ISO 45001 does not tell you to send every employee on one named course. It requires you to decide what competence each role needs for safe work, close any gap, make sure everyone is aware of the essentials, and keep documented evidence that you did. This guide sets out what that means in practice, how to plan and prove it, and where formal courses (for example for auditors or implementers) fit in.
TL;DR
- Clause 7.2 (Competence) and Clause 7.3 (Awareness) are the two training-related requirements. They are separate, and you need to meet both.
- The standard asks for competence through appropriate education, training or experience. It names no mandatory course and no personal ISO 45001 certificate for each worker.
- Certification of the organisation is voluntary and done by independent certification bodies, not by ISO itself.
- Keep documented information as evidence of competence: a training matrix, attendance records, assessments and, where relevant, certificates.
- Courses for internal auditors and implementers are a sensible choice for the people who run the system, not a requirement for everyone.
Table of Contents
- What ISO 45001 actually says about training
- Competence and awareness are not the same thing
- Does every employee need an ISO 45001 certificate?
- How to identify training needs
- What good OH&S training should include
- How to measure whether training worked
- Records and evidence to keep
- Training for the people who run the system
- Our perspective: build competence around real work
- Getting help building a training programme
- FAQ
- Sources
What ISO 45001 actually says about training
The standard does not have a clause called “training requirements”. Training sits inside the support section, where ISO’s preview of the 2018 standard lists Clause 7.2, Competence, and Clause 7.3, Awareness, as separate requirements.
In plain terms, the reproduced text of Clause 7.2 says an organisation must determine the competence needed for workers who affect, or can affect, occupational health and safety performance. It must then make sure those people are competent on the basis of appropriate education, training or experience, and keep documented information as evidence (ISO 45001:2018 text, Clause 7.2). Three things follow from that wording:
- Training is one route, not the only route. Education and experience count too.
- The standard is outcome-based. It cares that people can do the work safely, not how many hours they sat in a classroom.
- Evidence is mandatory. If you cannot show how you decided someone was competent, an auditor has little to go on.
ISO’s own guidance takes the same line. Its practical explainer on ISO 45001 recommends training workers and supervisors as part of building an effective management system, and it does not say that every employee must hold a certificate or complete one named course.
Competence and awareness are not the same thing
Many teams treat these as one box to tick. They are different requirements with different tests.
Competence (7.2) is about ability. Can this person do their job, including the hazardous parts, without harming themselves or others? A forklift driver, an electrician and a warehouse supervisor need very different competence.
Awareness (7.3) is about understanding. According to the reproduced Clause 7.3 text, workers must be aware of the OH&S policy and objectives, their own contribution to the effectiveness of the system, the consequences of not conforming to it, relevant incidents and investigation outcomes, the hazards and risks that apply to them, and their ability to remove themselves from work situations they believe present an imminent and serious danger (ISO 45001:2018 text, Clause 7.3).
The practical difference is that awareness is broader than completing a course. A one-off induction does not satisfy it if workers cannot explain the policy, do not hear about incidents in their area, or would not feel able to stop work.
A quick way to separate the two
| Question | Competence (7.2) | Awareness (7.3) |
|---|---|---|
| Who does it apply to? | Workers whose work affects OH&S performance | All persons working under the organisation’s control |
| What is tested? | Can they perform the task safely? | Do they understand the policy, hazards, their role and their right to withdraw? |
| Typical evidence | Training records, assessments, observed practice, experience | Toolbox talks, briefings, inductions, signed acknowledgements, interviews |
| Typical failure | Role requirements never defined | Message delivered once and never refreshed |
Does every employee need an ISO 45001 certificate?
No. This is the most common misunderstanding behind the keyword. ISO says ISO 45001 certification is voluntary for organisations, is carried out by independent certification bodies, and that ISO itself does not certify organisations (ISO explainer).
So there are really three different things people mean when they say “ISO 45001 certification”:
- Organisational certification. An accredited certification body audits your management system and issues a certificate to the organisation. Optional, though customers or tenders sometimes ask for it.
- Personal course certificates. A training provider issues a certificate of attendance or achievement to an individual, for example for an introduction, implementation or internal auditor course. Useful evidence, but not a universal credential required by the standard.
- Competence records. Your own documented information showing how each person meets the competence you defined. This is what Clause 7.2 asks for.
Note that the standard itself is a voluntary framework. Legal duties on employers, such as those under UK health and safety law, exist separately, and some of them (for example specific training for certain equipment or substances) are far more prescriptive than ISO 45001. Check the legal requirements for your activity first, then use the standard to organise how you meet them.
How to identify training needs
Because the standard asks you to determine the necessary competence, a training needs analysis (TNA) is the natural first step. ISO 45001 does not dictate a method, and ISO’s own guidance for smaller organisations stresses that it provides requirements without a single prescribed way to implement them. You are free to build an approach that suits your size and risks.
A useful reference for what a sound TNA covers is the technical guidance published by the Abu Dhabi Public Health Centre. It is a regional document, not UK law, but its approach is sensible. It says organisations should look at legal requirements, the risk management programme, incident history and the requirements of each task or role, and that the analysis should also take account of the languages spoken and understood in the workforce (ADPHC technical guideline, July 2024).
A practical five-step process
- List roles, not people. Start with job roles and the tasks in each that carry significant hazards, taken from your risk assessments.
- Define the competence for each role. Write down what someone needs to know and be able to do: qualifications, licences, supervised experience, specific safe systems of work.
- Compare against what people actually have. Use certificates, experience, assessments and supervisor observation.
- Choose the action for each gap. Training is one option. Mentoring, reassignment, or hiring or contracting someone who already meets the requirement are also acceptable ways to address a gap (Clause 7.2 guidance).
- Schedule, deliver and check. Put dates against each action and confirm afterwards that it worked.
Include contractors and temporary staff
The awareness requirement refers to workers broadly, not only permanent employees. Agency staff and contractors on your site should know the hazards they will meet and what to do in an emergency. Our practical view is that the induction for visitors and contractors is one of the most audited and most neglected parts of a system. Content on hazard recognition and imminent danger response shows how a short, role-specific briefing can make that expectation concrete for temporary staff.
What good OH&S training should include
The ILO’s guidance for labour inspectors says training programmes should be run by competent persons and reviewed periodically, and that training should be provided at no cost to workers and, where possible, during working hours (ILO guidance on organising OSH management). That gives you a few quality markers beyond the clause text:
- The trainer is competent. An experienced practitioner with real site knowledge beats a slide deck read aloud.
- Content is tied to your hazards. Generic material rarely changes behaviour.
- Timing is fair. Training during paid hours signals that safety is part of the job.
- Comprehension is checked. The ILO guidance also points to evaluating participants’ comprehension and retention, and reviewing programmes with the safety and health committee where one exists.
Topics most organisations cover
Which topics you need depends on your risk profile. Typical building blocks include:
- The OH&S policy, objectives and each worker’s contribution
- Hazard identification and risk assessment for the worker’s own area
- Incident and near-miss reporting, and lessons from past incidents
- Emergency arrangements and the right to remove yourself from imminent danger
- Task-specific safe systems of work, permits and equipment
- Workplace violence, security and behavioural risks where relevant. Our workplace violence prevention and security course and security awareness and threat prevention course are examples of how this topic can be handled in a structured programme.
How to measure whether training worked
Attendance is not effectiveness. The ADPHC guidance suggests assessing effectiveness by setting objectives for the training, measuring results, and gathering trainee feedback (ADPHC technical guideline). In day-to-day terms that can mean:
- A short knowledge check straight after the session
- A supervisor observation of the task a few weeks later
- Trends in near-miss reports and incident rates for the group trained
- Feedback on whether the training matched real work
If the numbers do not move, change the training or look for a cause outside training, such as equipment, supervision or workload.
Records and evidence to keep
Clause 7.2 requires documented information as evidence of competence, and a certificate is one possible record rather than a universal ISO 45001 credential (ISO 45001:2018 text). The ADPHC guidance suggests using a training matrix or plan to track requirements by individual or role, planned dates and completion dates, covering both internal and external training (ADPHC).
A simple matrix usually has these columns:
| Column | Example entry |
|---|---|
| Role or person | Warehouse operative |
| Required competence | Manual handling, emergency evacuation, site induction |
| Evidence held | Course certificate, assessment sheet, supervisor sign-off |
| Date completed | Recorded on completion |
| Next review or refresher | Set by risk and role |
| Gap action | Training, mentoring, reassignment or other |
Keep the records readable by someone outside the team. At an audit, the person asking will not know your shorthand.
Training for the people who run the system
The standard does not require specialist courses, but the people who build and audit the system need skills most workers do not. Three groups typically benefit:
- Implementers, who map your processes to the clauses, run risk assessments and set up documentation
- Internal auditors, who check conformity and effectiveness
- Managers and leaders, who have to show commitment and allocate resources
Provider courses differ in length, format and entry requirements. Some introductory courses assume no prior knowledge, while others recommend familiarity with the common high-level structure used by ISO management system standards. Because this varies, read the prerequisites on the specific course page and ask the provider before you enrol anyone, particularly for auditor-level courses. The audit of a system is also a skill in its own right, so choose a course with practical audit exercises rather than slides alone.
Once a team is qualified, the work is not finished. Competence has to be maintained, so plan refreshers when processes, legislation or equipment change.
Our perspective: build competence around real work
We see the same pattern across the organisations we train. Companies that treat ISO 45001 as a calendar of courses end up with full attendance sheets and the same incidents. Companies that start from the hazards in each role, and define what “good” looks like, end up with shorter, sharper training that people use.
Our view, grounded in how we design programmes:
- Customise the content. A programme built around your own sites, equipment and incident history is more convincing to an auditor and more useful to a worker than an off-the-shelf course.
- Choose the format to fit the work. On-site delivery suits hands-on tasks, online suits dispersed teams and refreshers, and a blended format often works best for mixed audiences.
- Use accredited courses where credentials matter, such as for auditors or for roles that need a recognised qualification, and use internal sessions for site-specific rules.
- Train leaders as well as workers. The standard places expectations on top management, and a supervisor who shrugs at a briefing undoes it.
- Treat records as a by-product. If your matrix is the way you plan the work, evidence takes care of itself.
— Sam
Getting help building a training programme
If you need to turn the clauses into a plan for your own teams, we can help. We design customisable professional training with global accreditation, delivered on-site, online or in a blended format, and we work with corporate teams, HR managers and individual professionals. Browse our professional training courses or see what we run in your area, such as our London training page. If your team also needs project or programme skills to run an implementation, our project management courses are a place to start. Tell us your roles and hazards, and we will shape the programme around them.
FAQ
Is ISO 45001 certification compulsory?
No. ISO states that certification to ISO 45001 is voluntary and is carried out by independent certification bodies. You may still need it commercially if customers or tenders ask for it, but the law and the standard are separate matters.
Do all employees need ISO 45001 training?
All workers need awareness of the policy, their hazards and their role, and anyone whose work affects OH&S performance needs the competence you have defined for their role. That does not have to mean a formal ISO 45001 course for everyone. Induction, toolbox talks and task training can all meet the requirement if you can evidence them.
What records prove competence under ISO 45001?
Clause 7.2 asks for documented information as evidence of competence. Typical records include a training matrix, attendance and assessment records, qualifications, licences and supervisor sign-offs. A certificate is one example, but it is not the only acceptable proof.
Do I need a course before becoming an internal auditor?
The standard does not name a course, but your organisation must be able to show that auditors are competent. Many providers offer internal auditor courses, and entry requirements differ, so check the prerequisites on the course page and ask the provider if you are unsure. Experience and education can also count towards competence.
Sources
- ISO 45001:2018 preview, Clauses 7.2 and 7.3
- ISO 45001:2018 reproduced text
- ISO explainer on ISO 45001
- ILO guidance on organising OSH management
- ADPHC training, awareness and competency technical guideline
- Clause 7.2 competence guidance