What is ISO 45001:2018, and how can it benefit your business?

ISO 45001:2018 is the international standard for occupational health and safety (OHS) management systems. It sets out what a management system must do to find hazards, control risks and keep improving safety. In Australia the adopted version is AS/NZS ISO 45001:2018, which replaced the older AS/NZS 4801. The standard doesn't make your site safe on its own. It gives you a structure to make safety systematic, and a business can choose to be certified against it.

The benefits come from that structure: clearer responsibilities, fewer surprises on site, better evidence for clients and insurers, and a process for keeping up with changing laws.

What ISO 45001 is

ISO 45001 is a management system standard. It doesn't list safety rules for any particular industry. Instead, it sets requirements for how you run safety across your organisation, whether you are a plumbing business, a warehouse or a hospital.

Its main requirements cover:

• understanding your organisation and the people affected by its work;
• leadership and worker participation;
• planning to manage risks and opportunities;
• support, including resources, competence, awareness and communication;
• operating controls for your hazards;
• checking performance through monitoring and internal audits; and
• improving the system when things go wrong.

The standard uses the Plan-Do-Check-Act cycle, which is the same structure used in ISO 9001 (quality) and ISO 14001 (environment). If you already run one of those systems, ISO 45001 will feel familiar.

ISO 45001 in Australia

Standards Australia adopted ISO 45001:2018 as AS/NZS ISO 45001:2018. Businesses in Australia and New Zealand that want to show conformity usually work to the Australian version, which keeps the same requirements.

The older AS/NZS 4801 has been replaced. If your current documents or audit checklists still refer to AS/NZS 4801, update them to refer to AS/NZS ISO 45001:2018.

ISO 45001 is not a legal requirement. It doesn't replace your duties under the WHS laws, which you must meet whether or not you are certified. What it does is help you meet those duties in a repeatable way. The standard asks you to identify the legal and other requirements that apply to your work, and to keep track of changes to them.

What the standard asks of leaders

ISO 45001 puts responsibility for safety at the top of the business. Leaders must set the OHS policy, make sure the system has the resources it needs, and take part in it. A leader who signs the policy and then never walks the site will struggle to meet the standard.

Leaders are also expected to listen to workers and other people affected by the work. Workers must be consulted on changes that affect their health and safety, and they should be able to report hazards without fear.

Benefits for your business

Fewer injuries and better planning

A systematic process finds hazards earlier and controls them before they cause harm. Fewer injuries mean fewer lost days, less disruption and fewer claims.

Better evidence for clients and insurers

Principal contractors, clients and insurers often ask for proof of your safety system. A certified system gives them a consistent, independent answer. Ask your insurer whether certification would change your premium before you assume it will.

Access to tenders

Some clients make safety credentials a condition of bidding for work, especially on large or high-risk projects. Certification can help you qualify, but check each tender's requirements.

One system for several standards

Because ISO 45001 shares its structure with ISO 9001 and ISO 14001, you can run one set of document control, one audit programme and one management review for all three. Many businesses find that cuts paperwork.

How certification works

Certification is voluntary. If you choose to certify, you engage an accredited certification body, which assesses your system against the standard. In Australia, certification bodies are accredited by JAS-ANZ.

The process usually runs in stages:

1. Gap analysis. Compare your current system with the standard's requirements. You can do this yourself with an internal audit checklist.
2. Fix the gaps. Write or update procedures, set objectives, train people and start recording results.
3. Stage one audit. The certification body checks your documents and whether the system is ready for a full audit.
4. Stage two audit. The auditor checks that the system works in practice, by talking to workers and looking at records on site.
5. Certification and surveillance. A certificate is issued. Certification usually runs for three years, with surveillance audits in between.

How long this takes depends on the size of your business and how mature your current system is. A small business with a simple operation can often move faster than a large, multi-site business.

What to check in your system

Before you engage a certification body, check that you can show these things:

• a signed OHS policy that is communicated to all workers;
• a current register of hazards and risks, with controls and owners;
• a list of legal and other requirements, and how you keep it up to date;
• training and competency records for each role;
• a way for workers to raise concerns and take part in decisions;
• incident and near-miss records, with root cause analysis;
• internal audit reports and corrective action records; and
• management review minutes with actions and owners.

An internal audit checklist for AS/NZS ISO 45001:2018 helps you test each of these before the external audit.

How SafetyDocs helps

Most of the records above are forms you fill in again and again, so templates save real time. SafetyDocs has over 1,250 expert-written templates, including management plans, risk registers, internal audit checklists and management review reports. Job, client and site details fill in automatically. Workers sign on any phone from a text, link or QR code, with no app or account, and a changed document goes back to everyone who signed it.

The templates help you build and run the system. They don't replace an audit, and they don't make you certified. The evidence still has to come from your own site.

Why it matters for WHS

The WHS Act makes the business that controls the work responsible for keeping people safe, so far as is reasonably practicable (section 19). An OHS management system is the practical way to show you have processes to do that. Under ISO 45001 those processes are written down, checked and improved, which is the same discipline regulators look for when they assess how a business manages risk.

If you are starting out, you don't need certification to benefit. Use the structure now, and decide later whether certification is worth the cost for your clients and tenders. Our guide to what a safety management system is explains the parts you would build either way.

Common questions

Is ISO 45001 mandatory in Australia?

No. It is a voluntary standard. The WHS laws are the legal requirement, and ISO 45001 is one way to meet your duties in a structured way.

Does ISO 45001 make me compliant with WHS law?

No. Certification shows your management system meets the standard. It does not mean you comply with every WHS duty, and a certification body doesn't check your legal compliance in the same way a regulator does.

How long is a certificate valid?

Certificates typically run for three years, with surveillance audits in between. Your certification body will confirm the schedule.

What is the difference between ISO 45001 and my SMS?

ISO 45001 is the framework. Your SMS is the policies, procedures and records you actually use. The standard tells you what the system should do, and your SMS shows how your business does it.

This is general information, not legal advice. Check the current law with your WHS regulator.