must know their right to stop unsafe work
Workers should know that they can move away from or stop work where they believe there is serious and immediate danger, without fear of punishment.

Evidence:
Written communication and worker interviews.
Share lessons from incidents
Workers should be informed about relevant incidents and lessons learned.

Evidence:
• Safety alerts
• Toolbox talks
• Incident briefings
• Notice boards
Have a communication plan
Decide:
• What needs to be communicated
• Who needs the information
• When it should be communicated
• Who is responsible for communicating it

Evidence:
Communication plan or communication matrix.
Communication should reach everyone, including:
• Night-shift workers
• Agency workers
• Contractors
• Workers speaking different languages
• Workers with limited literacy
Communicate with external parties
You may also need to communicate health and safety information to:
• Contractors
• Visitors
• Regulators
• Emergency services

Evidence:
Induction records, correspondence, signage and other communication records.
Control documented information
Maintain the documents and records required by ISO 45001 and those needed by your organisation.

Evidence:
A document and record list.
Approve documents
New or revised documents should be reviewed and approved before they are used.

Evidence:
Approval records on documents.
Control document versions
Workers should be able to easily find the current version, while outdated versions should be removed or clearly controlled.

Evidence:
Document-control records and workplace checks.
Retain records
Records must be retained for the required period, including health and exposure records where applicable.
Evidence:
Record-retention requirements and confidential storage of health information.
________________________________________

8. Operational Control – Doing the Work Safely

Define safe working methods
You need to establish how safety-critical work should be performed and verify that workers actually follow those controls.

Evidence:
• Safe work procedures
• Method statements
• Supervision records
• Inspection records
Adapt work to workers
Work should be designed around people rather than expecting workers to adapt to unsuitable conditions.

Evidence:
• Ergonomic improvements
• Job rotation
• Suitable equipment
Follow the hierarchy of controls
When controlling a hazard, first try to eliminate or reduce the hazard before relying on PPE.
The general order is:
1. Eliminate the hazard
2. Substitute it
3. Use engineering controls
4. Use administrative/work-practice controls
5. Use PPE as the last line of defence
If every risk assessment simply says “PPE and training,” this may indicate that higher-level controls have not been properly considered.
Control PPE
Where PPE is required, it should be:
• Properly selected
• Issued
• Inspected
• Replaced when necessary
• Properly used

Evidence:
PPE issue records, inspection records and workplace observations.
Control changes
Before introducing changes such as:
• New equipment
• New processes
• New layouts
• Staffing changes
• New legal requirements
you should assess their possible health and safety impact.

Evidence:
Change-management records showing that the safety assessment was completed before the change.
Temporary changes should also be considered.
Consult workers about changes
Workers should be consulted when changes may affect their health and safety.

Evidence:
Consultation records relating to actual workplace changes.
Control purchased products and services
Health and safety requirements should be considered when purchasing:
• Equipment
• Chemicals or substances
• Services

Evidence:
Purchase specifications and delivery checks.
Control contractors
Contractors working for or at your organisation should be properly controlled.

Evidence:
• Contractor approval
• Site induction
• Site rules
• Permits to work
• Supervision records
Coordinate with contractors
When your employees and contractor employees work together, responsibilities must be clear.

Evidence:
Written coordination arrangements and evidence of discussions before work begins.
Control outsourced activities
If an activity is outsourced, you still need to control the health and safety risks associated with it.

Evidence:
• Contract requirements
• Monitoring records
• Performance reviews
Identify emergencies
Identify emergencies that could occur at your workplace, such as:
• Fire
• Medical emergencies
• Rescue situations
• Chemical spills
• Structural failure
• Workplace violence
Prepare for emergencies
You need appropriate:
• Emergency plans
• Equipment
• Trained personnel

Evidence:
• Emergency plans
• First-aid training
• Fire warden training
• Equipment inspection records
Test emergency plans
Emergency arrangements should be tested through drills or other exercises.

Evidence:
Drill records showing what happened, who participated and what improvements were identified.
Plans should be updated when necessary.
Emergency arrangements should also consider:
• Visitors
• Contractors
• Other people present at the workplace
________________________________________

9. Performance Evaluation – Checking How You Are Doing

Decide what to measure
Define:
• What you will monitor
• Why you will monitor it
• How you will measure it
• How often you will measure it

Evidence:
A monitoring and measurement plan.
Use both:
Leading indicators
• Safety inspections
• Near-miss reports
• Training completion
• Corrective actions closed
Lagging indicators
• Injuries
• Lost-time incidents
• Occupational illness
Conduct workplace inspections
Regularly inspect the workplace and take action when problems are identified.

Evidence:
Inspection records and evidence that findings were closed.
Monitor workers' health and exposure
Where workplace conditions can affect health, appropriate health surveillance or exposure monitoring should be carried out.
This may include:
• Occupational health assessments
• Noise monitoring
• Dust monitoring
• Chemical exposure monitoring

Evidence:
Health records and monitoring reports.
Ensure measurements are reliable
Monitoring and measuring equipment should be appropriately calibrated or verified.

Evidence:
Calibration or verification certificates.
Evaluate legal compliance
Regularly check whether you are complying with the legal requirements identified in your legal register.

Evidence:
Compliance evaluation records with dates and conclusions.
This may include checks of:
• Lifting equipment
• Pressure equipment
• Electrical systems
• Ventilation systems
• Other statutory inspections
Correct non-compliance
When a legal or other compliance issue is identified, take action and record what was done.

Evidence:
Corrective action records, notices and relevant regulatory correspondence.
Conduct internal audits
Your organisation should audit its OH&S management system to check whether it meets ISO 45001 requirements and is effectively implemented.

Evidence:
• Audit programme
• Audit plans
• Audit reports
• Findings and corrective actions
Base audits on risk
The audit programme should consider:
• Risk level
• Previous problems
• Important processes
• Changes within the organisation
Use competent and independent auditors
Auditors should have suitable knowledge and should be independent of the activities they audit.

Evidence:
• Auditor training records
• Competence records
• Audit assignments
In a small organisation, internal audits can be exchanged between competent people or performed by an external auditor.
Share audit results
Audit results should be communicated to relevant:
• Management
• Workers
• Worker representatives

Evidence:
Records showing that audit results were communicated, not simply filed away.
Conduct management reviews
Top management should review the OH&S management system at planned intervals.
The review should consider:
• Previous actions
• Changes affecting the organisation
• OH&S performance
• Incidents
• Worker consultation and participation
• Legal compliance
• Audit results
• Risks and opportunities
• Resources
• Opportunities for improvement
Management review must lead to action
A management review should result in actual decisions and actions.

Evidence:
Action plans showing responsibilities and deadlines.
Relevant results should also be communicated to workers and worker representatives.
________________________________________

10. Improvement – Correct Problems and Keep Improving

Look for improvement opportunities
Do not wait for someone to get injured before improving safety.

Evidence:
• Improvement register
• Safety improvement projects
• Completed improvement actions
Record incidents
Record different types of incidents, including:
• Injuries
• Near misses
• Ill health
• Other relevant OH&S events

Evidence:
An incident register covering the relevant types of events.
Take immediate action
When an incident occurs, take immediate steps to control the situation and prevent further harm.

Evidence:
Records of immediate actions taken.
Investigate incidents
Investigate why the incident happened and involve workers in the investigation.
The investigation should look for root causes, rather than simply blaming an individual.

Evidence:
Investigation reports showing worker participation and identified causes.
Check whether the problem exists elsewhere
After an incident, consider whether the same risk could exist:
• On another machine
• On another shift
• At another location
• In another department
• During another activity

Evidence:
Records showing that wider checks were carried out.
Check whether corrective actions worked
After corrective action is taken, verify that it actually solved the problem.
Update the relevant risk assessment where necessary.

Evidence:
Follow-up records and revised risk assessments.
Report incidents where legally required
If the law requires an incident to be reported to an authority, make sure the report is submitted within the required time.

Evidence:
Copies of statutory reports and submission dates.
Maintain incident and corrective-action records
Records should clearly show:
• What happened
• Why it happened
• What action was taken
• What the result was
Demonstrate continual improvement
You should be able to demonstrate that your OH&S performance is improving over time.
Evidence may include:
• Incident trends
• Near-miss reporting
• Occupational health trends
• Corrective-action closure
• Achievement of OH&S objectives
• Worker feedback or surveys
________________________________________
How to Use This Guide

ISO 45001 does not require you to create a huge collection of manuals, templates and documents simply for the sake of documentation.

The real focus is on making appropriate decisions, implementing them and being able to demonstrate that they were actually implemented.

A long procedure does not automatically mean compliance.
In fact, a procedure that nobody follows can create a bigger problem because an auditor may identify the difference between what is written and what actually happens.

The important question is:

Does the documented system reflect what people actually do at work?

A good ISO 45001 system should be practical, understood by workers and effectively implemented—not just a collection of documents prepared for an audit.