Overview
Health and safety is the one part of ESG that's hardest to fake: fire exits either work or they don't, PPE is either worn or it isn't. ISO 45001:2018 is the international standard for occupational health and safety (OH&S) management systems, and it's the structural backbone of Standard ESG's Social subject S2. This primer explains what it actually requires and how it connects directly to what an on-site auditor will look for.
Why an OH&S Management System, Not Just a Safety Policy
ISO 45001 opens from a simple premise: an organization is responsible for the occupational health and safety of its workers and others who can be affected by its activities, and that responsibility covers both physical and mental health. A management system exists because good intentions don't prevent injuries — a systematic process does: identifying hazards, assessing and controlling risks, and continually improving, driven by top management leadership and genuine worker participation.
Like ISO 14001, the standard is candid that adopting it does not, by itself, guarantee the prevention of work-related injury and ill health — what it provides is the framework that makes prevention and continual improvement possible and demonstrable to workers and other interested parties.
The Plan-Do-Check-Act Cycle for Safety
ISO 45001 uses the same PDCA logic as ISO 14001, applied to OH&S risks and opportunities:
- Plan — determine and assess OH&S risks and opportunities, and establish objectives and processes to deliver results consistent with the OH&S policy.
- Do — implement the processes as planned.
- Check — monitor and measure activities against the policy and objectives, and report the results.
- Act — take action to continually improve OH&S performance to achieve the intended outcomes.
At the center of the cycle sits leadership and worker participation — the standard places this deliberately at the core of its framework diagram, not as a peripheral requirement, because an OH&S system driven only from the top, without genuine worker input, tends to miss the hazards workers actually encounter.
Leadership and Worker Participation
The standard identifies several success factors that determine whether an OH&S system actually works, not just exists on paper: top management leadership, commitment, responsibility and accountability; a supportive safety culture actively led from the top; communication; consultation and participation of workers and, where they exist, worker representatives; adequate resource allocation; an OH&S policy compatible with the organization's overall strategic direction; effective hazard-identification and risk-control processes; continual performance evaluation; integration of OH&S into normal business processes; and compliance with legal and other requirements.
Worker consultation and participation is worth emphasizing on its own: workers are often the first to know where a hazard actually is, and a system that only consults management about safety systematically misses that information — which is precisely why Standard ESG's Level 3 on-site framework includes confidential worker interviews rather than relying solely on management's account (see Section 9).
Hazard Identification and Risk Assessment
The operational core of any OH&S system is the ongoing process of identifying hazards — routine and non-routine activities, situations involving human factors, past incidents, emergency situations, changes to the organization or its operations — and assessing the resulting risks. This isn't a one-time exercise at setup; it's a continuous process that runs alongside changes in operations, equipment, or personnel.
Planning: Eliminating Hazards, Not Just Managing Them
Once hazards and risks are identified, the standard follows a clear hierarchy of control, prioritizing elimination and substitution of hazards over merely managing exposure to them: eliminate the hazard where possible; substitute with less hazardous processes, materials, or equipment; use engineering controls and reorganize work; use administrative controls, including training; and use personal protective equipment as the last line of defense, not the first. OH&S objectives are set consistent with the policy and the identified risks and opportunities, with plans to achieve them.
Support and Operation: Where the Policy Meets the Floor
Support covers resources, competence, awareness, and communication — including making sure workers actually understand the hazards relevant to their work, not just that a policy exists. Operational control covers the processes needed to eliminate hazards and reduce OH&S risk day to day: safe systems of work, permit-to-work systems where relevant, management of change, and — critically — emergency preparedness and response: planning for foreseeable emergency situations (fire, chemical spill, medical emergency) and testing that plan periodically rather than assuming it would work if needed.
Incident Investigation and Corrective Action
When an incident or nonconformity occurs, the standard requires investigating it to determine underlying OH&S deficiencies and other contributing factors, reviewing existing risk assessments in light of what's found, determining corrective action that addresses the actual root cause, and reviewing the effectiveness of that action once taken. The goal is a system that learns from near-misses and incidents rather than treating each one as an isolated, unrelated event.
Performance Evaluation and Management Review
OH&S performance is monitored and measured against the policy and objectives, and compliance with legal and other requirements is evaluated on a planned basis. Top management reviews the system at planned intervals — considering incident trends, audit results, and progress on objectives — and drives continual improvement from that review. The cycle then returns to planning, informed by what performance evaluation revealed.
The Concrete Inspection Points Auditors Look For
If your organization pursues Level 3 on-site assessment, health and safety is one of the eight checklist domains, and it's the most directly observable of them all — an auditor doesn't have to take your word for it. The specific points an auditor checks map closely to what a functioning ISO 45001 system would naturally have in place: emergency exits — accessible, unobstructed, clearly marked; fire equipment — present, in date, and serviced; PPE — actually available and actually worn, not just stocked in a cupboard; machine guarding — physically in place on equipment with moving parts; chemical storage and labelling — correctly segregated and identified; and first-aid provision — stocked, accessible, and staff aware of its location. Alongside physical inspection, worker interviews conducted away from management specifically test whether the participation and communication elements of Sections 3 and 6 are real in practice, not just documented in policy.
Mapping to Standard ESG Subject S2 and Level 2 Evidence
Subject S2 of the Standard ESG Protocol is explicitly aligned with ISO 45001, covering occupational health and safety within the Social pillar. A functioning OH&S system naturally produces the typical Level 2 evidence for this subject: your H&S policy, risk assessments for your actual operations, accident and incident logs, training records showing staff have been briefed on relevant hazards, and — if you've formalized it — a grievance or reporting mechanism workers can use to raise safety concerns. As with ISO 14001 (see the ISO 14001 primer), you do not need a formal third-party ISO 45001 certification to satisfy subject S2 — what matters is that the underlying practices and documentation genuinely exist and hold up to on-site scrutiny.
Getting Started Proportionately
A workable starting point for an organization with no dedicated safety function:
- Walk your own workplace and write down what you see: exits, fire equipment, hazards, PPE availability — this is your first hazard identification exercise.
- Write a short H&S policy naming who's responsible for safety, even if that's the owner or general manager.
- Fix the cheap, obvious things first — unobstructed exits, serviced extinguishers, labelled chemicals — before worrying about more elaborate documentation.
- Start a simple accident/incident log, even a single spreadsheet, and actually use it when something happens, however minor.
- Ask your team, directly, what they think the biggest safety risk is — this is your worker-participation starting point and often surfaces things management alone would miss.
See Getting Started with ESG: A Practical Guide for SMEs for how this fits into a broader starting plan across all three pillars.
Standard ESG (standardesg.org) treats health and safety as one of the most directly verifiable ESG subjects — which is why it anchors both the S2 evidence category at Level 2 and a full inspection domain at Level 3. See What to Expect from an On-Site ESG Assessment (Level 3) for the full on-site picture.
Was this page useful?