ISO 45001 in 2026: best practices for a management system that actually lowers risk

Occupational safety is still one of the largest preventable burdens in the global economy. The International Labour Organization estimates that Nearly three million workers die every year due to work-related accidents and diseases⁴, and that 395 million workers worldwide sustained non-fatal work injuries⁴. Against that backdrop, ISO 45001 has become the common language that multinational clients, insurers and regulators use to ask one question: does this organisation manage occupational health and safety as a system, or as a series of reactions?

This guide summarises what the standard is, where it is going, and the practices that consistently make the difference between a system that lowers risk and one that exists mainly for audit day.

What ISO 45001 is — and what it is not

ISO 45001 is an international standard for occupational health and safety management systems³. Its stated aim is the reduction of occupational injuries and diseases, including promoting and protecting physical and mental health³. It replaced the older OHSAS 18001 specification; according to the standard’s history, it was published on 12 March 2018³, and its structure follows the High Level Structure of other ISO standards, such as ISO 9001 (2026 edition) and ISO 14001 (now in its 2026 edition⁶), which makes integration of these standards easier³.

Two points are frequently misunderstood. First, certification is optional: ISO notes that certification is not a requirement of the standard and that ISO does not perform certification² — it is carried out by external certification bodies. Second, the standard is a management framework, not a technical rulebook. It does not tell you what guardrail height or respirator class to use; it requires you to identify your legal and other requirements, assess risk, and prove you control it.

Where the standard is heading: Amendment 1 and ISO 45001:2027

The current text is ISO 45001:2018. ISO’s catalogue shows it was Last reviewed and confirmed in 2024¹ and that it now carries an amendment, ISO 45001:2018/Amd 1:2024 climate action changes¹. That amendment, shared with other management system standards, asks organisations to consider whether climate change is a relevant issue in their context and for interested parties.

More significantly, a full revision is in progress. The ISO page states that the standard Will be replaced by ISO/DIS 45001 (under development)¹, with the revision planned as ISO 45001:2027¹. Organisations certifying now should not wait: the core architecture is very likely to remain, and any transition period will be set by accreditation bodies after publication. The practical move is to keep the system clean, documented and evidence-based so that a gap analysis against the new text is quick.

The engine: Plan-Do-Check-Act

ISO explains that ISO 45001 uses the Plan-Do-Check-Act (PDCA) model². That loop is the most useful way to organise your work, because every clause maps to one of its four stages.

Plan

Planning begins with context. The standard requires the organisation to determine internal and external issues that are relevant to its purpose and that affect its ability to achieve the intended outcome(s) of its OHS management system³, and to understand interested parties, which the standard’s commentary lists as workers, suppliers, subcontractors, clients, regulatory authorities³. Good practice here is concrete: name the contractors who do your highest-risk work, the regulators who inspect you, and the clients whose requirements flow down to you.

Do

Implementation is where most of the effort goes: operational controls, management of change, procurement and contractor controls, emergency preparedness, competence and worker participation. Organisations that perform well keep these controls close to the work, in permits, job plans and checklists, rather than in a manual nobody reads.

Check

Monitoring, measurement, internal audit and incident investigation tell you whether the controls are working. The most mature systems track leading indicators (inspections completed, critical-control verifications, corrective actions closed on time) alongside lagging injury rates.

Act

Management review and corrective action close the loop. The question top management should be able to answer is simple: what did we learn this quarter, and what did we change because of it?

Seven best practices that separate effective systems

The practices below are editorial recommendations drawn from the structure of the standard and from regulator guidance. OSHA’s own recommended practices make the underlying point well: finding and fixing hazards before they cause injury or illness is a far more effective approach⁵ than reacting after the fact.

1. Make leadership visible, not ceremonial. The standard places stronger emphasis on top management to actively engage and take accountability for the effectiveness of the management system³. In practice that means leaders attending site walks, chairing reviews and personally owning a small number of critical risks.
2. Consult and involve workers for real. Worker participation is a requirement, not a courtesy. Use the people who do the job to write and test procedures, and give non-managerial workers a defined route to raise hazards without fear.
3. Build the risk register around critical controls. Rather than hundreds of equal-weight risks, identify the handful of scenarios that can kill or permanently injure (falls, energy release, vehicles, confined spaces, chemicals) and define the few controls that must never fail.
4. Apply the hierarchy of controls. ISO 45001 expects controls to follow a hierarchy that starts with elimination. Auditors increasingly ask why a hazard was accepted with PPE when an engineering solution existed.
5. Integrate, do not duplicate. Because the standard uses the management system standard structure guideline Annex SL to allow for simplified integration with other management system standards, such as ISO 9001 and ISO 14001³, many organisations run one integrated system with one document control, one audit programme and one management review.
6. Manage contractors as part of your system. Many serious incidents involve contractors. Pre-qualification, joint risk assessment, permit-to-work and supervision should be explicit parts of your operational planning.
7. Start small and grow. OSHA’s advice to smaller employers is pragmatic: The idea is to begin with a basic program and simple goals and grow from there.⁵

Certification: how to approach the audit

If you choose certification, select a certification body accredited by a recognised accreditation body, and check that its auditors are competent for your sector. Competence requirements for these auditors are set out in a dedicated specification: ISO/IEC TS 17021-10:2018 is a technical specification setting out competence requirements for auditing and certification of ISO 45001³. The typical cycle is a two-stage initial audit, annual surveillance audits and recertification every three years.

Prepare for the audit by running at least one full internal audit cycle and one management review. Most first-time nonconformities cluster in the same places: incomplete legal registers, risk assessments that do not reflect the actual work, weak evidence of worker consultation, and corrective actions closed without verifying effectiveness.

Watch: an introduction to ISO 45001

The video below gives a short overview of the standard’s structure. It is embedded for reference only.

A 90-day starting plan

The plan is deliberately modest. A system that is small, honest and used every day is worth more than a large one that is filled in for the auditor. ISO 45001 rewards organisations that can show, with evidence, that they learn faster than their risks change.

Common pitfalls to avoid

Paper-first implementation. Writing a full procedure set before understanding the work produces documents that do not match reality. Walk the job first, then write the minimum documentation needed to control it.

Treating the legal register as a list. A register is only useful when each requirement is linked to an owner, a control and evidence that the control is in place.

Counting injuries as the only metric. Low injury rates can hide weak controls, particularly for rare, high-severity events. Pair lagging data with verification of the critical controls themselves.

Ignoring health. The standard explicitly covers physical and mental health. Exposure monitoring, ergonomics and psychosocial risk deserve the same rigour as machinery safety.

Key takeaways

• ISO 45001:2018 remains current, with a 2024 climate amendment; a revision is planned as ISO 45001:2027.
• Certification is optional and is performed by third-party bodies, not by ISO.
• PDCA, leadership accountability, worker participation and the hierarchy of controls are the pillars of an effective system.
• Integration with ISO 9001 and ISO 14001 is easiest when you plan for one system from the start.

Sources

Every factual statement marked with a number links to the source below. Sources were retrieved on 23 October 2026; check the publisher for later revisions.

1. ISO 45001:2018 — standard page (ISO) iso.org
2. ISO 45001 — occupational health and safety (ISO) iso.org
3. ISO 45001 (Wikipedia) en.wikipedia.org
4. Nearly 3 million people die of work-related accidents and diseases (ILO) ilo.org
5. Recommended Practices for Safety and Health Programs (OSHA) osha.gov
6. ISO 14001:2026 published (ISO news, 15 April 2026) iso.org