ISO 45001 and the model WHS laws: how the OH&S management standard maps to Australian duties

ISO 45001:2018 is the international standard for an occupational health and safety management system. Australia adopts it identically as AS/NZS ISO 45001:2018. It is the closest thing to a global common language for safety management — and it is not, and cannot be, a substitute for the duties imposed by Australia's model work health and safety laws.

This article maps the two against each other so a PCBU can see exactly where certification helps, where it is silent, and where Australian law demands more.

Does ISO 45001 satisfy Australian WHS law?

No. Certification to ISO 45001 does not discharge any duty under the WHS Act or Regulations, and it is not a defence to a prosecution.

Australia's WHS framework is statutory. Safe Work Australia maintains the model WHS laws — a model Act, model Regulations and model Codes of Practice — but Safe Work Australia does not regulate or enforce them. Each jurisdiction must enact them separately, and the state and territory regulators enforce their own version. See our regulator profile for Safe Work Australia.

The primary duty of care sits at section 19 of the model Act: a person conducting a business or undertaking must ensure, so far as is reasonably practicable, the health and safety of workers and of other persons affected by the business. That duty is not delegable and not satisfied by holding a certificate. Our walkthrough of the primary duty under section 19 sets out what "reasonably practicable" requires, and the state-level obligation is tracked at whs-primary-duty-nsw with equivalents in each jurisdiction.

What ISO 45001 does is provide the management machinery — hazard identification, control hierarchy, competence, consultation, monitoring, incident investigation, review — that helps a PCBU show its duty was discharged systematically. That is a real benefit. It is just not the same thing as compliance.

What ISO 45001 requires

ISO 45001 follows the harmonised management-system structure, with OH&S-specific requirements layered onto clauses 4 to 10. The catalogue entry is ISO 45001:2018; the Australian adoption is listed as AS/NZS ISO 45001:2018.

The requirements that distinguish it from ISO 9001 or ISO 14001:

• Worker consultation and participation as an explicit, resourced requirement, including participation of non-managerial workers.
• Hazard identification on an ongoing and proactive basis, covering work organisation, social factors, leadership and workplace culture — the hook for psychosocial hazards.
• A hierarchy of controls applied in order: eliminate, substitute, engineering controls, administrative controls, personal protective equipment.
• Management of change — assessing OH&S risk before changes to processes, equipment, workforce or legal requirements.
• Procurement and contractor control, including outsourced functions.
• Emergency preparedness and response, with testing.
• Incident and nonconformity investigation with root-cause analysis.

Like the other Type A standards, ISO 45001 carries the 2024 climate action amendment adding climate change to the context clauses — see ISO 45001:2018/Amd 1:2024. For Australian operations the practical relevance is heat, bushfire smoke and extreme weather exposure in the context analysis.

Mapping the standard to the model WHS laws

The mapping is close in structure and different in force. The standard asks you to plan; the Act imposes an outcome.

The last row is the one to internalise. ISO 45001 requires you to have a process for determining and evaluating compliance with legal requirements. It does not tell you what those requirements are. Building and maintaining that legal register is the Australian-specific work — the model Regulations run to hundreds of provisions and each jurisdiction's version differs at the margins.

Where the model WHS laws go further

Four areas where Australian law imposes duties the standard does not reach.

Notifiable incidents. The Act requires immediate notification to the regulator of deaths, serious injuries or illnesses and dangerous incidents, and requires the site to be preserved. There are statutory timeframes and record-keeping periods. Use the WHS incident timer to work the clock, and note that ISO 45001 is silent on any of it.

Psychosocial hazards. The model WHS Regulations were amended to make psychosocial risk management explicit, supported by a model Code of Practice. Australia is ahead of the international standard here in specificity. See psychosocial hazards code of practice, the obligation psychosocial-hazards-code-2024, and the psychosocial hazard assessment tool.

Officer due diligence. The Act imposes a personal duty on officers to exercise due diligence to ensure the PCBU complies. That duty attaches to individuals, has its own six limbs, and cannot be met by pointing at a certified management system.

Industrial manslaughter. Every mainland jurisdiction now has an industrial manslaughter offence, with substantial custodial exposure. Certification is not a defence. See industrial manslaughter laws by state.

Prescriptive hazard-specific duties also sit outside the standard entirely: hazardous chemicals registers and GHS classification (covered in hazardous chemicals classification), plant safety duties under Chapter 5 of the WHS Regulations, asbestos, silica and high-risk work licensing.

Consultation and worker participation: the sharpest difference

This is where an Australian ISO 45001 audit most often diverges from an offshore one.

The model WHS Act creates a statutory consultation architecture: a duty to consult workers who are or are likely to be directly affected, a duty to consult, cooperate and coordinate with other duty holders, and a machinery of health and safety representatives, work groups and health and safety committees with defined powers. HSRs can issue provisional improvement notices and, in prescribed circumstances, direct that unsafe work cease.

ISO 45001 requires consultation and participation of workers, with emphasis on non-managerial workers, and requires the removal of barriers to participation. It does not create representatives with statutory powers. An organisation can be fully conformant with clause 5.4 and still be in breach of its Australian consultation duty if it has not established work groups on request or has obstructed an HSR.

If you operate multi-nationally, treat the Australian consultation regime as an additive requirement in your OH&S management system documentation, not as something clause 5.4 covers.

What auditors check in an Australian ISO 45001 audit

Auditors sample for evidence that the system operates and reflects Australian law.

• The legal and other requirements register, and evidence it is current for the correct jurisdiction. Registers listing a repealed Act, or the model laws rather than the enacted state version, are a common finding.
• Compliance evaluation records — not just the register, but evidence you assessed conformance and acted on gaps.
• Hazard identification records covering work organisation and psychosocial factors, not only physical hazards.
• Hierarchy of controls applied in order, with justification where a lower-order control was selected.
• HSR and committee records, meeting minutes, and evidence issues raised were resolved.
• Contractor and procurement controls, including how you verified competence and licensing for high-risk work.
• Incident investigations with root cause, and evidence the corrective action was verified as effective.
• Emergency plan testing records.
• Management review minutes with the required inputs and resourcing decisions.
• Worker competence and induction records matched to the tasks actually performed.

Certification is evidence, not a defence

A certificate is an assessment by a certification body that, on the days sampled, your OH&S management system conformed to ISO 45001. It is not a regulator finding, it is not a compliance determination, and no Australian WHS regulator treats it as one.

Where certification genuinely helps is in the "reasonably practicable" analysis. That test weighs the likelihood of the hazard, the degree of harm, what the person knew or ought to have known about the hazard and ways to eliminate or minimise it, the availability and suitability of controls, and the cost. A maintained management system produces contemporaneous records of exactly those considerations — the risk assessments, control decisions, review cycles and incident learnings that show the duty was addressed systematically rather than reconstructed after an incident.

Safe Work Australia continues to review the model framework — see its best practice review of the model WHS laws. Keep the legal register under active maintenance, because a certified system built on a stale register audits clean and fails in court. For the broader Australian picture, see the WHS topic hub.