What is ISO 45001?

The Evolution to ISO 45001

Published by the International Organization for Standardization in March 2018 and adopted by Standards Australia in October 2018, ISO 45001 represents a fundamental shift in how organisations approach workplace safety. It replaces the legacy standards AS/NZS 4801:2001 and OHSAS 18001:2007, moving from a compliance-driven, procedure-heavy approach to a risk-based, integrated safety management system.

The transition period ended on 13 July 2023. As of this date, the previous standards are superseded and no longer recognised for accredited certification in Australia. For organisations holding government contracts or operating in supply chains that mandate safety certification, ISO 45001 is now the only recognised framework.

The standard was developed with input from Australian experts and the International Labour Organization, harmonising global best practice with local regulatory requirements. This integration makes it particularly valuable for Australian organisations navigating the Work Health and Safety Act 2011 and state-based variations.

The Australian Regulatory Context

While ISO 45001 certification remains voluntary, its architecture directly supports compliance with mandatory Australian legislation. The standard's structure aligns seamlessly with the duties imposed on Persons Conducting a Business or Undertaking (PCBUs) under the WHS Act.

Most significantly, ISO 45001 provides a robust framework for Officers—directors, CEOs, and senior executives—to demonstrate due diligence under Section 27 of the WHS Act. This personal, non-delegable duty requires Officers to take reasonable steps to ensure their organisation complies with its WHS obligations. Failure to exercise due diligence can result in personal liability, including substantial fines and, in cases of gross negligence, imprisonment.

The standard maps directly to the six elements of due diligence defined in the WHS Act. By implementing ISO 45001, Officers can demonstrate they have acquired knowledge of WHS matters, understood operational hazards, ensured appropriate resources, established information flows, maintained compliance processes, and verified their effectiveness through audits.

The High-Level Structure

ISO 45001 follows the Annex SL framework, a standardised structure shared with ISO 9001 (Quality) and ISO 14001 (Environment). This enables organisations to create Integrated Management Systems, managing safety, quality, and environmental risks through a single cohesive framework rather than maintaining separate, duplicated systems.

The standard is built on the Plan-Do-Check-Act cycle and organised into ten clauses. The operational clauses (4-10) form the core of the management system.

From Procedures to Processes

The most significant conceptual shift in ISO 45001 is the move from documented procedures to effective processes. Under the previous standards, organisations often focused on having comprehensive safety manuals—a "paper safety" approach where the existence of documentation was sometimes conflated with actual workplace safety.

ISO 45001 shifts the focus to outcomes. It requires organisations to demonstrate that their processes genuinely reduce risk and prevent harm, regardless of documentation volume. This aligns with the WHS Act's emphasis on "safe systems of work" rather than merely having safety paperwork.

The standard introduces the concept of "Risks and Opportunities," requiring organisations to identify not just hazards but also circumstances that could improve safety performance. This might include opportunities to adopt new technologies, restructure work to reduce fatigue, or invest in automation to eliminate high-risk tasks entirely.

Worker Participation and Consultation

ISO 45001 places significant emphasis on worker participation, distinguishing between consultation (seeking views before making a decision) and participation (involvement in decision-making itself). The standard requires non-managerial workers to be involved in determining consultation mechanisms, identifying hazards, assessing risks, determining controls, and investigating incidents.

This requirement directly supports Section 47 of the WHS Act, which mandates that PCBUs consult with workers who are, or are likely to be, directly affected by health and safety matters. A common audit non-conformance is demonstrating genuine two-way dialogue—merely informing staff of safety decisions through toolbox talks is insufficient to meet the participation threshold.

Psychosocial Hazards and ISO 45003

Recent updates to Australian WHS regulation have elevated psychosocial hazards—workplace factors that create risks to mental health—to the same regulatory status as physical hazards. These include high job demands, low control, poor support, bullying, and isolated work.

Australian regulators now require PCBUs to apply the hierarchy of controls to psychosocial risks. Simply offering an Employee Assistance Program is insufficient; organisations must attempt to eliminate the risk at source by redesigning work, reducing overload, or improving organisational support structures.

To support this integration, ISO published ISO 45003:2021, a guidance standard for managing psychosocial risks within the ISO 45001 framework. While not a certification standard in its own right, ISO 45003 provides practical methods—such as surveys and focus groups—for identifying and controlling mental health risks. Australian organisations can integrate these practices into their ISO 45001 risk registers, ensuring a single management system covers both physical and psychological safety.

Certification and Implementation

Achieving ISO 45001 certification typically takes 6 to 18 months, depending on the organisation's current safety maturity, size, and complexity. The process involves developing the management system, implementing it across operations, conducting internal audits, and undergoing external assessment by an accredited certification body.

The external audit occurs in two stages. Stage 1 reviews documentation and readiness. Stage 2 involves on-site verification that the system is genuinely implemented and effective. Once certified, organisations undergo annual surveillance audits and a full recertification audit every three years.

For Australian organisations, certification costs vary significantly based on size and risk profile. Small service-based businesses might expect initial certification costs between $6,000 and $12,000, while large or high-risk operations (construction, mining) can face costs exceeding $30,000 for the initial audit alone, with annual surveillance fees of $15,000 to $25,000.

Despite these costs, certification often delivers measurable economic returns. Organisations report reduced workers' compensation premiums, improved tender success rates (particularly for government contracts), and lower incident rates that reduce both direct and indirect costs of workplace injury.

Industry-Specific Considerations

In the construction sector, ISO 45001 exists alongside the rigorous requirements of the Office of the Federal Safety Commissioner (OFSC). The OFSC administers the Australian Government Building and Construction WHS Accreditation Scheme, mandatory for contractors tendering on federal building projects exceeding $4 million.

A common misconception is that ISO 45001 certification automatically qualifies organisations for OFSC accreditation. It does not. While ISO 45001 provides the structural framework, OFSC accreditation requires significantly more prescriptive evidence for High-Risk Construction Work, including detailed Safe Work Method Statements and site-based verification. Many construction consultancies offer "OFSC-mapped" systems that use the ISO 45001 structure but populate it with the specific content required by the OFSC criteria.

Outside construction, state government procurement increasingly relies on ISO 45001 as a gate-opener. Queensland Rail requires it for Category 1 and 2 works. WorkSafe Victoria allows certified organisations to bypass detailed OHS criterion questions in tender pre-qualification, streamlining the administrative burden significantly.

Common Implementation Challenges

Organisations frequently encounter specific non-conformances during certification audits. The most common include inadequate legal registers that list only generic legislation rather than site-specific regulations, failure to demonstrate contractor safety management as required under procurement clauses, and insufficient evidence of genuine worker participation beyond simple communication.

For small to medium enterprises, the complexity trap is real. Purchasing generic, off-the-shelf safety manuals creates a "paper tiger" risk. If the manual specifies quarterly management reviews and formal vendor audits that never occur, this becomes dangerous. In legal proceedings following a workplace incident, such documentation can prove the organisation knew what was required but failed to implement it—an aggravating factor in sentencing.

The solution is proportionality. ISO 45001 is scalable. Small organisations should develop systems that match their actual operations, with documentation sufficient to demonstrate control without creating unmanageable administrative overhead.

References

1. Standards Australia, AS/NZS ISO 45001:2018 Occupational health and safety management systems — Requirements with guidance for use, Standards Australia, 2018.
2. Safe Work Australia, Work Health and Safety Act 2011, Commonwealth of Australia, 2011. Available: safeworkaustralia.gov.au
3. Safe Work Australia, Model Code of Practice: Managing psychosocial hazards at work, Commonwealth of Australia, 2022.
4. Office of the Federal Safety Commissioner, Australian Government Building and Construction WHS Accreditation Scheme, Commonwealth of Australia, 2024. Available: fsc.gov.au