ISO 45001 Documents Checklist: Safety Policies, Risk Assessments and Records Auditors Ask For

Picture the auditor's first morning at your plant. She does not start on the shop floor. She starts at a table, with a list, and asks to see your file. The scope. The policy. The risk register. The training records. In the next twenty minutes, before a single machine has been inspected, she already has a view of how seriously your safety system is run. That is why the documents matter. They are not paperwork for its own sake. They are the evidence that the system exists when nobody is watching.

Short answer: ISO 45001:2018 requires seven documents you maintain and thirteen records you retain, from the scope and safety policy to the risk register, legal register, training evidence, audit reports and management review minutes. No safety manual is mandatory. A small company can pass with a thin, honest file; a thick, copied file fails the moment the auditor samples it.

What "documented information" actually means

ISO 45001 never uses the words document and record the way older standards did. It uses one phrase for both: documented information. Clause 7.5 then splits it into two jobs, and the split is the whole trick to understanding the checklist.

Some information you maintain. That means the document exists, it is current, and people work to it. The safety policy is maintained. The risk assessment method is maintained. Think of these as recipes. They tell people how the work gets done.

Other information you retain. That means you keep the evidence that something happened. A training attendance sheet is retained. An audit report is retained. Think of these as receipts. They prove the work was done.

One analogy carries the whole idea. A recipe tells the cook what to do; a receipt proves the meal was bought. An auditor wants both kinds of paper, for different reasons. Show her a recipe with no receipts and she will doubt the cooking ever happened. Show her receipts with no recipe and she will doubt anyone knew what they were cooking. Your file needs both, and it needs them to agree with each other.

Clause 7.5 also sets three control rules that apply to everything in the file. Every document needs identification — a title, a date, an author or a reference number. It needs review and approval before use. And it must be available where and when it is needed, protected from accidental change, and reachable by workers and their representatives. A policy locked in the managing director's laptop fails that last test. The workers it protects must be able to see it.

The seven documents you must maintain

These seven are not optional, and no auditor will accept their absence. The clause number is given for each, because auditors cite clauses, and knowing the number lets you answer in their language.

Document	Clause	What it is, in one line
Scope of the safety management system	4.3	Which sites, activities and workers the system covers, and what it leaves out
OH&S policy	5.2	Top management's signed commitments on safety, legal compliance and improvement
Roles, responsibilities and authorities	5.3	Who owns each safety duty, by role rather than by person
Process for addressing risks and opportunities	6.1.1	How risks get found, judged and acted on, end to end
Methodology and criteria for risk assessment	6.1.2.2	The scoring method that turns a hazard into a risk rating
OH&S objectives and plans to achieve them	6.2.2	Measurable targets, with owners, resources and dates
Emergency preparedness and response process	8.2	How the site reacts to fire, spill, injury and other emergencies

What each document must actually contain

The scope (4.3) is one page, and it is the page auditors read first. It names the sites, the activities, the products and the workers covered — including contract workers and visitors where they fall inside the system. If your warehouse sits across the road and is excluded, the scope says so, and says why. A scope that claims everything while the audit finds an unmentioned godown is worse than a narrow, honest scope.

The policy (5.2) must carry three commitments in plain words: a safe and healthy workplace, fulfilment of legal and other requirements, and continual improvement. It must be signed by top management, communicated to workers, and available to interested parties. One page. If it runs to four pages of corporate prose, nobody on the floor has read it, and the auditor knows it.

Roles (5.3) work best as a short table: duty, role, authority. Who can stop work that looks unsafe. Who investigates an incident. Who owns the legal register. Write roles, not names — names change, and a file that names one departed safety officer is out of date the week he leaves.

The risk process and its method (6.1.1, 6.1.2.2) are the heart of the system, and the pair auditors test hardest. The process says how hazards get identified — shop-floor walks, worker reports, incident history, change reviews. The method says how each hazard gets scored: likelihood against severity, on a scale your people can actually use. A five-by-five matrix nobody can explain is a finding waiting to happen. A simple three-by-three scale that every supervisor can apply beats a clever one nobody understands.

The objectives (6.2.2) must be measurable, and each needs a plan: what will be done, what resources it needs, who owns it, and by when. "Reduce accidents" is not an objective. "Cut recordable injuries on the fabrication line from six to three in twelve months, through guarding upgrades owned by the plant head" is one. The auditor will check progress against it at the next visit.

The emergency process (8.2) covers the scenarios that fit your site — fire, chemical spill, electrical incident, serious injury, and whatever else your risk assessment flags. It names response roles, evacuation routes, assembly points, and how drills are run. A drill record with no process behind it proves you once walked outside. The process proves you would know what to do on a bad day.

The thirteen records you must retain

Records are the receipts. The standard names thirteen, and an auditor will sample across them rather than reading every page. Keep them current, dated, and retrievable in minutes — the time it takes you to find a record is itself evidence about how the system runs.

Record	Clause
Risks, opportunities and the actions taken on them	6.1.1
Legal and other requirements	6.1.3
Evidence of worker competence	7.2
Evidence of communications	7.4.1
Plans for responding to emergencies	8.2
Monitoring, measurement and performance evaluation results	9.1.1
Maintenance, calibration or verification of monitoring equipment	9.1.1
Compliance evaluation results	9.1.2
Internal audit programme and audit results	9.2.2
Management review results	9.3
Incidents, nonconformities and actions taken	10.2
Results of corrective action, including effectiveness	10.2
Evidence of continual improvement	10.3

Three of these deserve a closer look, because they are where small companies most often stumble.

The legal register (6.1.3) is a living list of every safety law that applies to you, what it requires, and how you comply. For an Indian factory this usually starts with the Factories Act, 1948 and your state's factory rules, plus the Building and Other Construction Workers Act, 1996 where construction work is involved, and any consent or licence conditions that carry safety duties. Each row needs an owner and a review date. A register last touched two years ago tells the auditor compliance is nobody's current job.

Competence evidence (7.2) is not a folder of certificates. It is proof that each worker can do the safety-critical parts of their job: training records, yes, but also assessments, licences for forklift or crane operation where required, and induction records for new joiners and contract workers. An attendance sheet for a training session nobody understood is a weak record. A short test or a supervised task demonstration is a strong one.

Corrective action effectiveness (10.2) is the record auditors return to again and again. It is not enough to write that a guard was fitted after a near miss. The file must show someone went back, checked the guard was still fitted a month later, and recorded that the fix held. An action with no effectiveness check is an open loop, and open loops are the most common minor nonconformity in safety audits.

What you do not have to write

This surprises most owners, so it is worth saying plainly: ISO 45001 does not require a safety manual. It does not require a written procedure for worker consultation, for document control, for operational control, or for incident investigation — though all of those procedures are useful, and most certified companies have them. The standard requires the seven documents and thirteen records above, plus whatever else your organisation decides is necessary for the system to work.

That freedom cuts both ways. If your hazard controls live only in people's heads, the auditor will ask how a new supervisor learns them, and "we tell them" is a thin answer. Write the procedures your operation actually needs. Leave out the ones that exist only to thicken the file. I have seen a twenty-page manual nobody had opened since the day it was printed, and a six-page set of work instructions, stained and annotated, that passed without a comment. The auditor can tell which one runs the plant.

What an auditor actually asks for

Knowing the list is half the preparation. Knowing how it gets tested is the other half.

At Stage 1, the document review, the auditor reads your seven documents and checks the system is coherent: does the scope match the sites, does the policy match the objectives, does the risk method produce the risk register? Gaps found here are usually fixed before Stage 2, and that is the point of the stage.

At Stage 2, the auditor samples. She picks a hazard from your register and follows it to the shop floor: is the control in place, does the worker know it, is there a record? She picks a law from your register and asks for the compliance evidence. She picks a training record and asks the worker what the training covered. She reads your last management review minutes and checks the actions from it actually happened. A file that is consistent across those jumps passes. A file where the paper says one thing and the floor says another does not, no matter how neat the folders look.

For construction companies, expect the sampling to reach subcontractors: their competence records, their induction, and how your system covers work you do not directly employ. For factories, expect it to reach maintenance and calibration records for safety-critical equipment. Either way, the test is the same: paper, floor, and people agreeing with each other.

How to organise the file

One structure works for companies of every size. Keep a single master folder, physical or digital, with a section per clause: scope and policy, risk, legal, competence, operations and emergency, monitoring and audit, review and improvement. Give every document a version and a date. Keep superseded versions out of circulation — an old risk assessment left on a shared drive will be found, and it will be treated as current.

Name one owner for the file. Not a committee. One person who knows where everything is and can produce any record in minutes. And review the file on a fixed rhythm, not when an audit looms: the legal register quarterly, the risk register after every incident and every change, the objectives at each management review. A file reviewed on schedule stays thin. A file assembled in a panic week grows fat and inconsistent.

If you run quality, environmental and safety systems together, much of this file can be shared — one document control method, one audit programme, one management review — with safety content kept distinct where the standard demands it. That is one of the real savings of an integrated system, and auditors accept shared documents when the safety requirements are visibly met inside them.

Six mistakes that cost companies at audit

• Copying another company's file. The auditor spots it in minutes: hazards your site does not have, laws from another state, objectives nobody owns. A copied file fails the floor test every time.
• Writing the policy nobody signed or saw. An unsigned policy, or one workers have never seen, fails both the document and the awareness test.
• A risk register frozen at certification. New machine, new chemical, new contractor — each one should trigger a register update. A register with no entries after the certification date reads as decoration.
• Training records without competence proof. Attendance is not competence. Add the assessment, however short.
• Corrective actions nobody rechecked. Close the loop with an effectiveness check, or leave the finding open honestly.
• Old versions lying around. One superseded procedure on the shop floor can raise a finding about document control even when the current version is perfect.

What this costs, and how long it takes

Building the file is usually the largest part of getting certified, and it is where consultancy help pays for itself. Our ISO 45001 certification consultancy runs at ₹9,999 for a Standard engagement up to 25 employees and ₹19,999 for Growth up to 100, with the certification body's audit fees extra at actuals. The typical timeline from a standing start is two to four months, depending on how much of this file already exists in usable form. Companies that already run safety meetings, incident records and a legal list are closer than they think; companies starting from a blank page should plan for the longer end.

Use the compliance fee calculator to sanity-check the filing costs around the project, and start with the seven documents before touching anything else. Get the scope honest, the policy signed, and the risk method usable, and the rest of the file builds itself around them.

Frequently asked questions

Do I need a safety manual for ISO 45001?
No. The standard does not require a manual. It requires the seven documents and thirteen records listed above, plus whatever your organisation decides is necessary. A short, used set of procedures beats a long manual nobody reads.

How many documents does ISO 45001 require in total?
Seven documents you maintain and thirteen records you retain, under clauses 4.3 through 10.3. Beyond those, you document what your operation needs for the system to work effectively — no more, no less.

Can a small company with ten workers pass with a thin file?
Yes, if the file is complete and true. Auditors judge whether the system fits the size and risk of the organisation, not the weight of the folder. A ten-person workshop needs the same seven documents, but each one can be short.

What happens if a document is missing at Stage 1?
Stage 1 exists to catch exactly that. The auditor raises it, you fix it, and Stage 2 proceeds. A missing document found at Stage 2, after you claimed readiness, is harder — it can become a nonconformity and delay certification.

How often should the legal register and risk register be updated?
The legal register on a fixed rhythm, at least quarterly, and whenever a law changes. The risk register after every incident, near miss, new process, new machine or new contractor — and at each management review as a minimum.

The file is not the system. The system is what happens on the floor when the auditor is not there. But the file is how the auditor learns whether to believe that, and a thin, honest, consistent file is the fastest way to earn that belief. Build the seven documents first, keep the thirteen records current, and let the audit be a confirmation of work you already do — not a performance you rehearse once a year.