Where mental health sits in the standard
ISO 45001 never carves mental health out as a separate topic, and that is the point: the standard's definitions of injury and ill health cover adverse physical and mental conditions arising from work. Hazard identification (clause 6.1.2) explicitly includes how work is organized, social factors, workload, work hours, leadership, and the culture of the organization. An OH&S system that assesses guarding and chemicals but ignores chronic overload, bullying, or violence at work has a scoping hole an auditor can legitimately probe.
ISO 45003, the companion standard
ISO 45003:2021 (psychological health and safety at work) is guidance, not a certifiable requirements standard. It catalogs psychosocial hazards in three groups: how work is organized (workload, hours, control, role clarity), social factors (relationships, leadership, harassment, violence, isolation), and environment and equipment. It then maps management of them onto the ISO 45001 structure, so organizations already certified can extend their existing system rather than build a parallel one. You cannot certify to 45003, but auditors and mature clients increasingly expect to see its thinking inside your 45001 system.
What evidence looks like in practice
- Psychosocial hazards appearing in your hazard register with the same seriousness as physical ones.
- Worker consultation channels through which workload, treatment, and support issues can safely surface, with visible responses.
- Incident and absence data examined for work-related stress patterns, and investigations that consider organizational causes.
- Management of change assessing psychosocial impact (restructures, shift changes, remote work shifts).
An auditor's practical caution
This area demands care with privacy and competence: assessing organizational risk factors is your system's job; diagnosing individuals is not, and records must respect medical confidentiality. Handle the topic at the level of work design and aggregate indicators, involve workers in shaping the controls, and bring in occupational health expertise where cases require it. Done that way, extending your system to psychological health is not an add-on; it is the standard finally being read in full.