1.1 OHSAS 18001 to ISO 45001:2018 Evolution & Annex SL Structure

1.1 OHSAS 18001 to ISO 45001:2018 Evolution & Annex SL Structure

Historical Context and the Migration from OHSAS 18001:2007

For nearly two decades, the British Standards Institution's Occupational Health and Safety Assessment Series (OHSAS 18001:1999, revised in 2007) served as the primary international benchmark for occupational health and safety management systems. While adopted in over 130 countries, OHSAS 18001 was never a formal International Organization for Standardization (ISO) consensus standard. This created structural friction for multinational organizations maintaining integrated management systems alongside ISO 9001 (quality) and ISO 14001 (environmental management).

In 2013, the ISO Technical Management Board established Project Committee ISO/PC 283 to develop an official, globally harmonized standard aligned with International Labour Organization guidelines (such as ILO-OSH 2001, Guidelines on occupational safety and health management systems). On March 12, 2018, ISO 45001:2018 (Occupational health and safety management systems — Requirements with guidance for use) was published. The International Accreditation Forum (IAF) set a three-year migration window governed by IAF MD 21 (Requirements for the Migration to ISO 45001:2018 from OHSAS 18001:2007), running from March 12, 2018, to March 11, 2021. Due to global operational disruptions from the COVID-19 pandemic, the IAF extended the valid transition period through September 11, 2021. Following that date, OHSAS 18001 was formally withdrawn, rendering legacy OHSAS 18001 certificates completely invalid worldwide.

Today, the ISO 45000 family encompasses supporting standards that provide specialized guidance:

• ISO 45001:2018: The sole normative specification standard containing auditable requirements ("shall" statements).
• ISO 45002:2023: Informative guidelines for the implementation of ISO 45001:2018.
• ISO 45003:2021: The first global standard giving guidelines for managing psychological health and safety at work (psychosocial risks).
• ISO 45004:2024: Guidance on performance evaluation in OH&S management systems.

Annex SL: The Harmonized High-Level Structure

A cornerstone of ISO 45001:2018 is its structural adoption of Annex SL (formally designated in ISO/IEC Directives, Part 1, as the Harmonized Structure). Annex SL resolves historical incompatibilities across management standards by imposing a mandatory 10-clause framework, identical core titles, standardized text, and shared baseline definitions across all ISO management system standards (MSS):

• Clause 1: Scope — Boundaries and applicability of the standard, establishing the intended outcomes of the OH&S MS.
• Clause 2: Normative references — Supporting normative publications (ISO 45001 contains none; this clause is retained to maintain identical numbering across standards).
• Clause 3: Terms and definitions — Normative vocabulary and baseline concepts comprising 37 defined terms.
• Clause 4: Context of the organization — Internal and external issues (4.1), interested parties and worker needs (4.2), system scope (4.3), and OH&S processes (4.4).
• Clause 5: Leadership and worker participation — Top management accountability (5.1), OH&S policy (5.2), organizational roles and responsibilities (5.3), and worker consultation and participation (5.4).
• Clause 6: Planning — Actions addressing risks and opportunities (6.1), identification of hazards (6.1.2), legal and other requirements (6.1.3), and OH&S objectives (6.2).
• Clause 7: Support — Resources (7.1), competence (7.2), awareness (7.3), communication (7.4), and documented information (7.5).
• Clause 8: Operation — Operational controls and the hierarchy of controls (8.1.1, 8.1.2), management of change (8.1.3), procurement and contractors (8.1.4), and emergency preparedness and response (8.2).
• Clause 9: Performance evaluation — Monitoring, measurement, analysis, and performance evaluation (9.1.1), evaluation of legal compliance (9.1.2), internal audit (9.2), and management review (9.3).
• Clause 10: Improvement — General improvement (10.1), incident investigation, nonconformity, and corrective action (10.2), and continual improvement (10.3).

Clauses 1–3 provide introductory context and vocabulary, while Clauses 4–10 contain auditable requirements populated with mandatory "shall" directives. Annex A of ISO 45001 provides informative explanatory guidance intended to prevent misinterpretation, but it contains no requirements and cannot be used as an audit criterion.

Key Structural & Paradigm Differences: OHSAS 18001 vs. ISO 45001:2018

ISO 45001 shifts the safety paradigm from reactive technical compliance and facility-confined monitoring to strategic organizational governance embedded in top-level decision-making:

Proactive Leadership vs. The Management Representative

In OHSAS 18001, executive leaders frequently distanced themselves from day-to-day safety governance by appointing an "OH&S Management Representative" (Clause 4.4.1) who held delegated authority for system implementation. In practice, this often isolated safety within a technical silo while executive leadership focused strictly on financial metrics. ISO 45001 deliberately eliminated the Management Representative role. Under Clause 5.1, top management must demonstrate direct, personal leadership and commitment:

• Assuming ultimate, non-delegable responsibility and accountability for the prevention of work-related injury and ill health and the provision of safe workplaces (5.1a);
• Ensuring the OH&S policy and objectives are established and compatible with strategic business direction (5.1b);
• Integrating OH&S requirements directly into the organization's core business processes (5.1c);
• Allocating necessary resources for establishing, maintaining, and improving the OH&S MS (5.1d);
• Protecting workers from reprisals when reporting incidents, hazards, risks, and opportunities (5.1k);
• Establishing and supporting effective processes for worker consultation and participation (5.1l).

While operational duties can still be delegated to safety managers, top management retains total accountability. During a certification audit, lead auditors are required to interview executive leadership directly to verify personal engagement.

Risk and Opportunity vs. Standalone Preventive Action

Under OHSAS 18001, organizations maintained a separate "preventive action" procedure that was paradoxically triggered only after recognizing a potential flaw in an existing process. ISO 45001 removed preventive action as an independent clause because the entire Annex SL architecture is inherently preventive. Through Clause 4 (Context) and Clause 6.1 (Actions to address risks and opportunities), the system identifies and treats potential threats before they materialize as nonconformities or incidents.

Furthermore, ISO 45001 introduces OH&S opportunities (Clause 6.1.2.3). Organizations cannot merely defend against hazards; they must systematically pursue proactive workplace enhancements, such as:

• Introducing ergonomic automation to eliminate repetitive strain injuries;
• Substituting hazardous solvent degreasers with non-toxic aqueous alternatives;
• Implementing wearable heat-stress monitoring telemetry for high-temperature work environments;
• Redesigning work schedules to mitigate shift worker fatigue.

Integrated Management Systems (IMS): ISO 45001, ISO 9001, and ISO 14001

Because ISO 45001:2018, ISO 9001:2015 (Quality), and ISO 14001:2015 (Environment) share the identical Annex SL structure, organizations can operate a single Integrated Management System (IMS):

• Unified Strategic Planning: Conducting a single context review under Clause 4.1 analyzing commercial, environmental, and health/safety factors simultaneously.
• Consolidated Governance: Holding integrated Management Reviews (Clause 9.3) that evaluate customer satisfaction, environmental impacts, and injury metrics in a single executive agenda.
• Harmonized Audits & Infrastructure: Operating unified internal audit programmes (Clause 9.2) and managing shared documented information protocols (Clause 7.5).

However, lead auditors must verify the critical OH&S-specific requirements that distinguish ISO 45001 from ISO 9001 and ISO 14001:

1. Clause 5 Title and Focus: Expanded to "Leadership and worker participation."
2. Clause 5.4: A dedicated, non-negotiable sub-clause requiring formal mechanisms, time, and training for non-managerial worker consultation and participation.
3. Clause 8.1.2: Prescriptive five-tier Hierarchy of Controls (Elimination, Substitution, Engineering controls, Administrative controls, PPE).
4. Clause 8.1.4: Multi-tiered procurement controls addressing contractors, multi-employer worksites, and outsourced processes.
5. Clause 9.1.2: Formal, periodic evaluation of compliance with legal and other requirements (a rigorous legal verification not present in ISO 9001).

Lead Auditor Scenario: Auditing Leadership vs. The "Management Representative"

During a Stage 2 certification audit of a chemical manufacturing facility, the audit team schedules an opening interview with the Chief Executive Officer (CEO). The CEO declines detailed questioning on OH&S governance, stating: "Our Corporate Safety Director is our designated Management Representative under our Board Charter. She holds full operational authority and budgetary sign-off for safety across all production lines. My responsibility is commercial growth and investor returns. Please direct all safety questions to her."

Lead Auditor Evaluation: The Lead Auditor must issue a Major Nonconformity against ISO 45001:2018 Clause 5.1 (Leadership and commitment). Under ISO 45001, top management cannot delegate ultimate accountability to a representative or safety director. The standard mandates that top management take direct responsibility for preventing work-related injury and ill health (5.1a), ensure that OH&S requirements are integrated into the organization's business processes (5.1c), and actively lead the safety culture. While administrative execution and operational safety management may be handled by qualified specialists, executive leadership must demonstrate active personal knowledge, strategic oversight, and direct governance during the audit.

Common Candidate Traps & Exam Pitfalls

• The "Preventive Action" Illusion: Believing that ISO 45001 abandoned preventive action. In reality, Clause 6 makes the entire management system preventive by design, rendering a separate retrospective procedure redundant.
• The Delegation Fallacy: Assuming that appointing a highly qualified safety director satisfies Clause 5.1. Top management retains direct, non-delegable accountability and cannot transfer ultimate governance to a subordinate.
• Harmonization Overgeneralization: Assuming all Annex SL clauses are identical across standards. Always verify OH&S-specific clauses: Clause 5.4 (Worker Participation), Clause 8.1.2 (Hierarchy of Controls), and Clause 8.1.4 (Procurement and Contractors).
• Informative vs. Normative Confusion: Citing Annex A guidance as an audit requirement. Annex A is informative; nonconformities can only be raised against requirements in Clauses 4 through 10.