In brief
ISO 45001 is an international, voluntary standard for occupational health and safety management systems; it was published in 2018 and replaced OHSAS 18001. The obligations in Law No. 6331, by contrast, are mandatory and are inspected whether or not you hold a certificate. Your existing documents, such as the risk assessment, emergency plan, training records and committee minutes, provide a direct basis for many clauses of the standard; what is usually missing is the management cycle.
What is ISO 45001?
ISO 45001 is a management system standard published by the International Organization for Standardization (ISO) for organisations to manage their occupational health and safety performance systematically. Its full title is "Occupational health and safety management systems: Requirements with guidance for use". The standard was published in 2018 and replaced OHSAS 18001, which had been used for many years; the transition from OHSAS 18001 has been completed. An amendment published in 2024 added the requirement to consider whether climate change is a relevant issue when determining the organisation's context.
The standard describes an OHS management system: it says not what to do, but how to manage it. It does not say "this is how a forklift is inspected"; it says "determine legal and other requirements, assess risks, set objectives, implement, monitor, review and improve". This cycle is based on the Plan-Do-Check-Act (PDCA) logic.
An ISO 45001 certificate, on the other hand, is confirmation through an audit by an independent certification body that you meet the requirements of the standard. Certification is voluntary; you can also apply the standard purely as a management tool without obtaining a certificate.
The difference between ISO 45001 and Law No. 6331
A misunderstanding we often come across is the statement "we have ISO 45001 certification, so we are meeting our OHS obligations". The two are on different levels:
| Subject | Law No. 6331 and regulations | ISO 45001 |
|---|---|---|
| Nature | Mandatory legal rule | Voluntary international standard |
| Scope | All workplaces covered by the Law | Organisations that choose to apply the standard |
| Content | Concrete obligations: assigning a specialist and physician, risk assessment, training hours, examination frequencies, periodic inspections | Management processes: context, leadership, planning, support, operation, performance evaluation, improvement |
| Inspected by | Ministry labour inspectors | Certification body auditors |
| Consequence of non-compliance | Administrative fine, work stoppage | Suspension or withdrawal of the certificate |
ISO 45001 requirements: the 10-clause structure
The standard uses the same high-level structure as ISO's other management system standards. The first three clauses cover scope, normative references and terms; the requirements start at clause 4. ISO 45001 requirements and how they relate to your existing OHS documents in Türkiye:
| Clause | Subject | Existing document or process that can serve as a basis |
|---|---|---|
| 4 | Context of the organisation: internal and external issues, needs of interested parties, scope | Hazard class determination, customer and supplier requirements |
| 5 | Leadership and worker participation: policy, roles, consultation and participation | OHS policy, worker representative, OHS committee minutes |
| 6 | Planning: hazard identification, risks and opportunities, legal requirements, objectives | Risk assessment, annual work plan, list of legislation |
| 7 | Support: resources, competence, awareness, communication, documented information | Training plan and records, vocational training certificates, document archive |
| 8 | Operation: eliminating hazards and reducing risks, management of change, procurement and contractors, emergencies | Action plans, work permits, subcontractor documents, emergency plan and drills |
| 9 | Performance evaluation: monitoring, measurement, evaluation of compliance, internal audit, management review | Periodic inspection reports, workplace measurements, health surveillance, annual evaluation report |
| 10 | Improvement: incidents, non-conformities and corrective action, continual improvement | Accident and near miss records, root cause analyses, approved logbook follow-up |
The order of risk reduction in clause 8 of the standard is the same as the prevention principles in Turkish legislation: first eliminate the hazard, then substitution, engineering controls, administrative controls and, last of all, PPE. See hierarchy of controls.
How can your existing OHS documents serve as the basis for the system?
The documents produced over the years for compliance with Law No. 6331 meet most of ISO 45001's need for "documented information". What is usually missing is the management cycle that links these documents together. A practical route for the transition:
- Carry out a gap analysis. Fill in the table above with your own documents; for each clause write "yes, partly, no".
- Write down the context and scope. Which site, which processes, which interested parties? Customer specifications matter here in the automotive supplier industry.
- Draw up the list of legal requirements. List the laws, regulations and communiqués that apply, together with how they are met in each process. This list is the basis for the standard's evaluation of compliance requirement.
- Set objectives. "No accidents" is not an objective. Choose measurable objectives: the number of near miss reports, compliance with the training plan, the proportion of items in the action plan closed on time, and so on.
- Set up internal audit and management review. OHS committee meetings can be part of this cycle, but they do not automatically replace the review ISO 45001 requires.
- Define management of change. A new machine, a new chemical or a change in layout should automatically trigger a revision of the risk assessment.
How does the certification process work?
If you want to obtain a certificate after setting up the system, the process runs in several stages according to the international rules for certification bodies:
- Choosing a body: Check whether the certification body is accredited for ISO 45001. In Türkiye the national accreditation body is TÜRKAK; your field of activity must also be within the scope of its accreditation certificate.
- Stage one audit: The auditor examines the documentation, the scope, the list of legal requirements and whether the system is ready for audit.
- Stage two audit: It is checked on site that the system is actually being applied; workers, the worker representative and managers are interviewed and records are examined.
- Certificate and surveillance: The certificate is issued after non-conformities have been closed. Regular surveillance audits are carried out during the term of the certificate, and a recertification audit comes at the end of the term.
What the auditor looks at most on site is whether the procedure on paper and practice are the same. If a measure written in the risk assessment is not on the machine, that is a non-conformity.
Common mistakes
- Making the certificate the goal. If the system turns into files prepared for audit week, nothing changes on the shop floor.
- Neglecting legal documents. Passing the certification audit does not mean you will have no shortcomings in a labour inspection; the basic legal documents are a precondition of the system.
- Leaving worker participation on paper. The standard requires consultation and participation of workers as a separate requirement; the representative's signature is not enough, their views must be reflected in decisions.
- Keeping contractors outside the system. Subcontractor and contractor management is part of the operation clause.
Why does it come up in the automotive supplier industry?
In automotive supplier companies in and around Bursa, the question of ISO 45001 can often come from a customer audit or a tender specification. Vehicle manufacturers may also assess their suppliers in terms of OHS performance, and a certified management system may be asked about in that assessment. Read which requirement is being asked for in each customer's own supplier specification; to prepare, see our article on vehicle manufacturer supplier OHS audits. Regional planning notes for companies operating in the OIZs (organised industrial zones) in Nilüfer are on our Nilüfer page, and sectoral risks on our automotive supplier industry page.
In the certification audit, the auditor also looks at whether legal obligations are being met. That is why the basic documents under Law No. 6331 must be complete and up to date before setting up the system: a valid risk assessment, the emergency plan and drill records, training certificates, health surveillance records and periodic inspection reports.
Under our OHS specialist service, we keep your legal OHS documents up to date and, for companies that want to move to ISO 45001, support a gap analysis showing which clauses the existing documents meet. The certification audit is carried out by independent certification bodies.
Frequently Asked Questions
Is an ISO 45001 certificate mandatory?
No. ISO 45001 is a voluntary standard. What is mandatory are the obligations in Law No. 6331 and the regulations. The certificate may be required in a customer or tender specification; in that case the requirement arises from the contract.
What is the difference between OHSAS 18001 and ISO 45001?
ISO 45001 has replaced OHSAS 18001. It uses the same high-level structure as other ISO management system standards, and places more weight on the organisation's context, the leadership of top management and the consultation and participation of workers. The transition from OHSAS 18001 has been completed.
Is a workplace with ISO 45001 certification exempt from labour inspections?
No. The labour inspector inspects the obligations under Law No. 6331 independently of the certificate. The certificate shows that a management system exists; it is not proof that legal obligations have been fulfilled.
Can ISO 45001 be applied together with ISO 9001 and ISO 14001?
Yes. Because all three standards use ISO's common high-level structure, clauses such as context, leadership, document management, internal audit and management review can be combined in a single integrated system. Companies with a quality or environmental certificate can use this common structure to add the OHS clauses to their existing system; the OHS-specific clauses on hazard identification, worker participation and legal compliance must, however, be set up separately.
Can a small business apply ISO 45001?
Yes. The standard can be applied to organisations of any size; the complexity of the system scales with the size and risks of the organisation. In small businesses, existing OHS documents can easily form the basis of the system.
A certified specialist matched to your hazard class: site inspections, approved logbook, training plan, annual plan and report follow-up.
Bursa SİSTEMER OSGB Technical Team — written from the field experience of our OHS specialists and workplace physicians. Legal information is valid as of the publication/update date; contact us for an assessment specific to your business.