Management system guidance
3.0 Terms and Definitions
ISO Navigator Pro™ is a free tool that provides practical, expert guidance for businesses wishing to interpret and better implement the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018.
Our range of ISO templates cover the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018, and offer an easy way to implement your next management system.
3 Terms and definitions
Clause 3 of ISO 45001:2018 defines 37 terms that are used throughout the standard. Many of them, such as ‘worker’, ‘workplace’, ‘consultation’ or ‘incident’, carry a more precise meaning in the standard than in everyday conversation. Misreading them is a common cause of weak procedures and avoidable audit findings, so it is worth taking a little time to understand them before you write procedures or train staff.
Amendment 1:2024 (climate action) did not add or change any definitions, so the vocabulary explained below is current for ISO 45001:2018 incorporating Amendment 1:2024.
Unlike ISO 14001, ISO 45001 does not sort its terms into themed groups; they appear as one flat list numbered 3.1 to 3.37. More than half (21 of the 37) are the common terms shared by all ISO management system standards, such as organization, interested party, requirement, top management, policy, objective, risk, competence, documented information, process, audit, nonconformity, corrective action and continual improvement. Several of these carry extra OH&S notes. The rest are specific to occupational health and safety, and these are what make ISO 45001 distinctive.
How the terms are arranged
Although the standard does not group them, it helps to think of the 37 terms in four clusters:
- People and places (3.1–3.7) – organization, interested party, worker, participation, consultation, workplace and contractor;
- System and direction (3.8–3.17) – requirement, legal requirements and other requirements, management system, OH&S management system, top management, effectiveness, policy, OH&S policy, objective and OH&S objective;
- Harm, risk and opportunity (3.18–3.22) – injury and ill health, hazard, risk, OH&S risk and OH&S opportunity;
- Support, operation, evaluation and improvement (3.23–3.37) – competence, documented information, process, procedure, performance, OH&S performance, outsource, monitoring, measurement, audit, conformity, nonconformity, incident, corrective action and continual improvement.
The key terms explained
The table below explains the terms that cause the most difficulty in practice. The explanations are our own plain-English paraphrase; refer to the published standard for the exact definitions.
| Term | What it means | Why it matters |
| 3.2 Interested party (stakeholder) | Any person or organization that can affect, or be affected by, your decisions or activities, or that believes it is affected. Workers are interested parties too, which is why clause 4.2 names them separately. | 4.2 asks you to decide which other parties are relevant and what they need from your OH&S management system. |
| 3.3 Worker | Anyone carrying out work or work-related activities that your organization controls. It covers paid and unpaid people, whether permanent, temporary, seasonal, casual or part-time, and runs from top management to non-managerial staff. Agency staff and people employed by contractors or external providers can also be workers, to the extent that you control or share control of their work. | Far wider than ‘employee’. Most requirements, including consultation and participation in 5.4, apply to workers in this broad sense. |
| 3.4 Participation 3.5 Consultation |
Consultation means asking for workers’ views before you make a decision. Participation goes further: workers are involved in making the decision itself. Both include working through health and safety committees and workers’ representatives where these exist. | 5.4 lists the topics that need consultation and those that need participation of non-managerial workers. Telling people after the event is neither. |
| 3.6 Workplace | Any place under your organization’s control where a person has to be, or has to go, for work. How far your responsibilities extend depends on how much control you have over that place, so a client’s premises or a public road is treated differently from your own site. | Remember vehicles, home workers, client sites and temporary locations when setting the scope in 4.3 and identifying hazards in 6.1.2. |
| 3.7 Contractor | An external organization that provides services to you under agreed specifications, terms and conditions. Construction work is a typical example, but cleaning, maintenance and security contracts are just as common. | Contractor controls sit in 8.1.4 (8.1.4.2). The contractor’s staff may also be workers under 3.3. |
| 3.9 Legal requirements and other requirements | The laws you are obliged to comply with, plus other requirements you have to, or decide to, comply with, so far as they relate to the OH&S management system. Collective agreements are included, as are the rules that decide who acts as a workers’ representative. | Identified in 4.2, determined in detail in 6.1.3 and evaluated in 9.1.2. Fulfilling them is an intended outcome of the system. |
| 3.11 OH&S management system | The management system, or the part of a wider management system, that you use to deliver your OH&S policy. Its intended outcomes are to prevent work-related injury and ill health and to provide safe and healthy workplaces. ‘OH&S’ and ‘OSH’ mean the same thing. | It should be part of how the business is run, not a separate set of files. See 4.4. |
| 3.12 Top management | The person or group who directs and controls the organization at the highest level. They may delegate authority and provide resources, but they keep ultimate responsibility for the OH&S management system. Where the scope covers only part of an organization, it means the leaders of that part. | Accountability cannot be handed to the safety manager. See 5.1. |
| 3.18 Injury and ill health | Harm to a person’s physical, mental or cognitive condition, including occupational disease, illness and death. The phrase covers injury, ill health or both together. | Mental and cognitive harm, such as work-related stress, sits inside the definition and should be covered by hazard identification. |
| 3.19 Hazard | Anything with the potential to cause injury and ill health. It includes sources of harm, hazardous situations and circumstances in which someone could be exposed to harm. | The starting point of OH&S planning. See 6.1.2. |
| 3.20 Risk 3.21 OH&S risk |
Risk in general is the effect of uncertainty, which can be positive or negative. OH&S risk is narrower: it combines how likely a work-related hazardous event or exposure is with how severe the resulting injury and ill health could be. Where the standard says ‘risks and opportunities’, it means OH&S risks and opportunities plus other risks and opportunities for the management system. | Keep the two apart. OH&S risks and other risks to the system (such as losing a key competent person) are both assessed in 6.1.2 (6.1.2.2). |
| 3.22 OH&S opportunity | A circumstance, or combination of circumstances, that could lead to better OH&S performance, such as adopting safer equipment or redesigning a task to remove manual handling. | Assessed under 6.1.2.3 and acted on through 6.1.4. |
| 3.24 Documented information | Information you need to control and maintain, together with whatever it is held on, in any format. ISO 45001:2018 still separates documents you ‘maintain’ from records you ‘retain as evidence’. | You can keep calling them procedures and records. See 7.5. |
| 3.28 OH&S performance | How effective you are at preventing injury and ill health to workers and providing safe and healthy workplaces. It can be measured in numbers or described in words. | Improving OH&S performance is the first intended outcome. Monitored under 9.1.1. |
| 3.29 Outsource | Arranging for an external organization to carry out part of one of your functions or processes. The external organization sits outside your system scope, but the outsourced function or process stays inside it. | ISO 45001:2018 still uses this term. Controls are covered in 8.1.4 (8.1.4.3). |
| 3.35 Incident | An event arising out of, or during, work that results, or could result, in injury and ill health. One that causes harm is often called an accident; one that causes no harm but could have is often called a near miss, near hit or close call. An incident can happen even when no requirement has been broken. | Incidents and nonconformities are managed together in 10.2. |
| 3.36 Corrective action | Action to remove the cause or causes of a nonconformity or an incident so that it does not happen again. ISO 45001 extends the common definition to include incidents. | Different from immediate containment such as fencing off a spill. See 10.2. |
| 3.37 Continual improvement | A recurring activity to improve performance. In ISO 45001 this means using the system to improve overall OH&S performance in line with your policy and objectives. It need not happen everywhere at once or without a break. | See 10.3. |
Key words clarified in Annex A.3
Annex A.3 explains several everyday words that carry a specific meaning in the requirements. In summary:
- Continual – improvement takes place over time with pauses between, which is why the standard avoids ‘continuous’;
- Consider and take into account – both mean you must think about the topic, but something you ‘consider’ may be excluded, while something you ‘take into account’ may not;
- Appropriate and applicable – ‘appropriate’ means suitable and leaves room for judgment; ‘applicable’ means that if a requirement can be applied, it must be;
- Interested party and stakeholder – the two words mean the same thing;
- Ensure – the task can be delegated, but accountability for making sure it happens cannot;
- Maintain and retain – ‘maintain documented information’ refers to documents, including procedures, while ‘retain documented information as evidence’ refers to records. It does not mean records must satisfy legal rules of evidence;
- Shared control – activities where you share control of the means or methods of work, or share direction of the work, as far as OH&S performance is concerned. Multi-employer sites and principal contractor arrangements are typical examples.
Annex A.3 also recognizes that some organizations must use terms required by law or by other requirements. That is acceptable, provided the organization still conforms to ISO 45001.
Applying clause 3 in practice
- Add a short glossary to your OH&S manual and induction material so that people use worker, hazard, OH&S risk, incident, nonconformity and corrective action consistently;
- Check that your consultation and participation arrangements really involve workers in decisions where the standard expects participation, rather than simply informing them;
- Make sure your risk assessments separate hazards (the source of harm) from OH&S risks (likelihood combined with severity), and that other risks to the management system are recorded separately;
- Review incident forms so that near misses are captured as incidents, not ignored because nobody was hurt;
- Confirm that your definition of ‘worker’ in procedures includes agency, temporary and contractor staff where you control or share control of their work;
- If you run an integrated management system, align your glossary with ISO 9001 and ISO 14001, but note that ISO 45001:2018 keeps terms such as ‘outsource’, ‘risk’ and ‘maintain/retain’ that the 2026 editions of those standards have changed.
You should seek and record evidence that the people responsible for the OH&S management system understand the key terms, that workers and their representatives understand what consultation and participation mean in practice, and that your documented information uses terms such as worker, hazard, OH&S risk and incident consistently and correctly.
More information on PDCA
Planning
Context
Planning
Support
Doing
Support
Operations
Checking
Monitoring, measurement, analysis and evaluation
Acting
Improvement
Want to know more?
- Read our customer's feedback
- Client list - who's using our templates?
- How the templates are formatted and download examples
- Why we use turtle diagrams and process maps
- What's the difference between a process and a procedure?
- About documented information
SSL certification
A certificate guarantees the information your internet browser is receiving now originates from the expected domain - https://www.iso9001help.co.uk. It guarantees that when you make a purchase, sensitive data is encrypted and sent to the right place, and not to a malicious third-party.
Free PDCA guidance
ISO Navigator™ is our FREE online training tool that shows you how to apply the principles of PDCA to your operations. We also offer many helpful templates that get you on the road to documenting your management system, please visit the download page.