Ask people outside the safety profession who ISO 45001 is for, and many will picture hard hats and scaffolding. That makes sense, because construction and heavy industry have the most visible hazards. It’s also the reason some office-based, service or public sector organizations assume the standard isn’t meant for them.

In reality, ISO 45001 is written so that any organization can use it. What changes from one sector to another isn’t whether the standard fits, but how deeply each requirement needs to be applied.

This article looks at what the scope of ISO 45001:2018 actually says, how the standard adapts to very different kinds of work, and where its boundaries are.

Quick Answer

Yes, ISO 45001 applies to all industries. ISO describes it as applicable to any organization regardless of size, industry or geographic location. The standard doesn’t set fixed safety targets for any sector. Instead, each organization applies the same requirements to its own risks, so a chemical plant will apply them in far more depth than a small consultancy.

What the Scope of ISO 45001 Says

ISO describes ISO 45001 as “applicable to any organization looking to implement an OH&S management system, regardless of size, industry or geographic location.” The scope clause of ISO 45001:2018 puts it a slightly different way, saying the standard “is applicable to any organization regardless of its size, type and activities.”

The word “type” is worth noticing. It means the standard isn’t limited to private companies. Government bodies, charities, schools, hospitals and service providers can all use it in exactly the same way as a manufacturer.

The scope also explains what the standard is applied to: the OH&S risks under the organization’s control, taking into account the context it operates in and the needs and expectations of its workers and other interested parties.

Why the Same Standard Fits Such Different Work

ISO 45001 works across sectors because it tells you what to manage, not what your results must be. Its scope makes this explicit: it “does not state specific criteria for OH&S performance, nor is it prescriptive about the design of an OH&S management system.”

That’s the key difference from a technical safety rulebook. A rulebook might tell you exactly how high a guardrail must be. ISO 45001 instead asks you to understand your context, involve your workers, identify your hazards, assess your risks, meet the legal requirements that apply to you, control those risks, and keep checking and improving.

Every organization works through that same cycle. The content is what changes. A logistics company will be thinking about vehicles, loading and manual handling. A software firm will be thinking about workstations, workload and lone working. Both are applying the same standard to their own reality.

Applying ISO 45001 in Higher-Risk Industries

In construction, manufacturing, oil and gas, mining, chemicals, utilities and similar sectors, the standard is applied in considerable depth. The hazards are serious and constantly changing, so the system usually puts more weight on a few areas:

• Hazard identification that keeps up with changing tasks, sites and equipment, not just a one-time assessment.
• Contractors and subcontractors, who often carry out a large share of the high-risk work.
• Operational controls such as permits to work, energy isolation and safe systems of work.
• Emergency preparedness for events like fires, falls, releases and serious injuries.
• Managing change, so new equipment, processes or site layouts are assessed before they’re introduced.

These industries also tend to have detailed, sector-specific laws and technical standards. ISO 45001 doesn’t replace any of them. It provides the management framework that helps an organization identify those requirements, meet them and confirm it still does.

Applying ISO 45001 in Lower-Risk Industries

Offices, IT and professional services, education, retail and hospitality still have real OH&S risks. They’re often just less obvious. Common examples include poor workstation set-up, slips and trips, fire safety, driving for work, lone or remote working, violence and aggression from members of the public, and work-related stress.

For these organizations, the requirements are the same but the system can be much lighter. There’s no benefit in copying the procedures of a construction company. A simple, proportionate system that genuinely reflects the organization’s own risks is exactly what the standard intends.

This is also where ISO 45001 can reach beyond basic safety. Its scope notes that an organization can use its OH&S management system to “integrate other aspects of health and safety, such as worker wellness/wellbeing.” Many lower-risk organizations find this is where the standard adds the most value.

Small and Large Organizations Use It Differently

Size doesn’t decide whether ISO 45001 applies, but it does shape how the system looks. A small business might run its system through a handful of documents, a simple risk register and regular conversations with its team, with the owner closely involved.

A large or multi-site organization will need more formal structures: defined responsibilities, a planned internal audit programme and more detailed records. Both are using the same standard.

What Falls Outside the Scope

Applying to every industry isn’t the same as covering every kind of risk. ISO 45001 is about the health and safety of workers and others affected by the organization’s work. Its scope states that it “does not address issues such as product safety, property damage or environmental impacts, beyond the risks to workers and other relevant interested parties.”

In practice, that means a food manufacturer still needs separate arrangements for product safety, and an organization concerned with its environmental performance would look to ISO 14001 rather than ISO 45001. Many organizations run these systems side by side, and CQI and IRCA certified Lead Auditor courses for ISO 9001, ISO 14001 and ISO 45001 reflect that, with each standard covered separately.

Using the Standard Isn’t the Same as Being Certified

It’s easy to blur two ideas here. ISO 45001 applying to your industry doesn’t mean you have to be certified. ISO leaves that choice to each organization, stating that companies “can choose whether they want to go through a certification process or not.”

Certification tends to be requested more often in some sectors, particularly where clients or tenders ask contractors for it. When that happens, the requirement comes from the client or contract, not from the standard. Personal qualifications are a separate matter again, which is why comparisons such as NEBOSH versus an OHSMS Lead Auditor course come up so often in safety careers.

Which Edition Applies Today?

The current edition is ISO 45001:2018, together with its 2024 amendment on climate action. A revised edition is in development, and ISO expects it to replace ISO 45001:2018 in the first half of 2027. Until the new edition is published, organizations in every sector work with ISO 45001:2018.

Conclusion

ISO 45001 applies to all industries because it describes how to manage OH&S, not what every organization’s safety results must look like. A high-risk operation and an office-based business follow the same requirements, but at very different depths. The limits are just as clear: the standard focuses on the health and safety of workers and others affected by the work, and leaves product safety, property damage and environmental impacts to other systems.

If you’re interested in auditing these systems across different sectors, the steps to become a certified ISO 45001 Lead Auditor explain how training, the exam and audit experience fit together.

Frequently asked questions

3FOLD Training is a CQI and IRCA Approved Training Partner (view the CQI IRCA profile). Its CQI and IRCA certified ISO 45001 Lead Auditor course is delivered 100% live online and is open to professionals from many different industries. The course develops individual auditing skills. It doesn’t certify an organization or replace any industry-specific safety qualification.