ISO 45001 Requirements in Saudi Arabia: What the Standard Asks For

ISO 45001 is the international standard for occupational health and safety management systems. It gives an organization a structured way to find hazards, control risks and stop people getting hurt or made ill by their work. If you are thinking about certification, the first thing to understand is what the standard actually requires. This article goes through the main requirements in plain terms.

The standard is about how you manage safety day to day, not about holding a certificate. Auditors want to see that leaders are involved, workers take part, risks are controlled and problems lead to change.

1. Understand your organization and its context

You identify the internal and external issues that affect your safety results, and the needs of workers and other interested parties. That includes legal requirements, industry and client expectations, and the specific risks of your sites and activities. You also define the scope of the system: which sites, activities and people it covers.

2. Leadership and worker participation

Top management has to lead the system, not delegate it. That means setting the safety policy, assigning responsibilities, providing resources and being visible on safety matters. The standard also requires you to consult workers and involve them in decisions, including in hazard identification and incident investigation, at every level, and to remove barriers that stop them taking part. Workers should be able to report hazards and raise concerns without fear of reprisal.

3. Planning: hazards, risks and objectives

You identify hazards, assess the risks and opportunities, and work out which legal and other requirements apply to you. You then set measurable safety objectives and plan how to reach them. When you decide how to control a risk, the standard expects you to work from the top of the hierarchy of controls: eliminate the hazard first, then substitute, engineer it out, use administrative controls, and rely on personal protective equipment last.

4. Support: resources, competence and communication

You provide what the system needs: people, equipment, training and time. Workers must be competent for the tasks they do and aware of the policy, the hazards in their work and what to do when something goes wrong. You also need to control documented information and decide what you will communicate, when and to whom.

5. Operational control

You put controls on the activities that matter. That usually includes safe work procedures, permits for high-risk tasks, equipment maintenance, and management of change so that new equipment or processes are assessed before they start. It also covers contractors and outsourced work, procurement, and emergency preparedness, with plans that are actually tested through drills.

6. Performance evaluation

You monitor and measure safety performance, evaluate compliance with legal requirements, carry out internal audits and hold management reviews. Measures should go beyond injury counts. Leading indicators such as hazard reports, inspections completed and corrective actions closed tell you more about how the system is working.

7. Improvement

When an incident, near miss or audit finding occurs, you investigate, find the root cause, correct it and check that the fix worked. The system as a whole should keep improving, based on what those investigations and reviews show.

ISO 45001 and OHSAS 18001

OHSAS 18001 was the earlier occupational health and safety specification. ISO 45001, published in 2018, replaced it. OHSAS 18001 certificates stopped being valid when the migration period ended in 2021, so an organization that still relies on an old OHSAS 18001 certificate needs to be certified to ISO 45001 to hold a valid one.

The main differences are:

• Leadership: ISO 45001 places clearer accountability on top management for safety performance and culture.
• Worker participation: consultation and participation are explicit requirements, not just good practice.
• Context and integration: the system is tied to your business context and follows the same high-level structure as ISO 9001 and ISO 14001, which makes an integrated management system easier.
• Risks and opportunities: the standard looks at opportunities to improve safety as well as at hazard control.

What certification gives you

Certification means an accredited certification body has audited your system against the standard. It does not by itself prove you meet every Saudi legal requirement, but a working system makes those requirements easier to manage. Companies typically see:

• fewer incidents and lost-time injuries
• clearer control of legal requirements
• better worker engagement on safety
• lower exposure to legal and insurance costs
• evidence for clients who ask contractors about their safety systems

How Qdot helps

Qdot is a consultancy. We assess your current system against ISO 45001, help you build and run it, train your team and prepare you for the audit. The certificate is issued by the certification body you choose. See our ISO 45001 consultancy in Saudi Arabia page, or the awareness and internal auditor training courses. If you are deciding between standards, read ISO 14001 vs 45001 vs 27001.