ISO 45001 training: who needs what, and the evidence of competence auditors accept on site

What does ISO 45001 require for training and competence?

ISO 45001:2018, with Amendment 1:2024, places its people requirements in clause 7, Support, under two headings: Competence (7.2) and Awareness (7.3). Neither prescribes a course, hours or a qualification. The requirement is a cycle you run yourself: decide what each role that affects OH&S performance must know and be able to do, make sure the people in those roles meet it through education, training or experience, act where they do not, check that the action worked, and retain documented information as evidence.

The occupational safety version carries a specific demand. Competence explicitly includes the ability to identify hazards, so a welder, a forklift driver or a maintenance planner is expected to recognise what could hurt them or others. That links clause 7 directly to hazard identification under clause 6: when a new hazard enters the register, someone should ask who now needs to know about it. ISO 45001 hazard identification and risk assessment

Two definitions widen the reach. A worker, in the standard's terms, is anyone performing work or work-related activities under the organisation's control, which brings in agency staff and contractors. And the hierarchy of controls in 8.1.2 lists administrative controls, "including training", as the fourth of five steps, after elimination, substitution and engineering controls. A training record cannot justify leaving a hazard in place that could have been designed out.

Who needs what training under ISO 45001

Top management

Directors carry accountability for preventing injury and ill health under clause 5. Their training is short and specific: the policy commitments they signed, the significant risks on their own sites, the legal duties that fall on them and what a management review must decide. ISO 45001 management review: inputs, outputs and the record

The OH&S coordinator and site safety leads

The person running the system needs the whole standard, the risk assessment method you have chosen, the legal register and its evaluation, incident investigation to root cause and the audit cycle. Multi-site groups need a trained lead at each site.

Supervisors and line managers

This group decides whether the system works on the shift. They brief crews, issue and check permits to work, stop unsafe work, report near misses and apply management of change. Coaching on the job beats another classroom module.

Workers in high-risk tasks

Anyone working at height, in confined spaces, on energised equipment, with lifting gear or with hazardous substances needs task competence: the safe method, the controls, the permit conditions and when to stop. Where local law requires a licence or certificate for the task, it becomes part of the role criteria.

Safety representatives and committee members

Clause 5.4 requires consultation and participation of non-managerial workers. Representatives who take part in risk assessments and investigations need enough method to contribute, and the minutes of their meetings show it.

Emergency responders

First aiders, fire wardens and rescue teams need their role in each emergency plan under clause 8.2, practised through drills that are reviewed and improved.

Internal auditors

Auditors must be objective and competent. They need ISO 45001, audit technique, and enough knowledge of the work they audit to tell a real control from a paper one. ISO 45001 internal audit: planning, conduct and reporting

Contractors

Contractors need a site induction before they start and task competence checked at prequalification. ISO 45001 contractor management: prequalification to permits

An ISO 45001 training matrix by role

A matrix shows an auditor that competence is planned. Build it from your own registers.

Review the matrix whenever a new process, substance, site or contractor arrives, after any incident that points to a skills gap, and when the revised edition of ISO 45001 is published. ISO 45001 revision: what is changing and when

What ISO 45001 awareness must cover

Awareness is the minimum every worker carries, whatever the role, and auditors check it with plain questions at the workstation. Under clause 7.3 workers should be aware of:

• the OH&S policy and the objectives that concern them;
• how they contribute to the system, and what follows if they do not;
• incidents relevant to them and what was learned from the investigations;
• the hazards and risks of their own work and the actions that control them;
• their ability to remove themselves from work situations they consider present imminent and serious danger.

The last point is where awareness programmes most often fall short. A worker who does not know they can stop and walk away is a finding waiting to happen and a real risk on site.

What proves competence at an ISO 45001 audit

Certification bodies audit OH&S management systems during operational activities, including a tour of the workplaces, so competence is judged where the work happens. The trail runs from a task to the role criteria, the record and the person.

• Defined criteria. Each role states the education, training, experience and hazard knowledge it requires. A record with no criteria behind it proves nothing.
• Personal records. Licences, authorisations to issue permits, induction records and course records, traceable to the individual and in date.
• A check of effectiveness. A test, an observed task, a supervisor's sign-off or a fall in repeat findings, recorded against the action it evaluates.
• The work itself. Permits completed correctly, controls in place as the risk assessment says, a worker who can name the hazard and the control.

Where a competence requirement comes from the law, record it in the legal register as well as in the role criteria, so it is evaluated with your other obligations. ISO 45001 legal register and evaluation of compliance

Common ISO 45001 training gaps

• Training used instead of a better control. A hazard that could be guarded or substituted is managed by a briefing alone.
• Agency staff and contractors outside the matrix. They often do the riskiest tasks and have the thinnest records.
• Supervisors never trained to supervise safety. They sign permits they were never taught to check.
• Language and literacy ignored. Workers sign for a briefing they could not follow, and cannot answer the auditor.

Sterling Academy and internal auditor training for ISO 45001

Sterling Academy offers e-learning that suits the awareness row of the matrix. Each course runs with learning checks and a final exam, and learners who pass receive a numbered Sterling Academy Certificate of Completion. Task competence for high-risk work still needs observed practice, permits and drills on your own sites.

Internal auditor training, as applicable to your standard, is part of the consulting engagement. Your Sterling consultant prepares your audit team on ISO 45001 using your own sites, hazards and permits, and the reports of their first audits add to their competence evidence.

Sterling consulting clients benefit from preferential Sterling Academy course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.

Contact us about Academy access

How training records and competence sit in the software is explained in Effivity for ISO 45001: the guide.

ISO 45001 training: questions buyers ask