Standards for safety management: ISO 45001 and CSA Z45001

When Rachel told the leadership team that Harrowgate Foods Ltd. would build a safety management system, the first question came from the finance director: 'Whose system?' He had heard of ISO certificates, of COR, of the WCB's Safety Certified program, and he wanted to know which one the company was signing up for and what it would cost. Elena's answer was that the company would build its own system, designed around its own work, and use a recognized standard as the framework. The standard would tell them what a complete system needs. It would not tell them how to run a bakery.

This lesson introduces the main standards for OHS management systems, how they are structured, how they relate to each other and to the law, and what certification does and does not mean.

What a management system standard is

A management system standard is a document, written by a standards body through a consensus process, that sets out what an organization should have in place to manage something systematically: quality, environment, food safety, information security or occupational health and safety. Most use the word 'shall' for requirements and 'should' or 'can' for guidance. They describe outcomes and processes, not detailed methods. A standard will require an organization to identify hazards and assess risks; it will not tell it which risk matrix to use.

Standards are voluntary unless a law, a contract or a customer makes them mandatory. Nothing in Nova Scotia's Occupational Health and Safety Act requires an employer to follow a management system standard. Organizations choose to use one because it gives them a tested framework, a common language with customers and auditors, and a way of being confident that nothing important has been left out.

ISO 45001

ISO 45001, Occupational health and safety management systems: requirements with guidance for use, is the international standard. It was published in March 2018 by the International Organization for Standardization after several years of work by experts from dozens of countries, and it replaced OHSAS 18001, an earlier specification that many companies had been certified to. Organizations certified to OHSAS 18001 were given a migration period of about three years to move to the new standard.

ISO 45001 applies to any organization, of any size, in any sector. It is written so that a five-person contractor and a multinational manufacturer can both use it, scaling the depth of each process to their risks. Its purpose, in plain terms, is to help organizations provide safe and healthy workplaces by preventing work-related injury and ill health and by proactively improving OHS performance.

The common structure

ISO management system standards written in the last decade share a common high-level structure, now called the harmonized structure. Every one has the same ten clauses in the same order, with much of the same core wording. Clauses 1 to 3 cover scope, references and definitions. The requirements are in clauses 4 to 10.

The common structure is a gift to companies like Harrowgate Foods Ltd.. Aisha Rahman's food safety management system and the company's environmental program follow the same skeleton, so the three systems can share processes for document control, internal audit, management review and corrective action instead of running three of each. Lesson 12 returns to integration.

Changes since 2018

Standards are living documents. ISO 45001 has already changed once and is in the middle of a full revision.

• The 2024 climate amendment. In February 2024, ISO published a short amendment to ISO 45001 and many other management system standards. It adds a requirement that, when an organization looks at its context, it determines whether climate change is a relevant issue, and a note that interested parties can have climate-related requirements. For a food plant, relevant issues might include more frequent extreme heat in production areas, storms that disrupt deliveries, or flooding near a distribution centre.
• Guidance documents. ISO 45003, published in 2021, gives guidance on managing psychosocial risks such as excessive workload, harassment and poor organizational change within an OHS management system. ISO 45002, published in 2023, gives general guidance on implementing ISO 45001.
• The revision under way. ISO's committee began revising ISO 45001 in 2024. A draft international standard went out for ballot in early 2026, and the new edition is expected around the middle of 2027. Published commentary on the draft points to stronger treatment of psychosocial health, climate-related risks, new ways of working such as remote and digital work, supply chains and outsourcing, leadership accountability, and the needs of a diverse workforce. Certified organizations are expected to have a transition period of about three years once it is published.

Elena made a practical decision about the revision. Harrowgate Foods Ltd. would build to the current standard and its 2024 amendment, but where the draft signalled a clear direction, especially psychosocial risk, which HSE-401 had already raised at the distribution centre, the company would build that in now rather than retrofit it later.

The national standard

Canada adopted ISO 45001 as a national standard, CSA Z45001, published by CSA Group. The Canadian edition reproduces the international text with a small number of Canadian deviations and notes, mainly to align terms and references with Canadian practice, such as references to Canadian legislation and to the internal responsibility system. CSA Group also publishes an implementation guide. Before CSA Z45001, many Canadian organizations used CSA Z1000, a Canadian OHS management system standard first published in 2006, and some older documents and audit tools still refer to it.

For Harrowgate Foods Ltd., the difference between ISO 45001 and CSA Z45001 is small in practice. Certification bodies in Canada can certify to either. Elena chose to work from CSA Z45001 because its notes refer to Canadian law and to joint health and safety committees, which the company's joint occupational health and safety committees would recognize.

The law comes first

A standard sits on top of the law, never in place of it. Where Nova Scotia's Occupational Health and Safety Act sets a specific requirement, such as a written program, a training duty or a reporting deadline, the organization must meet it whatever the standard says. ISO 45001 itself requires organizations to identify their legal requirements and evaluate compliance with them; lesson 6 covers that process. A company can conform to ISO 45001 and still break the law if its legal register is incomplete. A company can comply with the law and still fail an ISO audit if its system lacks, say, a management review.

In Nova Scotia, much of what a management system requires already appears in law in some form: the general duties of employers and supervisors, the written OHS program required for workplaces with 20 or more employees, the joint committee, hazard assessment duties in specific regulations, and incident reporting. A good system makes those legal elements work as part of one whole.

Conformity, certification and accreditation

Three words cause endless confusion, and it helps to separate them.

• Conformity means that a system meets the requirements of a standard. An organization can claim conformity on its own, after checking itself.
• Certification, sometimes called registration, means that an independent certification body has audited the system and confirmed that it conforms. The certificate usually lasts three years, with surveillance audits at least once a year and a recertification audit at the end.
• Accreditation means that a national accreditation body has checked the certification body itself and found it competent to certify. Certificates from accredited bodies carry more weight with customers.

In Canada, the Standards Council of Canada accredits certification bodies. ISO itself does not certify anyone.

Self-declared conformity can be perfectly valuable. Many organizations use a standard as a framework without ever seeking certification, especially small ones. Harrowgate Foods Ltd. decided to seek certification for the main plant first, because the grocery customer asked for it and because an external audit would keep the project honest, and to extend it to the other sites over two years.

Estimating the effort

The finance director still wanted a number. Elena built a rough estimate of internal effort by element, based on her own experience and on the size of each site, then added external costs for training, a gap assessment and certification audits. She was careful to call it an estimate.

# Rough internal effort to build the system at the main plant (person-days).
effort = {
    "context, scope and policy": 8,
    "hazard and risk process": 40,
    "legal register": 15,
    "training and competence": 25,
    "procedures and controls review": 45,
    "change and contractor processes": 15,
    "monitoring, audit and review": 20,
    "worker participation time": 30,
}
total = sum(effort.values())
print(f"total internal effort: {total} person-days")
print(f"spread over 12 months: about {total / 12:.0f} person-days a month")
for item, days in sorted(effort.items(), key=lambda x: -x[1])[:3]:
    print(f"  largest: {item} ({days} days, {100 * days / total:.0f}%)")

total internal effort: 198 person-days
spread over 12 months: about 16 person-days a month
  largest: procedures and controls review (45 days, 23%)
  largest: hazard and risk process (40 days, 20%)
  largest: worker participation time (30 days, 15%)

The biggest blocks of effort were not writing documents but reviewing how work was actually done and building a working hazard and risk process. Worker participation was budgeted as real time, paid and backfilled. The finance director signed off on the plan with one comment: 'I can see where the money goes. Show me in a year what it bought.'

Reading a standard well

Standards are written in a compressed, careful style that rewards slow reading. Elena gave the project team a short guide to reading ISO 45001 before anyone wrote a procedure.

• 'Shall' means a requirement. Every 'shall' is something an auditor can check. 'Should' is a recommendation, and 'can' or 'may' indicate a possibility or permission.
• Notes and annexes are guidance. Notes under a clause explain intent. Annex A of ISO 45001 gives guidance on using the standard and is often the most practical part, but it does not add requirements.
• Definitions matter. Words like worker, workplace, contractor, risk, hazard, incident and competence have specific meanings in clause 3 that may differ from everyday use. 'Worker', for example, includes people performing work under the organization's control, not only employees.
• Documented information has two kinds. Some clauses require the organization to maintain documented information, meaning keep a document such as a procedure up to date. Others require it to retain documented information, meaning keep records as evidence.
• Most requirements do not require a document. A requirement to 'establish a process' can be met by a process that people understand and follow, recorded only as much as the organization needs.

That last point surprised the team. Several managers assumed that every clause needed a written procedure. In fact, ISO 45001 requires relatively few specific documents and leaves the organization to decide how much documentation it needs to run its processes effectively. Lesson 7 returns to the question of how much to write down.

Other frameworks worth knowing

Safety professionals meet other management frameworks that overlap with the main standards. Process safety management frameworks, used in chemical plants, refineries and facilities with large ammonia refrigeration systems, focus on preventing catastrophic releases and add elements such as process hazard analysis, mechanical integrity and operating procedures. Harrowgate Foods Ltd.'s main plant and distribution centre both have ammonia refrigeration, so Luis Ortega's team already ran parts of a process safety program, which the new system needed to absorb rather than duplicate. Industry codes of practice, insurers' risk engineering guides and customer supplier standards also often borrow the same plan-do-check-act logic.