On this page
The short version
- Clause 6.1.2.1 a) mandates identifying social factors including workload, work hours, harassment, bullying, leadership, and organisational culture.
- ISO 45001 explicitly protects both physical and mental health by defining injury and ill health to cover cognitive conditions.
- Organisations must apply the hierarchy of controls to mitigate psychosocial risks through work reorganisation and administrative safeguards.
- Internal auditors must gather evidence through worker interviews, workload data, shift patterns, and anti-harassment reporting mechanisms.
Background, Regulatory Context, and Affected Roles
ISO 45001 establishes a comprehensive framework for managing occupational health and safety by addressing both physical and mental well-being. The standard explicitly states in its introduction that organisations are responsible for promoting and protecting the physical and mental health of workers. Clause 6.1.2.1 a) embeds this requirement into planning by mandating that hazard identification processes take into account social factors, work organisation, leadership, and organisational culture. Quality managers, compliance leads, and internal auditors must understand how to evaluate these non-physical risks to ensure full management system compliance.
This regulatory scope affects top management, line managers, human resource teams, safety representatives, and non-managerial workers. Traditional occupational health and safety frameworks focused primarily on physical workplace hazards such as machinery, trips, or chemical exposures. ISO 45001 broadens this operational scope by recognising that social hazards directly impact worker health and safety performance. Internal auditors must evaluate whether hazard identification processes proactively capture psychosocial risks alongside traditional physical hazards.
Technical Nuances of Psychosocial Hazard Identification
Clause 3.18 defines injury and ill health as an adverse effect on the physical, mental, or cognitive condition of a person. This definition links mental and cognitive harm directly to workplace hazards under Clause 3.19. Clause 6.1.2.1 a) explicitly requires that organisations must identify hazards arising from work organisation and social factors, including workload, work hours, victimisation, harassment, and bullying. Furthermore, Annex A.6.1.2.1 clarifies that hazards can be psychosocial and emphasises that human factors must be considered across all routine and non-routine work activities.
Organisations must systematically assess how leadership practices and cultural factors create or exacerbate psychosocial risks. Under Clause 6.1.2.2, organisations must assess OH&S risks from identified psychosocial hazards while considering the effectiveness of existing operational controls. Annex A.8.1.2 demonstrates how the hierarchy of controls applies to social hazards. Organisations must eliminate hazards where practicable, such as by removing monotonous work or work causing negative stress, whereas organisations may select appropriate administrative controls such as training to prevent bullying and harassment.
Operational Controls and Audit Evidence Matrix
Internal auditors must gather multi-faceted audit evidence to verify that psychosocial hazard identification is ongoing and proactive. Relying solely on standard physical safety checklists is insufficient to demonstrate conformity with Clause 6.1.2.1 a). Auditors must inspect documented information, including risk assessment methodologies, shift logs, turnover data, and formal reporting records for harassment or victimisation. Furthermore, auditors must conduct direct interviews with non-managerial workers to confirm that psychosocial concerns are reported without fear of retribution under Clause 5.1 k).
| Focus Area | Clause Reference | Mandatory Requirement or Guidance | Core Audit Evidence |
|---|---|---|---|
| Work Organisation & Workload | Clause 6.1.2.1 a), Annex A.8.1.2 c) | Reorganise work to avoid excessive workload and unhealthy work hours | Work schedules, overtime logs, staffing plans, risk assessments |
| Social Factors & Harassment | Clause 6.1.2.1 a), Annex A.8.1.2 d) | Establish administrative controls and training to prevent bullying | Harassment policies, training records, victimization report logs |
| Leadership & Organisational Culture | Clause 5.1 j), Clause 6.1.2.1 a) | Top management must lead and promote a supportive safety culture | Management review outputs, worker survey data, leadership communications |
| Protection From Reprisals | Clause 5.1 k), Clause 5.4 c) | Protect workers from reprisals when reporting hazards and barriers | Anonymous reporting channels, reprisal policy review, worker interviews |
What to do now
- Update hazard identification procedures to explicitly include social factors, workload, work hours, bullying, harassment, and leadership culture.
- Evaluate operational control measures to verify that work reorganisation and administrative controls effectively address identified psychosocial hazards.
- Review incident investigation processes under Clause 10.2 to confirm that root cause analysis considers work organisation and fatigue factors.
- Sample training and awareness records to ensure workers understand reporting arrangements for victimisation and psychosocial concerns without fear of retribution.
- Conduct worker interviews during internal audits to assess whether actual working hours, shift patterns, and workloads align with documented risk assessments.
Reference documents
- BS ISO 45001:2018 Occupational health and safety management systems — Requirements with guidance for use
Manage this work in 4Auditee
Keep audit plans, problems, corrective actions and document versions in one place. See the records behind each change and decision.
Book a demo