ISO 45001: Occupational Health and Safety Standards

ISO 45001: Occupational Health and Safety Standards

ISO 45001:2018 is the global standard for Occupational Health and Safety Management Systems (OHSMS). For Indian businesses in manufacturing, construction, logistics, and large-scale services, certification serves three simultaneous purposes in FY 2026-27: it satisfies legal compliance obligations under the Occupational Safety, Health and Working Conditions Code, 2020 (OSH Code); it qualifies your business for multinational supply chains that now treat it as a mandatory pre-qualification filter; and it systematically reduces the incident-driven costs — direct, indirect, and regulatory — that quietly erode operating margins. Implementation for a 200–500-worker unit typically runs 12–15 months.

What ISO 45001 Actually Requires

ISO 45001 follows the High Level Structure (Annex SL) used by ISO 9001 (Quality Management) and ISO 14001 (Environmental Management). This is deliberate: it allows organisations to integrate all three into a single Integrated Management System (IMS), sharing one policy cycle, one internal audit programme, and one management review. If you already hold ISO 9001, the incremental effort for ISO 45001 is substantially lower than starting from scratch.

The standard spans Clauses 4 to 10. Every clause creates a real obligation.

Clause 5 — Leadership and Worker Participation is the clause most Indian implementations underestimate. The Managing Director or CEO must personally sign the OHS policy and demonstrate visible commitment through allocated resources, active participation in management review, and a culture that does not punish workers for raising hazard concerns. Delegating the entire programme to the HSE Manager and signing the policy as a formality is a Major Nonconformity waiting to happen at Stage 2.

Clause 6 — Planning is where the most value is created. You must identify every hazard across every process, location, contractor zone, and visitor pathway; assess risk using a documented methodology (a likelihood-versus-severity matrix is standard practice); build and maintain a Legal Compliance Register covering every applicable OHS law, permit condition, and rule; and set measurable OHS objectives tied to your planning cycle.

Clause 8 — Operational Controls mandates the Hierarchy of Controls, applied in sequence. Many Indian facilities install PPE dispensing machines and consider the job done. The standard explicitly requires you to document why higher-level controls — elimination, substitution, engineering controls — were evaluated and either implemented or found impracticable before PPE was selected. PPE is the last resort in the hierarchy, not the primary strategy.

Clause 10 — Improvement requires you to investigate every incident and every near-miss using root-cause analysis — not to log the event and move on. Root causes must be systemic ("the permit-to-work system did not cover this task category") rather than person-centric ("worker was careless").

The Hierarchy of Controls in Practice

Documented Information You Must Maintain

ISO 45001 uses the term "documented information" rather than procedures and records, but the practical list is specific:

• OHS policy signed by top management
• Hazard Identification and Risk Assessment (HIRA) records
• Legal compliance register, updated at least annually
• Competency and training records — for permanent employees and contract labour
• Emergency response plans with drill evidence (date, participants, observations, corrective actions)
• Internal audit reports and management review minutes with decisions and owners
• Incident and near-miss investigation records, including root-cause analysis

The Indian Regulatory Stack ISO 45001 Sits Within

ISO 45001 is a voluntary standard. The Indian regulatory environment in FY 2026-27 makes it functionally necessary for a growing range of businesses.

OSH Code 2020: What Changed and Why It Matters

The OSH Code consolidates 13 legacy statutes — including the Factories Act 1948, the Mines Act 1952, the Building and Other Construction Workers (BOCW) Act 1996, and the Contract Labour (Regulation and Abolition) Act 1970 — into a single framework. Key changes relevant to your OHSMS:

• Broader coverage: all establishments with 10 or more workers fall under the Code's safety obligations, compared to the higher thresholds under several earlier laws
• Contract and migrant worker inclusion: the host/principal employer is explicitly responsible for safety conditions of contract workers deployed on its premises — a major expansion of liability
• Criminal liability for officers: in cases of workplace death or grievous hurt attributable to negligence, directors, managers, and designated officers face imprisonment up to two years plus fine
• Mandatory Safety Officer: required in factories with 500 or more workers and in construction sites above notified thresholds
• Safety Committee: mandatory in establishments with 250 or more workers, with worker representation

Your ISO 45001 legal compliance register (Clause 6.1.3) maps directly onto OSH Code obligations. If your IMS already maintains a compliance register for ISO 14001, adding OSH Code entries for your sector takes days rather than weeks.

The Four Labour Codes at a Glance

Most states have notified rules under these codes. Your legal register must capture both the central Code provisions and your state-specific notified rules.

Certification Roadmap: A Step-by-Step Sequence

A realistic programme for a mid-size Indian unit with 200–500 workers runs 12–15 months. Here is the sequence that holds up under audit scrutiny.

Months 1–2: Gap Analysis and Scope Definition

• Appoint a Project Lead — the HSE Manager for smaller units, a cross-functional team for larger ones
• Conduct a formal gap analysis against all ten clauses using a checklist
• Define your scope statement: which sites, which activities, which visitor and contractor categories are covered. Scope restrictions that exclude high-risk areas create credibility problems with enterprise clients
• Establish project milestones with the MD's sign-off

Months 2–5: Hazard Identification and Risk Assessment (HIRA)

• Walk every workstation, storage bay, contractor work zone, roof, and visitor access route
• Use a structured HIRA worksheet: hazard description, affected persons (include contractors), existing controls, likelihood rating, severity rating, risk score, required additional controls, Hierarchy of Controls rationale
• Do not conduct HIRA from a desk using generic industry templates. Auditors routinely visit site areas not covered in the HIRA and raise Major NCRs

Months 3–6: Documentation and Operational Controls

• Draft the OHS policy — MD or CEO signature required on the original, not a scanned copy of the HSE Manager's signature
• Build work-permit systems for hot work, confined space entry, and work at height — with physical permit forms, responsible authority sign-off, and close-out procedures
• Implement Lock-Out Tag-Out (LOTO) for machinery maintenance — specific procedure, specific locks, periodic verification
• Stand up a near-miss reporting mechanism: a paper register works at small scale; a QR-code-linked mobile form works at medium scale; HSEQ software works at large scale

Months 6–9: Training and Emergency Preparedness

• Train all workers — permanent, contract, and migrant — on the OHS policy, their specific hazards, and how to report near-misses. Keep signed attendance records
• Conduct at least one full emergency evacuation drill and one fire drill per applicable scenario per year, with written records including observed gaps and corrective actions
• Train Internal Auditors (minimum two, ideally four) through an accredited ISO 45001 Internal Auditor or Lead Auditor course

Months 9–11: Internal Audit and Management Review

• Run a full internal audit covering all clauses and all locations within scope
• Raise Nonconformity Reports (NCRs) and Observations; close them with root-cause analysis, not just corrective action. An NCR closed with "worker retrained" without addressing the systemic cause will reopen at the external audit
• Hold a formal Management Review meeting with the MD/CEO present — not a proxy. Record inputs (incident statistics, audit results, legal compliance status, OHS objectives progress) and outputs (resource decisions, improvement actions, owners, deadlines)

Months 11–15: Certification Audit

• Stage 1 Audit (Document Review): The certification body auditor reviews your documented information for adequacy. Typically one auditor-day, often conducted remotely. The auditor issues a list of items to address before Stage 2 proceeds.
• Stage 2 Audit (Implementation Audit): On-site. Auditors interview workers at all levels, observe processes, examine records, and test emergency preparedness evidence. Duration follows IAF MD5 — for 200 workers, expect 3–4 auditor-days on site. Any Major NCR must be closed before the certificate is issued.

Post-Certification: Surveillance and Recertification

• Surveillance Audit 1: approximately 12 months after certification
• Surveillance Audit 2: approximately 24 months after certification
• Recertification Audit: approximately 36 months — effectively a full reassessment

Worked Example: The True Cost of One Serious Workplace Incident

Scenario: A logistics company with 300 workers. A loading-dock worker, aged 32, falls from an unsecured vehicle tailgate and suffers a fractured spine — classified as Permanent Total Disablement (PTD) under the Employees' Compensation Act 1923 (now administered under the Social Security Code 2020).

Direct Legal Liability — Employees' Compensation: Under Section 4(1)(b) of the Employees' Compensation Act, PTD compensation = 60% of monthly wages × relevant factor from Schedule IV. For a 32-year-old worker earning Rs. 22,000 per month, applying the Schedule IV factor produces a compensation liability in the range of Rs. 25–28 lakh (exact figure depends on the current Schedule notification — verify with the Commissioner for Employees' Compensation in your jurisdiction). This is a mandatory statutory payment, not a matter for negotiation.

Regulatory Fine: Under the OSH Code 2020, failure to provide a safe working platform and restraint equipment at the dock: fine up to Rs. 2,00,000 for first offence. Repeat or aggravated offence: up to Rs. 5,00,000. If a director is named in the complaint: criminal proceedings under the relevant section of the OSH Code.

Quantifiable Indirect Costs:

• Production shutdown at the dock during police panchanama and DGLMS inspection (2 shifts): Rs. 1,60,000
• Replacement worker sourcing, deployment, and site induction: Rs. 45,000
• Legal defence — employer's solicitor, Commissioner's proceedings, and any Labour Court involvement: Rs. 1,50,000–Rs. 3,00,000
• Workers' compensation insurance premium loading for next three policy years: approximately Rs. 2,40,000 additional (Rs. 80,000/year), assuming the insurer does not invoke exclusion clauses
• Senior management time — HSE Manager, HR Head, MD — for investigation documentation, regulator meetings, and proceedings: approximately Rs. 80,000 in opportunity cost

Total direct and quantifiable indirect cost: approximately Rs. 33–36 lakh from one incident.

Compare with the ISO 45001 implementation cost for this 300-worker logistics unit:

• External OHSMS consultant (gap analysis through certification readiness): Rs. 1,80,000–Rs. 2,20,000
• Certification body fees (Stage 1 + Stage 2 + first-year surveillance): Rs. 1,60,000–Rs. 2,00,000
• Internal auditor training (two staff): Rs. 40,000–Rs. 60,000
• Emergency drill improvements and LOTO hardware: Rs. 40,000
• Near-miss reporting software or setup: Rs. 30,000–Rs. 60,000
• Total first-year outlay: Rs. 4,50,000–Rs. 5,40,000

The certification investment is approximately 13–16% of one serious incident cost. Organisations that treat ISO 45001 as an overhead are, in fact, self-insuring a multi-crore liability without a documented risk-reduction framework.

Who Needs It and When: Sector-Specific Triggers

ISO 45001 is formally voluntary. These real-world triggers make it functionally necessary across sectors.

Manufacturing (Auto-Ancillary, Chemicals, Pharma, Textiles): Tier-1 original equipment manufacturers — Maruti Suzuki, Tata Motors, Mahindra — routinely mandate ISO 45001 in supplier development agreements. Tier-2 and Tier-3 suppliers targeting OEM business should treat certification as a pre-qualification, not a nice-to-have. Chemical and pharmaceutical manufacturers must comply with the Manufacture, Storage and Import of Hazardous Chemicals Rules 1989 — the HIRA methodology under ISO 45001 directly satisfies these documentation obligations.

Construction: Government infrastructure tenders under NHAI, the Ministry of Road Transport and Highways (MoRTH), and railway projects increasingly include OHS certification in pre-qualification criteria. The OSH Code's obligations for principal employers on construction sites — covering contract labour safety, welfare facilities, and accident notification — are most efficiently managed through a live ISO 45001 system.

Logistics and Warehousing: Major e-commerce operators in India require their third-party logistics (3PL) partners to demonstrate OHS certifications as part of vendor agreements. Fall hazards, manual handling injuries, and forklift incidents make logistics one of India's highest-incident sectors by absolute numbers.

IT and Large-Format Services: Multinational clients in BFSI, ITES, and organised retail now include OHS performance in ESG due-diligence questionnaires. Ergonomic hazards, psychosocial risks (stress, overwork), and fire safety all fall within ISO 45001's scope. A certificate with a current surveillance audit provides an auditable response to ESG procurement queries.

Choosing a Certification Body in India

The relevant accreditation authority in India is the National Accreditation Board for Certification Bodies (NABCB), operating under the Quality Council of India (QCI). NABCB is a signatory to the IAF Multilateral Recognition Arrangement (IAF MLA) — meaning a certificate from a NABCB-accredited body is accepted globally without re-audit.

When evaluating certification bodies, verify:

1. NABCB accreditation for your sector NACE code. A certification body accredited for food manufacturing cannot competently audit a construction-sector OHSMS. Request the accreditation certificate and check the scope.
2. Proposed auditor's CV and sector experience. You are entitled to review auditor credentials before audit assignment. Object in writing if the assigned auditor lacks your industry background.
3. Impartiality. The certification body that audits you cannot also be your ISO 45001 consultant. ISO 17021-1 prohibits this. Keep consultancy and certification separate.
4. Audit duration per IAF MD5. Ask the CB to show their audit time calculation. Under-resourced audits (too few auditor-days for your headcount) produce certificates that sophisticated supply-chain auditors will challenge.

Well-known certification bodies with NABCB accreditation operating in India include Bureau Veritas, TÜV Rheinland, TÜV SÜD, DNV, SGS, Intertek, BSI Group, and BVQI. Fees vary materially. Obtain itemised quotes from at least three bodies before committing.

Common Mistakes and How to Fix Them

Mistake 1: Excluding contractors and migrant workers from the HIRA The standard covers "all persons under the organisation's control." Excluding contract or migrant labour from your hazard assessment creates your largest legal liability and guarantees a Major NCR from any competent auditor. Fix: Build a contractor management process with pre-qualification questionnaires, mandatory site induction records, periodic safety inspections of their work areas, and incident-reporting obligations written into your contractor agreements.

Mistake 2: Treating the HIRA as a one-time document An HIRA produced at implementation and never updated becomes worthless — and will produce NCRs at surveillance. Fix: Link HIRA review to three triggers: (a) any change in process, equipment, or chemical inventory; (b) after any significant incident or near-miss; and (c) annually as part of the management review cycle.

Mistake 3: Near-miss logs that show zero entries A blank near-miss register is not evidence of a safe workplace. It is evidence of a reporting culture that has failed — workers either do not know how to report, fear consequences, or have not been trained on what constitutes a near-miss. Fix: Introduce simple, anonymous reporting channels. Celebrate near-miss reporting in team briefings as a proactive safety behaviour. Investigate near-misses with the same root-cause rigour applied to incidents.

Mistake 4: PPE as the primary — and only — hazard control Issuing helmets and reflective vests is not hazard management under ISO 45001. Your HIRA must document that you evaluated and either applied or rejected each level of the Hierarchy of Controls before selecting PPE. Fix: Add a mandatory "Hierarchy of Controls Rationale" column to your HIRA worksheet. For every hazard, the assessor must document why elimination, substitution, and engineering controls were or were not feasible.

Mistake 5: Management review conducted without top management A management review meeting conducted by the HSE Manager in the MD's absence does not satisfy Clause 9.3. The standard requires top management — not a delegate — to review OHS performance and make resource and improvement decisions. Fix: Schedule the management review as a Board-level agenda item. Document attendance, inputs reviewed, decisions taken, owners assigned, and deadlines set. Thirty minutes with genuine decisions is better than three hours with no outcomes.

Mistake 6: Building a system for the audit, not for safety Surveillance auditors are trained to distinguish live systems from document-ready displays. If your near-miss register was completed in the two weeks before the audit, if your drill records are undated or use the same handwriting for all 50 participants, if workers cannot explain the hazards in their own area — the auditor will see it. Fix: Integrate OHS system activities into daily operations: morning toolbox talks, weekly inspection rounds, monthly performance dashboards to leadership, quarterly HIRA review meetings. When the audit comes, it should find a system already in motion.

Maintaining Certification: Surveillance and Continual Improvement

The three-year certification cycle is not a "set and forget" arrangement. Between surveillance audits, you must:

• Continue running internal audits quarterly or at minimum semi-annually — not just in the weeks before an external audit
• Update the legal compliance register when new rules are notified under the OSH Code or any state-level labour law
• Track OHS objectives monthly: Lost-Time Injury Frequency Rate (LTIFR), near-miss frequency rate, days away from work rate, safety training completion rate
• Conduct at least one emergency drill per scenario type per year, with records showing observations and corrective actions taken

At Surveillance Audit 1 (Year 1), auditors focus on whether the system is alive: Are near-miss records being generated organically? Has the HIRA been updated since certification? Have incident root causes led to systemic fixes? The most common finding at Year 1 is that organisations that were diligent at certification have become lax.

At Recertification (Year 3), the auditor reviews the entire three-year arc: OHS performance trends, how you handled incidents and regulatory changes, whether continual improvement actions produced measurable results. The recertification audit is closer in scope to a full Stage 2 than to a surveillance audit.

Key Takeaways

• ISO 45001:2018 replaced OHSAS 18001 (which expired in 2021) and uses Annex SL structure — integrating with ISO 9001 and ISO 14001 into an IMS is the most efficient path for established manufacturers
• The OSH Code 2020 extends criminal liability to directors and designated officers for workplace deaths and grievous injuries — ISO 45001's documented controls and training records are your primary evidence of due diligence
• A single PTD incident costs Rs. 33–36 lakh in direct and indirect costs for a mid-size unit; full ISO 45001 implementation costs Rs. 4.5–5.5 lakh, making the ROI case unambiguous
• Contract and migrant workers must be included in your HIRA and training records — excluding them is the most common Major NCR and your largest legal exposure under the OSH Code
• PPE is the last resort, not the first line of defence; your HIRA must document the Hierarchy of Controls evaluation for every hazard
• Near-miss reporting culture is the leading indicator of OHSMS health — an empty near-miss register signals a failing system, not a safe workplace
• Use only NABCB-accredited certification bodies in your sector NACE code; verify auditor competence and ensure audit duration complies with IAF MD5 before signing the certification agreement