ISO 45001 Scope and Applicability: Which Organisations Should Get Certified?

One question dominates our initial conversations with organisations considering ISO 45001: “Do we really need this?”

The answer is nuanced. Technically, ISO 45001 is voluntary everywhere. Practically, the business case for implementation varies dramatically by industry, organisational size, and market positioning.

This article clarifies the scope and applicability question: who genuinely needs ISO 45001, and how do you define the scope of your OH&S management system?

Scope of ISO 45001: Universal Applicability

ISO 45001 applies to any organisation, anywhere, of any size. The standard explicitly states no exclusions.

We’ve certified:

• A three-person consulting firm in Sydney
• A 50-person technology startup in Melbourne
• A 2,000-person manufacturing facility in Brisbane
• A multinational corporation operating across 15 countries
• A non-profit aged care organisation
• Government agencies
• Universities

The standard fits all. Your system’s complexity scales with your organisation’s complexity. A small consultancy’s system is simpler than a multinational’s. But both can be certified.

What does “scope” mean in ISO 45001?

Scope is the boundary of your OH&S management system. You define what’s in and out. You might cover:

• Your entire organisation
• Specific locations or business units
• Specific products or services
• Specific processes or functions

For a multinational with plants in multiple countries, scope might be “all manufacturing facilities worldwide but not corporate offices.” For a service organisation, scope might be “all customer-facing operations but not back-office functions” (though this is unusual—most include all functions).

Defining your scope (Clause 4.3):

ISO 45001 requires you to define your scope clearly. Your scope statement documents what your OH&S system covers. During audit, auditors verify the scope is realistic (you actually manage OH&S within it) and complete (you haven’t excluded major OH&S risks).

If you declare your scope is “all manufacturing operations” but haven’t implemented OH&S management at a major facility, you’ll fail audit. Overstating scope is worse than understating it.

Voluntary vs Mandatory: The Critical Distinction

This is where confusion often arises. ISO 45001 certification is voluntary globally. But statutory OH&S requirements exist in most jurisdictions and are mandatory.

ISO 45001 Certification: Voluntary

No law requires you to pursue ISO 45001 certification. You choose to implement it and pursue external audit. If you don’t pursue certification, you’re not breaking any law.

Statutory OH&S Duties: Mandatory

Most jurisdictions have laws requiring organisations to manage occupational health and safety:

• Australia: Work Health and Safety Act 2011 (applies to all organisations)
• United Kingdom: Health and Safety at Work etc. Act 1974 (applies to all organisations)
• United States: OSHA Act 1970 (applies to most private sector employers)
• European Union: EU Health and Safety Directive (applies across EU)

These laws impose duties on employers and officers (directors, managers). You must identify hazards, assess risks, implement controls, provide training, maintain records, and investigate incidents. Breaching statutory duties can result in prosecution, fines, or imprisonment.

The relationship between ISO 45001 and statutory requirements:

ISO 45001 is a management system framework. It doesn’t replace statutory requirements; rather, a robust ISO 45001 system typically aligns well with statutory duties because both demand systematic hazard identification, risk control, and continuous improvement.

In practice: ISO 45001 certification doesn’t guarantee statutory compliance (you must separately meet applicable laws), but implementing ISO 45001 seriously typically aligns with statutory duties.

Practical Drivers of ISO 45001 Adoption

While ISO 45001 certification is voluntary, several factors drive organisations to pursue it:

1. Procurement and Tender Requirements

Large organisations and government bodies increasingly require suppliers to hold ISO 45001 certification. It’s a tender qualification criterion.

For small and medium enterprises, this is powerful. A subcontractor might not care about ISO 45001 intrinsically, but if their major customer won’t work with them without it, certification becomes necessary—not legally, but commercially.

2. Insurance Incentives

Some insurers reduce premiums for ISO 45001-certified organisations. If your organisation carries significant workers’ compensation or public liability insurance, certification might reduce costs, improving the financial case for implementation.

3. Industry Practice and Competitive Norms

In some sectors, ISO 45001 certification is the norm. In construction, mining, manufacturing, and utilities, most major players are certified. If you’re not, you’re at a competitive disadvantage—customers view you as less professional, less serious about safety.

In low-risk sectors (retail, hospitality, professional services), certification is less common but growing. As environmental and social responsibility becomes more valued, even low-risk organisations are pursuing certification to demonstrate commitment.

4. Reputation and Brand Value

ISO 45001 signals credibility. It tells customers, employees, partners, and the public that you manage risk seriously. In competitive markets, this differentiation is valuable. Employees prefer working for organisations with strong safety records and visible commitment to their wellbeing.

5. Operational Efficiency and Risk Visibility

Even without external certification, implementing ISO 45001’s framework improves operations. You identify hazards you’d otherwise miss. You prevent incidents before they occur. You reduce workers’ compensation costs. You improve process efficiency. These benefits accrue whether you pursue formal certification or not.

Industry-Specific Applicability and Adoption Rates

High Adoption Sectors:

Construction — Extremely high-risk sector. Multiple hazards (heights, machinery, chemicals, noise). High incident rates. Major customers require suppliers be certified. Most major construction firms are certified; many subcontractors pursue it for competitive access. ISO 45001 is increasingly the default for the sector.

Mining — Extremely high-risk sector with significant regulatory oversight. Mining companies operate in jurisdictions with stringent statutory requirements and insurance pressure. ISO 45001 certification is nearly universal among larger mining operations.

Manufacturing — High-risk sector with machinery, chemicals, and production hazards. Many major manufacturers are certified. Procurement requirements from automotive, aerospace, and consumer goods customers drive uptake. ISO 45001 is common among larger manufacturers.

Healthcare — Moderate to high-risk sector (biological hazards, sharp injuries, chemical exposures, psychological stress). Major hospitals and health networks increasingly pursue certification. Aged care is following. Insurance and reputation drivers are significant.

Utilities and Energy — High-risk sector (electrical hazards, heights, confined spaces). Regulatory environment is stringent. Major utilities are typically certified. Insurance and procurement requirements drive adoption.

Growing Adoption Sectors:

Hospitality — Lower intrinsic risk but faced with procurement requirements from major chains, insurance incentives, and growing recognition of psychological hazards (stress, harassment in customer-facing roles). Certification is growing but not yet the norm.

Aged Care — Increasingly adopting ISO 45001 due to regulatory focus on worker safety, insurance requirements, and reputation. High staff turnover and physical injury risks (lifting, violence) are being taken more seriously.

Professional Services — Lower physical risk but growing recognition of psychological hazards (stress, overwork cultures). Some firms pursue certification for reputation and employee retention benefits.

Technology — Historically low OH&S risk, but rapid growth in adoption. Driven by employee wellbeing expectations, remote work challenges, and talent competition (employees choose employers with strong safety cultures).

Lower Adoption Sectors (But Increasing):

Retail — Historically low adoption but growing. Recognised hazards include ergonomics, violence, shift work. Insurance and reputation drivers emerging.

Education — Schools and universities have historically low certification rates, but increasing. Hazards include psychological stress, violence, workplace bullying.

Government and Public Administration — Widely certified due to public accountability, budget availability, and high employee expectations.

Organisational Size and ISO 45001

A common misconception: “ISO 45001 is only for large organisations.”

False. We’ve certified micro-enterprises (3–5 people) to multinational corporations. The standard’s universality is genuine.

Small Organisations (1–50 people):

For small organisations, implementation is typically straightforward. You have fewer hazards, simpler operations, and less documentation overhead. Implementation often takes 2–4 months. The challenge isn’t complexity; it’s allocating time and resources.

Benefits for small organisations: procurement access (major customers might require suppliers be certified), insurance advantages, reduced incidents, better operational clarity, improved reputation.

Business case: Often marginal. If you don’t have procurement requirements and insurance incentives aren’t significant, the business case is weaker. However, small organisations often find that implementing ISO 45001 reveals hazards they hadn’t formally recognised, preventing incidents that would be proportionally more devastating for a small enterprise.

Medium Organisations (50–500 people):

Sweet spot for ISO 45001. Implementation is neither trivial nor overwhelming. Business case is usually compelling: procurement requirements are common, insurance incentives are material, competitive advantage is significant.

Typical implementation: 4–8 months. Benefits: clear procurement advantage, insurance cost reductions, improved operations, stronger reputation, reduced incidents.

Large Organisations (500+ people):

Implementation is more complex due to organisational size, multiple locations, diverse operations. Implementation often takes 9–18 months. However, benefits scale: procurement access (critical for competitiveness), significant insurance cost reductions, operational efficiency gains, strong reputation impact.

For large organisations, business case is compelling. Most major organisations in high-risk sectors are certified.

Multi-Site and Multi-Company Scope Considerations

For organisations with multiple locations, scope can be defined flexibly:

Option 1: Unified Scope — One OH&S management system covering all locations worldwide. One policy, one procedure set, unified risk register, one internal audit schedule, one certification. This is common for multinational corporations. Certification covers “all manufacturing facilities worldwide” or “all offices globally.”

Benefit: true integration, consistency across locations, economies of scale in governance. Drawback: requires strong central coordination; local sites must align to central framework.

Option 2: Grouped Scope — Multiple locations grouped into a single scope by geography or business unit. “All European facilities” is one system; “all Asian facilities” is another. Each group has one certification.

Benefit: balances central oversight with regional flexibility. Drawback: more administrative burden than single global scope; more complex than location-by-location approach.

Option 3: Location-by-Location Scope — Each facility is a separate scope with its own certification. “Sydney facility” and “Melbourne facility” are separately certified.

Benefit: maximum local flexibility. Drawback: highest overhead; each location conducts its own audit, maintains its own records; losing the consistency and efficiency of unified governance.

For multi-company situations (e.g., a parent company and subsidiaries), scope should reflect management control. Subsidiaries with autonomous OH&S governance might be separately certified. Those managed centrally might be included in a parent company’s unified scope.

How to Determine If ISO 45001 Makes Sense for Your Organisation

Ask yourself these questions:

Procurement Drivers: Do your customers require ISO 45001? Are you losing business to certified competitors? Is certification a tender requirement?

Insurance Drivers: Do insurers offer premium reductions for ISO 45001? Have you calculated potential savings?

Operational Drivers: Are you concerned about incidents? Would systematic hazard identification and risk control improve operations? Could reduced workers’ compensation costs offset implementation investment?

Reputation Drivers: Would certification improve your market positioning? Are employees or customers demanding stronger safety commitment?

Strategic Drivers: Are you planning to pursue ISO 9001 or ISO 14001? If so, ISO 45001 integration creates significant value. Are you in a high-risk sector where certification is becoming the norm?

Financial Case: Estimate implementation costs (consultant fees, internal staff time, audit fees) and compare to benefits (incident reduction, insurance savings, procurement access, reputation improvement). For high-risk organisations with procurement drivers, ROI is typically positive within 2–3 years. For low-risk organisations without procurement drivers, payback period is longer.

If the answers are “no procurement requirement, no insurance incentive, low incident risk, and no integration with other standards,” the business case is weak. But even then, the systematic thinking ISO 45001 demands often reveals unexpected benefits.

Special Considerations: High-Risk Work Activities

In some jurisdictions, certain high-risk work activities carry additional requirements. In Australia, for example, Schedule 2 of the Work Health and Safety Act specifies high-risk work (e.g., work at heights, work in confined spaces, work with explosives, work with hazardous chemicals).

If your organisation undertakes high-risk work, statutory requirements are more stringent. You must have specific competence certifications, specific training records, specific supervision arrangements. ISO 45001 complements these but doesn’t replace them. Your system must address statutory high-risk work requirements explicitly.

Getting Started: First Steps in Defining Your Scope

If you’re considering ISO 45001, begin by defining your scope:

Step 1: Identify what your organisation does. What are your primary business activities? What locations do you operate? What products or services do you deliver?

Step 2: Identify what your OH&S system will cover. Will it cover all activities or specific ones? All locations or a subset? Write a clear scope statement.

Step 3: Assess whether the scope is realistic. Can you genuinely implement OH&S management across the declared scope? If scope is too broad, you’ll fail audit. If overly narrow, you’ll miss significant risks.

Step 4: Identify hazards within your scope. What could go wrong? What could harm people? This hazard identification shapes your entire system.

Step 5: Make the business case. Will certification deliver value? Compare costs to benefits.

Step 6: Proceed with implementation or decide not to. If the business case is compelling, proceed. If not, you can still implement the ISO 45001 framework informally (without pursuing certification) and gain many of the benefits.

Conclusion: Applicability Is Universal, Adoption Is Strategic

ISO 45001 applies to any organisation. Technically, it’s voluntary everywhere. Practically, adoption drivers are sector-specific and organisation-specific.

High-risk sectors (construction, mining, manufacturing) are moving toward ISO 45001 as an industry norm. Procurement requirements and insurance incentives drive adoption. For these organisations, the question isn’t whether to pursue certification, but when.

Low-risk sectors (hospitality, retail, professional services) have lower adoption to date, but certification is growing as expectations evolve. For these organisations, the question is whether procurement drivers, insurance incentives, or reputation benefits justify investment.

Regardless of sector, organisations pursuing multiple ISO standards (quality, environment) benefit enormously from integrating ISO 45001. The High Level Structure alignment makes integration straightforward, reducing overhead and improving governance.

If you’re considering ISO 45001, focus on your specific context: your hazards, your market requirements, your competitive situation, your strategic direction. The business case will emerge clearly.

For guidance on implementation, see our complete implementation guide.

Frequently Asked Questions