Your Practical Guide to ISO 45001 Clauses

A guide to ISO 45001 clauses should do more than restate the standard. For a growing business, the real question is how each clause changes everyday decisions: who identifies hazards, how workers raise concerns, what evidence demonstrates control, and how leaders know that the system is working.

ISO 45001 is the international standard for occupational health and safety management systems. It provides a structured framework for preventing work-related injury and ill health, meeting applicable legal and other requirements, and improving health and safety performance over time. Certification is valuable, but the greater benefit comes from building controls that people can use consistently.

The standard is arranged into ten clauses. Clauses 1 to 3 provide background information; clauses 4 to 10 contain the requirements that an organisation must address within its management system.

How to use this guide to ISO 45001 clauses

The clauses follow the Plan-Do-Check-Act cycle. Clauses 4 to 7 establish the context, leadership, planning and support needed to plan effectively. Clause 8 covers operational delivery. Clauses 9 and 10 require the organisation to check performance, learn from findings and improve.

Not every business needs the same volume of documentation. A small engineering firm and a multi-site contractor face different risks, legal duties and levels of operational complexity. However, both need clear responsibilities, reliable risk controls and evidence that the system is being reviewed and improved.

Clauses 1 to 3: scope, references and terms

Clause 1 defines the scope of ISO 45001. It applies to organisations of all sizes and sectors that want to provide safe and healthy workplaces, remove hazards, reduce occupational health and safety risks, and improve performance.

Clause 2 lists normative references. There are no additional referenced standards required for using ISO 45001.

Clause 3 explains key terms and definitions. These include worker, workplace, hazard, risk, incident, consultation and participation. Teams often use these words loosely, so agreeing what they mean in your business prevents confusion when implementing procedures or conducting audits.

Clause 4: context of the organisation

Clause 4 asks you to understand the business conditions that affect health and safety. This includes internal issues, such as workforce capability, culture, work patterns and equipment, and external issues, such as legislation, client requirements, supply-chain pressures and sector risks.

You must also identify interested parties and their relevant needs. Workers, contractors, regulators, clients, insurers, landlords and local communities may all have legitimate expectations. The objective is not to create a lengthy stakeholder register. It is to identify requirements that affect the management system and act on them.

This clause also requires a defined scope for the occupational health and safety management system. State the activities, locations and workers covered, including where relevant those working remotely or under your control at client sites. Recent amendments also require organisations to consider whether climate change is a relevant issue in their context. For some businesses, this may affect heat stress, severe weather planning, travel, or emergency arrangements.

Clause 5: leadership and worker participation

ISO 45001 places clear accountability on top management. Health and safety cannot sit solely with an external adviser, a compliance manager or a folder of policies. Leaders must establish the policy, provide resources, integrate health and safety into business processes and promote continual improvement.

The health and safety policy should be appropriate to your business and include commitments to provide safe and healthy working conditions, fulfil compliance obligations, eliminate hazards and reduce risks, consult and involve workers, and improve the system. A signed statement is not enough if operational decisions contradict it.

Worker consultation and participation are central to Clause 5. Employees are often closest to the task and can identify impractical controls before they fail. Give people workable ways to report hazards, contribute to risk assessments, take part in investigations and raise concerns without fear of negative consequences. Consultation means seeking views before decisions are made; participation means enabling people to influence and contribute to action.

Clause 6: planning for risks, opportunities and objectives

Clause 6 is where an organisation turns its understanding of risks into a focused plan. It requires processes to identify hazards, assess occupational health and safety risks, identify opportunities to improve performance, and determine legal and other requirements.

Hazard identification must be proactive as well as reactive. Consider routine and non-routine work, maintenance, changes in processes, visitors, contractors, human factors, emergency situations and the design of work. A risk assessment copied from a template may satisfy neither the standard nor the people doing the job. Controls need to reflect actual conditions.

Use the hierarchy of controls when deciding how to treat risks. Eliminating a hazard is generally stronger than relying on training or personal protective equipment. In practice, the best option depends on technical feasibility, cost, operational needs and the degree of risk. Where a higher-level control is not immediately achievable, record the rationale and put suitable interim controls in place.

You must also set measurable health and safety objectives. These might include completing planned inspections, reducing manual-handling incidents, improving near-miss reporting, closing corrective actions on time, or achieving competence targets. Each objective needs ownership, resources, a timescale and a way to evaluate results.

Clause 7: support, competence and documented information

Clause 7 covers the foundations that make the system usable. This includes resources, competence, awareness, communication and documented information.

Competence should be based on the skills needed to carry out work safely, not just attendance at a course. Induction records, licences, supervision arrangements, toolbox talks and practical assessment can all provide evidence, depending on the role. Where gaps exist, provide training, mentoring or tighter supervision until competence is demonstrated.

Communication needs to work in both directions. Workers should understand the policy, significant risks, controls and consequences of not following procedures. Management also needs accurate information from the workforce about changing conditions, unsafe behaviours and improvement opportunities.

Documented information must be controlled so that people use the current version. Keep what is necessary to operate effectively and demonstrate conformity, such as risk assessments, inspection records, training evidence, incident reports, audit findings and management review outputs. Excessive paperwork can create false confidence; insufficient evidence makes it difficult to show that controls are working.

Clause 8: operational planning and control

Clause 8 is where health and safety arrangements become visible in daily operations. Plan work, establish criteria for safe delivery and control processes in line with the hierarchy of controls. This can include safe systems of work, permit arrangements, pre-use checks, maintenance plans, site rules and supervision.

The clause also addresses management of change. New equipment, revised shift patterns, new premises, changing materials or a new client contract can introduce risks before anyone is hurt. Assess the impact before implementing the change, communicate revised controls and verify that workers understand them.

Procurement, contractors and outsourced processes require particular attention. A contractor's competence, method statements and insurance documents are relevant, but they do not remove your responsibility to coordinate work under your control. Define expectations, share site-specific risks, monitor performance and deal with nonconformities promptly.

Emergency preparedness and response should be tested rather than assumed. Your arrangements may need to cover fire, first aid, chemical spills, equipment failure, violence, severe weather or lone-worker incidents. The right approach depends on your activities, premises and risk profile. After a drill or real event, review what happened and update arrangements where necessary.

Clause 9: performance evaluation

Clause 9 requires you to measure whether the management system is delivering its intended outcomes. Monitoring can include inspections, workplace observations, health surveillance where appropriate, legal compliance checks, incident data, corrective-action closure and achievement of objectives.

Do not rely only on accident rates. Lagging indicators tell you what has already gone wrong. Leading indicators, such as completed inspections, reported near misses, overdue actions and safety conversations, can reveal weaknesses earlier.

Internal audits provide an independent check that processes conform to planned arrangements and are effective. Auditors must be objective and competent, and findings should focus on evidence rather than opinion. Management review then brings together performance data, audit results, changes in risks, resource needs and opportunities for improvement. It is a leadership decision-making process, not a meeting held simply to satisfy the standard.

Clause 10: improvement

Clause 10 deals with incidents, nonconformities, corrective actions and continual improvement. When something goes wrong, contain the immediate issue, investigate the cause, decide what action is needed and check whether that action has worked.

A corrective action should address the reason a problem occurred, not only its visible symptom. Replacing a damaged guard may be necessary, for example, but the wider cause might involve weak maintenance controls, inadequate procurement specifications or insufficient training. Patterns matter, especially where the same issue recurs across sites or teams.

Continual improvement can be practical and incremental. Better housekeeping, clearer task instructions, improved consultation or more reliable action tracking may materially reduce risk while making operations more efficient.

A well-implemented ISO 45001 system gives leaders clearer oversight and gives workers confidence that concerns will be heard and acted upon. If your business needs support translating these clauses into proportionate processes, ParagonQMS can help build an audit-ready system that strengthens everyday performance, not just certification evidence.