The international standard for occupational health and safety

ISO 45001:2018 is the first truly international ISO standard for occupational health and safety (OH&S) management systems. It was published in March 2018 and replaced the earlier British standard OHSAS 18001:2007. The standard was developed by the International Organization for Standardization (ISO) with the participation of experts from more than 70 countries.

The key difference from OHSAS 18001: ISO 45001 places much greater emphasis on leadership, worker participation, the context of the organization and management of change. It is no longer enough for occupational safety to be handled by the safety professional alone - top management must be actively involved in the system and take responsibility for it.

Why do companies pursue certification?

• Legal compliance: The standard requires you to identify all applicable laws and regulations, keep them documented (usually in a legal register) and have a process for tracking changes - which keeps your compliance with occupational health and safety legislation under systematic control.
• Lower costs: Companies with ISO 45001 report on average 30-50% fewer workplace injuries, which means less sick leave, lower insurance premiums, and fewer lawsuits and regulatory fines.
• Competitive advantage: Many public tenders and large international corporations require ISO 45001 certification from their suppliers and subcontractors.
• Integrated management system (IMS): The standard uses the same high-level structure (HLS) as ISO 9001 (quality) and ISO 14001 (environment), so it integrates easily into your existing ISO systems.
• Safety culture: The standard isn't just about paperwork - it requires building a real culture of prevention in which every worker takes responsibility for safety.
• Employee satisfaction and retention: Workers feel safer, which increases productivity and reduces staff turnover.

What does the standard require? (Clauses 4.1 - 4.4)

This is the foundation of the whole system. An organization must understand itself and its environment before it can build an effective OH&S management system:

• 4.1 Understanding the organization and its context: Identify the internal and external issues that affect the OH&S management system (e.g. the regulatory framework you operate in, your industry, safety culture, economic conditions, location).
• 4.2 Understanding the needs and expectations of workers and other interested parties: Who are the interested parties (workers, trade unions, regulatory authorities, customers, subcontractors, insurance companies) and what do they expect from the OH&S management system?
• 4.3 Determining the scope of the OH&S management system: Clearly define which sites, processes and activities the certificate covers. The scope must be documented.
• 4.4 OH&S management system: Establish, implement, maintain and continually improve the system in accordance with the requirements of the standard.

What does the auditor check?

The auditor will look for evidence that:

• There is a documented context analysis (SWOT, PESTLE or equivalent) that covers OH&S aspects.
• There is a list of interested parties and their requirements (including the legal requirements that apply to your organization).
• The scope of the system is clearly defined and available as documented information.

How PRIMO Manager helps

In the Compliance and Risk Management module, PRIMO Manager lets you maintain a register of interested parties and their requirements, as well as a legal register of all applicable regulations. When a law or regulation changes, the system automatically creates a notification and an update task. This covers clause 4.2 from one central place.

What does the standard require? (Clauses 5.1 - 5.4)

In terms of the change in philosophy compared to OHSAS 18001, this is the most important clause. Top management can't delegate occupational safety and "forget about it":

• 5.1 Leadership and commitment: Top management must take overall responsibility and accountability for the OH&S management system. It must provide resources, promote a safety culture and protect workers from reprisals when they report hazards.
• 5.2 OH&S policy: Top management must establish and sign an OH&S policy that includes a commitment to safe working conditions, the prevention of injuries, compliance with legal requirements and continual improvement. The policy must be documented, communicated to all workers and available to interested parties.
• 5.3 Organizational roles, responsibilities and authorities: Clearly define who is responsible for what. In practice, this includes the OH&S professional, managers and supervisors with delegated safety responsibilities, worker safety representatives and the members of the health and safety committee.
• 5.4 Consultation and participation of workers: Workers must be actively consulted on OH&S matters. This isn't a formality - the auditor will talk to workers on site and check whether they are genuinely involved in hazard identification and decision-making.

What does the auditor check?

• An OH&S policy signed by top management (the managing director or a board member).
• Evidence that management takes part in system reviews (management review) and makes decisions on OH&S resources.
• An organizational chart with clearly defined OH&S roles.
• Minutes of health and safety committee meetings, records of worker consultations and evidence that worker safety representatives take part in risk assessments.
• The auditor will talk to workers without management present - to check whether they know the OH&S policy, know whom to report a hazard to and feel safe doing so.

How PRIMO Manager helps

PRIMO Manager records all worker consultation and participation through its integrated documentation system. The OH&S policy is stored and distributed digitally to all employees, with read confirmation. Health and safety committee meeting minutes are kept in the system, with automatic reminders so that meetings are held at the required intervals. Every worker can use the system to report a hazard or a near miss, which demonstrates active participation.

What does the standard require? (Clauses 6.1 - 6.2)

Clause 6 is the heart of operational planning and covers three key processes:

6.1.2.1 Hazard identification

This is the most extensive requirement of clause 6. The organization must establish a process for ongoing hazard identification that takes into account:

• Routine and non-routine activities - everyday work, but also occasional activities such as maintenance, cleaning and repairs.
• Human factors - workers' capabilities, limitations and experience.
• New or changed hazards - new machinery, processes, materials, organizational changes.
• Potential emergency situations - fire, explosion, chemical spills, earthquakes.
• People in the vicinity of the workplace - visitors, contractors, the public.
• Past incidents (internal and external) and near misses.
• Psychosocial factors - stress, violence, bullying and harassment, workload.

6.1.2.2 - 6.1.2.3 Assessment of OH&S risks and opportunities

Once hazards have been identified, the organization must assess the OH&S risks (likelihood × severity) and the opportunities for improvement. There must be a documented risk assessment methodology (e.g. a 5×5 risk matrix) and criteria for ranking risks.

6.1.3 Determination of legal requirements and other requirements

The organization must establish a process to identify and access all the legal requirements that apply to it (occupational health and safety laws and regulations, fire safety regulations, environmental regulations), as well as the other requirements it has chosen to comply with (collective agreements, corporate standards, customer requirements).

6.2 OH&S objectives and planning to achieve them

The organization must set measurable OH&S objectives at relevant levels and functions. Objectives must be consistent with the policy, measurable (e.g. "reduce the number of injuries by 20% within 12 months") and monitored, with clearly assigned responsibilities, resources and deadlines.

What does the auditor check?

• A documented hazard register for all work processes and sites.
• A risk matrix or another assessment methodology with clear criteria.
• A legal register - an up-to-date list of all applicable regulations.
• OH&S objectives with measurable indicators and action plans.
• The auditor will check that hazard identification isn't just a "copy-paste" of the risk assessment, but is regularly updated based on process changes and incidents.

How PRIMO Manager helps

PRIMO Manager fully supports clause 6 through the Compliance and Risk Management module: structured risk assessment with a 5×5 matrix, automatic risk ranking and action plans with deadlines and responsible persons. The legal register is maintained centrally, with automatic notifications when regulations change. OH&S objectives are tracked on dashboards with real-time KPIs. The AI Compliance Assistant module can automatically identify new hazards based on the information you enter about process changes.

What does the standard require? (Clauses 7.1 - 7.5)

7.1 Resources

The organization must provide the resources needed to establish, implement, maintain and improve the OH&S management system - human, financial, technological and infrastructure resources.

7.2 Competence

Everyone whose work affects OH&S performance must be competent on the basis of appropriate education, training or experience. The organization must:

• Determine the necessary competence for every job that affects OH&S.
• Ensure that workers have that competence (through training, mentoring or hiring).
• Take action where there is a competence gap and evaluate the effectiveness of that action.
• Keep documented evidence of competence (certificates, qualifications, training records).

7.3 Awareness

All workers must be aware of:

• The OH&S policy and objectives.
• Their contribution to the effectiveness of the OH&S management system.
• The consequences of not conforming to the requirements of the system.
• Incidents and investigation outcomes that are relevant to their work.
• The hazards and OH&S risks that relate to their job.
• Their ability to remove themselves from work situations that they consider to present an imminent and serious danger to their life or health, without fear of reprisals.

7.4 Communication

The organization must determine its internal and external communication on OH&S matters: what is communicated, when, to whom, how and who is responsible. It must ensure that workers at all levels can contribute to continual improvement.

7.5 Documented information

The standard requires documented information (the term that replaced the old "documents" and "records"), which must be:

• Created and updated with appropriate identification (title, date, author, version).
• Controlled - available when and where it is needed, and protected against loss, unauthorized changes or accidental destruction.
• Retained for an appropriate period (retention periods in line with legal requirements).

What does the auditor check?

• Training and competence records for every worker - safety training certificates, certifications for high-risk jobs and records of periodic training.
• Evidence that workers understand the OH&S policy and their responsibilities (the auditor talks to workers).
• An OH&S communication plan - how information flows vertically and horizontally across the organization.
• Document control - versioning, approvals, distribution and archiving. The auditor will pick a random document and check whether its current version is available where it is used.

How PRIMO Manager helps

PRIMO Manager automates all of your document management (clause 7.5), with versioning, approvals, digital distribution and automatic withdrawal of outdated versions. The Digital Inspections and Documentation module provides full traceability - every document has a change history, creation date, author and approval status. For clause 7.2, the system keeps complete competence records for each worker: OH&S training, medical examinations and certifications for high-risk jobs, with automatic notifications before they expire. Communication (clause 7.4) runs through automatic notifications and tasks that make sure the right information reaches the right person at the right time.

What does the standard require? (Clauses 8.1 - 8.2)

8.1 Operational planning and control

The organization must plan, implement, control and maintain the processes needed to meet the requirements of the OH&S management system, including:

• 8.1.1 General: Establishing criteria for the processes, controlling the processes in line with those criteria and keeping documented information as evidence.
• 8.1.2 Eliminating hazards and reducing OH&S risks: Applying the hierarchy of controls - (1) eliminating the hazard, (2) substituting it with something less hazardous, (3) engineering controls (physical barriers, ventilation), (4) administrative controls (procedures, signage, job rotation), (5) personal protective equipment (PPE) as a last resort.
• 8.1.3 Management of change: The organization must have a process for managing planned changes that affect OH&S - new machinery, process changes, reorganization, new materials. Every change must go through an OH&S impact assessment before it is implemented.
• 8.1.4 Procurement: Controlling the procurement processes that affect OH&S - suppliers, contractors, outsourcing.

8.2 Emergency preparedness and response

The organization must establish processes for preparing for and responding to potential emergency situations:

• Identify potential emergency situations (fire, explosion, chemical spill, earthquake, medical emergency).
• Develop response plans, including first aid, evacuation and communication with emergency services.
• Test the plans with periodic exercises (fire drills, spill simulations).
• Review the plans after exercises or after actual emergencies.

What does the auditor check?

• Work instructions and procedures for hazardous activities - are they up to date, available at the workplace and known to workers?
• Evidence that the hierarchy of controls is applied - the auditor will ask why PPE is used instead of elimination or engineering controls.
• The management of change (MOC) process - records of impact assessments carried out before a new machine or process was introduced.
• Emergency plans - evacuation plans, drill records, first aid arrangements, evacuation signs.
• Contractor evaluation - how the OH&S performance of outside companies working on site is evaluated.

How PRIMO Manager helps

With the Process Automation module, PRIMO Manager provides standardized procedures with checklists for every activity. Management of change runs through an automated workflow - when a change is entered (a new machine, a new chemical), the system automatically starts an OH&S impact assessment with defined approval steps. Emergency plans are stored in the documentation module, with automatic reminders for periodic drills. Records of contractors and their OH&S qualifications are also kept centrally.

9.1 Monitoring, measurement, analysis and performance evaluation

The organization must determine:

• What needs to be monitored and measured - OH&S performance indicators (proactive: the number of inspections, training sessions and near-miss reports carried out; and reactive: the number of injuries, sick leave days and incidents).
• Monitoring methods - how data is collected and who analyzes it.
• Evaluation criteria - what performance is measured against (legal requirements, OH&S objectives, industry benchmarks).
• 9.1.2 Evaluation of compliance - a process for periodically checking compliance with the legal and other requirements in your register.

9.2 Internal audit

This is the key self-assessment mechanism. The organization must carry out internal audits at planned intervals to determine whether the OH&S management system conforms to the requirements of the standard and whether it is effectively implemented and maintained.

For internal audits, the standard requires:

• An audit program - a plan that covers all requirements of the standard over the certification cycle (usually drawn up annually).
• Competent auditors - people trained to conduct audits (competence in line with ISO 19011) who are independent of the area being audited.
• Audit reports - documented findings, nonconformities and recommendations.
• Actions taken based on the audit findings.

9.3 Management review

Top management must review the OH&S management system at planned intervals (usually once a year, ideally every six months). The review must cover:

• The status of actions from previous management reviews.
• Changes in external and internal issues relevant to OH&S.
• OH&S performance: trends in incidents and nonconformities, monitoring and measurement results, audit results, the results of worker consultation, and risks and opportunities.
• The adequacy of resources for maintaining the system.
• Opportunities for continual improvement.

The outputs of the management review must include decisions and actions to improve the OH&S management system and the resources needed to do so.

What does the auditor check?

• KPIs and trends - OH&S performance indicators with historical data and trend analysis.
• The internal audit program - the plan, records of completed audits, internal auditor competence, findings and corrective actions.
• Management review minutes - with clear inputs, decisions and assigned actions. The auditor checks whether management's decisions have actually been implemented.
• Evaluation of compliance - records of periodic reviews of the legal register and of compliance with regulations.

How PRIMO Manager helps

PRIMO Manager provides real-time dashboards with OH&S performance KPIs: the number of injuries, near misses, completed inspections, training sessions and expired medical examinations - all visible on a single screen. For internal audits, the system lets you plan the audit program, assign auditors, record findings and track corrective actions through to closure. For the management review, the system automatically generates a report with the input data (trends, KPIs, action status), which keeps preparation for the meeting to a minimum.

10.2 Incident, nonconformity and corrective action

This is one of the most important requirements, and auditors check it in detail. When an incident (injury, ill health, near miss) or a nonconformity occurs, the organization must:

• React in a timely manner - take action to control and correct the situation.
• Investigate the incident - determine the root cause, not just the symptoms. Methods such as the 5 Whys, Ishikawa (fishbone) diagrams and fault tree analysis are used.
• Determine corrective action - a measure that addresses the root cause and prevents recurrence.
• Implement the corrective action and verify its effectiveness.
• Consider the impact on the risk assessment and update it as needed.
• Document every step: the nature of the incident or nonconformity, the actions taken and their results.

10.3 Continual improvement

The organization must continually improve the suitability, adequacy and effectiveness of the OH&S management system by improving performance, promoting a safety culture, involving workers in improvement and communicating relevant results.

What does the auditor check?

• An incident register - all injuries, near misses and occupational diseases.
• Incident investigations - were they carried out for every incident, and was the root cause identified (not just "the worker wasn't paying attention")?
• Corrective actions - were they defined, implemented and verified?
• An improvement trend - does the data show that OH&S performance improves over time?

How PRIMO Manager helps

PRIMO Manager has an integrated module for incident and nonconformity management. Every incident is reported digitally (including photos and witness statements) and goes through a defined investigation workflow with a mandatory root cause analysis. Corrective actions are assigned to responsible persons with deadlines, and the system automatically tracks their status and sends escalations when a deadline is missed. The Dashboards module shows incident and improvement trends, so clause 10.3 is documented with real-time data.

Stage 1 audit (document review)

The certification audit is carried out in two stages. Stage 1 is a document review, usually carried out on site or remotely:

• The auditor reviews all system documentation: the policy, scope, risk assessment, legal register, procedures and records.
• Assesses the organization's readiness for Stage 2.
• Identifies areas of particular interest for Stage 2.
• Issues findings - if there are significant gaps in the documentation, the organization must address them before Stage 2.

Typical duration of Stage 1: 1-2 days for a small company, 2-3 days for a medium-sized one.

Stage 2 audit (implementation audit)

Stage 2 is carried out on site and checks how the system is implemented in practice:

• Opening meeting - the auditor explains the scope, methodology and schedule of the audit.
• Workplace tour - the auditor visits production halls, warehouses, offices and construction sites. They observe working conditions, talk to workers and check safety signs, PPE and the condition of equipment.
• Interviews - with management, the OH&S professional, managers with delegated safety responsibilities, worker safety representatives and randomly selected workers.
• Records review - the auditor asks for concrete evidence: records of training, medical examinations, equipment inspections, incident investigations and corrective actions, and health and safety committee minutes.
• Closing meeting - the auditor presents the findings, nonconformities and recommendations.

Typical duration of Stage 2: 2-5 days, depending on the size and complexity of the organization.

Types of audit findings

• Major nonconformity: A requirement of the standard is not met at all, or a situation seriously undermines the capability of the system. The certificate cannot be issued until the major nonconformity has been closed.
• Minor nonconformity: A requirement is only partially met, without undermining the overall effectiveness of the system. The certificate can be issued, on condition that the nonconformity is closed within an agreed period (usually 90 days).
• Observation / opportunity for improvement (OFI): Not a nonconformity, but the auditor sees room for improvement. It is for information only, with no obligation.

Surveillance and recertification audits

After successful certification, the certificate is valid for 3 years, but during that period the certification body carries out:

• Surveillance audits - once a year. They cover part of the requirements of the standard, but not all of them. The focus is on continual improvement and on closing previous findings.
• A recertification audit - at the end of the 3-year cycle, before the certificate expires. Similar to the initial audit, it covers all requirements of the standard. If it is successful, the certificate is renewed for another 3 years.

How PRIMO Manager helps during the audit

When the certification auditor arrives on site, PRIMO Manager serves as the central place for presenting all the evidence. Instead of searching for paperwork in filing cabinets, the OH&S professional opens the system and shows the risk assessment, training records, medical examinations, equipment inspections, incident investigations, corrective actions and health and safety committee minutes - all in one place, with full traceability and change history. This dramatically shortens the audit and reduces stress, because the auditor immediately gets everything they ask for.

Documents the auditor will ask for

The following list covers all the documented information that the standard explicitly requires or implicitly expects. Have it ready before the audit:

• Scope of the OH&S management system (clause 4.3) - which sites, processes and activities are covered.
• OH&S policy (clause 5.2) - signed by top management.
• Organizational chart with OH&S roles (clause 5.3) - the OH&S professional, managers with delegated safety responsibilities, worker safety representatives, the health and safety committee.
• Register of interested parties and their requirements (clause 4.2).
• Legal register (clause 6.1.3) - a list of all applicable regulations, with evidence that it is kept up to date.
• Hazard register and risk assessment (clause 6.1.2) - for all work processes, with a risk matrix and an action plan.
• OH&S objectives and programs (clause 6.2) - measurable objectives with action plans.
• Competence and training records (clause 7.2) - certificates, qualifications and training records for every worker.
• Communication plan (clause 7.4) - internal and external OH&S communication.
• Operating procedures and work instructions (clause 8.1) - for all activities with OH&S risks.
• Management of change process (clause 8.1.3) - records of change impact assessments.
• Emergency plan (clause 8.2) - evacuation plan, drill records.
• OH&S performance monitoring records (clause 9.1) - KPIs, trends.
• Evaluation of compliance (clause 9.1.2) - periodic checks of compliance with legal requirements.
• Internal audit program and records (clause 9.2) - plan, reports, corrective actions.
• Management review minutes (clause 9.3) - inputs, decisions, assigned actions.
• Incident and nonconformity register (clause 10.2) - investigations, root causes, corrective actions.
• Records of worker consultation (clause 5.4) - health and safety committee minutes, hazard reports.
• Medical examination records - especially for workers in high-risk jobs that require medical surveillance.
• Personal protective equipment (PPE) records - equipment issued to each worker.
• Inspections of work equipment and the working environment - reports from periodic inspections and testing.

How PRIMO Manager covers this checklist

Every item on the list above can be created, stored and presented to the auditor directly from PRIMO Manager. The system automatically warns you if any of the required documented information is missing or has expired. The AI Compliance Assistant module can automatically generate document templates (OH&S policy, procedures, communication plan) tailored to your organization, drastically reducing the time it takes to prepare for certification.

Phase 1: Gap analysis (months 1-2)

Compare the current state of your organization with the requirements of ISO 45001. Determine what you already have (risk assessment, training, records) and what is missing. PRIMO Manager helps because as you enter your existing data, it immediately visualizes the gaps in your compliance.

Phase 2: Planning and documentation (months 2-4)

• Define the scope of the system.
• Write the OH&S policy and have it signed by top management.
• Define roles and responsibilities.
• Create or update the risk assessment for all work processes.
• Set up the legal register.
• Define OH&S objectives.
• Write operating procedures for critical activities.
• Establish a management of change process.
• Prepare an emergency plan.

Phase 3: Implementation (months 4-8)

• Train all employees on the OH&S management system, the policy and their roles.
• Hold consultations with workers on hazards and controls.
• Start recording incidents and near misses in the system.
• Carry out regular workplace inspections according to plan.
• Test the emergency plan (evacuation drill).
• Track OH&S KPIs on dashboards.

Phase 4: Internal audit and corrections (months 8-10)

• Carry out the first round of internal audits, covering all requirements of the standard.
• Document the findings and define corrective actions.
• Implement the corrective actions and verify their effectiveness.
• Hold a management review.
• Carry out a second round of internal audits for verification.

Phase 5: Certification audit (months 10-12)

• Choose a certification body (TÜV, SGS, Bureau Veritas, DNV, Lloyd's Register or another accredited body).
• Complete the Stage 1 audit (document review).
• Address any findings from Stage 1.
• Complete the Stage 2 audit (on-site implementation audit).
• Close any minor nonconformities within 90 days.
• Receive your ISO 45001:2018 certificate, valid for 3 years.