ISO 45001 – Occupational health and safety management systems

Contents

Purpose and main structure
All clauses and sub-clauses (auditable requirements)
Mandatory documented information – self-check list
Common performance indicators (KPIs)
Who uses it and how
Practical example
Notes for use in Vietnam
Sources and cross-references

ISO 45001 – Hệ thống quản lý an toàn và sức khỏe nghề nghiệp · Ảnh: FTS CSRA

Overview and origin

Item	Details
Vietnamese name	Hệ thống quản lý an toàn và sức khỏe nghề nghiệp – Các yêu cầu và hướng dẫn sử dụng (in Vietnam: TCVN ISO 45001:2018)
English name	ISO 45001:2018 – Occupational health and safety management systems – Requirements with guidance for use
Issuer / administrator	International Organization for Standardization (ISO), Technical Committee ISO/TC 283. In Vietnam the equivalent national standard is published by the national standards body; certification is carried out by independent certification bodies (preferably accredited ones).
Nature	A management-system standard that is certifiable by a third party. It sets “what” must be done (requirements), not detailed “how” or technical thresholds – those are set by national law.
Reference scope	Any organisation of any size or sector; uses the Harmonized Structure (HS) shared with ISO 9001 and ISO 14001, making integration easy. Related: ISO 45003 (psychological health at work), ISO/PAS 45007:2026 (climate-related risks), ILO Conventions, GRI 403.

ISO 45001 was published in March 2018, replacing OHSAS 18001 (withdrawn in 2021). In 2024 ISO issued Amendment 1:2024 (Climate action changes), requiring organisations to determine whether climate change is a relevant issue in their context (clauses 4.1, 4.2). ISO/TC 283 is now fully revising the standard, with a new edition expected in 2027 focusing on psychosocial and climate-related risks. Until then, ISO 45001:2018 + Amd 1:2024 remains the edition in force.

Purpose and main structure

ISO 45001 aims to help organisations provide safe and healthy workplaces, prevent work-related injury and ill health, and proactively improve occupational health and safety (OH&S) performance. Three intended outcomes: continual improvement of OH&S performance; fulfilment of legal and other requirements; achievement of OH&S objectives.

The standard follows the PDCA cycle across 10 clauses; the auditable requirements are in clauses 4 to 10:

All clauses and sub-clauses (auditable requirements)

Clause	Key requirements
	Clause 4 – Context of the organization
4.1	Understanding the organization and its context: internal and external issues affecting OH&S outcomes; determine whether climate change is a relevant issue (Amd 1:2024)
4.2	Needs and expectations of workers and other interested parties; which become legal or other requirements (Amd 1:2024: interested parties may have climate-related requirements)
4.3	Determining the scope of the OH&S management system (documented)
4.4	Establish, implement, maintain and continually improve the OH&S management system
	Clause 5 – Leadership and worker participation
5.1	Top management takes overall accountability for preventing injury and ill health; ensures resources; protects workers from reprisals when reporting; builds a supportive culture
5.2	OH&S policy: commitments to safe conditions, legal compliance, eliminating hazards, improvement, worker consultation (documented)
5.3	Organizational roles, responsibilities and authorities at all levels
5.4	Consultation and participation of workers (incl. non-managerial): hazard identification, risk assessment, controls, training needs, incident investigation; remove barriers to participation
	Clause 6 – Planning
6.1.1	General: determine risks and opportunities to address, incl. planned changes
6.1.2.1	Hazard identification: work organization, social factors (workload, hours, harassment), routine and non-routine activities, past incidents, emergencies, people, changes
6.1.2.2	Assessment of OH&S risks and other risks to the system (methodology documented)
6.1.2.3	Assessment of OH&S opportunities (improve conditions, eliminate hazards) and other opportunities
6.1.3	Determination of legal and other requirements (documented, kept up to date)
6.1.4	Planning action for risks, opportunities, legal requirements and emergencies; integrate into business processes
6.2.1	OH&S objectives: consistent with policy, measurable, monitored, communicated
6.2.2	Planning to achieve objectives: what, resources, who, when, indicators (documented)
	Clause 7 – Support
7.1	Resources
7.2	Competence of workers, incl. ability to identify hazards (evidence retained)
7.3	Awareness: policy, objectives, relevant incidents, hazards, ability to remove themselves from imminent danger
7.4.1 – 7.4.3	Communication: general, internal, external (what, when, with whom, how)
7.5.1 – 7.5.3	Documented information: general, creating and updating, control
	Clause 8 – Operation
8.1.1	Operational planning and control: criteria, controls, adapting work to workers
8.1.2	Eliminating hazards and reducing risks via the hierarchy: eliminate → substitute → engineering → administrative (incl. training) → PPE
8.1.3	Management of change (products, processes, equipment, legal requirements, hazard knowledge)
8.1.4.1	Procurement: control goods and services to conform to the OH&S system
8.1.4.2	Contractors: coordinate hazard identification and risk control; selection criteria
8.1.4.3	Outsourcing: control outsourced functions and processes
8.2	Emergency preparedness and response: plans, first aid, training, periodic drills, evaluation (documented)
	Clause 9 – Performance evaluation
9.1.1	Monitoring, measurement, analysis: compliance, hazards, progress on objectives, effectiveness of controls; calibration
9.1.2	Evaluation of compliance with legal requirements (results retained)
9.2.1 – 9.2.2	Internal audit and audit programme; results reported to workers and their representatives
9.3	Management review: incident trends, consultation outcomes, risks and opportunities, resources, improvement decisions
	Clause 10 – Improvement
10.1	General: determine opportunities for improvement
10.2	Incident, nonconformity and corrective action: react, investigate root causes with worker participation, review risk assessments (documented)
10.3	Continual improvement of OH&S performance, culture and worker participation

Mandatory documented information – self-check list

Certification auditors will ask for the following records. Use this list as a self-check before the audit:

Clause	Required record
4.3	Scope of the system
5.2	OH&S policy
5.3	Roles, responsibilities, authorities
6.1.1	Risks, opportunities and related processes
6.1.2.2	Risk assessment methodology and criteria
6.1.3	Legal and other requirements
6.2.2	OH&S objectives and plans
7.2	Evidence of competence (training records, certificates)
7.4.1	Evidence of communication
8.1.1	Operational processes and criteria
8.2	Emergency response plans
9.1.1	Monitoring and measurement results; calibration records
9.1.2	Compliance evaluation results
9.2.2	Internal audit programme and results
9.3	Management review results
10.2	Incidents, nonconformities, corrective actions
10.3	Results of continual improvement

Figure 1. The ISO 45001 PDCA cycle with leadership and worker participation at its core. (AI-generated image) / Hình 1. Chu trình PDCA của ISO 45001 với lãnh đạo và sự tham gia của người lao động ở trung tâm. (Ảnh do AI tạo)

Common performance indicators (KPIs)

ISO 45001 does not prescribe KPIs, but clause 9.1 requires the organisation to decide what to measure. A typical set combines lagging (outcome) and leading (preventive) indicators:

Indicator	Calculation	Type
LTIFR – Lost-time injury frequency rate	Lost-time injuries × 1,000,000 / hours worked	Lagging
TRIR – Total recordable incident rate	Recordable cases × 200,000 / hours worked	Lagging
Severity rate	Days lost × 1,000,000 / hours worked	Lagging
New occupational disease cases	From occupational disease screening results	Lagging
Near-miss reporting rate	Near-miss reports / 100 workers / month	Leading
Corrective actions closed on time	Actions closed on time / total actions	Leading
OSH training coverage	Workers trained and passed / workers required	Leading
Leadership safety walks	Hours or walks per month	Leading

Who uses it and how

Users: any organisation wanting to manage OH&S risks – especially manufacturing, construction, mining, chemicals, logistics, energy, wood processing, textiles and garments. Exporters are often asked by customers or brands for ISO 45001 certification during supplier assessment.

Typical implementation path (6–12 months):

Top management commits, appoints a representative and sets up an OH&S committee with worker/union representatives.
Gap analysis against clauses 4–10 and Vietnam's occupational safety and hygiene law.
Identify hazards and assess risks per process and job; set controls following the hierarchy of controls.
Establish policy, objectives, procedures and work instructions; train and communicate.
Operate for at least 3 months and keep records; run internal audit and management review.
Invite a certification body for Stage 1 (documents) and Stage 2 (on-site) audits. Certificates are valid for 3 years with annual surveillance.

Figure 2. The ISO 45001 hierarchy of controls: eliminate hazards first; PPE is the last line of defence. (AI-generated image) / Hình 2. Thứ bậc kiểm soát rủi ro theo ISO 45001: ưu tiên loại bỏ mối nguy, bảo hộ cá nhân là phương án cuối cùng. (Ảnh do AI tạo)

Practical example

Hypothetical case: Wood-processing plant Y (Binh Duong), 600 workers, 1,300,000 hours worked per year. In 2025 it had 6 lost-time injuries (mostly hand injuries on saws and planers) and 84 days lost.

Baseline: LTIFR = 6 × 1,000,000 / 1,300,000 ≈ 4.6; severity rate = 84 × 1,000,000 / 1,300,000 ≈ 64.6.
Applying the hierarchy to saws: replace hand-fed saws with sliding-table saws with stop sensors (substitution/engineering); fit blade guards and local dust extraction (engineering); lock-out/tag-out (LOTO) for maintenance and retraining (administrative); cut-resistant gloves only where there is no rotating blade (PPE).
Worker participation: each team has a “safety champion” and near-miss cards; within 6 months reports rose from 3 to 41 per month – a sign of a reporting culture taking shape.
Results for 2026 (9 months): 1 lost-time injury, annualised LTIFR ≈ 1.0; compensation costs and production disruption fell sharply; ISO 45001 certification achieved in August 2026.

Notes for use in Vietnam

The law comes first: the 2015 Law on Occupational Safety and Hygiene and its implementing regulations (training, inspection of equipment with strict safety requirements, workplace environment monitoring, health check-ups, accident reporting) are mandatory “legal requirements” that must feed clause 6.1.3 and the compliance evaluation in 9.1.2. An ISO certificate does not replace legal duties.
Regulator: state management of labour and OSH moved to the Ministry of Home Affairs after the 2025 government restructuring; update your reporting contacts and track newly issued regulations.
Avoid “paper ISO”: auditors interview workers (clause 5.4); neat documents while workers cannot name the hazards at their own station is a common nonconformity.
Contractors and seasonal workers: clause 8.1.4 requires contractor control – a group with high accident rates on Vietnamese sites and factories.
Climate and heat: under Amd 1:2024, extreme heat, flooding and storms should be considered in the organisation's context – highly relevant in Vietnam (outdoor work, tin-roofed workshops).
Psychological health: overtime pressure and workplace harassment are real risks; ISO 45003 can help prepare for the 2027 edition.
Choosing a certification body: check accreditation (e.g., by BoA or an IAF member) and that certificates can be verified online.