Shortcut: OSHA is the law — the minimum you must do. ISO 45001 is a management system — how you organize yourself to stay above the minimum everywhere, every day.
OSHA (in the US) issues legally enforceable regulations about specific hazards: fall protection heights, lockout/tagout steps, exposure limits. Compliance is mandatory, inspected, and penalized. ISO 45001 is voluntary and doesn't set a single exposure limit — instead it requires you to build a system that identifies all your legal requirements (OSHA included), assesses risks beyond what the law names, involves workers, and improves continually.
They are complements, not competitors. A certified ISO 45001 system has legal compliance as one of its inputs — clause 6.1.3 explicitly requires you to determine and honor legal requirements. Many organizations pursue 45001 precisely because it systematizes OSHA compliance and reduces the chance of the violation they didn't see coming.
Our OSH Five Frameworks guide puts OSHA, NEBOSH, NIOSH, IOSH, and ISO 45001 side by side.
Yes. OHSAS 18001 was formally withdrawn, and the migration deadline (extended to September 2021 due to the pandemic) has long passed. Any OHSAS 18001 certificate still hanging on a wall is expired history, not a valid credential.
For anyone migrating knowledge rather than certificates: 45001 differs from 18001 mainly in structure (the common ISO high-level structure), stronger leadership requirements, explicit worker participation, and risk thinking applied to the management system itself, not just to workplace hazards.
If a supplier shows you an OHSAS 18001 certificate today, treat it as no certification at all.
No jurisdiction makes ISO 45001 itself law — occupational safety law comes from national regulators (OSHA in the US, HSE in the UK, and so on). ISO 45001 is voluntary.
Commercially, though, it is increasingly demanded: large construction clients, oil & gas operators, mining companies, and public infrastructure tenders commonly require certification from contractors as a prequalification condition. If your revenue depends on winning that work, the market has made it mandatory for you.
It also carries legal weight indirectly: in many jurisdictions, a functioning certified system is persuasive evidence of due diligence if an incident ever reaches court — though it is never immunity.
In plain terms, the standard asks for ten things: (1) understand your organization's context and who has a stake in its safety; (2) visible leadership — top management owns safety personally, not by delegation; (3) worker consultation and participation at every level; (4) systematic hazard identification and risk assessment; (5) a plan to comply with every legal requirement that applies to you; (6) objectives and plans to improve, not just maintain; (7) competence, awareness, and communication; (8) operational controls, including for contractors, procurement, and outsourcing; (9) emergency preparedness; and (10) performance evaluation — monitoring, internal audit, management review — feeding corrective action and continual improvement.
Notice what's absent: no mandated forms, no specified software, no required org chart. The standard defines outcomes; you define methods.
Every clause is unpacked in our free 45001 guide.
Yes. The standard scales the same way ISO 9001 does — requirements are proportional to your hazards and complexity, not your headcount. A 12-person electrical contractor has real hazards and therefore real work to do on risk assessment and controls, but its documentation can be lean and its meetings short.
Small businesses actually hold an advantage on the hardest requirement — worker participation — because in a small team, involving everyone is a Tuesday toolbox talk, not a corporate program.
Cost scales too: fewer auditor-days, smaller fees. If a client contract or prequalification portal is asking for 45001, small size is not a barrier.
Shortcut: the hazard is the thing that can hurt you; the risk is how likely and how bad. A tiger is a hazard; a tiger in a locked cage is a low risk.
ISO 45001 keeps these deliberately distinct. A hazard is a source with the potential to cause injury or ill health — the unguarded blade, the solvent vapor, the night shift fatigue. A risk is the combination of how likely harm is and how severe it would be, given your current controls.
The distinction drives the whole system: you identify hazards, you assess risks, and you control risks by acting on hazards — eliminate first, substitute next, engineer, administrate, and only then rely on PPE (the hierarchy of controls).
You can practice exactly this in our free Hazard Trainer & Risk Lab — spot hazards in a scene, rate risk with the RPN formula, and apply controls to shrink residual risk. See also the glossary entry hazard vs risk.
It is the standard's signature requirement, and auditors probe it hard. Participation means workers — including non-managerial workers — are genuinely involved in the decisions that affect their safety: hazard identification, risk assessment, incident investigation, policy development, and setting objectives. Consultation means they're asked and answered before decisions land on them.
Evidence auditors look for: safety committee records with worker names on them, risk assessments signed by the people who do the task, incident investigations that interviewed the crew, and — the acid test — workers who, when interviewed alone, can describe how they raise a concern and give an example of one that changed something.
A system where managers write everything and workers sign the last page fails this requirement, however beautiful the documents.
Expect more walking and fewer conference rooms than a quality audit. The auditor will tour work areas, watch tasks being performed, and talk to workers away from their supervisors — asking what hazards their job has, what training they received, and what they'd do if they saw something unsafe. Document review focuses on risk assessments, legal compliance evaluation, incident records, and emergency drills.
Findings follow the standard scheme — nonconformities graded major or minor, plus observations. Common 45001 findings: risk assessments that don't match the task as actually performed, contractor controls that exist on paper only, and consultation that can't produce evidence.
Try our Integrated Audit Game to experience a five-station mock audit combining ISO 9001 and ISO 45001.
Yes — that is exactly why all three share the same ten-clause high-level structure. Context, leadership, planning, support, operation, performance evaluation, improvement: one framework, three lenses (quality, environment, safety). Most multi-standard organizations run a single integrated management system with one document set, one internal audit program, and one management review.
Integration cuts costs twice: internally (one system to maintain instead of three) and externally (certification bodies audit combined systems in fewer total days than three separate audits).
If you're building from zero and know you'll need two or three standards eventually, design the integrated system from day one — bolting them together later works, but costs more.
Three returns show up repeatedly. Fewer incidents: a functioning system finds hazards before they find people — the direct saving in injuries, downtime, insurance premiums, and workers' compensation is the core ROI. Market access: in construction, energy, and industrial services, certification increasingly decides who is even allowed to bid. Legal resilience: systematic legal-compliance evaluation plus documented due diligence is the strongest position an employer can be in after an incident.
The soft return is cultural and real: organizations report that visible leadership commitment plus genuine worker voice changes what people report, and early reporting is the cheapest safety intervention that exists.
The caveat mirrors ISO 9001's: a wall certificate over a paper system returns nothing and fools no auditor for long. When you're ready to certify for real, USQC audits and certifies OH&S systems worldwide.