ISO 45003 · Psychological health and safety at work

ISO 45003 psychosocial risk management consulting for a workplace that protects minds as carefully as bodies.

Manage psychosocial risk inside your occupational health and safety system with ISO 45003:2021, the international guideline on psychological health and safety at work. Sterling's expert and experienced consultants find the hazards in how your work is organised, with your managers and workers, put the controls where the work is designed rather than where the symptoms appear, and stay with you until the programme runs on its own, in 60+ countries. ISO 45003 is guidance under ISO 45001, not a certifiable standard: the outcome is a healthier workforce and an audit-ready OH&S system. We ensure our clients put the standard in place successfully.

Book a free discovery call Start the free readiness check

Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
A team of expert and experienced psychosocial risk consultants, advising on management systems across sectors and countries since 2003
The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling applies the guidance with you; there is no certificate to issue

ISO 45003 at a glance

Purpose: Manage psychosocial risk, the hazards in how work is organised, social factors at work and the work environment, and promote well-being, inside an OH&S management system based on ISO 45001
Relevant to: Organisations of any size and sector, from ISO 45001-certified companies to BPOs, hospitals, contractors and professional firms with shift, remote or high-pressure work
Edition: ISO 45003:2021, the first edition, published in June 2021 by ISO/TC 283, with no amendment; ISO's systematic review of the edition closed in September 2026, outcome yet to be announced
Certification: None on its own. ISO 45003 gives guidelines, not requirements; psychosocial risk is audited within an ISO 45001 certification by the accredited certification body, and any standalone ISO 45003 certificate is unaccredited
Sterling's role: Hazard identification and risk assessment with your managers and workers, controls inside your OH&S system, Effivity, training and the first evaluation cycle, then Sustain™
Cost and timing: Total investment for an ISO 45003-based psychosocial risk management programme depends on the current maturity of your processes, the scope, locations and number of employees. The process typically takes 3 to 6 months

Certified to ISO 45001:2018?

Your hazard identification already has to cover psychosocial hazards. Make it real before the next audit.

ISO 45001 requires hazard identification to consider how work is organised, social factors such as workload, working hours, victimisation, harassment and bullying, and leadership and culture. ISO 45003 is the guidance on doing that well, and with a revised ISO 45001 expected in the first half of 2027 it is the most useful next step for a certified organisation.

ISO 45003 for ISO 45001-certified organisations

8,100+ client engagements in 60+ countries.

ISO 45003 client experience

What it is

What is ISO 45003 and what is it used for?

ISO 45003 is the first international standard on psychological health and safety at work. It gives guidelines for managing psychosocial risk within an occupational health and safety (OH&S) management system based on ISO 45001, so that an organisation prevents work-related injury and ill health and promotes well-being at work. In the standard's framing, psychosocial hazards arise from three sources: how work is organised, social factors at work, and the work environment, equipment and hazardous tasks. Unmanaged, they lead to anxiety, depression, sleep disorders and burnout, and for the organisation to absence, turnover, litigation and reputational damage.

The document treats psychological health the way ISO 45001 treats every other hazard: identify it, assess the risk, eliminate or reduce it at the source, verify the control and improve. That is what separates it from a wellness programme. An app or a resilience workshop supports people after the exposure; ISO 45003 requires first whether the workload, the roster, the unclear role or the way managers behave is the hazard, and whether it can be changed. Worker participation at every stage is, in the standard's words, critical to success.

Current edition. ISO 45003:2021, published on 8 June 2021, is the first edition, prepared by ISO/TC 283, the committee responsible for ISO 45001; it has no amendment. Its clauses mirror ISO 45001 from context to improvement and add what psychosocial risk needs, including confidentiality and return to work. ISO's routine systematic review of the edition opened in April 2026 and closed in September 2026; the outcome has not been announced. Because the document is guidance, a future edition brings no certificate transition. A revised ISO 45001 is expected in the first half of 2027. ISO 45003 explained: psychosocial hazards, clause by clause

Who it is for

Who needs ISO 45003 psychosocial risk management?

ISO 45003 applies to organisations of all sizes and sectors, and ISO/TC 283 notes that it can also be used without a formal OH&S management system, although it is written to complement ISO 45001. Organisations come to Sterling from four starting points:

Absence, turnover and grievances tell a story the safety statistics miss. Sick leave is rising in one department, exit interviews keep naming the same manager, and a harassment complaint has reached the board. The hazards sit in how the work is organised and led, and no register names them.
Your ISO 45001 auditor, or your own internal audit, asked how psychosocial hazards are identified. ISO 45001 requires hazard identification to consider how work is organised, social factors, leadership and culture. A register that stops at machinery, chemicals and working at height leaves that requirement unanswered.
Regulators, customers or investors now ask about psychological health at work. In a growing number of jurisdictions the duty to manage psychosocial hazards is explicit, and customer questionnaires and ESG assessments ask how well-being is managed. A programme aligned with the guideline answers with evidence rather than a brochure.
The work has changed faster than the controls. Night shifts serving other time zones, remote and hybrid teams, monitored targets, restructuring and precarious contracts each add pressure, and each needs a method to see it and manage it.

The intended outcome is fewer people harmed by their work, with evidence that the organisation looked for the hazards, acted on them and checked the result.

Business benefits

How ISO 45003 protects people and performance

A psychosocial risk programme earns its place when a hazard is removed from the work rather than absorbed by the worker. We start where the pressure is highest, the night shift, the restructured team, the role with two managers and no job description, and build there first.

Fewer people harmed by their workPsychosocial hazards identified and controlled at the source, so anxiety, burnout and stress-related illness are prevented rather than treated.
Lower absence and turnoverThe costs the standard itself names, absence, turnover, lost quality, investigations and litigation, reduced by acting on the causes.
Managers with a methodWorkload, change and conduct handled through one process with clear roles, instead of every manager improvising when a team is in trouble.
Workers who reportConsultation, confidentiality and protection from reprisal built in, so hazards surface early through the people who experience them.
One system for every hazardPsychosocial hazards on the same register, consultation and improvement route as physical ones, and inside the scope your ISO 45001 auditor examines.
Evidence for regulators, customers and investorsA programme aligned with the international guideline, with records that show hazards found, risks assessed and controls working.

Choose a few measures, such as work-related sickness absence, concerns raised and closed or survey results by team, and judge the programme by whether they move. A well-being calendar is not a control.

Guidance, clause by clause

What does ISO 45003 ask of an organisation?

Nothing auditable as a requirement: ISO 45003 contains guidance, not "shall" statements. It follows the structure of ISO 45001, clauses 4 to 10, so that everything it suggests fits inside an existing OH&S management system, and adds what psychosocial risk needs. The table is a plain-language map of the 2021 edition; your arrangements are designed against it clause by clause and, where you hold ISO 45001, checked against that standard's requirements.

Clause	What the guidance covers	What it looks like in practice
4 Context of the organisation	Understand the issues that shape psychosocial risk and the needs and expectations of workers and other interested parties, and make sure the OH&S management system's scope takes in psychosocial risk	A context review that names the pressures on your workforce, consultation records, and a scope that covers psychological as well as physical health
5 Leadership and worker participation	Top management commits to preventing psychosocial harm and promoting well-being, sets the policy, assigns roles and ensures workers are consulted and take part	A policy that names psychological health, leaders who model the behaviour they expect, responsibilities assigned to managers and HR, and consultation arrangements workers trust
6.1 Hazard identification and assessment of risks and opportunities	Identify the psychosocial hazards in how work is organised, in social factors at work and in the work environment, equipment and hazardous tasks; assess the risks and opportunities	Surveys, focus groups and interviews designed for confidentiality; a register that records the hazard, who is exposed, the controls and the risk; opportunities such as job redesign captured too
6.2 Objectives to address psychosocial risk	Set objectives for psychosocial risk consistent with the policy, and plan how to achieve them	Measurable objectives with owners and dates, tracked with the other OH&S objectives
7 Support	Provide the resources, competence, awareness and communication the work needs, and control documented information with particular attention to confidentiality	Managers trained to recognise and respond, workers who know how to raise a concern, personal information held with restricted access, and communication that reaches remote workers
8.1 Operational planning and control	Eliminate hazards, reduce OH&S risks and promote well-being at work; manage change; address procurement, contracting and outsourcing	Work redesigned first, workload, rosters, role clarity and change handled through defined processes, contractors included, and well-being initiatives that support control rather than replace it
8.2 Emergency preparedness and response	Prepare for and respond to emergencies with their psychological impact in mind	Response plans that include support for workers exposed to traumatic events or violence, and debriefing afterwards
8.3 Rehabilitation and return to work	Support the recovery and return to work of workers affected by psychosocial risk	Return-to-work plans agreed with the worker, adjustments to the work, contact kept during absence and confidentiality protected
9 Performance evaluation	Monitor, measure and evaluate performance, audit the arrangements internally and review them at top management level	Indicators such as absence, turnover, concerns raised and survey trends, an internal audit that covers psychosocial risk, and a management review that decides
10 Improvement	Deal with incidents and nonconformities related to psychosocial risk, take corrective action and improve continually	Bullying, harassment and stress-related incidents investigated with worker participation to the causes in the work, corrective actions verified and lessons fed back into hazard identification

What does useful ISO 45003 evidence look like?

A context review and scope that name psychological health; a policy commitment; the hazard identification method, with survey, focus-group or interview records held confidentially; a register that states the hazard, who is exposed, the controls and the risk; objectives, competence records and consultation minutes; concern and incident records with investigations that reach the causes in the work; return-to-work plans; indicators; the internal audit; and the management review that acted on them. We identify the records your arrangements need and set them up in Effivity from the first workshop, so the evidence accumulates as the work is done.

ISO 45003 explained: psychosocial hazards, clause by clause

Implementation route

How do you implement ISO 45003?

There is no ISO 45003 certification body in this route. The guidance is implemented inside your OH&S management system, your own leadership and workers judge whether it works, and where you hold ISO 45001 the accredited certification body audits the psychosocial hazards as part of the system it certifies. Sterling designs and builds with you; the decisions on how work is organised and led are yours.

01
Define the scope and the workforce it covers.Confirm the sites, functions, shifts and employment arrangements in scope, including remote, agency and contracted workers, and how the programme fits your OH&S system.
02
Gap analysis: review current arrangements against the guidance.The gap analysis compares your policies, HR processes, consultation channels, survey, absence, incident and grievance data and hazard register with the ISO 45003 clauses, keeps what works and agrees actions, owners, dates and resources.
03
Design the approach with leadership and workers.Top management sets the commitment and the roles; the hazard identification method, confidentiality rules, consultation channels and reporting lines are designed with worker representatives so that people use them.
04
Identify the hazards, assess the risks and act on the work.Surveys, focus groups and interviews across the agreed scope, a register built with the people who do the work, and controls that change workload, rosters, roles and conduct first, with well-being support alongside.
05
Evaluate and close the gaps.Indicators are reviewed, the internal audit covers psychosocial risk and the management review decides; findings are closed with evidence, ready for the certification body's next audit.
06
Embed and review.Management of change, contracting, emergency response and return to work carry the guidance into daily management; the annual cycle of monitoring, audit and review keeps it current, and Sustain™ supports each cycle.

Check what you are being sold. ISO 45003 provides guidelines rather than requirements, so no accredited certification to it exists; a standalone "ISO 45003 certificate" is either a certification body's own unaccredited scheme or a seller's invention. Ask instead how the hazards will be identified with your workers, who in your leadership will own the changes to the work, and what will exist when the consultant leaves. How to choose a credible ISO 45003 provider · The certification buyer's checklist

Cost

How much does ISO 45003 implementation cost?

There is no useful universal price. A single-site firm adding the guidance to a mature ISO 45001 system needs a different scope from a multi-site BPO with night shifts, high attrition and no OH&S system. What we can promise is a proposal in which every component is visible and nothing is added later, with no ISO 45003 certification fee, because none exists.

Cost component	What affects it
Consulting and implementation	Current maturity, the sites, functions and employment arrangements in scope, whether an ISO 45001 system exists, the survey effort, deliverables and how much of the work your team takes on (Design™ or Drive™)
Independent assessment, if you want one	None for ISO 45003. If you certify to ISO 45001, the accredited certification body's fees are shown separately, as is the fee for any unaccredited ISO 45003 assessment you choose
Internal resources	Leadership time for decisions on work design, worker time for surveys, focus groups and consultation, manager training, and the changes to rosters, roles or staffing the risk assessment calls for
Software and learning	Included in a Sterling engagement: Effivity for the register, controls, incidents, audits and reviews, and Sterling Academy access for your people, with users, courses and access period confirmed in the proposal
Continued support	Annual reassessment, survey cycles, refresher learning, internal audits and adoption of any revised edition under Sustain™

What moves the price

Number of sites, countries, shifts and languages in scope
Whether an ISO 45001 system exists and how mature it is
Workforce size and employment arrangements, including remote, agency and contracted workers
The depth of hazard identification: survey scale, focus groups and teams covered
The deadline, and how much of the work your team can carry

What a Sterling proposal always shows

Deliverables, responsibilities, assumptions and exclusions, in writing
No ISO 45003 certification fee; any ISO 45001 certification-body fee identified separately
Effivity, training and Academy access itemised at no additional cost
Payment milestones tied to deliverables, not to the calendar
One all-inclusive proposal. No surprises, ever

Timeline

How long does ISO 45003 implementation take?

The timeline depends on your starting point, the size and spread of the workforce, how quickly leadership can decide on changes to the work and whether an OH&S system already exists. It is measured in months, not days, typically three to six: hazards have to be identified with the workers, controls put in place and given time to operate, and an internal audit and a management review completed before anyone can say the programme works. We plan around that first cycle, with milestones your team tracks in Effivity.

Phase	What determines the pace
Scope and gap analysis	Access to leadership, HR and OH&S data, existing surveys, policies and grievance records
Design and consultation set-up	How quickly leadership agrees the commitment, roles and confidentiality rules, and how fast worker representatives are engaged across sites and shifts
Hazard identification, assessment and controls	The survey and focus-group programme, the number of teams, the decisions on workload, rosters and roles that need budget, and the training of managers
Evaluation and review	Enough operating time for indicators to move, then the internal audit, the management review and the closure of findings, aligned to any ISO 45001 audit date

If a surveillance audit, a regulator's request or a board date sets the deadline, share it at the start. We will tell you what is achievable and which decisions cannot wait. A programme promised in weeks, before anyone has spoken to your workers, is a template with your logo on it, not a plan.

Challenges

Common ISO 45003 implementation challenges

Most psychosocial risk programmes stall for the same five reasons.

It is run as a well-being campaign, not as hazard control.

Fruit baskets, apps and mindfulness sessions treat the symptom. We put psychosocial hazards through the same identify, assess, control and verify cycle as any other hazard, with work design as the first control.

Workers will not say what is wrong.

Fear of reprisal and doubts about confidentiality silence the people who know the hazards. We design the surveys, focus groups and reporting routes with worker representatives, put the confidentiality rules in writing, and make sure leadership acts visibly on the first findings.

Managers hear blame, and leadership behaviour is itself a hazard.

The standard counts leadership and culture among the social factors at work. We frame the programme as a method managers receive rather than a verdict, train them to recognise and respond, and have the hard conversation about leadership behaviour with top management first.

Controls stop at the individual.

Resilience training and counselling ask the worker to cope with a hazard the organisation created. We design controls at the source, workload, staffing, rosters, role clarity, change management and conduct standards.

The workforce is spread across shifts, countries, contractors and homes.

One method, one register and one Effivity workspace, with locally owned assessments, so that a night-shift team, a remote team and an agency crew on site are all in scope and all heard.

Your engagement

What your ISO 45003 engagement includes

Most providers run a survey, hand over a report and leave you to act on it; a Sterling engagement is the whole journey, from one team, under one all-inclusive proposal.

Scope, gap analysis and implementation plan
Sites, workforce, employment arrangements and decision owners agreed with leadership before the first workshop.
Design and documentation
Policy, roles, hazard identification method, confidentiality rules, procedures and forms, built with your leaders and worker representatives on Sterling's template sets.
Effivity ISO & GRC software
Your hazard register, controls, objectives, incidents, audits and reviews run in Effivity from day one, included with the engagement at no additional cost.
Training for everyone
Internal auditor training for your audit team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Facilitated hazard identification and risk assessment
Surveys, focus groups and interviews across the agreed scope, the register built with the people who do the work, and controls agreed with the managers who own the work.
First evaluation cycle
Indicators, the internal audit and the management review completed with you, findings closed with evidence, ready for your ISO 45001 certification body.

ISO 45003 provides guidelines, not requirements; there is no ISO 45003 certificate to issue and none is promised. Where the programme is part of an ISO 45001 system, certification decisions remain with the independent certification body.

How we deliver

How Sterling supports your ISO 45003 implementation

Every ISO 45003 engagement runs on Sterling OS™, our delivery operating system: five phases with named deliverables, decision owners and evidence at each stage. Pick the level of support your capacity allows; the method, software and accountability do not change.

01
Design™Guided implementation: your OH&S and HR leads build the programme with Sterling's structure, templates, workshops and coaching.
02
Drive™Fully managed consulting: Sterling consultants take on the agreed design, facilitation and documentation work with your leaders, managers and worker representatives.
03
Sustain™After the first cycle: reassessments, internal audits, management review preparation, refreshers and new-hire training, every year.
04
Automate™The programme running in Effivity: register, controls, objectives, incidents, audits, actions and reviews in one workspace beside your physical hazards.
05
Revise™Adoption of any revised edition of ISO 45003 or ISO 45001, and changes in scope, structure, working arrangements or regulation.

Before work starts we agree the engagement team, the weekly working session, the deliverables and who decides what, and progress is reviewed against those commitments.

How Sterling OS™ works

Often combined with

Standards organisations pair with ISO 45003

Effivity · ISO 45003 psychosocial risk software, included in every engagement

How Effivity helps you fulfil, automate and simplify the guidance of ISO 45003:2021.

Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries, is part of every Sterling ISO 45003 engagement. Your consultant configures the OH&S workspace within the agreed scope, so the psychosocial hazard register, controls, objectives, competence records, concern and incident reports, audits and management reviews live in one place beside your physical hazards, and the auditor reads live records rather than a report assembled the week before. For Sterling consulting clients the Effivity subscription is included with the engagement, at no additional cost.

Included in every engagement See Effivity

Context of the organisation

Issues, interested parties and scope

The issues that shape psychosocial risk, the needs and expectations of workers and other interested parties and the scope kept in one register with review dates, so the context stays current between reviews.

Leadership and worker participation

Policy, roles and consultation

The policy with its approvals, responsibilities for managers and HR, and consultation meetings and worker concerns recorded where they arise with actions tracked to closure, so participation is evidenced rather than asserted.

Hazard identification and assessment of risks and opportunities

The psychosocial hazard register

Hazards from how work is organised, social factors and the work environment recorded by team and site, with exposed groups, controls, assessed risk and the treat, monitor or escalate decision, beside the physical hazards.

Objectives to address psychosocial risk

Objectives with owners and progress

Psychosocial objectives set beside the other OH&S objectives, with measures, owners, dates and progress visible to management.

Support

Competence, awareness and confidential records

Training linked to Sterling Academy, procedures and forms with versions and approvals, and documented information with access limited to those who need it, so confidentiality is a control rather than a promise.

Operation

Controls, change, contractors and return to work

Work-design controls with owners, management-of-change assessments that ask the psychosocial question, contractor arrangements in scope, and return-to-work plans tracked to completion.

Performance evaluation

Indicators, audits and review

Absence, turnover, concerns raised and survey trends on live dashboards, the internal audit programme with findings and follow-up, and a management review that records its decisions and actions.

Improvement

Concerns, incidents and corrective action

Concerns and incidents, from a reported case of bullying to a team in overload, investigated with worker participation to the causes in the work, corrective actions verified and trends visible early.

What this means at the audit

Whoever examines your arrangements, certification body, internal audit, regulator or board, asks for the hazard identification method, the register, the controls and their owners, manager training, the concern and incident records, the indicators and the last management review. In Effivity each is a screen with dates, owners and evidence attached, not a folder assembled the week before the visit. After the first cycle, Sustain™ runs in the same workspace.

Effivity for ISO 45003: the guide Effivity OH&S software on effivity.com

In your engagement

Subscription included with the engagement, at no additional cost
Configured by your Sterling consultant within the agreed scope
Your risk assessments, survey results and records migrated, not retyped
Admin and user training for your OH&S and HR teams
Modules for OHSMS, QMS, EMS, ISMS and more for an integrated system

ISO 45003 client experience

Client letters on file, available on request.

Client feedback wall: letters on file

Signed client letters for ISO 45003 are available on request. The client feedback wall lists every letter by standard.

Programmes with ISO 45003 in scope

How an integrated programme runs.

All case studies

01
Psychosocial risk inside an integrated HSE system
ISO 45003 is commonly implemented as the psychosocial layer of an ISO 45001 system that is itself integrated with ISO 9001 and ISO 14001. In such a programme physical and psychosocial hazards sit on one register, workers are consulted through the same committees, a concern about workload or conduct follows the same investigation route as a machinery near miss, and one accredited certification audit examines all of it, so psychological health is evidenced by the same system that protects physical safety.
How integrated programmes run

Sterling Academy · ISO 45003 e-learning

Train every manager and worker on ISO 45003, not just HR.

Sterling Academy delivers e-learning for the whole workforce and for the people who run the programme: video lessons with practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online. Sterling consulting clients benefit from preferential course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.

ISO 45003 awareness for every employee, so hazards are recognised and reported by the people who experience them first
Practitioner courses for the managers, supervisors and HR who run the programme
Internal auditor training for the people who will audit the arrangements, as applicable to your standard, as part of the engagement
Learner progress by department and site, and a training status report for the auditor
New hires trained as they arrive, so competence evidence is current at every review
A Sterling consultant reachable when a learner needs one

Keep exploring

Explore more about ISO 45003

Watch a video on how to implement ISO 45003 here.
Watch a video on ISO 45003 guidance here.

ISO 45003 resources

Services for ISO 45003

Why Sterling

Want ISO 45003 psychosocial risk management that changes the work? Come to Sterling.

Whether you are bringing psychological health into one site's OH&S system or aligning the approach across several countries, Sterling helps you establish one method with clear local ownership, working through the differences in employment law, culture and working arrangements between locations.

Management systems in 60+ countries since 2003

OH&S management systems implemented for BPOs, hospitals, contractors, manufacturers and service firms, with one engagement team accountable across every country you operate in.

All-inclusive proposal

Consulting, Effivity, training and Academy access in one proposal, with no ISO 45003 certification fee because none exists, and any ISO 45001 certification-body fee identified separately. No surprises, ever.

A programme managers and workers will use

Less documentation and more effect: a hazard method managers can apply in a team meeting, reporting routes workers trust, and controls that change rosters, roles and conduct rather than adding a policy.

Expert and experienced consultants

Consultants who have advised on management systems across sectors and countries since 2003, and who design your psychosocial risk programme properly the first time, so the first survey leads to decisions.

Sterling vs the rest: the full comparison Explore ISO 45003 client experience

The Sterling Promise

What our ISO 45003 implementation success guarantee means

100%on-time completion · success · 8,100+ client engagements

We stay with you until your agreed ISO 45003 implementation outcome is achieved: the hazards identified with your workers, the controls in place and operating, and the first evaluation cycle completed. Clear explanations, practical delivery, included software and employee learning turn the investment into lasting capability.

The engagement identifies the guideline, scope, outcome and responsibilities. Your organisation supplies accurate information, consults its workers, decides the changes to the work and applies the agreed arrangements. ISO 45003 carries no accredited certification, so no certificate is promised; where the programme sits within an ISO 45001 system, the independent certification body assesses conformity and keeps its decision. Our commitment concerns the agreed consulting support, not a promise that no worker will ever experience psychological harm.

After implementation

What happens after ISO 45003 implementation?

The programme should keep working as the organisation, its people and its pressures change. Indicators are monitored, concerns are handled as they arise, every restructuring, new roster or new contract is assessed for its psychosocial effect, and the register is reassessed when the work moves. Once a year the arrangements are audited internally and reviewed by top management.

Where you hold ISO 45001, the accredited certification body sees the psychosocial arrangements at each surveillance audit as part of the system it certifies. Under Sterling OS™ Sustain™ we facilitate the reassessments, prepare the survey cycle, the internal audit and the management review with you, and train the people who join, so the programme stays alive between reviews.

FAQs

Frequently asked questions about ISO 45003

Can an organisation be certified to ISO 45003?

Not on an accredited basis. ISO 45003 is a guidance standard with no requirements, so there is nothing to accredit certification against. Some certification bodies offer their own unaccredited certificate or verification against ISO 45003: a scheme of the body's design, useful for internal assurance, but not accredited certification and not equivalent to an ISO 45001 certificate.

What is the difference between ISO 45003 and ISO 45001?

ISO 45001 is the requirements standard for an OH&S management system: it uses "shall", is audited clause by clause and can be certified by an accredited body. ISO 45003 follows the same clause structure but contains guidance on one family of hazards. ISO 45001 already requires hazard identification to consider how work is organised, social factors, leadership and culture; ISO 45003 explains how to do it.

Do we need ISO 45001 before we can use ISO 45003?

No. ISO/TC 283, the committee that wrote both, says ISO 45003 can be used by organisations without a formal OH&S management system. It is written to complement ISO 45001 and works best inside one, because the consultation, competence, incident and review processes are already there to carry it.

What counts as a psychosocial hazard under ISO 45003?

The standard groups psychosocial hazards under three headings: how work is organised, social factors at work, and the work environment, equipment and hazardous tasks. In everyday terms that covers workload and pace, working hours, role clarity, job control, change, remote and isolated work, job security, relationships, leadership and culture, recognition, support, violence, harassment and bullying, and the conditions and equipment people work with.

Is ISO 45003 the same as a mental health or well-being programme?

No, although the two should work together. A well-being programme offers support; ISO 45003 requires the organisation to find the hazards in the work and remove or reduce them first, then to promote well-being alongside. Counselling for a chronically understaffed team treats the symptom; the guidance expects the staffing to be addressed.

How does the certification body check psychosocial risk in an ISO 45001 audit?

As part of the system: the auditor looks at how hazards are identified and whether that reaches how work is organised and the social factors, then at the risk assessments, controls, consultation, competence, incident handling, monitoring, internal audit and management review. There is no separate ISO 45003 certificate; the psychosocial arrangements are evidenced by the same records as the rest of the system.

How do you assess psychosocial risks without breaching confidentiality?

By designing for it from the start. Surveys are anonymous and reported at a group size that protects individuals, focus groups and interviews follow agreed rules, and personal information is held with restricted access, as the guidance on documented information expects. Workers are told what will be recorded and who will see it, and leadership commits in writing to protecting those who raise concerns.

Does ISO 45003 cover remote, hybrid, agency and contracted workers?

Yes. The guidance applies to all kinds of work tasks, equipment and employment arrangements, and it addresses procurement, contracting and outsourcing. Remote and isolated work brings its own hazards, and people who work under your control without being on your payroll are within the system's scope.

What do you need to prepare an ISO 45003 proposal?

The sites, functions and working arrangements to be covered, approximate headcount including agency and contracted workers, whether you hold ISO 45001, what surveys or policies exist today, who is asking for the programme, and your deadline. That is enough for a scoped, all-inclusive proposal; there is no need to run a survey first.

Before the first call

Prepare a useful ISO 45003 readiness brief

You do not need a survey or a policy first. Bring a short account of the work, the people and where the pressure shows. Seven questions are enough:

Who is asking for psychosocial risk management: a regulator, your ISO 45001 auditor, a customer, the board or the workers? If nobody has asked, which figures or events prompted the question?
Which sites, functions, shifts and working arrangements should the programme cover, including remote, agency and contracted workers?
Do you hold ISO 45001 or another management system certificate, and how does your hazard identification currently treat psychosocial hazards?
What do absence, turnover, grievance, survey and exit-interview data from the last two years say about where the hazards are?
Which arrangements already exist and work: an employee assistance programme, a well-being initiative, a conduct policy, a safety committee, manager training?
Who in leadership can decide on changes to workload, rosters, roles and staffing, and who will own the programme?
Is there a surveillance audit, a regulatory request, a board date or a survey cycle to plan around?

These answers let us scope the work and prepare a realistic proposal; they are not a scored assessment or a verdict on your workplace.

Don’t be fooled by certification scams

If it promises an accredited ISO 45003 certificate, walk away: there is no such thing.

ISO 45003 provides guidelines, not requirements, so no accreditation body accredits certification to it. Certificates against it are a certification body's own unaccredited scheme or a seller's invention, and the market offers both, alongside ten-day assessments built from a survey nobody answered accurately. They cost less, until a regulator, a customer's auditor or a tribunal asks what changed in the work.

How to choose a credible ISO 45003 provider

Walk away from any offer of an accredited ISO 45003 certificate. No accreditation body accredits certification to a guideline; a document that claims it will not survive a check with the body it names.
If a certification body offers its own ISO 45003 certificate or verification, ask exactly what it is. It is an unaccredited scheme of that body's design: useful for internal assurance, but not accredited certification, and your customers should be told so.
Ask how the hazards will be identified with your workers, and how confidentiality will be protected. A programme built from a template register describes the consultant's assumptions.
Ask what will change in the work. If every proposed control is training, an app or counselling, the hazard stays where it was.
Identify who carries each task, what leadership will decide and when, and what support exists when the first survey results are uncomfortable.
Be cautious of "ISO 45003 compliant in ten days" and one invoice for programme and certificate. Hazards have to be identified with the people exposed to them and controls have to operate before anyone can evaluate them, and there is no accredited certificate to invoice for.

All ten warning signs of shortcut certification

What a credible ISO 45003 implementation always involves

Leadership commitment in writing, and visible in how leaders behave
Workers consulted and participating at every stage, with confidentiality protected
Hazard identification that covers how work is organised, social factors and the work environment
Controls at the source of the hazard, with well-being support alongside
Managers competent to recognise and respond, and workers who know how to raise a concern
Indicators, an internal audit and a management review, with the changes recorded
No accredited certificate, because ISO 45003 has none; the ISO 45001 audit as the independent check where you hold it

Sterling's position. Sterling does not certify, and ISO 45003 cannot be certified on an accredited basis. We consult on the guidance inside your OH&S system with your leaders and workers and prepare the evidence; whether it works is judged by your workers, your management, your internal audit and, where you hold ISO 45001, the accredited certification body. We do not sell certificates, and we will tell you plainly what any certificate you are offered demonstrates. Accredited certification exists for requirements standards such as ISO 45001, recognised through the Global ACI arrangement, which replaced the IAF MLA and ILAC MRA; a guideline sits outside it.

Holding or been offered an ISO 45003 certificate you are unsure about? Send it to us and we will tell you, at no charge, what it does and does not demonstrate.

Keep exploring

More on ISO 45003 and related standards

Plan your ISO 45003 psychosocial risk management with confidence.

Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.

hello@sterling-grc.com

+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page

What would you like to achieve?

Choose a starting point. The enquiry form takes about a minute.

Implement ISO 45003-based psychosocial risk managementUnderstand cost, scope and timingBring psychosocial risk into our ISO 45001 systemStrengthen an existing well-being or psychosocial risk programme

Book my free discovery call

Continue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice