ISO requirements map

Determine the external and internal issues that are relevant to the organization's purpose and affect its ability to achieve the intended outcomes of the OH&S management system.

Determine whether climate change is a relevant issue for the organization (Amendment 1:2024).

Identify the interested parties, in addition to workers, that are relevant to the OH&S management system.

Determine the relevant needs and expectations of workers and other interested parties (these can include climate-related requirements — Amendment 1:2024).

Determine which of these needs and expectations are, or could become, legal requirements and other requirements.

Determine the boundaries and applicability of the system, considering internal/external issues, the requirements of interested parties and the planned or performed work-related activities; include all activities, products and services under the organization's control or influence; keep the scope available as documented information.

Establish, implement, maintain and continually improve the OH&S management system, including the needed processes and their interactions.

Top management takes overall responsibility and accountability for preventing work-related injury and ill health and for providing safe and healthy workplaces and activities.

Top management ensures the policy and objectives fit the strategic direction, integrates the system into business processes, provides resources, communicates its importance, and directs and supports people to contribute to it.

Top management promotes continual improvement and supports other relevant management roles to show leadership in their areas.

Top management develops, leads and promotes a culture that supports the intended outcomes of the system.

Workers are protected from reprisals when they report incidents, hazards, risks and opportunities.

Top management ensures a process for consultation and participation of workers exists and supports health and safety committees where they exist.

The policy commits to safe and healthy working conditions suited to the organization's size, context and the nature of its risks; gives a framework for objectives; commits to fulfilling legal and other requirements, eliminating hazards and reducing risks, continual improvement, and consultation and participation of workers.

The policy is available as documented information, communicated within the organization, available to interested parties as appropriate, and kept relevant and appropriate.

Responsibilities and authorities for relevant roles are assigned and communicated at all levels and kept as documented information; workers at each level take responsibility for the OH&S aspects they control.

Authority is assigned for ensuring the system conforms to ISO 45001 and for reporting its performance to top management.

A process exists for consultation and participation of workers (and worker representatives) at all applicable levels and functions in developing, planning, implementing, evaluating and improving the system.

Mechanisms, time, training and resources for consultation and participation are provided, with timely access to clear, understandable information.

Obstacles or barriers to participation (e.g. language, literacy, reprisals, policies) are identified and removed or minimized.

Non-managerial workers are consulted on: needs of interested parties, the policy, roles, legal requirements, objectives, controls for outsourcing/procurement/contractors, what to monitor, the audit programme and continual improvement.

Non-managerial workers participate in: consultation mechanisms, hazard identification and risk assessment, actions to eliminate hazards, competence and training needs, communication, control measures, and investigation of incidents and nonconformities.

When planning, consider context, interested parties and scope, and determine the risks and opportunities to be addressed (hazards, OH&S risks and other risks, OH&S opportunities and other opportunities, legal and other requirements).

The planning process takes planned permanent or temporary changes into account.

Documented information is kept on risks and opportunities and on the processes and actions needed to address them, to give confidence they are carried out as planned.

An ongoing, proactive hazard identification process considers how work is organized, social factors (workload, working hours, victimization, harassment, bullying), leadership and culture.

Hazard identification covers routine and non-routine activities and situations: infrastructure, equipment, materials, substances, physical conditions, product/service design, research and development, human factors and how work is performed.

Past relevant incidents (inside or outside the organization), including emergencies and their causes, and potential emergency situations are considered.

People are considered: workers, contractors, visitors and others with access to the workplace, people nearby affected by the activities, and workers at locations not directly controlled by the organization.

Design of work areas, processes, installations, machinery, procedures and work organization (adapted to workers' needs and capabilities), situations near the workplace, and actual or proposed changes in organization, operations or knowledge about hazards are considered.

OH&S risks from identified hazards are assessed taking into account the effectiveness of existing controls, and other risks to establishing and maintaining the system are determined and assessed.

The risk assessment methodology and criteria are defined for scope, nature and timing so they are proactive and systematic, and are kept and retained as documented information.

Opportunities to enhance OH&S performance are assessed (adapting work and environment to workers, eliminating hazards, reducing risks) together with other opportunities to improve the system.

A process determines and gives access to up-to-date legal and other requirements applicable to hazards, risks and the system, determines how they apply and what must be communicated, and takes them into account in the system; this is kept, retained and updated as documented information.

Actions are planned to address risks and opportunities, legal and other requirements, and emergency preparedness; how to integrate them into processes and how to evaluate their effectiveness is planned.

The hierarchy of controls, best practice, technological options and financial, operational and business requirements are considered when planning actions.

OH&S objectives are established at relevant functions and levels to maintain and continually improve the system and OH&S performance.

Objectives are consistent with the policy, measurable (or able to be evaluated), take into account requirements, risk and opportunity assessment and consultation with workers, and are monitored, communicated and updated.

Plans to achieve objectives define what will be done, resources, responsibility, completion dates, how results are evaluated (including indicators) and how actions are integrated into business processes; objectives and plans are kept and retained as documented information.

The resources needed to establish, implement, maintain and continually improve the system are determined and provided.

The competence needed by workers who affect OH&S performance (including the ability to identify hazards) is determined; workers are competent through education, training or experience; actions to acquire competence are taken and their effectiveness evaluated; evidence is retained.

Workers are aware of the policy and objectives, their contribution, the implications of not conforming, incidents and investigation outcomes relevant to them, and the hazards, risks and actions relevant to them.

Workers know they can remove themselves from work situations they consider an imminent and serious danger, and how they are protected from undue consequences for doing so.

Communication processes define what, when, with whom (internally, with contractors and visitors, and other interested parties) and how to communicate, taking diversity (gender, language, culture, literacy, disability) and legal requirements into account; evidence is retained.

Views of external interested parties are considered, communicated information is consistent and reliable, and relevant communications are responded to.

Relevant information, including changes to the system, is communicated internally among levels and functions, and workers are enabled to contribute to continual improvement.

Relevant information is communicated externally as established by the communication processes and as required by legal requirements.

The system includes the documented information required by ISO 45001 and that the organization decides is necessary for its effectiveness.

Documents are created with suitable identification (title, date, author, reference), format and media, and are reviewed and approved for suitability and adequacy.

Documented information is controlled: available and suitable where and when needed, protected, with control of distribution, access, storage, legibility, changes (version control), retention and disposal; documents of external origin are identified and controlled.

Processes needed to meet system requirements are planned, implemented, controlled and maintained by setting criteria and implementing control in line with them; documented information is kept to the extent needed for confidence that processes are carried out as planned.

Work is adapted to workers.

At multi-employer workplaces, the relevant parts of the system are coordinated with the other organizations.

A process eliminates hazards and reduces risks using the hierarchy of controls: elimination; substitution; engineering controls and reorganization of work; administrative controls including training; personal protective equipment.

A process controls planned temporary and permanent changes (new products, services, processes, workplaces, equipment, organization, workforce, legal requirements, knowledge about hazards, technology).

The consequences of unintended changes are reviewed and action is taken to mitigate any adverse effects.

A process controls the procurement of products and services so they conform to the system.

Procurement is coordinated with contractors to identify hazards and control risks arising from contractor activities affecting the organization, the organization's activities affecting contractors' workers, and contractor activities affecting other interested parties.

Contractors and their workers meet the system's requirements, and OH&S criteria are defined and applied for selecting contractors.

Outsourced functions and processes are controlled, consistent with legal requirements, and the type and degree of control is defined within the system.

A process prepares for and responds to potential emergency situations: planned response including first aid, training for the planned response, periodic testing and exercising of the response capability.

Performance is evaluated and the planned response revised after tests and especially after emergencies; duties are communicated to all workers, and information is given to contractors, visitors, emergency services, authorities and the local community; needs of interested parties are considered; the process and plans are kept and retained as documented information.

Determine what is monitored and measured (fulfilment of legal requirements, activities related to hazards and risks, progress toward objectives, effectiveness of controls), the methods, the criteria, when to monitor and when to analyse, evaluate and communicate the results.

Monitoring and measuring equipment is calibrated or verified and maintained; results of monitoring, measurement, analysis and performance evaluation and of equipment maintenance/calibration are retained.

A process evaluates compliance with legal and other requirements at a set frequency and with set methods, action is taken where needed, knowledge of compliance status is maintained, and results are retained.

Internal audits are conducted at planned intervals to check the system conforms to the organization's own requirements and to ISO 45001 and is effectively implemented and maintained.

An audit programme sets frequency, methods, responsibilities, consultation, planning and reporting, considering the importance of processes and previous audit results; criteria and scope are defined for each audit; auditors are objective and impartial; evidence of the programme and results is retained.

Audit results are reported to relevant managers, workers, worker representatives and other interested parties, and action is taken on nonconformities and to improve performance.

Management review considers: status of previous actions; changes in issues, interested parties' needs, legal requirements, risks and opportunities; how far policy and objectives are met; OH&S performance (incidents, nonconformities, corrective actions, monitoring, compliance evaluation, audits, consultation and participation, risks and opportunities); adequacy of resources; communications with interested parties; opportunities for improvement.

Review outputs cover the continuing suitability, adequacy and effectiveness of the system, improvement opportunities, needed changes and resources, actions, opportunities to improve integration with business processes and implications for strategic direction; relevant outputs are communicated to workers and their representatives; results are retained.

Opportunities for improvement are determined and the actions needed to achieve the intended outcomes are implemented.

A process manages incidents and nonconformities: react in a timely way to control and correct them and deal with the consequences.

The need for corrective action is evaluated with the participation of workers and other interested parties by investigating the incident or reviewing the nonconformity, finding the causes, checking for similar cases, and reviewing existing risk assessments.

Corrective actions follow the hierarchy of controls and management of change; risks of new or changed hazards are assessed before acting; effectiveness is reviewed; the system is changed if needed.

Records are retained of the nature of incidents and nonconformities, actions taken, and results including effectiveness; this information is communicated to relevant workers and interested parties.

The system is continually improved by enhancing OH&S performance, promoting a supportive culture and worker participation, and communicating the results to workers; evidence is kept and retained.