ISO 45001 vs OSHA
This is not a comparison of two standards. ISO 45001:2018 is a voluntary international management system standard published by the International Organization for Standardization and developed by ISO/TC 283, and an accredited certification body can certify an organisation against it. OSHA is the Occupational Safety and Health Administration, a federal agency inside the United States Department of Labor, created by the Occupational Safety and Health Act of 1970. OSHA writes and enforces occupational safety regulations that are legally binding on covered US employers, and it does not certify management systems. So the real question is not which to pick, but how a voluntary standard and a regulator fit together.
What is ISO 45001?
ISO 45001:2018 is titled Occupational health and safety management systems: Requirements with guidance for use. It was published in March 2018, replacing the earlier British document OHSAS 18001, and it uses the harmonised high level structure shared by ISO management system standards. It received the climate action amendment in 2024 alongside the other management system standards.
What it requires an organisation to do:
- Determine the internal and external issues and the interested parties relevant to worker health and safety, and set the scope of the management system.
- Place accountability for worker protection on top management rather than delegating it to a safety officer.
- Consult with and enable the participation of workers, including non managerial workers, in hazard identification, incident investigation and the development of controls.
- Identify hazards, assess occupational health and safety risks, and apply the hierarchy of controls, working from elimination and substitution down to personal protective equipment.
- Determine the legal and other requirements that apply, which in the United States means the applicable OSHA regulations, and evaluate compliance with them.
- Control contractors, outsourced processes and procurement so that people the organisation does not employ are covered.
- Investigate incidents and near misses, take corrective action, and run internal audit, management review and continual improvement.
Certification is voluntary. It is carried out by a certification body accredited by a national accreditation body, through a Stage 1 and Stage 2 audit, and the certificate is valid for three years subject to annual surveillance audits.
What is OSHA?
OSHA is a regulator, not a standard. The Occupational Safety and Health Administration was created by the Occupational Safety and Health Act of 1970 and sits within the United States Department of Labor. Its remit is to set and enforce workplace safety and health requirements for covered employers in the United States, and to provide training, outreach and assistance.
How it operates:
- Regulations. OSHA standards are codified in Title 29 of the Code of Federal Regulations, with Part 1910 covering general industry and Part 1926 covering construction. Separate parts cover maritime and agriculture.
- Legal force. Compliance is mandatory for covered employers. It is not a matter of choice, contract or customer expectation.
- Enforcement. OSHA conducts inspections, including in response to complaints, referrals, injuries and fatalities, and issues citations and monetary penalties for violations.
- The general duty clause. Under the Act, employers must provide a workplace free from recognised hazards likely to cause death or serious physical harm, which allows enforcement where no specific standard applies.
- State Plans. Under section 18 of the Act, states may operate their own OSHA approved occupational safety and health programmes, which must be at least as effective as the federal programme. In those states the state agency, not federal OSHA, is the day to day enforcer.
- Recognition, not certification. OSHA runs the Voluntary Protection Programs, which recognise workplaces with effective safety and health management systems. VPP status is a recognition granted by the agency after an onsite evaluation. It is not an accredited certificate and it is not equivalent to ISO 45001 certification.
OSHA does not audit or certify management systems, does not accredit certification bodies, and does not issue certificates against ISO 45001 or any other standard.
ISO 45001 vs OSHA: side by side
| Attribute | ISO 45001:2018 | OSHA |
|---|---|---|
| What it is | An International Standard for an occupational health and safety management system | A United States federal regulator and the regulations it issues and enforces |
| Issued by | International Organization for Standardization, ISO/TC 283 | Occupational Safety and Health Administration, United States Department of Labor |
| Legal basis | None. It is a voluntary standard | The Occupational Safety and Health Act of 1970 |
| Geographic reach | International | The United States and its territories, subject to State Plans |
| Is compliance optional? | Yes. Adopted by choice or by contract | No. Mandatory for covered employers |
| Where the requirements live | The text of ISO 45001:2018 | Title 29 of the Code of Federal Regulations, notably Part 1910 and Part 1926 |
| How conformity is shown | Accredited third party certification after Stage 1 and Stage 2 audits | Compliance demonstrated during inspection. No certificate is issued |
| Who assesses | A certification body accredited by a national accreditation body | OSHA compliance safety and health officers, or a State Plan agency |
| Consequence of failure | Nonconformity, suspension or withdrawal of the certificate | Citations, monetary penalties and, in serious cases, referral for prosecution |
| Approach | Systems based. Hazard identification, hierarchy of controls, worker participation, continual improvement | Rules based, with the general duty clause covering recognised hazards not addressed by a specific standard |
| Recognition programme | Not applicable | Voluntary Protection Programs, a recognition status rather than a certificate |
| Validity period | Three years with annual surveillance audits | Not applicable. Obligations are continuous |
Which one do you need?
If you employ people in the United States, you do not get to choose. OSHA compliance is a legal obligation and applies whether or not you hold any certificate. ISO 45001 is the voluntary layer you add on top when you want a managed system and independent evidence of it.
- US operations only. OSHA compliance is compulsory. ISO 45001 becomes worth doing when clients ask for it, when you want to move from reactive compliance to a managed system, or when insurers and prime contractors reward it.
- US operations plus international sites or customers. ISO 45001 gives you one framework that works across jurisdictions, with local legal requirements handled inside it, rather than a different safety system per country.
- Non US organisations. OSHA regulations do not apply to you unless you have US operations. ISO 45001 is the recognised route, with your own national health and safety law captured as the legal requirements the system must meet.
Two points that are frequently misunderstood. First, ISO 45001 certification does not exempt an employer from OSHA obligations, inspections, citations or penalties, and it is not a defence against them. Second, ISO 45001 actually requires you to identify and comply with applicable legal requirements, so for a US site the OSHA regulations become part of what the management system is audited against. The two reinforce each other. There is no version of this where certification replaces the regulator.
Frequently asked questions
Is OSHA a certification you can obtain?
No. OSHA is a United States federal agency within the Department of Labor, created by the Occupational Safety and Health Act of 1970. It sets and enforces workplace safety regulations codified in Title 29 of the Code of Federal Regulations. It does not certify organisations or management systems, and there is no such thing as an OSHA certificate for a company. Individual OSHA outreach training courses issue cards to people, but those are training records, not organisational certification.
Does ISO 45001 certification make an organisation OSHA compliant?
No. ISO 45001 certification confirms that a management system meets the requirements of the standard. It does not confirm compliance with any particular set of regulations, and it offers no protection from OSHA inspection, citation or penalty. That said, ISO 45001 requires an organisation to determine the legal requirements that apply and to evaluate compliance with them, so for a US site the OSHA rules are drawn into the system and tested through internal audit.
What is the OSHA Voluntary Protection Programs status and how does it differ from ISO 45001?
The Voluntary Protection Programs recognise workplaces where management and workers have established effective safety and health management systems, following an onsite evaluation by OSHA. It is a recognition status granted by the regulator for a specific site. ISO 45001 is an international standard certified by an accredited third party certification body, not by a regulator, and it is recognised internationally rather than only in the United States.
Do OSHA rules apply outside the United States?
No. OSHA regulations apply to covered employers in the United States and its territories. Organisations elsewhere are governed by their own national occupational safety law. ISO 45001 is designed to work in any jurisdiction, with the applicable local law treated as the legal requirements the management system must identify and meet.
What are OSHA State Plans?
Under section 18 of the Occupational Safety and Health Act, a state may run its own occupational safety and health programme, which OSHA must approve and which must be at least as effective as the federal programme. Where a State Plan operates, the state agency carries out inspections and enforcement in place of federal OSHA, and its standards may in some cases be stricter.
Should a US employer implement ISO 45001 or focus on OSHA compliance?
OSHA compliance is not optional, so it comes first as a matter of law. ISO 45001 is the framework that turns compliance activity into a managed system with hazard identification, worker participation, incident investigation, internal audit and management review. Many US employers implement ISO 45001 because customers or prime contractors ask for it, or because they operate internationally and want one system rather than several.
