ISO 45003: 7 Questions Before You Start
Across a growing number of jurisdictions, psychosocial risk has stopped being a wellbeing topic and become a regulated one. France requires it in a mandatory assessment document. Sweden regulates workload and working hours directly. Denmark covers the psychological working environment in its statutory workplace assessment. Australia treats it as a hazard within the same risk framework as physical harm. Taiwan names overwork illness in the safety statute itself.
The obvious question for anyone running an international organisation is what you actually do about that, given the requirements are expressed differently in every country and a group cannot maintain a separate approach for each.
ISO 45003 is the most useful answer available, and it is widely misunderstood. Seven questions.
1. What is it?
ISO 45003:2021, occupational health and safety management, psychological health and safety at work, guidelines for managing psychosocial risks. It was developed by the relevant ISO technical committee and published in June 2021.
It gives guidelines for managing psychosocial risk within an occupational health and safety management system based on ISO 45001, with the aim of preventing work-related injury and ill health and promoting wellbeing at work. It applies to organisations of all sizes and in all sectors.
The important framing is in the title: managing psychosocial risk. Not culture, not engagement, not wellbeing benefits. It treats psychological harm as something to be identified, assessed and controlled in the same way as any other hazard.
2. Can you certify to it?
No, and this is the most common misconception.
ISO 45003 is a guidance standard rather than a requirements standard. ISO 45001 contains requirements and is certifiable through accredited certification. ISO 45003 supports it and is not a replacement or a revision of it.
Some assessment bodies offer verification or attestation services referencing the standard, which can be useful, but they are not the same thing as accredited certification to a requirements standard. If a provider offers you "ISO 45003 certification", ask precisely what is being certified and by whom.
The practical consequence is liberating rather than limiting. You can adopt the parts that fit your organisation, at the pace that suits, without an audit programme.
3. What does it treat as a hazard?
Need Expert H&S Guidance?
Our qualified consultants can help you implement the right health & safety measures for your business.
Three categories, and the first is the one that changes how organisations think.
How work is organised. Workload and work pace, working hours and shift patterns, job control and autonomy, role clarity, job security, and the demands placed on people.
Social factors at work. Relationships, supervision, support, recognition, communication, and behaviour including bullying and harassment.
Work environment, equipment and hazardous tasks. The physical setting, and the psychological effects of exposure to difficult conditions or content.
Read the first category against a professional or financial organisation. Workload, hours, control and role clarity are not peripheral to how those firms operate. They are the operating model, which is why psychosocial risk assessment in these sectors tends to produce findings that touch commercial decisions rather than facilities ones.
4. How does it differ from what we already do?
Most organisations arrive with an engagement survey, an employee assistance programme and a wellbeing calendar. Those are worth having and they are not risk management.
The difference is direction. A survey measures how people feel and leaves you to interpret it. A risk assessment identifies specific hazards arising from the work, evaluates who is exposed and how seriously, and requires controls with owners and dates. The standard also emphasises worker participation and top management commitment, and it treats "worker" as always implying worker representatives where they exist, which matters in jurisdictions where those representatives have statutory standing.
For anyone familiar with the HSE Management Standards, the shape will be recognisable: demands, control, support, relationships, role and change. ISO 45003 provides a broader international framework around a similar idea, and EU-OSHA's material on psychosocial risks sets out the European context.
5. Do we need ISO 45001 first?
It helps and it is not a precondition.
The standard is written to sit inside a management system based on ISO 45001, and if you have one, integrating psychosocial risk into it is straightforward and avoids running a parallel process. If you do not, the guidance still works as a structure for building the psychosocial element on its own.
What matters more than certification status is that the outputs live in the same place as everything else: the same risk register, the same action tracking, the same management review. Psychosocial findings held separately from other health and safety findings tend to be reviewed less often and closed more slowly, which is where health and safety consultants and software are worth more together than either alone.
6. Does it satisfy our legal obligations?
Not automatically, and this is the point where international groups most need to be careful.
The standard is guidance, not law, and national requirements are specific. A French entity needs psychosocial risk within its mandatory assessment document in the prescribed form. A Swedish entity works to national rules on organisational and social working environment. A Mexican entity has a dedicated official standard with its own questionnaires and record-keeping. Adopting ISO 45003 does not discharge any of those in itself.
What it does is give you a common methodology beneath them, so that each national instrument is populated from one coherent process rather than five unrelated exercises. That is a substantial practical gain and it is not the same as compliance.
Periodic health and safety audits remain the way to confirm each entity meets its own national test.
7. Where do you actually start?
Four steps, in order, and none requires a budget approval to begin.
Establish scope. Which entities, which populations, and whether contractors and non-employee workers are included. This decision shapes everything after it.
Identify hazards from the work. Not from a survey. Look at how work is allocated, the hours people actually do, the peaks that recur predictably, role clarity, and the situations where people deal with difficult content or difficult people.
Assess and control. Who is exposed, how seriously, what already mitigates it, and what more is reasonably practicable. Controls that change how work is organised sit higher in the hierarchy than controls that help people cope with it.
Review with the same discipline as everything else. Actions with owners and dates, reported alongside your other health and safety measures, so that the psychosocial half is visible to the people accountable for the whole.
The short version
| Question | Short answer | |---|---| | What is it? | Guidelines for managing psychosocial risk, published 2021 | | Certifiable? | No, it is guidance. ISO 45001 is the certifiable standard | | What it covers | Work organisation, social factors, work environment | | How it differs | Risk assessment with controls, not a survey | | Need 45001 first? | Helpful, not required | | Satisfies the law? | No. It gives a common method beneath national requirements | | Where to start | Scope, hazards from the work, assess and control, review |
The row worth dwelling on is the sixth. The value of a common methodology across a group is not that it makes you compliant everywhere. It is that it makes producing each national instrument a matter of formatting rather than starting again.
Where Arinite fits
Arinite works with organisations where the material risks are organisational rather than physical, which describes most office-based businesses and nearly all professional ones. We support 1,500+ businesses across 50+ countries and protect 100,000+ employees, with 95%+ client retention over 15+ years. Our health and safety consultants work extensively with legal, finance and banking and IT and software organisations, where workload and hours are the operating model and therefore the hazard.
Where a group spans several countries, our global health and safety consultants map one methodology onto each national requirement, and our international health and safety consultants confirm what each jurisdiction expects the output to look like. The ILO sets out the international standards that sit behind many of those national frameworks.
If psychosocial risk is currently owned by your wellbeing programme rather than your risk process, a free gap analysis will show you the difference in practice.
Related Articles
Written by
Arinite Health & Safety Consultants
Health & Safety Expert at Arinite
