ISO 45001 and ANSI Z10 Management Systems

Why This Topic Matters

Occupational health and safety management systems (OHSMS) are the backbone of modern safety practice. Instead of reacting to injuries one at a time, a management system provides a structured, repeatable framework that forces an organization to identify hazards, assess risk, set objectives, implement controls, measure performance, and continually improve. The two standards you must know for the ASP exam are ISO 45001:2018 (the international standard) and ANSI/ASSP Z10.0-2019 (the United States national consensus standard). The ASP blueprint under Safety Programs and Concepts expects you to recognize the structure of each standard, the Plan-Do-Check-Act logic that drives both, the role of leadership and worker participation, the hierarchy of controls as each standard presents it, and the practical differences between them. These standards also show up indirectly in questions about auditing, management of change, procurement, contractor safety, corrective action, and performance metrics, so a solid understanding pays dividends across the entire exam.

What a Safety Management System Is

An OHSMS is a set of interrelated elements used to establish an occupational health and safety policy and objectives, and to achieve those objectives. It integrates safety into how the business is run rather than treating it as a separate compliance function. Both ISO 45001 and Z10 are built on the Plan-Do-Check-Act (PDCA) cycle, often attributed to Deming and Shewhart:

Plan: Identify hazards, assess risks and opportunities, establish objectives, and plan actions.
Do: Implement the planned processes and controls.
Check: Monitor, measure, audit, and evaluate performance against objectives and requirements.
Act: Take corrective action and drive continual improvement, then start the cycle again.

Both standards are voluntary consensus standards. Neither is a regulation, although regulators such as OSHA may consider an effective management system as evidence of good faith, and some customers contractually require certification or conformance.

Historical Context

Before 2018 the dominant international OHSMS specification was OHSAS 18001 (first published 1999, revised 2007). It was never a true ISO standard. ISO 45001 was published in March 2018 and OHSAS 18001 was formally withdrawn, with a three-year migration period that was extended to September 2021 because of the pandemic. In the United States, ANSI Z10 was first published in 2005 with AIHA as secretariat, revised in 2012, and then revised again in 2019 with ASSP (American Society of Safety Professionals) as secretariat, which is why the current edition is cited as ANSI/ASSP Z10.0-2019. The 2019 edition was deliberately written to be compatible with ISO 45001 so that organizations can use Z10 as an implementation roadmap while pursuing ISO 45001 certification.

ISO 45001:2018 in Detail

ISO 45001 follows the Annex SL High Level Structure (HLS), the same ten-clause framework used by ISO 9001:2015 (quality) and ISO 14001:2015 (environmental). This common structure allows integrated management systems. The clauses are:

Clause 1 – Scope: Applicability to any organization regardless of size or type.
Clause 2 – Normative References: None (intentionally blank).
Clause 3 – Terms and Definitions: Key terms such as worker, interested party, hazard, risk, OH&S opportunity, incident, nonconformity.
Clause 4 – Context of the Organization: Understand internal and external issues, the needs and expectations of workers and other interested parties, determine the scope of the OHSMS, and establish the system and its processes.
Clause 5 – Leadership and Worker Participation: Top management must demonstrate leadership and commitment, establish the OH&S policy, assign roles and responsibilities, and ensure consultation and participation of workers including non-managerial workers. This clause is the heart of what makes ISO 45001 different from its predecessor.
Clause 6 – Planning: Actions to address risks and opportunities, hazard identification, assessment of OH&S risks and other risks, determination of legal and other requirements, and setting OH&S objectives with plans to achieve them.
Clause 7 – Support: Resources, competence, awareness, communication, and documented information (the ISO term that replaced documents and records).
Clause 8 – Operation: Operational planning and control, eliminating hazards and reducing risks using the hierarchy of controls, management of change, procurement (including contractors and outsourcing), and emergency preparedness and response.
Clause 9 – Performance Evaluation: Monitoring, measurement, analysis, evaluation of compliance, internal audit, and management review.
Clause 10 – Improvement: Incident, nonconformity, and corrective action; continual improvement.

Mapping to PDCA: Clauses 4, 5, 6 and 7 are generally viewed as Plan (with leadership at the center of the whole cycle), Clause 8 is Do, Clause 9 is Check, and Clause 10 is Act.

Key ISO 45001 Concepts You Must Know

Risk-based thinking: ISO 45001 dropped the separate concept of preventive action found in OHSAS 18001. Prevention is built in through identifying risks and opportunities during planning.
Interested parties: Workers, regulators, customers, contractors, suppliers, neighbors, unions, and anyone else who can affect or be affected by the OHSMS.
Worker: Defined broadly to include employees, contractors, agency workers, and anyone performing work under the control of the organization.
Top management: Must take overall responsibility and accountability for preventing work-related injury and ill health; this cannot be fully delegated to the safety manager.
Hierarchy of controls (Clause 8.1.2): Eliminate the hazard; substitute with less hazardous processes, operations, materials or equipment; use engineering controls and reorganization of work; use administrative controls including training; use adequate personal protective equipment. Note that ISO lists five levels.
Documented information: The standard requires certain information to be maintained (documents) and retained (records), but it is less prescriptive about mandatory procedures than older standards.
Certification: ISO 45001 is written in auditable shall language and organizations may obtain third-party certification from an accredited registrar. Certification is not required to use the standard, but it is the main reason many organizations adopt it.

ANSI/ASSP Z10.0-2019 in Detail

Z10 uses a seven-section structure that directly tracks PDCA. A distinctive feature is its two-column format: the left column contains the mandatory requirements (using shall) and the right column contains explanatory guidance labeled with E numbers (for example E3.1.1) that is advisory, not required. The sections are:

Section 1 – Scope, Purpose and Application: Applies to organizations of all sizes and types; purpose is to provide a management tool to reduce the risk of occupational injuries, illnesses and fatalities.
Section 2 – Definitions.
Section 3 – Management Leadership and Employee Participation: Top management establishes the OHSMS, defines the policy, assigns responsibility and authority, provides resources, and ensures effective employee participation including access to information and removal of barriers to participation. This is the Plan foundation and the element Z10 considers most critical.
Section 4 – Planning: Review processes (initial and ongoing), identification and prioritization of OHSMS issues, assessment of risks, legal and other requirements, and establishment of objectives and implementation plans. Also Plan.
Section 5 – Implementation and Operation: Risk assessment, hierarchy of controls, design review and management of change, procurement, contractors, emergency preparedness, education, training and competence, communication, and document and record control. This is Do.
Section 6 – Evaluation and Corrective Action: Monitoring, measurement and assessment; incident investigation; audits; corrective and preventive actions; feedback to the planning process. This is Check.
Section 7 – Management Review: Top management periodically reviews the OHSMS for suitability, adequacy and effectiveness and sets direction for improvement. This is Act.

Key Z10 Concepts You Must Know

Six-level hierarchy of controls: Elimination; substitution; engineering controls; warnings; administrative controls; personal protective equipment. Z10 inserts warnings (signs, alarms, labels) as a distinct level between engineering and administrative controls, which is a frequent exam discriminator versus the five-level ISO and NIOSH models.
Design review and management of change (MOC): Z10 was an early leader in requiring that hazards be addressed in the design stage (prevention through design) and whenever processes, materials, staffing or equipment change.
Procurement and contractors: Safety requirements must be built into purchasing specifications and contractor selection and oversight.
Risk assessment emphasis: Z10 expects a documented risk assessment process and prioritization based on risk level rather than simple compliance.
Not a certification standard: Z10 contains no formal third-party registration scheme. Organizations self-declare conformance, although consultants may perform gap assessments. This is the single most tested distinction from ISO 45001.
Supporting technical reports: ASSP publishes companion guidance (for example TR-Z10 technical reports on implementation, risk assessment and metrics) that provide how-to detail without adding requirements.

Comparing ISO 45001 and Z10

Origin: ISO 45001 is international (ISO, Geneva); Z10 is a U.S. national standard (ANSI accredited, ASSP secretariat).
Structure: ISO uses the 10-clause Annex SL framework; Z10 uses 7 sections mapped explicitly to PDCA.
Certification: ISO is certifiable by accredited registrars; Z10 is not.
Hierarchy of controls: ISO five levels; Z10 six levels including warnings.
Integration: ISO integrates seamlessly with ISO 9001 and ISO 14001; Z10 is compatible with ISO 45001 and often used as a detailed U.S. implementation guide.
Terminology: ISO says worker, interested party, documented information, nonconformity; Z10 says employee, stakeholder less formally, documents and records, and corrective and preventive action.
Leadership: Both place top management at the center; ISO adds a specific emphasis on consultation and participation of non-managerial workers; Z10 emphasizes removal of barriers to employee participation.
Common ground: PDCA, continual improvement, risk assessment, legal and other requirements, competence and training, MOC, procurement, contractors, emergency preparedness, audits, incident investigation, corrective action, management review.

How These Systems Work in Practice

A typical implementation begins with an initial review or gap analysis comparing current practices to the standard. Top management then issues a written OH&S policy that commits to providing safe and healthy workplaces, meeting legal and other requirements, eliminating hazards and reducing risk, continual improvement, and worker consultation and participation. The organization identifies hazards through inspections, job hazard analyses, incident data, worker input and process reviews, then assesses and prioritizes risk (often with a risk matrix combining severity and likelihood). Objectives are set that are measurable and consistent with the policy, and implementation plans assign who does what by when with what resources. Operational controls are selected using the hierarchy of controls. Performance is tracked using both lagging indicators (TRIR, DART, lost workdays) and leading indicators (training completion, near-miss reporting rates, corrective action closure, audit scores). Internal audits verify conformance to the standard and the organization's own requirements; third-party audits (ISO only) verify conformance for certification. Management review examines audit results, incident trends, objective status, changing legal requirements, resource adequacy and interested party concerns, and produces decisions that feed the next planning cycle.

Exam Tips: Answering Questions on ISO 45001 and ANSI Z10 Management Systems

1. Anchor every question in PDCA. If a question asks where an activity belongs, classify it: hazard identification, objectives and policy are Plan; controls, training, MOC, procurement and emergency response are Do; monitoring, audits and incident investigation are Check; corrective action, continual improvement and management review are Act. ISO Clauses 4-7 are Plan, 8 is Do, 9 is Check, 10 is Act. Z10 Sections 3-4 are Plan, 5 is Do, 6 is Check, 7 is Act.

2. Memorize the clause and section numbers. ISO: 4 Context, 5 Leadership and Worker Participation, 6 Planning, 7 Support, 8 Operation, 9 Performance Evaluation, 10 Improvement. Z10: 3 Management Leadership and Employee Participation, 4 Planning, 5 Implementation and Operation, 6 Evaluation and Corrective Action, 7 Management Review. A mnemonic for ISO 4-10 is Can Leaders Plan Safety Operations, Performance, Improvement.

3. Know the certification distinction cold. If an answer choice says an organization obtained third-party certification to Z10, it is wrong. If it says ISO 45001 is a legal requirement, it is wrong. ISO 45001 is voluntary but certifiable; Z10 is voluntary and not certifiable.

4. Count the hierarchy levels. When a question lists warnings as a separate control level, it is referencing Z10. When it lists five levels ending in PPE with engineering and administrative in the middle, it is referencing ISO 45001 or NIOSH. In any hierarchy question, elimination is always the most effective and PPE is always the least effective.

5. Watch the replacement history. ISO 45001 replaced OHSAS 18001, not Z10, not ISO 14001, and not OSHA VPP. ISO 45001 was published in 2018. Z10 current edition is 2019 with ASSP as secretariat.

6. Leadership is the correct answer when in doubt. Both standards hold top management ultimately responsible and accountable. If a question asks who is responsible for establishing the policy, providing resources or conducting management review, the answer is top management, not the safety professional, the committee or the supervisor.

7. Recognize Annex SL vocabulary. Terms such as context of the organization, interested parties, documented information, risks and opportunities and nonconformity signal ISO. Also remember that ISO 45001 removed the standalone preventive action requirement in favor of risk-based thinking, whereas Z10 still speaks of corrective and preventive action.

8. Differentiate audit types. First-party is an internal audit by the organization itself; second-party is by a customer or other interested party; third-party is by an independent registrar for certification. Internal audits are required by both standards; third-party certification audits apply only to ISO 45001.

9. Understand management review inputs and outputs. Inputs include audit results, incident and nonconformity data, status of objectives, changes in legal requirements and interested party needs, resource adequacy and communications from workers. Outputs are decisions on continual improvement, changes to the system, resource needs and new objectives. Questions often ask which item is an input versus an output.

10. Prefer continual improvement answers. Both standards use the phrase continual (not continuous) improvement. When a question asks the ultimate purpose of the management system, choose the option that mentions ongoing improvement of OH&S performance and prevention of injury and ill health rather than merely achieving compliance or passing an audit.

11. Link to related ASP topics. Expect integration questions tying these standards to management of change, prevention through design (ANSI/ASSP Z590.3), risk assessment (ANSI/ASSP/ISO 31000 and Z690), contractor management, leading indicators, and OSHA's Recommended Practices for Safety and Health Programs. The common thread is always a systematic PDCA approach driven by leadership and worker participation.

12. Eliminate absolutes and read for scope. Answer choices with all, only or never are frequently distractors. Both standards apply to organizations of any size and sector, so an option stating that ISO 45001 applies only to manufacturing or that Z10 applies only to large employers is incorrect.

Quick Review Summary

ISO 45001:2018 – international, Annex SL 10 clauses, replaced OHSAS 18001, certifiable, five-level hierarchy, emphasizes context, leadership, worker participation and risk-based thinking.
ANSI/ASSP Z10.0-2019 – U.S. national consensus standard, seven sections mapped to PDCA, not certifiable, six-level hierarchy including warnings, strong on design review, MOC, procurement and contractors, two-column format with explanatory E guidance.
Both – voluntary, PDCA, top management accountability, continual improvement, risk assessment, legal and other requirements, competence, communication, emergency preparedness, internal audits, incident investigation, corrective action and management review.

Master the structure, the vocabulary and the handful of sharp differences, and you will be able to handle any ISO 45001 or Z10 question the ASP exam presents.