ISO 45001 documentation: what you need, what you do not, and how to keep it matching the work

What counts as documentation in ISO 45001?

The standard calls it documented information and deals with its control in clause 7.5, under Support. Paper, tablet or cloud system are all acceptable; what matters is that the right version reaches the person doing the task and that nobody can quietly rewrite what happened last Tuesday.

Two families sit under that single term. The first is documents: the policy, a safe work method statement, the emergency plan, the risk assessment for grinding in the fabrication bay. These describe how things should be done and are revised when a machine, a material or a crew changes. The second is records: a signed permit to work, a toolbox talk attendance sheet, a drill report, an incident investigation. These capture a moment and stay as they were written.

The 2018 text, like other management system standards of that generation, marks the difference with two verbs: information you maintain is a document, information you retain is a record.

What ISO 45001 expects you to hold in writing

The table below follows the standard's own clauses and lists what a certification auditor will expect to find written down in a working OH&S management system. The exact wording is in the standard; our ISO 45001 requirements guide explains what each clause requires of you.

The method behind the heaviest rows has its own guides: hazard identification and risk assessment, the legal register and contractor management.

What ISO 45001 does not ask for

An inherited OHSAS 18001 binder or a downloaded pack of forty procedures is not what the standard demands. There is no clause titled manual, no required document hierarchy, no prescribed numbering and no expectation of one procedure for each requirement.

What the standard does expect is enough documented information to be confident that processes run as planned. That leaves a judgement to make, and in OH&S the judgement has a clear anchor: the severity of what could go wrong. A written method earns its place when a task is high risk, done rarely, done by rotating crews or contractors, or involves a sequence where one missed step injures someone. Isolation before maintenance, confined space entry and work at height are typical.

The hierarchy of controls in clause 8.1.2 is a useful check on over-documentation. It asks you to eliminate a hazard first, then substitute, then use engineering controls, and only then rely on administrative controls, including training, and finally PPE. A procedure is an administrative control: if a guard or a different material would remove the danger, a longer instruction is the weaker answer.

A minimal document set for a small organisation

For a workshop of thirty people with a few regular contractors, a lean, auditable set looks like this:

• One short system overview: scope, OH&S policy, roles and a simple process map.
• A hazard register and risk assessments for each activity, written with the people who do the work.
• A legal register listing the laws and permits that apply, with an owner and the date of the last compliance check.
• Three to five written methods or permit forms for the genuinely dangerous tasks.
• An emergency plan for the site, with a drill schedule.
• A contractor induction and a short prequalification form.
• Objectives for the year, each with a number, a date and a name.
• Record templates for inspections, incidents, training, consultation, internal audit and management review.

That is often fewer than twenty controlled documents. Our guide to ISO 45001 for small businesses shows how the same thinking applies to people, days and audit sampling.

Keeping documents current where the work happens

Document control in a safety system is tested on the shop floor: on the site tour, the auditor compares the method statement taped to the machine with the register. The usual controls:

• Identification. Title, reference, version, date and owner on every controlled document, including the one pinned to the wall.
• Review before release. Someone competent in the task, ideally with a worker who does it, checks the content before it goes live.
• Availability. The current version is reachable on every shift, in the language the crew reads, including for contractors.
• Change. A new machine, material or legal duty triggers a revision through management of change, and old copies are pulled from the field.
• Protection of records. Completed permits, investigations and training records are kept safe from loss and alteration, with a defined retention period.

The standard itself sets no retention periods. National law often does for certain safety records, so the legal register is the right place to note them. As a floor, keep records for at least one full three-year certification cycle, since surveillance and recertification auditors can sample any month within it.

What to avoid

• Generic risk assessments. A form that lists "slips, trips and falls" for every activity tells the auditor the assessment was copied, not done. Assessments should name the actual task, location and controls.
• Procedures that the crew has never seen. If supervisors cannot find the method and workers describe a different one, the document is evidence against you.
• Contractors outside the paperwork. The standard's definition of a worker includes people working under your control, so their inductions, permits and competence belong in the system too.
• Records written the week before Stage 2. Dates and file histories give this away and damage trust in everything else.

How Effivity holds ISO 45001 documentation

Effivity, used in 50+ countries, has an OH&S configuration with modules for hazard and risk assessment, compliance obligations, work permits, incident and accident management, context and interested parties, risk and opportunity, training and certifications, purchasing, documented information, nonconformance, internal audit and management review. Near misses can be reported from a phone at the point of work, and approval, versions and archived revisions sit in the same repository, so the auditor can follow the trail on screen.

The modules are explained in Effivity for ISO 45001: the guide.

ISO 45001 documentation: questions buyers ask