From British BS OHSAS 18001 to International ISO 45001: Why the Safety Paradigm Shifted
For nearly two decades (from 1999 to 2018), the global benchmark for occupational health and safety certification was British specification BS OHSAS 18001 (Occupational Health and Safety Assessment Series), developed by a consortium of national standards bodies and registrars led by BSI. Despite its widespread adoption, OHSAS 18001 carried significant structural limitations: it was not an International Organization for Standardization (ISO) standard, used an outdated clause numbering structure (Clauses 4.1 to 4.6), aligned poorly with the revised ISO 9001 and ISO 14001 standards, and treated workplace safety largely as reactive hazard control inside the factory fence.
To establish a unified international standard, project committee ISO/PC 283, working alongside experts from the International Labour Organization (ILO) and the European Agency for Safety and Health at Work (EU-OSHA), published ISO 45001:2018 (adopted in Ukraine as national standard DSTU ISO 45001:2019). Following the three-year transition window that ended in 2021, all OHSAS 18001 certificates were withdrawn.
Why does the distinction between OHSAS 18001 and ISO 45001 remain a critical operational topic in 2026? In practice, many industrial enterprises that built their safety documentation between 2010 and 2018 simply replaced the cover-page title "DSTU OHSAS 18001:2010" with "DSTU ISO 45001:2019" while leaving legacy OHSAS mechanics untouched inside their procedures: static hazard tables without OH&S opportunities, no formal mechanism for non-managerial worker consultation, unmanaged procurement and contractor risks, and over-reliance on Personal Protective Equipment (PPE) and repetitive briefing signatures.
10-Point Engineering Comparison: OHSAS 18001:2007 vs ISO 45001:2018 (DSTU ISO 45001:2019)
To understand the structural and engineering depth of the transition, the table below compares BS OHSAS 18001:2007 against ISO 45001:2018 across ten core governance and shop-floor dimensions.
| Comparison Dimension | BS OHSAS 18001:2007 (DSTU OHSAS 18001:2010) | ISO 45001:2018 (DSTU ISO 45001:2019) |
|---|---|---|
| 1. Normative Status & Structure | British assessment specification structured around legacy ISO Guide 72 (Clauses 4.1-4.6) | Full International Standard built on the ISO Harmonized High-Level Structure (Annex SL, Clauses 1-10) |
| 2. Organizational Context (Clause 4) | Absent; the OH&S system operated in isolation from external business, supply-chain, and macro factors | Mandatory analysis of internal and external issues (technological, legal, security, workforce) affecting OH&S outcomes |
| 3. Interested Parties (Clause 4.2) | Focused narrowly on direct employees and state labor inspectors | Broad stakeholder scope: direct and contract workers, unions, contractors, visitors, neighboring communities, clients, insurers |
| 4. Executive Leadership (Clause 5.1) | Allowed top management to delegate system oversight to an appointed "Management Representative" (typically the Safety Manager) | Eliminates the "Management Representative" role; places non-delegable accountability for OH&S performance directly on top management |
| 5. Worker Engagement (Clause 5.4) | Passive worker notification and appointment of safety representatives | Enforces a strict legal distinction between consultation (seeking input prior to decisions) and participation (joint decision-making) for non-managerial workers |
| 6. Risk & Opportunity Scope (Clause 6.1) | Limited to physical hazard identification and injury risk scoring | Dual-loop model: hazard identification + OH&S risks and OH&S opportunities + strategic risks and opportunities for the management system itself |
| 7. Health & Psychosocial Factors | Focused primarily on acute traumatic injuries and classic occupational diseases (noise, dust, vibration) | Explicitly mandates managing physical and mental health, including workload, burnout, shift fatigue, harassment, and stress (expanded in ISO 45003) |
| 8. Procurement & Outsourcing | Addressed tangentially under general operational control | Dedicated Subclause 8.1.4 requiring pre-purchase safety verification of machinery, chemicals, and raw materials plus control of outsourced processes |
| 9. Contractor Management (Clause 8.1.4.2) | Basic gate entry briefing for visiting contractor personnel | Three-way hazard coordination: how contractor work impacts company staff, how company operations impact contractors, and how both impact third parties |
| 10. Documentation (Clause 7.5) | Rigid split between "documented procedures" and "records" in paper binders | Flexible "documented information" concept supporting digital EHS platforms, electronic permit-to-work logs, and visual SOPs |
Clause-by-Clause Cross-Reference Matrix: OHSAS 18001 (4.1-4.6) to ISO 45001 (Clauses 4-10)
If your facility's safety manual or standard operating procedures still reference legacy OHSAS 18001 clause numbers, the cross-reference matrix below provides the exact mapping to the Annex SL architecture of ISO 45001. Aligning with Annex SL also allows seamless integration with quality and environmental systems (see our complete engineering guide to building an Integrated Management System for ISO 9001, ISO 14001, and ISO 45001).
| BS OHSAS 18001:2007 Clause | OHSAS 18001 Requirement Title | ISO 45001:2018 (DSTU ISO 45001:2019) Clause | Key Structural Additions in ISO 45001 |
|---|---|---|---|
| 4.1 | General requirements | 4.1, 4.2, 4.3, 4.4 | Adds Context of the Organization (4.1) and Needs and Expectations of Workers and Other Interested Parties (4.2) |
| 4.2 | OH&S policy | 5.2 | Policy must include explicit commitments to worker consultation/participation and to eliminating hazards using the hierarchy of controls |
| 4.3.1 | Hazard identification, risk assessment and determining controls | 6.1.2, 6.1.4, 8.1.2 | Adds assessment of OH&S opportunities (6.1.2.3) and psychosocial factors; moves the Hierarchy of Controls into Operational Planning (8.1.2) |
| 4.3.2 | Legal and other requirements | 6.1.3 | Requires documented maintenance of legal obligations and evaluation of how statutory rules apply to site-specific risks |
| 4.3.3 | Objectives and programme(s) | 6.2 (6.2.1, 6.2.2) | OH&S objectives must be measurable, integrated into business processes, and backed by defined resources and leading indicators |
| 4.4.1 | Resources, roles, responsibility, accountability and authority | 5.1, 5.3, 7.1 | Expands Leadership and Commitment (5.1), removes the formal "Management Representative" shield, and protects workers from reprisals when reporting hazards |
| 4.4.2 | Competence, training and awareness | 7.2, 7.3 | Splits into Competence (7.2) and Awareness (7.3); introduces the explicit worker right to remove themselves from imminent serious danger without undue consequences |
| 4.4.3 | Communication, participation and consultation | 5.4, 7.4 | Elevates Worker Consultation and Participation into the Leadership clause (5.4) as a core governance pillar, while detailing internal/external communication in 7.4 |
| 4.4.4, 4.4.5, 4.5.4 | Documentation, control of documents and records | 7.5 (7.5.1, 7.5.2, 7.5.3) | Consolidates into Clause 7.5 "Documented Information" with strict requirements for data integrity, medical privacy, and version control |
| 4.4.6 | Operational control | 8.1 (8.1.1, 8.1.2, 8.1.3, 8.1.4) | Structured into General Operational Control (8.1.1), Hierarchy of Controls (8.1.2), Management of Change / MOC (8.1.3), and Procurement, Contractors & Outsourcing (8.1.4) |
| 4.4.7 | Emergency preparedness and response | 8.2 | Expands requirements for scheduled drills, coordination with municipal emergency services and neighbors, and post-incident procedure updates |
| 4.5.1, 4.5.2 | Performance measurement, monitoring and evaluation of compliance | 9.1 (9.1.1, 9.1.2) | Requires balanced leading and lagging KPIs, calibration of occupational hygiene monitoring instruments, and scheduled legal compliance evaluations |
| 4.5.3 | Incident investigation, nonconformity, corrective and preventive action | 10.2 | Removes standalone "preventive action" (as the entire system acts preventively via Clause 6.1 risk planning); emphasizes root-cause analysis of incidents and near misses with worker participation |
| 4.5.5 | Internal audit | 9.2 | Mandates risk-based audit scheduling considering prior findings, incident trends, and auditor independence |
| 4.6 | Management review | 9.3 | Expands required executive inputs (incident trends, worker consultation outcomes, adequacy of safety budgets and engineering resources) |
| None | Continual improvement (as a standalone clause) | 10.1, 10.3 | Dedicated Clause 10.3 requiring systematic advancement of safety culture and worker engagement |
Five Core Requirements of ISO 45001 That Were Absent or Weak in OHSAS 18001
Passing an ISO 45001 certification audit (covered in full in our complete guide to ISO 45001 certification) requires more than renumbering paragraphs. Certification auditors focus heavily on five substantive requirements that separate ISO 45001 from legacy OHSAS 18001 systems.
1. From Delegated Management Representative to Direct CEO Accountability (Clause 5.1)
Under OHSAS 18001, it was common practice for a Managing Director to sign an order appointing the Head of Occupational Safety as the "OH&S Management Representative" and then appear during the external audit for only ten minutes at the opening meeting. ISO 45001 abolished the "Management Representative" role.
Subclause 5.1 defines 13 non-delegable leadership commitments: the CEO, Plant Director, and Operations Director must personally demonstrate to the auditor how safety objectives are integrated into capital budgeting, how engineering controls (such as machine guarding or local exhaust ventilation) are funded, and how leadership protects workers from retaliation or bonus deductions when they report unsafe conditions or halt defective machinery.
2. Consultation and Genuine Participation of Non-Managerial Workers (Clause 5.4)
Subclause 5.4 of ISO 45001 establishes a strict distinction between two engagement mechanisms specifically targeting non-managerial workers (machine operators, welders, warehousemen, drivers, maintenance technicians):
- Consultation (Clause 5.4 d): management's obligation to seek and consider worker feedback before making a decision (for example, before finalizing annual safety objectives, selecting new respirator or safety boot models, or outsourcing a production operation).
- Participation (Clause 5.4 e): involving shop-floor workers directly in joint decision-making during workplace hazard identification, selection of risk controls, incident and near-miss investigations, and determining training needs.
The standard also obliges the organization to identify and remove barriers to worker participation, such as fear of reprisal, shift scheduling constraints, language barriers, or overly complex reporting forms.
3. Dual Assessment Loop: OH&S Hazards, Risks, Opportunities, and Psychosocial Factors (Clause 6.1 & ISO 45003)
In OHSAS 18001, risk assessment was typically a single matrix scoring "Likelihood × Severity" for mechanical, electrical, or chemical hazards. Clause 6.1 of ISO 45001 expands risk thinking across two dimensions:
- Separating Operational OH&S Risks/Opportunities from Strategic System Risks/Opportunities: alongside workstation hazards, the company evaluates strategic risks to the OH&S management system itself (such as skilled technician shortages, power grid disruptions, or aging infrastructure) as well as OH&S opportunities (automating manual palletizing, ergonomic workstation redesign, or digital permit-to-work systems).
- Mandatory Inclusion of Psychosocial Hazards (Clause 6.1.2.1 a): ISO 45001 explicitly requires identifying hazards arising from social factors, including workload, overtime, night shifts, burnout, psychological stress, harassment, and bullying. This requirement is further detailed in companion standard ISO 45003:2021 on managing psychosocial risks and mental wellbeing at work.
4. Enforcing Engineering Controls Over PPE Reliance: The 5-Tier Hierarchy (Clause 8.1.2)
The most common flaw in legacy OHSAS 18001 risk registers was writing "Conduct unscheduled safety briefing and issue earplugs/respirators" as the control measure for every hazard from 95 dBA noise to solvent vapors. Subclause 8.1.2 of ISO 45001 makes the 5-tier Hierarchy of Controls a mandatory operational requirement (we cover the engineering methodology in detail in our guide to the risk-based approach to workplace safety under ISO 45001):
- Elimination: physically removing the hazard altogether (for example, using winch-lowered light fixtures serviced from floor level instead of working at height).
- Substitution: replacing hazardous materials or equipment with safer alternatives (switching from solvent-borne coatings to water-based paints, or replacing hydrogen-emitting lead-acid forklift batteries with sealed lithium-iron-phosphate units).
- Engineering Controls: physical machine guards, optoelectronic safety light curtains, two-hand press controls, LOTO (Lockout / Tagout) energy isolation locks, local exhaust ventilation, and acoustic enclosures.
- Administrative Controls: high-hazard Permits-to-Work, pedestrian-forklift floor segregation markings, shift rotation in hot or noisy zones, and targeted safety drills.
- Personal Protective Equipment (PPE): hard hats, safety glasses, fall-arrest harnesses, ear defenders, and protective garments serve strictly as the last line of defense combined with higher-tier controls, because PPE never eliminates the hazard itself.
5. Controlling Contractors, Procurement, and Outsourced Processes (Clause 8.1.4)
Industrial accident statistics across Ukraine and the EU consistently show that a disproportionate share of severe and fatal workplace injuries involve non-permanent personnel: construction, rigging, maintenance, or cleaning contractors unfamiliar with site hazards. ISO 45001 addresses this exposure directly in Subclause 8.1.4:
- Procurement (Clause 8.1.4.1): the OH&S team must review specifications for new machinery, production lines, and chemical substances before purchase orders are released (verifying CE safety interlocks, noise/vibration ratings, and Safety Data Sheets).
- Contractors (Clause 8.1.4.2): organizations must establish OH&S pre-qualification criteria during contractor selection, verify high-hazard licenses, and enforce three-way hazard coordination on site: (1) how contractor activities (such as hot work or roof repair) endanger host plant workers; (2) how host plant operations (overhead cranes, pressurized lines, ammonia refrigeration) endanger the contractor crew; and (3) how contractor work impacts visitors or adjacent contractors.
- Outsourcing (Clause 8.1.4.3): when manufacturing or logistics operations are outsourced, the company retains responsibility for ensuring those processes conform to its OH&S management system requirements and statutory law.
Integrating ISO 45001 with Ukraine's Statutory Safety System (SUOP) and Wartime Realities
In Ukraine, every employer is legally required to establish and maintain an Occupational Safety Management System (SUOP) under Article 13 of the Law of Ukraine "On Occupational Safety", the Labor Code, sector-specific safety regulations (NPAOP), and the Procedure for Workplace Attestation by Working Conditions (Cabinet of Ministers Resolution No. 442). Historically, the statutory SUOP framework has centered on state permits from the State Labor Service (Derzhpratsi) for high-hazard equipment and works, standardized briefing logbooks, mandatory medical exams, and PPE issuance cards.
Many Ukrainian companies mistakenly run their statutory SUOP and their international DSTU ISO 45001:2019 system on separate tracks: the safety engineer keeps paper briefing logbooks for state inspectors while a quality manager maintains a separate spreadsheet of ISO 45001 risks for the certification body. This duplication is eliminated by mapping statutory Ukrainian instruments directly into ISO 45001 clauses:
- Workplace Attestation by Working Conditions (Resolution No. 442) serves as the quantitative hygiene baseline for occupational disease risk assessment under Clause 6.1.2 and workplace environment monitoring under Clause 9.1.1 (accredited laboratory measurements of noise, vibration, illumination, microclimate, and airborne chemical concentrations).
- High-Hazard Work Lists and Permits-to-Work (NPAOP 0.00-4.12-05) integrate directly into operational control under Clauses 8.1.1 and 8.1.2, enhanced with physical LOTO energy isolation locks and pre-shift inspection checklists.
- Preliminary and Periodic Medical Examinations (Ministry of Health Order No. 246) fulfill Clauses 7.2 and 9.1 regarding worker medical fitness verification and early occupational health surveillance.
In 2026, Ukrainian facilities must also integrate wartime and energy-resilience risks into Clause 4.1 (Context), Clause 6.1 (Risk Assessment), and Clause 8.2 (Emergency Preparedness), which certification auditors actively verify on site:
- Emergency Equipment Shutdown Protocols During Air-Raid Alerts: engineered safe-state shutdown sequences for chemical reactors, boilers, furnaces, and pressurized lines before shift evacuation to shelters.
- Bomb Shelter and Protective Structure Engineering: shelter capacity sized for peak shift headcount, forced ventilation with filtration, at least two independent exits, potable water, trauma medical kits, backup communications, and emergency lighting.
- Industrial Diesel Generator and Battery Energy Storage (BESS) Safety: managing carbon monoxide (CO) exhaust routing, bulk diesel fuel storage bunding and fire suppression, electrical interlock protection during automatic transfer switch (ATS) changeovers, and acoustic insulation.
- Psychosocial Support and Fatigue Management: assessing sleep-deprivation risks after nighttime air attacks before clearing operators for crane, forklift, or high-voltage tasks, alongside workplace accessibility adaptations for returning veterans under ISO 45001 and ISO 45003.
How to Modernize an OH&S System from OHSAS 18001 Heritage to Mature ISO 45001: 6 Steps
If your safety documentation still relies on legacy OHSAS 18001 templates or you are preparing for initial certification (see our detailed checklist in ISO 45001 audit preparation), we recommend executing six practical engineering steps during your standards implementation project:
- Diagnostic Audit (Gap Analysis) of Shop-Floor Controls and Documentation: conduct a structured diagnostic audit comparing existing SUOP manuals, orders, and risk registers against DSTU ISO 45001:2019 (focusing on Clauses 4.1, 4.2, 5.1, 5.4, 6.1.2.3, 8.1.3, and 8.1.4).
- Re-Run Workstation Risk Assessments With Non-Managerial Workers: replace desk-bound risk spreadsheets with joint shop-floor walkthroughs involving safety engineers, shift supervisors, and machine operators; incorporate ergonomic, psychosocial, and wartime energy risks alongside measurable OH&S opportunities.
- Upgrade Risk Controls Using the 5-Tier Hierarchy (Clause 8.1.2): review every high and critical risk entry; wherever "safety briefing and PPE" are listed as the sole controls, engineer physical barriers, LOTO locks, gas detectors, or interlocks.
- Deploy Management of Change (MOC, Clause 8.1.3) and Safe Procurement Sign-Offs (Clause 8.1.4): institute a mandatory OH&S clearance step before purchasing new machinery, introducing new chemicals, altering warehouse racking, or onboarding contractors.
- Launch a Frictionless Near-Miss and Hazard Reporting Channel: give workers a 60-second reporting tool (shop-floor QR code, messaging bot, or physical drop-box) to flag exposed wiring, oil spills, or damaged slings without fear of blame, backed by monthly executive review.
- Cross-Functional Internal Audit and Management Review: audit all production, maintenance, and warehouse shifts (including night shifts and active contractor work zones) and leverage expert audit support to defend the system before the accredited certification body.
Conclusion: Moving from Sign-Off Briefing Logbooks to Proactive Safety Engineering
The fundamental difference between legacy OHSAS 18001 and modern ISO 45001 (DSTU ISO 45001:2019) lies in shifting from administrative hazard paperwork managed by an isolated safety officer to an engineering safety culture embedded into equipment design, procurement, contractor coordination, and executive decision-making. Organizations that retire legacy OHSAS templates and unify ISO 45001 with their statutory Ukrainian SUOP gain far more than a certificate for EU tenders and reconstruction projects: they reduce unplanned downtime, prevent severe workplace injuries, and protect their most valuable engineering and production talent.
If your organization needs to modernize its occupational health and safety management system, prepare for DSTU ISO 45001:2019 certification, or establish ongoing annual support, contact Ekontrol's specialists for an engineering gap assessment and implementation roadmap.
Need a certification consultation?
Free ConsultationOn This Page
- From British BS OHSAS 18001 to International ISO 45001: Why the Safety Paradigm Shifted
- 10-Point Engineering Comparison: OHSAS 18001:2007 vs ISO 45001:2018 (DSTU ISO 45001:2019)
- Clause-by-Clause Cross-Reference Matrix: OHSAS 18001 (4.1-4.6) to ISO 45001 (Clauses 4-10)
- Five Core Requirements of ISO 45001 That Were Absent or Weak in OHSAS 18001
- Integrating ISO 45001 with Ukraine's Statutory Safety System (SUOP) and Wartime Realities
- How to Modernize an OH&S System from OHSAS 18001 Heritage to Mature ISO 45001: 6 Steps
- Conclusion: Moving from Sign-Off Briefing Logbooks to Proactive Safety Engineering
From British BS OHSAS 18001 to International ISO 45001: Why the Safety Paradigm Shifted
For nearly two decades (from 1999 to 2018), the global benchmark for occupational health and safety certification was British specification BS OHSAS 18001 (Occupational Health and Safety Assessment Series), developed by a consortium of national standards bodies and registrars led by BSI. Despite its widespread adoption, OHSAS 18001 carried significant structural limitations: it was not an International Organization for Standardization (ISO) standard, used an outdated clause numbering structure (Clauses 4.1 to 4.6), aligned poorly with the revised ISO 9001 and ISO 14001 standards, and treated workplace safety largely as reactive hazard control inside the factory fence.
To establish a unified international standard, project committee ISO/PC 283, working alongside experts from the International Labour Organization (ILO) and the European Agency for Safety and Health at Work (EU-OSHA), published ISO 45001:2018 (adopted in Ukraine as national standard DSTU ISO 45001:2019). Following the three-year transition window that ended in 2021, all OHSAS 18001 certificates were withdrawn.
Why does the distinction between OHSAS 18001 and ISO 45001 remain a critical operational topic in 2026? In practice, many industrial enterprises that built their safety documentation between 2010 and 2018 simply replaced the cover-page title "DSTU OHSAS 18001:2010" with "DSTU ISO 45001:2019" while leaving legacy OHSAS mechanics untouched inside their procedures: static hazard tables without OH&S opportunities, no formal mechanism for non-managerial worker consultation, unmanaged procurement and contractor risks, and over-reliance on Personal Protective Equipment (PPE) and repetitive briefing signatures.
10-Point Engineering Comparison: OHSAS 18001:2007 vs ISO 45001:2018 (DSTU ISO 45001:2019)
To understand the structural and engineering depth of the transition, the table below compares BS OHSAS 18001:2007 against ISO 45001:2018 across ten core governance and shop-floor dimensions.
| Comparison Dimension | BS OHSAS 18001:2007 (DSTU OHSAS 18001:2010) | ISO 45001:2018 (DSTU ISO 45001:2019) |
|---|---|---|
| 1. Normative Status & Structure | British assessment specification structured around legacy ISO Guide 72 (Clauses 4.1-4.6) | Full International Standard built on the ISO Harmonized High-Level Structure (Annex SL, Clauses 1-10) |
| 2. Organizational Context (Clause 4) | Absent; the OH&S system operated in isolation from external business, supply-chain, and macro factors | Mandatory analysis of internal and external issues (technological, legal, security, workforce) affecting OH&S outcomes |
| 3. Interested Parties (Clause 4.2) | Focused narrowly on direct employees and state labor inspectors | Broad stakeholder scope: direct and contract workers, unions, contractors, visitors, neighboring communities, clients, insurers |
| 4. Executive Leadership (Clause 5.1) | Allowed top management to delegate system oversight to an appointed "Management Representative" (typically the Safety Manager) | Eliminates the "Management Representative" role; places non-delegable accountability for OH&S performance directly on top management |
| 5. Worker Engagement (Clause 5.4) | Passive worker notification and appointment of safety representatives | Enforces a strict legal distinction between consultation (seeking input prior to decisions) and participation (joint decision-making) for non-managerial workers |
| 6. Risk & Opportunity Scope (Clause 6.1) | Limited to physical hazard identification and injury risk scoring | Dual-loop model: hazard identification + OH&S risks and OH&S opportunities + strategic risks and opportunities for the management system itself |
| 7. Health & Psychosocial Factors | Focused primarily on acute traumatic injuries and classic occupational diseases (noise, dust, vibration) | Explicitly mandates managing physical and mental health, including workload, burnout, shift fatigue, harassment, and stress (expanded in ISO 45003) |
| 8. Procurement & Outsourcing | Addressed tangentially under general operational control | Dedicated Subclause 8.1.4 requiring pre-purchase safety verification of machinery, chemicals, and raw materials plus control of outsourced processes |
| 9. Contractor Management (Clause 8.1.4.2) | Basic gate entry briefing for visiting contractor personnel | Three-way hazard coordination: how contractor work impacts company staff, how company operations impact contractors, and how both impact third parties |
| 10. Documentation (Clause 7.5) | Rigid split between "documented procedures" and "records" in paper binders | Flexible "documented information" concept supporting digital EHS platforms, electronic permit-to-work logs, and visual SOPs |
Clause-by-Clause Cross-Reference Matrix: OHSAS 18001 (4.1-4.6) to ISO 45001 (Clauses 4-10)
If your facility's safety manual or standard operating procedures still reference legacy OHSAS 18001 clause numbers, the cross-reference matrix below provides the exact mapping to the Annex SL architecture of ISO 45001. Aligning with Annex SL also allows seamless integration with quality and environmental systems (see our complete engineering guide to building an Integrated Management System for ISO 9001, ISO 14001, and ISO 45001).
| BS OHSAS 18001:2007 Clause | OHSAS 18001 Requirement Title | ISO 45001:2018 (DSTU ISO 45001:2019) Clause | Key Structural Additions in ISO 45001 |
|---|---|---|---|
| 4.1 | General requirements | 4.1, 4.2, 4.3, 4.4 | Adds Context of the Organization (4.1) and Needs and Expectations of Workers and Other Interested Parties (4.2) |
| 4.2 | OH&S policy | 5.2 | Policy must include explicit commitments to worker consultation/participation and to eliminating hazards using the hierarchy of controls |
| 4.3.1 | Hazard identification, risk assessment and determining controls | 6.1.2, 6.1.4, 8.1.2 | Adds assessment of OH&S opportunities (6.1.2.3) and psychosocial factors; moves the Hierarchy of Controls into Operational Planning (8.1.2) |
| 4.3.2 | Legal and other requirements | 6.1.3 | Requires documented maintenance of legal obligations and evaluation of how statutory rules apply to site-specific risks |
| 4.3.3 | Objectives and programme(s) | 6.2 (6.2.1, 6.2.2) | OH&S objectives must be measurable, integrated into business processes, and backed by defined resources and leading indicators |
| 4.4.1 | Resources, roles, responsibility, accountability and authority | 5.1, 5.3, 7.1 | Expands Leadership and Commitment (5.1), removes the formal "Management Representative" shield, and protects workers from reprisals when reporting hazards |
| 4.4.2 | Competence, training and awareness | 7.2, 7.3 | Splits into Competence (7.2) and Awareness (7.3); introduces the explicit worker right to remove themselves from imminent serious danger without undue consequences |
| 4.4.3 | Communication, participation and consultation | 5.4, 7.4 | Elevates Worker Consultation and Participation into the Leadership clause (5.4) as a core governance pillar, while detailing internal/external communication in 7.4 |
| 4.4.4, 4.4.5, 4.5.4 | Documentation, control of documents and records | 7.5 (7.5.1, 7.5.2, 7.5.3) | Consolidates into Clause 7.5 "Documented Information" with strict requirements for data integrity, medical privacy, and version control |
| 4.4.6 | Operational control | 8.1 (8.1.1, 8.1.2, 8.1.3, 8.1.4) | Structured into General Operational Control (8.1.1), Hierarchy of Controls (8.1.2), Management of Change / MOC (8.1.3), and Procurement, Contractors & Outsourcing (8.1.4) |
| 4.4.7 | Emergency preparedness and response | 8.2 | Expands requirements for scheduled drills, coordination with municipal emergency services and neighbors, and post-incident procedure updates |
| 4.5.1, 4.5.2 | Performance measurement, monitoring and evaluation of compliance | 9.1 (9.1.1, 9.1.2) | Requires balanced leading and lagging KPIs, calibration of occupational hygiene monitoring instruments, and scheduled legal compliance evaluations |
| 4.5.3 | Incident investigation, nonconformity, corrective and preventive action | 10.2 | Removes standalone "preventive action" (as the entire system acts preventively via Clause 6.1 risk planning); emphasizes root-cause analysis of incidents and near misses with worker participation |
| 4.5.5 | Internal audit | 9.2 | Mandates risk-based audit scheduling considering prior findings, incident trends, and auditor independence |
| 4.6 | Management review | 9.3 | Expands required executive inputs (incident trends, worker consultation outcomes, adequacy of safety budgets and engineering resources) |
| None | Continual improvement (as a standalone clause) | 10.1, 10.3 | Dedicated Clause 10.3 requiring systematic advancement of safety culture and worker engagement |
Five Core Requirements of ISO 45001 That Were Absent or Weak in OHSAS 18001
Passing an ISO 45001 certification audit (covered in full in our complete guide to ISO 45001 certification) requires more than renumbering paragraphs. Certification auditors focus heavily on five substantive requirements that separate ISO 45001 from legacy OHSAS 18001 systems.
1. From Delegated Management Representative to Direct CEO Accountability (Clause 5.1)
Under OHSAS 18001, it was common practice for a Managing Director to sign an order appointing the Head of Occupational Safety as the "OH&S Management Representative" and then appear during the external audit for only ten minutes at the opening meeting. ISO 45001 abolished the "Management Representative" role.
Subclause 5.1 defines 13 non-delegable leadership commitments: the CEO, Plant Director, and Operations Director must personally demonstrate to the auditor how safety objectives are integrated into capital budgeting, how engineering controls (such as machine guarding or local exhaust ventilation) are funded, and how leadership protects workers from retaliation or bonus deductions when they report unsafe conditions or halt defective machinery.
2. Consultation and Genuine Participation of Non-Managerial Workers (Clause 5.4)
Subclause 5.4 of ISO 45001 establishes a strict distinction between two engagement mechanisms specifically targeting non-managerial workers (machine operators, welders, warehousemen, drivers, maintenance technicians):
- Consultation (Clause 5.4 d): management's obligation to seek and consider worker feedback before making a decision (for example, before finalizing annual safety objectives, selecting new respirator or safety boot models, or outsourcing a production operation).
- Participation (Clause 5.4 e): involving shop-floor workers directly in joint decision-making during workplace hazard identification, selection of risk controls, incident and near-miss investigations, and determining training needs.
The standard also obliges the organization to identify and remove barriers to worker participation, such as fear of reprisal, shift scheduling constraints, language barriers, or overly complex reporting forms.
3. Dual Assessment Loop: OH&S Hazards, Risks, Opportunities, and Psychosocial Factors (Clause 6.1 & ISO 45003)
In OHSAS 18001, risk assessment was typically a single matrix scoring "Likelihood × Severity" for mechanical, electrical, or chemical hazards. Clause 6.1 of ISO 45001 expands risk thinking across two dimensions:
- Separating Operational OH&S Risks/Opportunities from Strategic System Risks/Opportunities: alongside workstation hazards, the company evaluates strategic risks to the OH&S management system itself (such as skilled technician shortages, power grid disruptions, or aging infrastructure) as well as OH&S opportunities (automating manual palletizing, ergonomic workstation redesign, or digital permit-to-work systems).
- Mandatory Inclusion of Psychosocial Hazards (Clause 6.1.2.1 a): ISO 45001 explicitly requires identifying hazards arising from social factors, including workload, overtime, night shifts, burnout, psychological stress, harassment, and bullying. This requirement is further detailed in companion standard ISO 45003:2021 on managing psychosocial risks and mental wellbeing at work.
4. Enforcing Engineering Controls Over PPE Reliance: The 5-Tier Hierarchy (Clause 8.1.2)
The most common flaw in legacy OHSAS 18001 risk registers was writing "Conduct unscheduled safety briefing and issue earplugs/respirators" as the control measure for every hazard from 95 dBA noise to solvent vapors. Subclause 8.1.2 of ISO 45001 makes the 5-tier Hierarchy of Controls a mandatory operational requirement (we cover the engineering methodology in detail in our guide to the risk-based approach to workplace safety under ISO 45001):
- Elimination: physically removing the hazard altogether (for example, using winch-lowered light fixtures serviced from floor level instead of working at height).
- Substitution: replacing hazardous materials or equipment with safer alternatives (switching from solvent-borne coatings to water-based paints, or replacing hydrogen-emitting lead-acid forklift batteries with sealed lithium-iron-phosphate units).
- Engineering Controls: physical machine guards, optoelectronic safety light curtains, two-hand press controls, LOTO (Lockout / Tagout) energy isolation locks, local exhaust ventilation, and acoustic enclosures.
- Administrative Controls: high-hazard Permits-to-Work, pedestrian-forklift floor segregation markings, shift rotation in hot or noisy zones, and targeted safety drills.
- Personal Protective Equipment (PPE): hard hats, safety glasses, fall-arrest harnesses, ear defenders, and protective garments serve strictly as the last line of defense combined with higher-tier controls, because PPE never eliminates the hazard itself.
5. Controlling Contractors, Procurement, and Outsourced Processes (Clause 8.1.4)
Industrial accident statistics across Ukraine and the EU consistently show that a disproportionate share of severe and fatal workplace injuries involve non-permanent personnel: construction, rigging, maintenance, or cleaning contractors unfamiliar with site hazards. ISO 45001 addresses this exposure directly in Subclause 8.1.4:
- Procurement (Clause 8.1.4.1): the OH&S team must review specifications for new machinery, production lines, and chemical substances before purchase orders are released (verifying CE safety interlocks, noise/vibration ratings, and Safety Data Sheets).
- Contractors (Clause 8.1.4.2): organizations must establish OH&S pre-qualification criteria during contractor selection, verify high-hazard licenses, and enforce three-way hazard coordination on site: (1) how contractor activities (such as hot work or roof repair) endanger host plant workers; (2) how host plant operations (overhead cranes, pressurized lines, ammonia refrigeration) endanger the contractor crew; and (3) how contractor work impacts visitors or adjacent contractors.
- Outsourcing (Clause 8.1.4.3): when manufacturing or logistics operations are outsourced, the company retains responsibility for ensuring those processes conform to its OH&S management system requirements and statutory law.
Integrating ISO 45001 with Ukraine's Statutory Safety System (SUOP) and Wartime Realities
In Ukraine, every employer is legally required to establish and maintain an Occupational Safety Management System (SUOP) under Article 13 of the Law of Ukraine "On Occupational Safety", the Labor Code, sector-specific safety regulations (NPAOP), and the Procedure for Workplace Attestation by Working Conditions (Cabinet of Ministers Resolution No. 442). Historically, the statutory SUOP framework has centered on state permits from the State Labor Service (Derzhpratsi) for high-hazard equipment and works, standardized briefing logbooks, mandatory medical exams, and PPE issuance cards.
Many Ukrainian companies mistakenly run their statutory SUOP and their international DSTU ISO 45001:2019 system on separate tracks: the safety engineer keeps paper briefing logbooks for state inspectors while a quality manager maintains a separate spreadsheet of ISO 45001 risks for the certification body. This duplication is eliminated by mapping statutory Ukrainian instruments directly into ISO 45001 clauses:
- Workplace Attestation by Working Conditions (Resolution No. 442) serves as the quantitative hygiene baseline for occupational disease risk assessment under Clause 6.1.2 and workplace environment monitoring under Clause 9.1.1 (accredited laboratory measurements of noise, vibration, illumination, microclimate, and airborne chemical concentrations).
- High-Hazard Work Lists and Permits-to-Work (NPAOP 0.00-4.12-05) integrate directly into operational control under Clauses 8.1.1 and 8.1.2, enhanced with physical LOTO energy isolation locks and pre-shift inspection checklists.
- Preliminary and Periodic Medical Examinations (Ministry of Health Order No. 246) fulfill Clauses 7.2 and 9.1 regarding worker medical fitness verification and early occupational health surveillance.
In 2026, Ukrainian facilities must also integrate wartime and energy-resilience risks into Clause 4.1 (Context), Clause 6.1 (Risk Assessment), and Clause 8.2 (Emergency Preparedness), which certification auditors actively verify on site:
- Emergency Equipment Shutdown Protocols During Air-Raid Alerts: engineered safe-state shutdown sequences for chemical reactors, boilers, furnaces, and pressurized lines before shift evacuation to shelters.
- Bomb Shelter and Protective Structure Engineering: shelter capacity sized for peak shift headcount, forced ventilation with filtration, at least two independent exits, potable water, trauma medical kits, backup communications, and emergency lighting.
- Industrial Diesel Generator and Battery Energy Storage (BESS) Safety: managing carbon monoxide (CO) exhaust routing, bulk diesel fuel storage bunding and fire suppression, electrical interlock protection during automatic transfer switch (ATS) changeovers, and acoustic insulation.
- Psychosocial Support and Fatigue Management: assessing sleep-deprivation risks after nighttime air attacks before clearing operators for crane, forklift, or high-voltage tasks, alongside workplace accessibility adaptations for returning veterans under ISO 45001 and ISO 45003.
How to Modernize an OH&S System from OHSAS 18001 Heritage to Mature ISO 45001: 6 Steps
If your safety documentation still relies on legacy OHSAS 18001 templates or you are preparing for initial certification (see our detailed checklist in ISO 45001 audit preparation), we recommend executing six practical engineering steps during your standards implementation project:
- Diagnostic Audit (Gap Analysis) of Shop-Floor Controls and Documentation: conduct a structured diagnostic audit comparing existing SUOP manuals, orders, and risk registers against DSTU ISO 45001:2019 (focusing on Clauses 4.1, 4.2, 5.1, 5.4, 6.1.2.3, 8.1.3, and 8.1.4).
- Re-Run Workstation Risk Assessments With Non-Managerial Workers: replace desk-bound risk spreadsheets with joint shop-floor walkthroughs involving safety engineers, shift supervisors, and machine operators; incorporate ergonomic, psychosocial, and wartime energy risks alongside measurable OH&S opportunities.
- Upgrade Risk Controls Using the 5-Tier Hierarchy (Clause 8.1.2): review every high and critical risk entry; wherever "safety briefing and PPE" are listed as the sole controls, engineer physical barriers, LOTO locks, gas detectors, or interlocks.
- Deploy Management of Change (MOC, Clause 8.1.3) and Safe Procurement Sign-Offs (Clause 8.1.4): institute a mandatory OH&S clearance step before purchasing new machinery, introducing new chemicals, altering warehouse racking, or onboarding contractors.
- Launch a Frictionless Near-Miss and Hazard Reporting Channel: give workers a 60-second reporting tool (shop-floor QR code, messaging bot, or physical drop-box) to flag exposed wiring, oil spills, or damaged slings without fear of blame, backed by monthly executive review.
- Cross-Functional Internal Audit and Management Review: audit all production, maintenance, and warehouse shifts (including night shifts and active contractor work zones) and leverage expert audit support to defend the system before the accredited certification body.
Conclusion: Moving from Sign-Off Briefing Logbooks to Proactive Safety Engineering
The fundamental difference between legacy OHSAS 18001 and modern ISO 45001 (DSTU ISO 45001:2019) lies in shifting from administrative hazard paperwork managed by an isolated safety officer to an engineering safety culture embedded into equipment design, procurement, contractor coordination, and executive decision-making. Organizations that retire legacy OHSAS templates and unify ISO 45001 with their statutory Ukrainian SUOP gain far more than a certificate for EU tenders and reconstruction projects: they reduce unplanned downtime, prevent severe workplace injuries, and protect their most valuable engineering and production talent.
If your organization needs to modernize its occupational health and safety management system, prepare for DSTU ISO 45001:2019 certification, or establish ongoing annual support, contact Ekontrol's specialists for an engineering gap assessment and implementation roadmap.
