ISO 45001 Occupational Health and Safety Management System: 3 Practical Boundaries — Hazard Identification / Worker Consultation and Participation / Procurement and Outsourcing Control — The First 3 Sets of Records a Printing Plant Should Prepare for a Customer Audit
💡 💡 At a Glance
ISO 45001:2018 established 3 practical boundaries for occupational health and safety management systems (equivalently adopted in China as GB/T 45001—2020, replacing GB/T 28001/28002 and succeeding OHSAS 18001). First, hazard identification is not simply a list of “mechanical injuries.” Clause 6.1.2.1 requires a proactive and systematic process covering 4 categories: how work is organized, including social factors such as workload, working hours, harassment, and bullying, together with leadership and organizational culture; routine and non-routine activities and conditions, including the physical environment of infrastructure, equipment, raw materials, and materials, product and service life cycles, human factors, and how work is performed; relevant internal and external historical events and their causes; and potential emergencies. Printing plants should prepare a zone-based identification table, records of non-routine activities such as maintenance shutdowns, color changes, blade changes, forklift traffic, and rainy-season electrical enclosure moisture, and closed-loop records of historical incidents, including ink in the eyes, cuts, and heatstroke that were not classified as work injuries. Second, worker consultation and participation are mandatory, not optional. The 2018 version expressly strengthens this requirement, and auditors commonly ask who the employee representatives are and how they participate. The strongest evidence includes actual consultation records, internal communication evidence, and closed-loop participation in improvement. Documented-information requirements are flexible, so resources should be spent on genuine records rather than attractive procedural documents. Third, procurement, contractor, and outsourcing controls are addressed separately. Printing plants routinely subcontract laminating, hot stamping, die cutting, and slitting, creating real risks. Outsourcing contracts should contain at least 3 sections covering qualifications and occupational health status, site access and working conditions, and incident information feedback. Before a customer audit, prepare the hazard identification and risk assessment register, worker consultation and participation records, and procurement and outsourcing control records.
In September 2026, an export-oriented electronics brand client notified us that their factory audit checklist had added an item: “Please provide your occupational health and safety management system certification.”
Sales brought us the checklist and asked: “We do not have this certificate. Can we still take the order?”
We asked: “Do you currently have ISO 14001?”
Sales replied: “Yes, we renewed it last year.”
We said: “Then it will be easier. ISO 45001 and ISO 14001 use the same management system architecture, the same PDCA logic, and a similar documentation structure. We can supplement the existing system and build it up as much as possible.”
This client is not especially common. More often, clients do not mention ISO 45001. They say, “Please provide proof of occupational health and safety for the workshop,” or “Our auditors need to see your injury records.” These two requests are checking the same type of evidence; the difference is only in the depth of the review.
ISO 45001:2018 is an international standard, equivalently adopted in China as GB/T 45001—2020, replacing GB/T 28001-2011 and GB/T 28002-2011. It replaces the British OHSAS 18001 and, like ISO 9001 and ISO 14001, follows PDCA. This article discusses 3 practical boundaries: when a printing plant receives a customer audit, which 3 sets of records should it prepare first?
Boundary 1: Hazard Identification Is Not Just a List of “Mechanical Injuries”
Clause 6.1.2.1 on hazard identification requires organizations to establish, implement, and maintain a process for proactive and systematic hazard identification. This process must consider 4 categories.
The first category is how work is organized, including social factors such as workload, working hours, harassment, and bullying, which must be considered together with leadership and organizational culture. The second category is routine and non-routine activities and conditions, explicitly including the physical environment of infrastructure, equipment, raw materials, materials, and the workplace; the design, research, development, testing, production, assembly, construction, delivery, maintenance, or disposal of products and services; human factors; and how work is performed. The third category is relevant events that have occurred inside or outside the organization, including emergencies, and their causes. The fourth category is potential emergencies.
When clients ask about this area, it reveals whether the system is genuine or merely cosmetic.
Clients ask: “What hazards are present in your workshop?”
If our answer is, “The main hazards are mechanical injuries from printing presses, die cutters, and folder-gluing machines, as well as solvent evaporation,” the statement is not incorrect, but it covers only a small part of the 4 categories. The standard requires a proactive and systematic process. Systematic means it operates routinely as part of the management system rather than being performed once before the annual audit. Proactive means potential incidents are identified before they occur, rather than only being investigated after an accident.
Therefore, a printing plant should be able to present 3 specific types of evidence: a zone-based identification table covering machines, the solvent room, finishing processes, warehousing, and the waste area; records covering non-routine activities, such as shutdowns during maintenance, color changes during inking, blade changes during die cutting, forklifts moving through the workshop, and electrical enclosure moisture during the rainy season; and closed-loop records of historical events, including minor incidents appearing in customer complaints that were not classified as work injuries.
We particularly emphasize the last category. Many printing plants have clean injury records not because nothing has happened, but because nothing meeting the formal definition of a work injury has occurred. Incidents such as ink splashed into an employee’s eyes, a cut hand while changing a blade, or heatstroke requiring hospital treatment may not enter the injury register, but auditors may learn about them from medical expense reimbursement records or employee interviews. Including such incidents in event management is what “proactive” means in practical terms.
Boundary 2: Worker Consultation and Participation Are Mandatory, Not Optional
An obvious change in GB/T 45001—2020 compared with the previous version is the emphasis on worker consultation and participation. This change is clearly stated in the 2018 version of ISO 45001 and is one of the major enhancements over OHSAS 18001.
The standard addresses this requirement in several places. The continuous improvement clause expressly requires organizations to “promote the participation of workers in the implementation of measures for the continual improvement of the occupational health and safety management system.” Participation requirements also apply to worker competence and awareness, communication, and incident management processes.
During customer audits, one of the most common questions asked by auditors is: “Who are your employee representatives, and how do they participate in the operation of the system?”
Why is this question difficult to answer? Many printing plants have the safety officer prepare registers, obtain a supervisor’s signature, and assemble all the documentation, while the role of employee representative cannot be found in the organization chart or is simply assigned to the safety officer as an additional duty. The standard requires both consultation and participation, and there must be evidence of both from management through to the operational level.
Our recommendation is to prepare 3 types of evidence: actual records of worker consultation and participation, such as feedback collected from workers on a workshop modification plan and which suggestion was adopted; evidence of internal communication, such as shift-start meetings, a safety month, or photographs of hazard reports displayed on the wall; and a closed loop for participation in improvement, documenting which issue an employee reported, how it was addressed, and who verified the outcome.
Clients said: “We are indeed not doing enough of this at present.”
We replied: “Then start with one thing: make hazard reporting genuinely operational. Record how many reports are submitted each month, how many people submit them, and how many are resolved. After 6 months, you will have participation records that demonstrate real activity during the audit.”
There is a pragmatic reason behind this recommendation: purchasing a management system standard is easy, but auditors and customer auditors share one common preference. They are more inclined to trust a system that has imperfections but operates genuinely than a system with polished, complete documentation that has no credible answers when detailed questions are asked.
Boundary 3: Procurement, Contractor, and Outsourcing Controls Are Addressed Separately — Responsibilities Cannot Be Subcontracted with the Process
This is another area refined in the 2018 version: the requirements for procurement control, contractor control, and outsourcing control have been elaborated, and the operational control clauses require organizations to ensure that contractor and outsourced activities conform to the requirements of the occupational health and safety management system.
This requirement is highly relevant to printing plants because subcontracting is routine.
Processes commonly subcontracted by our plant include laminating, hot stamping, die cutting, outsourced processing, and even paper slitting. We may not perform these jobs ourselves, but our employees may work in those environments. Solvent odors in the hot-stamping workshop, noise in the die-cutting workshop, and the occupational health and safety status of the subcontractor are all real risks.
Clients ask: “Is your hot stamping outsourced, or do you do it in-house?”
If it is outsourced, the client will invariably ask: “What is the subcontractor’s certificate of occupational health and safety?”
This is where printing plants often get stuck, because outsourcing contracts usually specify unit prices, delivery schedules, waste rates, and quality standards, while occupational health and safety provisions are left blank.
Our practical recommendation is that outsourcing contracts should contain at least 3 sections. The first covers qualifications and current status, including the subcontractor’s certificates and its own occupational health and safety management status. The second addresses site access and working conditions, specifying who is responsible for environmental protection, occupational safety, and emergency facilities when your employees work at the subcontractor’s premises. The third covers information feedback, requiring the subcontractor to notify you of accidents or serious hazards within an agreed period and allowing you to conduct verification.
Clients asked: “Will adding these provisions to the contract increase costs?”
We replied: “Possibly, but it is far less expensive than another outcome. If an incident occurs, the first question in any accident investigation will always be, ‘Who was responsible for this process?’ Whether the contract contains this wording can mean the difference between a liability determination of several million and several hundred thousand.”
Incidentally, the standard uses more flexible language regarding documentation: the requirements for documented information are more flexible. Auditors will not deduct points merely because you lack a thick manual, but they will deduct points if you cannot produce records. Resources should therefore be invested in “genuine records,” rather than “attractive procedural documents.”
Preparing for a Customer Audit: The First 3 Sets of Records
If time is limited and you can prepare only 3 items, prepare these.
First: The hazard identification and risk assessment register. Organize it by area and activity, cover routine and non-routine activities, identify social and human factors, and document closed-loop follow-up for historical events. This is the most critical document set, and the first audit round will generally focus on it.
Second: Records of worker consultation and participation. Provide at least several concrete examples that can be produced, rather than merely a list of employee representatives. This is the hardest set to prepare at the last minute because the activities must genuinely have occurred.
Third: Procurement, contractor, and outsourcing control records. These should include subcontractor qualifications and occupational health status, site access conditions, and incident information feedback provisions. This set corresponds directly to the area where printing plants are most likely to struggle during audits, because most outsourcing contracts do not include these provisions.
Once these 3 sets are prepared, most remaining questions can be explained on site.
A Message for Clients
Regarding occupational health and safety, the most important message we want to convey to clients is: “Do not buy a certificate first. Build these 3 sets of records first.”
Clients asked: “We are not certified. Will the client refuse to accept us?”
We replied: “Yes. That is precisely why we recommend these 3 sets of records. They form the foundation for certification. Once they are in place, certification merely puts an official stamp on what already exists. If you purchase a certificate first but still cannot answer detailed questions during the audit, you will have spent money twice.”
Further Reading
- 3 Key Occupational Health Indicators for Packaging Printing Plants: VOC / Noise / Dust — The management system addresses management, while indicators establish the minimum limits; both are necessary
- 3 Practical Implementation Blind Spots in Packaging Printing Plants’ ISO 14001 Environmental Management Systems — Implementation experience from another system within the same architecture
- Comparison of 3 Processes for VOCs Emission Control in Packaging Printing Plants — Occupational health and environmental protection converge on the same equipment
- 3 Real Costs and Responsibility Boundaries of Outsourced Finishing Processes in Printing Plants — Subcontracting does not transfer only the process, but also responsibility
FAQ
Can a printing plant without an ISO 45001 certificate accept an order that requires this factory audit?
In most cases, yes, because ISO 45001 is usually a bonus item rather than an automatic disqualification criterion on most customer audit checklists. Typical automatic disqualification criteria include a failed BSCI social responsibility audit, prohibited night-time production during the audit, or site-specific issues such as blocked fire exits. However, 2 matters must be distinguished. First, whether the order can be accepted depends on whether the customer accepts an uncertified supplier. Second, whether the business can be sustained depends on whether the first audit records the absence of the management system as a major nonconformity, which may affect the following year’s reassessment score. We recommend first completing the critical records, then truthfully explaining that the system is in the establishment stage and seeking a corrective action period rather than accepting the audit without preparation.
What is the relationship between ISO 45001 and ISO 14001? Is implementing both burdensome?
Both standards use the same ISO High-Level Structure (HLS). Their core logic is consistent, both are based on PDCA, and their documentation structures are highly similar: clauses 4 organizational context, 5 leadership, 6 planning, 7 support, 8 operation, 9 performance evaluation, and 10 improvement. For printing plants, the practical benefit is that procedural documents and record forms can be shared, allowing one system to support the other. However, their content cannot be copied directly. ISO 14001 focuses on environmental aspects and compliance obligations, while ISO 45001 focuses on hazard identification and occupational health and safety performance. The planning requirements in clause 6.1 differ, so each system requires its own documents.
How far must worker consultation and participation go to comply with the standard?
The standard does not prescribe participation numbers, frequency, or form templates. It requires the organization’s processes to genuinely include mechanisms for consultation and participation and to retain evidence. Auditors typically verify this in 3 ways: reviewing records such as hazard reports, corrective action closures, and meeting minutes; interviewing employees to ask whether they know what has recently changed in the workshop, whether they can submit suggestions, and whether someone follows up on those suggestions; and confirming whether a trade union or employee representatives exist and are formally incorporated into the system. The lowest-cost approach is to create a genuine closed loop for photographed hazard reports and record the monthly number of reports, number of participants, and closure rate. These 3 figures are participation records in themselves.
After a process is outsourced, who is responsible if a work injury or occupational health and safety issue occurs?
Legally, responsibility is determined by employment relationships and site management duties. Contractual provisions cannot override third-party rights, and accident investigations do not rely solely on contracts. However, clear contractual provisions can greatly reduce the printing plant’s exposure during subsequent accountability and corrective action processes. At minimum, the contract should specify the subcontractor’s qualifications and occupational health status, responsibility for labor protection conditions and emergency facilities when your employees work at the contractor’s premises, and the notification deadline for accidents or serious hazards, together with a right to conduct verification. If these 3 sections are entirely absent, the printing plant is left in the weakest position after an incident because it can neither demonstrate that it has fulfilled its management obligations nor clearly establish the conditions at the site.
How detailed should hazard identification be? Will more detailed documentation lead auditors to identify more nonconformities?
The opposite is true. The standard requires a proactive and systematic hazard identification process. The more specific and operationally realistic the documentation, the more readily auditors can confirm that the process operates genuinely. The real risk is a checklist that simply lists every item of workshop equipment, describes every risk as “may cause injury,” and specifies the same measure for all entries: “strengthen training.” In auditors’ eyes, this amounts to no identification because it provides no activity-specific hazards, no non-routine activities, and no review of historical events. It also fails to address work organization, social factors, and human factors. Greater detail also means that measures must actually be implemented; otherwise, unfulfilled measures create another nonconformity.
📚 📚 Related Recommendations
Need a Custom Packaging Solution?
Learn more about packaging, or consult directly for a custom solution and quote