ISO 45001 — Occupational health and safety management systems
What is ISO 45001?
ISO 45001 is the international standard for occupational health and safety management systems. Its aim is to prevent work-related injuries and ill health before they happen — by identifying hazards, assessing risks and building controls into everyday work.
ISO 45001 replaced OHSAS 18001, which was withdrawn in 2021. If a customer or contracting authority still asks you for OHSAS 18001, they are asking for a standard that no longer exists — the answer is ISO 45001.
The standard is voluntary, but it builds on obligations that exist in Serbia by law anyway — above all the workplace risk assessment (Akt o proceni rizika) and staff training. So a company that properly meets its occupational health and safety obligations already has a starting point. On top of that, the standard requires a policy and objectives, consultation with workers, management of change and procurement, and investigation of incidents.
What the standard requires
ISO 45001 replaced OHSAS 18001 and strengthened several of its requirements. What it requires:
- Hazard identification and risk assessment — for routine work, but also for maintenance, breakdowns, contractors’ work and emergencies.
- Top management accountability. The standard explicitly requires top management to take overall responsibility and accountability for preventing work-related injury and ill health — this can’t be delegated to the safety officer.
- Consultation and participation of workers, including non-managerial workers. This is a separate requirement, not a recommendation.
- Legal and other requirements — which regulations apply to you and how compliance is checked.
- The hierarchy of controls, in the prescribed order — see below.
- Management of change and procurement, including contractors and outsourced work.
- Reporting and investigating incidents, followed by actions that prevent them from happening again.
- Internal audit and management review.
Who ISO 45001 is for
The standard applies to any organisation, whatever its sector or size. It is most often implemented where workers face the greatest hazards, or where a client requires it:
- construction and contracting work;
- manufacturing, metalworking and the chemical industry;
- mining, energy and plant maintenance;
- transport, warehousing and logistics;
- companies that send workers to other companies’ construction sites and premises.
Office-based businesses implement it less often, but they are asked for it too — as a tender condition or by a parent company.
How implementation works
- Defining the scope — which sites, jobs and categories of workers the system covers, including contractors and temporary staff.
- Hazard identification and risk assessment by job and activity.
- Listing the legal and other requirements that apply to the organisation.
- OH&S policy and objectives, with measures and deadlines.
- Setting up worker consultation — how concerns are collected and what happens to them.
- Operational controls following the hierarchy, plus rules for contractors and procurement.
- Emergency preparedness and drills.
- Incident reporting, investigation and corrective action.
- Internal audit and management review, then the certification audit if a certificate is the goal.
What changes in practice
The first change you see is in who talks about safety. As long as safety is left to one safety officer, the system doesn’t really exist; once shift supervisors and workers have somewhere to report a hazard and can see what was done about it, it starts to work.
- Hazards are reported before someone gets hurt, because there is a way to report them.
- Incidents and near misses are investigated, so the cause is removed and the incident doesn’t happen again.
- Contractors on site work by the same rules as employees, because that is in the contract.
- Changes to processes or equipment are assessed before they are introduced, not afterwards.
- In tenders, you have the evidence that clients in construction and industry regularly ask for.
The hierarchy of controls — the order the standard prescribes
ISO 45001 doesn’t let you deal with a risk by handing out protective equipment and calling it done. It requires controls to be considered in this order, with lower levels relied on only when higher ones aren’t feasible or aren’t enough on their own:
- Eliminating the hazard — removing the dangerous task or material.
- Substitution with a less hazardous material, piece of equipment or method.
- Engineering controls and reorganising work — guards, ventilation, automation, separating workers from the hazard.
- Administrative controls — procedures, training, warning signs, job rotation.
- Personal protective equipment — the last line of defence, not the first.
At the audit you need evidence that the higher levels were considered. A common finding is a control that exists with no sign that anything higher up the hierarchy was ever looked at.
Worker participation — what the standard explicitly requires
The standard distinguishes between two things: consultation (asking for views before a decision) and participation (involvement in making the decision). For both, it requires a defined way of doing it, and the removal of obstacles — language, timing, or the fear of consequences for the person who reports a hazard.
It explicitly requires the participation of non-managerial workers, among other things in identifying hazards, investigating incidents and deciding on controls. That means meeting minutes, a suggestion box or a reporting system must really exist and be acted on — not appear the day before the audit.
Climate change in the organisation’s context
Since February 2024, ISO 45001 has had an amendment (ISO 45001:2018/Amd 1:2024), one of the climate amendments ISO made to its management system standards. It requires the organisation to determine whether climate change is a relevant issue, and adds a note that relevant interested parties can have requirements related to climate change.
This isn’t a separate system or new documentation. What is required is that the consideration takes place and can be seen — in the context analysis and in the management review. If you conclude that climate change isn’t relevant to your occupational health and safety system, that is an acceptable outcome too, provided it is clear the question was asked.
How long implementation takes
Implementing ISO 45001 usually takes 30 to 90 days. Exactly how long depends on the size of the organisation, the number of employees and how much of the above is already in place. The workplace risk assessment and training records are legal obligations in Serbia. If yours are in order, the system is built around them rather than from scratch. We give an estimate for your case after a short conversation about the scope. On your side, for small and medium-sized organisations it takes 2 to 5 hours a week in total, spread across several people — more on this in our frequently asked questions.
What affects the price
Three things affect the cost of implementation:
- the size of the organisation;
- the number of employees;
- the standard being implemented — the amount of work differs from standard to standard.
We can only give an exact price after you get in touch and we have a short conversation about the scope. Without that, any figure would be guesswork, so we don’t give one here.
Frequently asked questions
Does ISO 45001 replace our legal health and safety obligations?
No. Legal obligations apply regardless of the standard. ISO 45001 requires those obligations to be listed, met and regularly checked — so it builds on them rather than replacing them.
We have a workplace risk assessment. Is that enough for ISO 45001?
No, but it is a good starting point. The risk assessment covers risks job by job; the standard also requires a policy, objectives, worker consultation, management of change and procurement, incident investigation, internal audit and management review.
What happened to OHSAS 18001?
ISO 45001 replaced it. Organisations certified to OHSAS 18001 have moved to ISO 45001; no new OHSAS 18001 certificates are issued.
Does it also cover contractors working at our site?
Yes. The standard explicitly requires risks arising from contractors and outsourced work to be taken into account, and requirements for them to be included in procurement and contracts.
Can it be combined with ISO 9001 and ISO 14001?
Yes — the structure is the same, so the shared parts of the system aren’t done twice. The same harmonised structure means the context, policy, internal audits and management review are run together.
What do worker consultation and participation mean?
The standard requires non-managerial workers to take part in identifying hazards, assessing risks, deciding on controls and investigating incidents, and to be consulted on matters such as the OH&S policy, objectives and the audit programme. It also requires obstacles to that participation to be removed — for example, fear of the consequences of reporting, or meetings held outside working hours.
General questions — cost and duration, who issues the certificate and how long it is valid — are covered in our frequently asked questions.
Related standards
- ISO 14001 — environmental management; controls and emergency planning overlap with ISO 45001.
- ISO 9001 — the quality management system, with a shared structure and documentation.
- ISO 39001 — road traffic safety; relevant if most of your employees’ risk is on the road.
- Occupational health and safety — our service, if you need support beyond the standard itself.
- Frequently asked questions about ISO standards — how certification works, how long a certificate is valid, what new editions mean.
- HACCP — food safety; a common pairing in food production and hospitality, where workplace safety and food hygiene overlap.
- Overview of all standards — if you’re not sure what you need.
- Fire safety — part of the emergency planning that ISO 45001 requires.
How STANDARDISO can help
We guide you through the whole process — from hazard identification and risk assessment, through the hierarchy of controls, worker consultation and rules for contractors, to incident investigation and the internal audit. The certificate is issued by an independent, accredited certification body.
We work from your real processes: the documentation describes what you actually do, rather than forcing your work into a template. We train your staff so they can keep using the system after the audit. Everyone on our team works in English, and your ISO documentation can be in English too, alongside Serbian wherever your staff or Serbian law need it.