ISO 45001 clause 2: distinguish references, guidance and duties
ISO 45001:2018 clause 2 contains no normative references. It does not identify another publication as indispensable for applying the standard through this clause. This is a statement about the standard’s reference structure, not a release from legal duties, contractual requirements or the need for competent technical information.
What clause 2 requires in practice
Clause 2 is short: the standard lists no normative references. In practice that means no other publication has to be obtained or applied simply to satisfy ISO 45001 itself. The standard is read on its own terms, with its own definitions in clause 3, and its explanatory annex is informative.
The clause does not remove other sources of obligation, though. Legal and other requirements still arrive through the determination process in clause 6.1.3, and the standard expects that process to be real. Technical standards, supplier instructions and contract conditions may bind the organisation for other reasons, and the context decides their status. The clause also helps separate three things that are often blurred: requirements of the standard, guidance that supports interpretation, and duties that arise elsewhere. A clean separation helps the organisation decide which statements it must meet, which it may choose to follow and which it can safely adapt.
Separate requirements from implementation resources
ISO 45001 sets management-system requirements. Applicable legal and other requirements are determined through clause 6.1.3. Guidance documents, technical resources and training can help implementation, but their recommendations do not automatically become additional ISO 45001 requirements.
The standard’s explanatory annex supports interpretation. It should not be turned into a new list of mandatory forms or committees. Equally, an external technical instruction may be necessary for safe operation or required by another obligation. Its importance comes from that context, not from being listed in clause 2.
Why the distinction between references, guidance and duties matters
Safety documents tend to accumulate: legislation, codes of practice, supplier manuals, client rules and internal procedures. When nobody can say which of these actually binds the work, two failures follow. Teams either treat everything as compulsory and become unable to act, or treat guidance as optional and ignore a duty that applies to them. Both are costly in audit findings, in contract disputes and, above all, in how workers are protected. A clear view of what governs, what informs and what merely suggests also keeps consultancy and training spend proportionate, because the organisation can say what it needs rather than collecting every publication in sight.
How to apply clause 2 in practice
Because clause 2 contains no obligation to document, the useful step is to build a shared understanding of sources. One practical way Sterling teams approach it is below. Keep the exercise proportionate: a short conversation with operational managers often does more than a large document review.
- Gather the sources people already rely on, such as legislation, client site rules, equipment manuals and training handbooks.
- For each source, ask who imposes it and why: law, contract, voluntary commitment or simply helpful advice.
- Mark the ones that feed the legal and other requirements process under clause 6.1.3, and pass them to whoever runs that process.
- Identify external information the system needs in order to function and make someone responsible for keeping it current.
- Tell managers plainly that a recommendation in a guidance book does not become an ISO 45001 duty by being printed there.
- Revisit the picture when a new contract, site or regulation arrives.
Two illustrative reference decisions
A manufacturer uses a supplier’s equipment instructions and competent technical advice when planning controls. The absence of normative references in ISO 45001 does not justify ignoring that information. The organisation determines what is necessary for its work and how it must be controlled and communicated.
A BPO provider uses a training handbook to improve worker consultation. The handbook recommends one workshop format. The provider can choose another effective method that meets the standard and applicable duties; it does not need to treat the suggested workshop as an ISO-prescribed procedure.
Evidence without an unnecessary register
Clause 2 does not require a normative-reference register. Necessary external documented information is identified and controlled under the relevant information-control requirements. Legal and other requirements need their own applicability and evaluation arrangements. Keep those purposes distinct so that a library of documents is not mistaken for implementation.
Common mistakes include requiring every related publication, treating all guidance examples as mandatory and using “no normative references” to dismiss actual duties. A useful document hierarchy makes clear what governs the work, what supports a decision and who is responsible for keeping information suitable.
Common nonconformities linked to clause 2
No finding is raised against clause 2 itself, but confusion about sources shows up in these ways.
- Applicable legal duties missing from planning because the organisation believed that the absence of references meant none applied.
- Supplier equipment instructions ignored when controls were planned.
- Guidance examples enforced as if the standard demanded them, creating forms nobody uses.
- External documents used for safety decisions without anyone responsible for keeping them current.
- A large library of publications held as proof of implementation without evidence of use.
Frequently asked questions
Must we buy every related ISO publication?
No such list is imposed by clause 2. Obtain the information needed for your requirements, understanding and implementation.
Are legal duties optional because they are not listed here?
No. Applicable legal and other requirements remain part of the OH&S management system.
Can a guidance recommendation become an obligation?
It may if adopted through a binding or chosen commitment. Assess the actual source and terms rather than assuming its status.
Clarify what governs the work
Ask Sterling to review your OH&S document hierarchy and supporting evidence. The Documented Information Management course develops useful distinctions. Effivity ISO & GRC automation software can be scoped around agreed information needs. Return to the ISO 45001 directory for implementation guidance; certification decisions remain independent.