ISO 45001 vs OHSAS 18001: What Changed and Why
OHSAS 18001 has been withdrawn. ISO 45001 is the current international standard for occupational health and safety management, and it is the only occupational health and safety management system an accredited certification body can certify an organisation against [1][3]. If you are being asked why your business needs ISO 45001, or you still have a shelf of OHSAS 18001 procedures, this comparison explains what actually changed and why each shift matters for day-to-day safety work. It sits alongside our guide to integrated management system certification, and UK organisations that want the certification route can read our ISO 45001 certification overview.
Editorial note: UniCert is accredited by the United Accreditation Foundation (UAF) for ISO 9001, ISO 14001 and ISO 45001, and is an IAF MLA signatory through that accreditation [3]. Details are on our accreditation page.
A legacy OHSAS 18001 manual usually needs restructuring against ISO 45001 clauses 4 to 10. Source: UniCert
OHSAS 18001 is withdrawn: what that means now
OHSAS 18001 is no longer a live standard, and ISO 45001 has replaced it. The migration period set by the International Accreditation Forum ran until 2021, and once it closed, accredited certification bodies stopped issuing and maintaining certificates against OHSAS 18001 [2][3]. A certificate to OHSAS 18001, whether it is yours or one a supplier sends you, no longer demonstrates a currently certified occupational health and safety management system.
That reframes the comparison. The choice is not which standard to adopt, because only ISO 45001 is available. The useful question is how far a system built under OHSAS 18001 already meets ISO 45001, and where it falls short. Five shifts do most of the work:
- a clause structure shared with other ISO management system standards [3]
- risk and opportunity thinking rather than hazards alone [1]
- documented consultation and participation of workers [1]
- top-management accountability that cannot be delegated away [1]
- explicit requirements for organisational context and interested parties [1][3]
The rest of this article takes each shift in turn, then shows what it looks like clause by clause and in a first audit.
ISO 45001 vs OHSAS 18001: side-by-side comparison
The table below summarises the practical differences our auditors raise most often when a first ISO 45001 audit meets a system that grew up under OHSAS 18001. If you are scoping more than one standard, the standard comparison tool sets the same points against ISO 9001 and ISO 14001.
| Theme | OHSAS 18001 | ISO 45001 |
|---|---|---|
| Structure | Standalone health and safety framework with its own clause layout | ISO Harmonised Structure; clauses 4 to 10 shared with ISO 9001 and ISO 14001 [3] |
| Risk approach | Hazard identification and control, largely reactive | Hazards, risks and opportunities identified and addressed before incidents [1] |
| Worker participation | Some consultation expected, narrower scope | Explicit consultation and participation of workers and, where they exist, workers' representatives, with barriers removed [1] |
| Leadership | Management responsibility, often delegated to a safety manager | Top-management accountability for the system, which cannot be fully delegated [1] |
| Context and interested parties | Not a formal requirement | Clause 4 requires organisational context and the needs and expectations of interested parties [1][3] |
| Integration with other systems | Extra mapping effort to align with quality or environmental systems | Practical to integrate, with combined audits, because the structure is shared |
| Contractors and procurement | Handled through general operational control | Procurement, contractors and outsourcing addressed explicitly in operational planning and control [1] |
| Documentation | Separate "documents" and "records" | Single concept of "documented information", less prescriptive about format [3] |
OHSAS 18001 sections realigned to the ISO 45001 clause 4 to 10 spine. Source: UniCert
The five changes that matter most
The Harmonised Structure
ISO 45001 follows the ISO Harmonised Structure, the common template once called the High-Level Structure or Annex SL [3]. Its main clauses, numbered 4 to 10, use the same headings and much of the same core text as ISO 9001 and ISO 14001. OHSAS 18001 used its own standalone layout, so integrating it with a quality or environmental system meant mapping one framework onto another by hand.
For an organisation running more than one management system, the shared structure is the biggest practical gain. Requirements for leadership, planning, support, operation and performance evaluation sit in the same place across standards, so you can hold one internal audit programme, one management review and one set of combined external audits. Our comparison of ISO 14001 and ISO 9001 in a UK context shows the same clause spine at work, and if you are also passing an ISO 14001 Stage 2 audit, an integrated implementation becomes realistic rather than aspirational.
Proactive risk and opportunity, not hazards alone
ISO 45001 asks you to identify and address hazards, health and safety risks and opportunities before incidents happen [1]. OHSAS 18001 concentrated on hazard identification and the controls that follow, which in practice tended to be more reactive.
The addition of opportunities is the part legacy systems usually miss. An opportunity might be designing a manual handling task out of a process, adopting safer equipment during a planned refurbishment, or using a quiet production period to retrain a crew. ISO 45001 wants these captured and evaluated with the same discipline as hazards, not left to chance.
Worker consultation and participation
ISO 45001 requires consultation and participation of workers at all levels, and of workers' representatives where they exist [1]. It also asks organisations to identify and remove barriers to that participation, such as time pressure or fear of reprisal. OHSAS 18001 expected some consultation, but not this breadth.
In practice this means showing how workers help identify hazards, investigate incidents, set controls and review performance, and showing that non-managerial staff are genuinely involved. Informal conversations on the floor are a start. An auditor will look for evidence: meeting records, safety committee minutes, a procedure that changed because of feedback.
Leadership and top-management accountability
ISO 45001 makes top management accountable for the effectiveness of the health and safety management system [1]. Specific tasks can still be assigned, but overall accountability cannot be handed to a safety manager or a consultant.
Auditors test this through interviews with senior leaders, not only documents. Expect questions about how health and safety objectives connect to business planning, how leaders make resources available, and how they promote a culture where people report concerns without fear of reprisal.
Context of the organisation and interested parties
ISO 45001 adds two requirements that OHSAS 18001 did not carry: determining the context of the organisation, and identifying the needs and expectations of interested parties [1][3]. Both come from the Harmonised Structure, and both shape the scope of your system.
Context means the internal and external issues that affect health and safety outcomes: the nature of your work, your sites, your workforce, supply chain pressures and regulatory change. Interested parties include workers, regulators, clients, contractors, neighbours and insurers. The aim is to build the system around real conditions rather than a generic template.
What changed in practice, clause by clause
The first table sets out the themes. This one is the working version our auditors use: for each clause area, the OHSAS 18001 habit, the ISO 45001 requirement, and the evidence an auditor now expects to see.
| Clause area | OHSAS 18001 approach | ISO 45001 requirement | Typical evidence an auditor now expects |
|---|---|---|---|
| Context (Clause 4) | Not addressed | Determine internal and external issues and interested parties that affect health and safety outcomes [1][3] | A context analysis linked to health and safety risks, an interested-party register, and minutes showing both are reviewed |
| Leadership (Clause 5.1) | Duties often delegated to a management representative | Top management is accountable for the system's effectiveness [1] | Director-level interview responses, health and safety objectives inside business plans, resource decisions recorded |
| Worker participation (Clause 5.4) | Consultation expected, scope narrow | Consultation and participation of non-managerial workers, with barriers removed [1] | Records of what changed because of worker input, time released for safety committees, feedback logs |
| Risk and opportunity (Clause 6.1) | Hazard identification and control | Hazards, health and safety risks, risks to the system and health and safety opportunities all assessed [1] | A register that records opportunities with a stated method, and actions tracked to closure |
| Operational control (Clause 8.1) | General operational controls | Management of change, procurement, contractors and outsourcing addressed explicitly [1] | A management-of-change procedure with records, contractor pre-qualification tied to health and safety criteria |
| Documented information (Clause 7.5) | Separate control of documents and records | Single concept of documented information, format not prescribed [3] | Version control and access rules, with no requirement for a bound manual |
| Improvement (Clause 10.2) | Corrective action and continual improvement | Incident and nonconformity handling with emphasis on the hierarchy of controls [1] | Investigations that show elimination and substitution were considered before PPE |
A first ISO 45001 audit meeting an OHSAS-shaped system
The scenario below is drawn from Stage 2 audits of manufacturers making their first move to ISO 45001. Details and figures are changed.
A fabrication company held OHSAS 18001 for nine years and ran a mature hazard register. Every process had identified hazards, assessed risk ratings and layered controls. The Stage 2 audit confirmed all of that was sound. Two gaps came from the parts OHSAS 18001 never asked for.
First, the risk process recorded no health and safety opportunities. During the audit the plant manager mentioned a planned shutdown that would replace the fume extraction system, a change that would remove a welding exposure at source. It had been justified on maintenance cost alone. Nobody had logged it as an opportunity to eliminate a hazard, and no method existed for spotting the next one. The lead auditor raised a minor nonconformity against Clause 6.1.2.3.
Second, the context analysis had been written once, 18 months earlier, for the transition. Since then the company had opened a second site with different equipment and a night shift. The context and interested-party analysis still described one location. That became an observation against Clause 4.1, close to a nonconformity.
The corrections were modest. The company added an opportunities column and a short method to its existing risk procedure, ran one workshop to populate it, and logged the extraction upgrade with a target date. It also put a context review on the standing agenda for management review, so the analysis tracks the business rather than the transition. Both actions closed inside the 90 days the certification body allowed, and neither needed new software or a consultant.
What transition involved for organisations that did it
Organisations that moved from OHSAS 18001 to ISO 45001 generally ran a gap analysis against the new clauses, then closed the gaps before a transition audit. The recurring workstreams were consistent:
- writing a Clause 4 context and interested-parties analysis, usually from scratch
- formalising worker consultation and participation, with records to match
- getting top management visibly involved in objectives, resources and review
- extending the risk process to capture and evaluate opportunities
- re-basing documentation on the clause 4 to 10 structure, often merging health and safety procedures with existing quality or environmental ones
Businesses that already held ISO 9001 or ISO 14001 had a head start, because the management-system machinery was familiar. Auditing a participation requirement or a context clause calls for different questions from checking a hazard control, which is why several clients put their lead people through ISO 45001 lead auditor training before the transition audit. Our guidance on adding health and safety on the shop floor covers how an existing quality system can absorb health and safety controls without duplicating paperwork.
What to do now if you still have OHSAS 18001 material
Treat every OHSAS 18001 document as out of date and work towards ISO 45001 certification. The steps are straightforward:
- Inventory what you have. List procedures, forms, the safety manual and any certificate, and note which ones reference OHSAS 18001 or its clause numbers.
- Map to ISO 45001. Place each document against clauses 4 to 10 and mark gaps, especially context, interested parties, worker participation and opportunities.
- Renumber and retitle early, before staff relearn the old map. Align internal references to the ISO 45001 clause structure.
- Fix the substantive gaps. Build the context analysis, formalise consultation, involve top management, and extend risk to opportunities.
- Engage an accredited certification body for a Stage 1 and Stage 2 audit. For indicative timing and cost against your scope, request a quote.
After certification, the work is keeping the system live: internal audits, management reviews and hazard reviews on schedule, and preparing for a surveillance audit each year rather than treating certification as a one-off project.
Practical summary of the key steps covered in this guide. Source: UniCert
Frequently asked questions
Is OHSAS 18001 still valid?
No. OHSAS 18001 is withdrawn, and accredited certification bodies no longer issue or maintain certificates against it [2][3]. The IAF-set migration period closed in 2021. An organisation operating to OHSAS 18001 is not running a currently certified occupational health and safety management system.
Can I still get certified to OHSAS 18001?
No. New certification to OHSAS 18001 is not available from accredited certification bodies [3][4]. ISO 45001 is the only current occupational health and safety management system standard an accredited body can certify you against.
Is ISO 45001 a legal requirement?
No. ISO 45001 is a voluntary international standard, not legislation. It does not replace your legal duties under health and safety law in the UK, the US or elsewhere. It gives you a framework for meeting and managing those duties, and many clients and tenders now ask for it.
How different is ISO 45001 from OHSAS 18001 in practice?
The hazard and control work you already do still applies. The new effort concentrates on organisational context, interested parties, documented worker consultation and participation, visible top-management accountability, and adding opportunities to your risk process [1]. The clause structure also changes to match ISO 9001 and ISO 14001.
Does ISO 45001 integrate with ISO 9001 and ISO 14001?
Yes. All three use the ISO Harmonised Structure, with identical clause numbering from 4 to 10 and shared core requirements [3]. That makes a single integrated management system and combined audits practical, which was harder when OHSAS 18001 used its own layout. Our comparison of ISO 14001 and ISO 9001 for UK organisations works through how the shared clauses play out across two standards.
Where ISO 45001 leaves you
OHSAS 18001 is withdrawn, so the practical task is measuring your current health and safety system against ISO 45001 rather than choosing between the two. The gaps are usually predictable: organisational context, interested parties, documented worker participation, leadership accountability, and opportunities alongside hazards. Close those, align the documents to clauses 4 to 10, and the system becomes easier to run and easier to combine with quality and environmental management. For the wider picture, see our pillar guide to integrated management system certification.
References
- ISO, "ISO 45001:2018, Occupational health and safety management systems, Requirements with guidance for use", iso.org. Retrieved 28 August 2026. Used for the requirements on context, leadership, worker participation, risk and opportunity, operational control and improvement.
- ISO, "Annex SL and the harmonized structure for management system standards", ISO/IEC Directives Part 1, Consolidated ISO Supplement, iso.org. Retrieved 28 August 2026. Used for the shared clause 4 to 10 structure and terminology such as "documented information".
- International Accreditation Forum, communiqué and informative document on migration from OHSAS 18001 to ISO 45001, and IAF Multilateral Recognition Arrangement, iaf.nu. Retrieved 28 August 2026. Used for the 2021 migration deadline, the withdrawal of OHSAS 18001 certification, and the IAF MLA reference.
- ISO/IEC 17021-1:2015, "Conformity assessment, Requirements for bodies providing audit and certification of management systems". Used for how accredited certification bodies operate Stage 1 and Stage 2 audits and maintain certification.
- PECB, "Transition Chart from OHSAS 18001 to ISO 45001" (secondary). Used only to cross-check the clause mapping where a primary source restates the same point.
- NASP, "8 key differences between OHSAS 18001 and ISO 45001" (secondary). Used only as a practitioner cross-reference for the summary of differences.
- Avetta, "Key difference between OHSAS 18001 vs ISO 45001" (secondary). Used only as a practitioner cross-reference for the summary of differences.