ISO 45001 clause 5.2: make the OH&S policy a usable commitment
ISO 45001:2018 clause 5.2 requires top management to establish, implement and maintain an OH&S policy. It commits the organisation to safe and healthy working conditions for prevention of work-related injury and ill health and provides a framework for objectives. The policy needs to fit the organisation’s purpose, size, context and specific OH&S risks and opportunities.
What clause 5.2 requires in practice
Clause 5.2 requires top management to set up, put into effect and maintain an OH&S policy. The policy has to include a commitment to safe and healthy working conditions that prevent work-related injury and ill health, and has to suit the organisation's purpose, size, context and the nature of its OH&S risks and opportunities. It provides a framework for setting objectives.
It must also contain four further commitments: to meet legal and other requirements, remove hazards and lower OH&S risks, keep improving the management system, and consult and involve workers and, where they exist, their representatives. As to handling, the policy is kept as documented information, communicated within the organisation, made available to interested parties as appropriate, and kept relevant and appropriate. The word implement matters: a policy is judged by whether decisions actually follow it, not by how it is displayed.
Include the commitments that shape the system
The policy includes commitments to fulfil legal and other requirements, eliminate hazards and reduce OH&S risks, continually improve the management system, and consult and involve workers and their representatives where they exist. These commitments should be understandable as a direction for decisions, not only as a formal statement for display.
Hazard elimination and risk reduction connect with the hierarchy of controls in clause 8.1.2. Worker involvement connects with clause 5.4. Fulfilment of requirements connects with applicability and compliance evaluation. The policy does not replace those processes; it establishes the direction they need to support.
Make the wording fit the work
Consider the organisation’s activities and control relationships before adopting a generic policy. A construction contractor and a software support company can share the required commitments while explaining them in ways meaningful to their work. Avoid claims that are broader than the organisation can substantiate.
A commitment to prevention should not be written as a guarantee that no harm can occur. Similarly, certification should not be described as proof of universal legal compliance. The organisation remains responsible for applying its system, understanding duties and improving controls.
Why a usable policy matters to the business
A policy sets the standard against which workers, managers and outsiders can measure the organisation's conduct. When it is specific and accurate, it helps resolve disagreements about priorities, because there is a stated direction to appeal to. When it is generic or overstated, it invites scepticism and may be quoted back to the organisation after an incident. Customers, regulators and insurers often ask for it early in a relationship, and its wording shapes expectations. Commitments about worker involvement and hazard elimination also steer how managers act on day-to-day decisions. A policy people understand and apply costs little to maintain and anchors the objectives, planning and communication that follow.
How to implement clause 5.2
The clause names the commitments but leaves length and style to the organisation. One approach Sterling teams use to make a policy practical is as follows. Keep the policy short enough to be remembered, and avoid promises of outcomes that no organisation can guarantee.
- Start from what is true about the organisation: its activities, locations, and the kinds of harm that could arise, so wording is not copied from elsewhere.
- Include each required commitment, expressing it in language that a supervisor could connect with a decision.
- Test each commitment by asking what a manager would do differently because of it, and remove statements that change nothing.
- Have top management approve and personally explain the policy, and involve workers in commenting on the draft.
- Choose communication routes for each audience, including contractors and visitors, and make the policy available to outsiders where appropriate.
- Review it when the business, contracts or work arrangements change, and check that supporting processes change with it.
Two illustrative policy applications
A manufacturer’s policy commits to hazard elimination and risk reduction. When a recurring manual-handling concern is identified, management considers changes to the work and appropriate higher-order options with competent input and worker participation. The policy guides that decision; it does not specify a universal lifting technique or substitute for assessment.
A software company’s policy commits to consultation and participation. Before changing support-shift arrangements, managers seek worker views and involve relevant people in evaluating options. The policy becomes meaningful through the decision process. Publishing a statement about wellbeing while making the change without relevant worker input would weaken that connection.
Communicate and maintain the policy
The policy must be available as documented information, communicated within the organisation, available to interested parties as appropriate, and relevant and appropriate. Choose communication methods that help people understand the commitments connected with their work. A policy displayed in reception may be visible without being understood.
Keep the policy suitable as the organisation changes. A new business model, major acquisition or altered work arrangement may require review of its relevance and supporting processes. Updating the wording alone is insufficient if the implementation remains unchanged.
Evidence and common mistakes
The documented policy is required. Supporting evidence can include communication, worker understanding and decisions that apply its commitments. No particular length, visual design or policy template is prescribed. An integrated policy can work if the OH&S commitments remain clear.
Common mistakes include omitting worker participation, replacing hazard elimination with a generic instruction to be careful and making absolute public promises. Another is treating the policy as a safety department document that operational managers do not need to apply.
Frequently asked questions
Can the policy be integrated with quality or environmental policy?
Yes, if the required OH&S commitments remain clear, relevant and effectively communicated.
Must every worker memorise the wording?
No. Meaningful awareness of relevant commitments and their implications matters more than exact recital.
Does the policy need to promise zero injuries?
The standard requires prevention commitments and effective management, not an unsupported guarantee of future outcomes.
Connect the policy with a work decision
Ask Sterling to review your OH&S policy and its implementation, including documentation and audit preparation. The ISO 45001 Awareness course supports policy awareness. Consider Effivity ISO & GRC automation software for agreed system needs. See leadership and the complete guide.