ISO 45001 scope: sites, workers, contractors and the mistakes that cost you

What an ISO 45001 scope covers, and what clause 4.3 asks

Clause 4.3, Determining the scope of the OH&S management system, sits inside clause 4, Context of the organisation. It asks you to set the boundaries of the system and where it applies, drawing on the issues identified under clause 4.1 and the needs of workers and other interested parties under clause 4.2. Since Amendment 1:2024, clause 4.1 also asks you to decide whether climate change is a relevant issue, and that decision feeds the scope like any other.

In practice an OH&S scope answers four questions: which entities and sites, which activities, which people (including those not on your payroll), and which work happens away from your premises. A scope that says only "provision of engineering services" leaves the auditor to find those answers on the day.

Your own scope statement belongs to the system; the scope of certification is the body's wording on the certificate. The second may be narrower, never wider than what was audited.

Workers, contractors and visitors: who sits inside the boundary

ISO 45001 defines a worker as a person performing work or work-related activities under the control of the organisation. That definition decides more scope arguments than any other line in the standard. An agency welder on your floor or a subcontracted rigging team on your project does work you control, so their hazards, consultation and incidents belong in your system.

Control is a matter of degree, and the standard handles the gradations through clause 8.1.4, Procurement, with its parts on contractors and on outsourcing. Where you direct the work, contractors follow your risk assessments, permits and inductions; where you outsource a whole function, you still set and show the degree of control. The detail of prequalification, induction and permits is covered in ISO 45001 contractor management: prequalification to permits; for scoping, the point is simpler: outsourcing moves the work to someone else, not the responsibility out of your boundary.

Visitors, drivers and the public are not workers under the definition, but they are interested parties who meet your site's hazards, and their presence adds audit time, so describe it accurately.

What can be left out of the scope, and what cannot

You may draw the boundary around part of the organisation. A group can certify one legal entity, one country or one division first. What you cannot do is keep a site or activity in the business description while quietly leaving its hazards out of the system. Auditors test the boundary on the site tour: forklifts running beside the certified office will need explaining.

Defensible reasons are organisational: a separate entity with its own management, a newly acquired site not yet integrated, a business line being sold. Weak reasons are about the hazards: the demolition crew is hard to manage, the night shift is not ready. Those are gaps to close, not boundaries.

Within the boundary, treat every clause from 4 to 10 as applying; leadership, worker participation, emergency preparedness, incident investigation, internal audit and review describe the system itself. Two of the heaviest clauses have their own guides: ISO 45001 hazard identification and risk assessment and ISO 45001 legal register and evaluation of compliance.

Sites, shifts and temporary work locations

List every permanent site by address and what happens there, and name shift patterns where they matter: an auditor at a round-the-clock plant will want to see the night shift. For client premises or temporary projects, say so and keep a list of live locations; the body samples temporary sites on an evaluation of risk, and needs a list to sample from.

The examples below are illustrations written for this guide, not client scopes.

Multi-site groups often hope for sampling, but the OH&S rules say that where sites do not share the same activities, processes and risks, sampling is not appropriate. Harmonising how sites run safety changes the audit plan as well as the risk.

How the scope moves the audit days and the cost

The certification body calculates audit time from the effective number of personnel and the OH&S risk category of your activities, graded high, medium or low under the international audit-time rules. Effective personnel for OH&S includes contractor and subcontractor staff under your control or influence, so a small permanent headcount with a large contractor workforce is priced on the larger figure. Construction and heavy processing typically fall into the high category; office work typically falls into the low one.

Accident rates above the sector average, legal proceedings, a large temporary contractor presence and hazardous substance storage add time, and remote methods cannot replace witnessing risk control on the ground. The price consequences are explained in ISO 45001 certification cost: what moves the price, and how long the whole journey takes in ISO 45001 timeline: how long certification takes, stage by stage.

How the scope reads on the certificate

The certificate names the organisation and, for a multi-site certification, each site, with the activities covered at each. The certification body checks the proposed wording during Stage 1, its readiness review, and confirms it only after the Stage 2 audit on site. It must also hold accreditation for the sector codes your activities fall under; ask about this before you sign, as choosing an ISO 45001 certification body explains.

Clients read this wording closely: a tender for construction works is not satisfied by a certificate covering "head office administration". Keep your own statement identical to the one on the application.

Changes to sites or activities must be notified to the body, and a serious incident or regulatory breach can prompt a special audit; see ISO 45001 surveillance and recertification: the three-year cycle.

Five scope mistakes that cost you

1. Scoping out the hazardous work

The first client HSE inspection finds uncertified high-risk work. Include it and control it.

2. Counting only employees

The quote assumes permanent staff; Stage 1 finds a contractor workforce twice the size, and audit days rise. Declare the full effective headcount from the start.

3. Forgetting temporary and client sites

A scope that stops at the office gate fails when the auditor asks where the technicians are today.

4. One scope, several safety systems

Sites assessing risk in different ways cannot be sampled. Agree one method first.

5. Wording nobody outside the company understands

Internal division names confuse tender reviewers. Describe activities as a client would.

ISO 45001 scope: questions buyers ask