ISO 45001 and ANSI/ASSP Z10 Management Systems

Why This Topic Matters for the CSP Exam

Management systems sit at the heart of the BCSP Certified Safety Professional (CSP) blueprint. The Management Systems domain is one of the most heavily weighted areas on the exam, and ISO 45001 and ANSI/ASSP Z10 are the two reference frameworks BCSP expects you to know cold. Beyond the exam, these standards define how a modern safety professional thinks: safety is not a collection of programs and posters, it is a system that is planned, resourced, measured, audited, reviewed by top management, and continually improved. Questions on this topic rarely ask you to recite a clause number. Instead they test whether you understand the logic of a management system: who is accountable, what comes first, what feeds what, and how a weakness in one element shows up elsewhere. If you understand the Plan-Do-Check-Act (PDCA) cycle and can map both standards onto it, you can reason your way through almost any question in this area.

What a Safety Management System Is

An occupational health and safety management system (OHSMS) is a structured, documented set of interrelated elements an organization uses to establish policy and objectives, identify hazards, assess and control risks, measure performance, and improve over time. The defining characteristics of a true management system, as opposed to a safety program, are:

1. Top management ownership - accountability sits with the highest level of the organization, not the safety department.
2. Worker participation - employees, especially non-managerial workers, are consulted and participate in decisions.
3. Risk-based planning - hazards and risks are identified and prioritized before controls are chosen.
4. The hierarchy of controls - elimination and engineering solutions are preferred over administrative controls and PPE.
5. Performance evaluation - monitoring, measurement, incident investigation, and internal audits.
6. Management review and continual improvement - outputs of evaluation are fed back to leadership, who adjust the system.

Both ISO 45001 and Z10 are built on the PDCA (Deming/Shewhart) cycle: Plan (set policy, identify hazards, assess risk, set objectives), Do (implement controls, train, communicate, manage change), Check (monitor, measure, investigate, audit), Act (management review, corrective action, continual improvement).

ISO 45001:2018 - Overview

Full title: ISO 45001:2018, Occupational health and safety management systems - Requirements with guidance for use.
Published: March 2018 by the International Organization for Standardization. It replaced OHSAS 18001:2007, with a migration period that ended in 2021.
Nature: An international, certifiable standard. Organizations can be audited by accredited third-party registrars and receive certification.
Structure: Follows the ISO Annex SL High Level Structure (now called the Harmonized Structure), which is shared with ISO 9001 (quality) and ISO 14001 (environmental). This shared structure makes integrated management systems straightforward.
Intended outcomes: To prevent work-related injury and ill health and to provide safe and healthy workplaces. The standard does not set specific performance criteria or prescribe how the system must be designed; it specifies requirements and lets the organization decide the means.

The Ten Clauses of ISO 45001

Clauses 1 through 3 are introductory; clauses 4 through 10 contain the auditable requirements.

Clause 1 - Scope. Applicable to any organization regardless of size, type, or activity.
Clause 2 - Normative references. None.
Clause 3 - Terms and definitions. Key terms are defined here (see terminology section below).

Clause 4 - Context of the Organization (PLAN). Determine internal and external issues relevant to the OHSMS, identify the needs and expectations of workers and other interested parties, determine the scope of the OHSMS, and establish the system. This is the why and where of the system.

Clause 5 - Leadership and Worker Participation (PLAN). Top management must demonstrate leadership and commitment, take overall responsibility and accountability for preventing work-related injury and ill health, establish the OH&S policy, assign roles and responsibilities, and ensure consultation and participation of workers. Clause 5.4 requires processes for consultation and participation of workers at all applicable levels and functions, with specific emphasis on non-managerial workers, and requires removal of barriers to participation. The policy must include commitments to provide safe and healthy conditions, fulfil legal and other requirements, eliminate hazards and reduce risks, continually improve, and consult with workers.

Clause 6 - Planning (PLAN). Address risks and opportunities. 6.1.2 requires ongoing, proactive hazard identification considering routine and non-routine activities, human factors, past incidents, emergencies, people in and near the workplace, changes, and work design. 6.1.3 covers determination of legal and other requirements. 6.2 requires measurable OH&S objectives and plans to achieve them (what, resources, who, when, how evaluated). Note: ISO 45001 has no separate preventive action clause; preventive thinking is embedded through risk-based planning.

Clause 7 - Support (DO). Resources, competence, awareness, communication (internal and external), and documented information. The term documented information replaces the older documents and records language of OHSAS 18001.

Clause 8 - Operation (DO). 8.1.1 operational planning and control; 8.1.2 eliminating hazards and reducing OH&S risks using the hierarchy of controls: (a) eliminate the hazard, (b) substitute with less hazardous processes, operations, materials or equipment, (c) use engineering controls and reorganization of work, (d) use administrative controls including training, (e) use adequate personal protective equipment. 8.1.3 management of change (planned temporary and permanent changes: new products and processes, changes to legal requirements, changes in knowledge of hazards, changes in technology). 8.1.4 procurement, including contractors and outsourcing - the organization must ensure outsourced functions and processes are controlled. 8.2 emergency preparedness and response.

Clause 9 - Performance Evaluation (CHECK). 9.1 monitoring, measurement, analysis and performance evaluation, including evaluation of compliance with legal and other requirements. 9.2 internal audit at planned intervals, with auditors who are objective and impartial. 9.3 management review by top management at planned intervals, considering status of previous actions, changes in context, policy and objectives, OH&S performance (incidents, nonconformities, audit results, consultation, risks and opportunities), resource adequacy, communications with interested parties, and opportunities for continual improvement.

Clause 10 - Improvement (ACT). 10.1 general; 10.2 incident, nonconformity and corrective action - react, evaluate the need to eliminate root causes, implement action, review effectiveness, update risk assessments if needed; 10.3 continual improvement of suitability, adequacy and effectiveness of the OHSMS.

What Changed from OHSAS 18001 to ISO 45001

Exam questions sometimes probe these differences:
- Added context of the organization and interested parties.
- Elevated top management leadership - no option to delegate accountability to a management representative.
- Much stronger worker participation and consultation requirements.
- Introduced risks and opportunities (not just risks).
- Explicit coverage of procurement, contractors and outsourcing.
- Replaced preventive action with risk-based thinking.
- Replaced documents and records with documented information.
- Broadened the definition of worker to include contractors, agency workers, and top management.

ANSI/ASSP Z10.0-2019 - Overview

Full title: ANSI/ASSP Z10.0-2019, Occupational Health and Safety Management Systems. It is accompanied by ANSI/ASSP Z10.100-2019, Guidance and Implementation Manual.
History: First published in 2005 as ANSI/AIHA Z10 (AIHA was secretariat), revised in 2012, then revised and republished in 2019 with the American Society of Safety Professionals (ASSP) as secretariat.
Nature: An American National Standard developed through the ANSI voluntary consensus process. It is a voluntary consensus standard, not a regulation, and unlike ISO 45001 it was not written as a certification standard, although organizations may conform to it and some choose third-party assessment. OSHA may reference consensus standards as evidence of recognized practice, and Z10 is often cited as the U.S. benchmark alongside OSHA Recommended Practices for Safety and Health Programs.
Design philosophy: Z10 is written using the mandatory shall in the left column with explanatory guidance in a right-hand column (the Z10.0 standard) and detailed implementation guidance in Z10.100. It is compatible with ISO 45001 and was restructured in 2019 to align more closely with it.

The Sections of ANSI/ASSP Z10.0-2019

Section 1 - Scope, Purpose and Application. Applicable to organizations of all sizes and types; purpose is to provide a management tool to reduce the risk of occupational injuries, illnesses and fatalities.
Section 2 - Definitions.
Section 3 - Context of the Organization. Added in 2019 to align with ISO 45001; understand internal and external issues and interested parties.
Section 4 - Management Leadership and Worker Participation (PLAN). Top management shall establish, direct and resource the OHSMS, define the OHS policy, define responsibility and authority, and ensure effective worker participation. Z10 explicitly requires that barriers to participation be identified and removed and that workers have access to relevant information and are involved in hazard identification, incident investigation, and audits.
Section 5 - Planning (PLAN). A process to identify, assess and prioritize OHSMS issues, including an initial and ongoing review of the current state of the system (hazards, risks, legal requirements, system deficiencies, opportunities for improvement). Based on prioritization, the organization sets objectives and develops implementation plans with resources, responsibilities, and timelines. Z10 stresses risk assessment as the foundation of planning.
Section 6 - Support (DO). Resources, competence, education and training, awareness, communication, and document and record control.
Section 7 - Implementation and Operation (DO). Risk assessment and the hierarchy of controls, design review and management of change, procurement, contractors, and emergency preparedness. The Z10 hierarchy has six levels: (1) elimination, (2) substitution, (3) engineering controls, (4) warnings, (5) administrative controls, (6) personal protective equipment. The inclusion of warnings as a distinct level is a classic exam discriminator between Z10 and ISO 45001.
Section 8 - Evaluation and Corrective Action (CHECK). Monitoring, measurement and assessment; incident investigation; audits; corrective and preventive actions; and feedback to the planning process. Z10 retains preventive action as an explicit element, unlike ISO 45001.
Section 9 - Management Review (ACT). Top management reviews the OHSMS at planned intervals to assess its continued suitability, adequacy and effectiveness, and determines needed changes to policy, objectives, resources, and system elements. Z10 emphasizes that management review outcomes must be communicated and tracked to closure.

Z10 Distinctive Emphases to Remember

- Design review and prevention through design: Z10 explicitly requires that hazards and risks be addressed in the design and redesign of facilities, equipment, materials, and processes, before they enter the workplace. This connects to ANSI/ASSP Z590.3 (Prevention through Design).
- Management of change is paired with design review, covering new or modified processes, materials, equipment, staffing, and organizational changes.
- Initial review: Z10 is explicit that planning begins with an assessment of where the organization currently stands.
- Six-level hierarchy of controls including warnings.
- Feedback loop: evaluation results are formally fed back into planning, closing the PDCA loop.
- Contractors: the organization must ensure contractor safety performance meets its OHSMS requirements and that the organization protects contractor workers from its own hazards.

Side-by-Side Comparison

Origin: ISO 45001 - international (ISO). Z10 - U.S. national consensus (ANSI/ASSP).
Certification: ISO 45001 - designed for third-party certification. Z10 - not written for certification; a voluntary conformance standard.
Structure: ISO 45001 - Annex SL/Harmonized Structure, 10 clauses, integrates with ISO 9001 and 14001. Z10 - 9 sections, PDCA based, two-column format with guidance, aligned to ISO 45001 since 2019.
Hierarchy of controls: ISO 45001 - five levels (elimination, substitution, engineering and reorganization of work, administrative including training, PPE). Z10 - six levels (adds warnings between engineering and administrative).
Preventive action: ISO 45001 - replaced by risk-based thinking and risks and opportunities. Z10 - retains corrective and preventive action.
Terminology: ISO 45001 - documented information, worker, interested parties, nonconformity. Z10 - documents and records, worker (2019; employee in 2012), OHSMS issues.
Common ground: Both require top management accountability, policy, worker participation, hazard identification and risk assessment, legal requirements, objectives, operational controls using a hierarchy, management of change, procurement and contractor controls, emergency preparedness, training and competence, communication, incident investigation, internal audit, corrective action, management review, and continual improvement.

Key Terminology You Must Know

Hazard - a source with the potential to cause injury and ill health (ISO 45001 3.19). OH&S risk - combination of the likelihood of occurrence of a work-related hazardous event or exposure and the severity of injury and ill health that can be caused. Risk (generic) - effect of uncertainty. OH&S opportunity - circumstance that can lead to improvement of OH&S performance. Incident - occurrence arising out of or in the course of work that could or does result in injury and ill health; an incident with no injury is a near miss. Nonconformity - non-fulfilment of a requirement. Correction - action to eliminate a detected nonconformity (fixing the symptom). Corrective action - action to eliminate the cause of a nonconformity and prevent recurrence. Continual improvement - recurring activity to enhance performance. Top management - person or group who directs and controls the organization at the highest level. Worker - person performing work or work-related activities under the control of the organization, including top management, managerial and non-managerial persons, contractors, and agency workers. Interested party - person or organization that can affect, be affected by, or perceive itself to be affected by a decision or activity. Participation - involvement in decision making. Consultation - seeking views before making a decision. Outsourcing - arrangement where an external organization performs part of the organization's function or process. Documented information - information required to be controlled and maintained, and the medium on which it is contained.

How the Systems Work in Practice

Picture the flow in a real facility. Top management (Clause 5 / Section 4) signs a policy committing to eliminate hazards and consult workers, and assigns accountability to line managers. A planning team including hourly workers (Clause 6 / Section 5) walks the plant, reviews injury logs, regulatory requirements, and change logs, and builds a risk register. High risks become measurable objectives with owners and dates. Operations (Clause 8 / Section 7) then applies the hierarchy of controls, screens new equipment through design review and management of change, and writes contractor safety requirements into purchase orders. Support functions (Clause 7 / Section 6) ensure competence, training, communication, and controlled documents. Performance evaluation (Clause 9 / Section 8) tracks leading indicators (inspections completed, near misses reported, training completion) and lagging indicators (TRIR, DART), investigates incidents to root cause, and conducts objective internal audits. Management review (Clause 9.3 / Section 9) brings all of this to top management, who allocate resources and reset objectives (Clause 10 / feedback to planning), and the cycle begins again. A system question on the exam usually describes a breakdown somewhere in this flow and asks you to identify the element that failed or the best next step.

How to Answer Exam Questions on This Topic

Step 1 - Identify the PDCA phase. Read the stem and ask: is this about setting direction and planning (policy, context, hazard identification, objectives), executing (controls, training, MOC, procurement, emergencies), checking (monitoring, audit, investigation), or acting (management review, corrective action, improvement)? The correct answer almost always lives in the same phase as the problem described.

Step 2 - Identify who is responsible. If the question involves accountability, policy, resources, or review of the overall system, the answer is top management, not the safety manager, not a committee, and not a management representative. Both standards are emphatic on this point.

Step 3 - Apply the hierarchy of controls in order. When asked for the best, most effective, or preferred control, choose the highest feasible level: elimination first, PPE last. If a stem mentions Z10 specifically and lists warnings, remember that warnings sit above administrative controls and PPE but below engineering controls.

Step 4 - Distinguish the two standards when the question demands it. Certification, international, Annex SL, ten clauses, five-level hierarchy, documented information, no preventive action - that is ISO 45001. Voluntary U.S. consensus, ANSI/ASSP, design review, six-level hierarchy with warnings, corrective and preventive action, feedback to planning, initial review - that is Z10.

Step 5 - Think in terms of system logic, not programs. If several answers are reasonable, pick the one that addresses the system cause (lack of management review, inadequate hazard identification process, missing MOC) rather than the single symptom (retrain the employee, add a sign). Management systems questions reward answers that prevent recurrence and improve the system.

Step 6 - Watch for sequence questions. Hazard identification precedes risk assessment, which precedes selection of controls. Initial review precedes objective setting. Internal audit results feed management review; management review outputs feed planning. Correction precedes corrective action. Root cause analysis precedes corrective action.

Exam Tips: Answering Questions on ISO 45001 and ANSI/ASSP Z10 Management Systems

Tip 1 - Memorize the clause and section skeletons with PDCA labels. ISO 45001: 4 Context, 5 Leadership and Worker Participation, 6 Planning, 7 Support, 8 Operation, 9 Performance Evaluation, 10 Improvement. A mnemonic: Context, Leadership, Planning, Support, Operation, Performance, Improvement - C-L-P-S-O-P-I. Z10.0-2019: Context, Management Leadership and Worker Participation, Planning, Support, Implementation and Operation, Evaluation and Corrective Action, Management Review.

Tip 2 - Top management is the default answer for accountability questions. Any stem asking who has ultimate responsibility for the OHSMS, who approves the policy, who conducts management review, or who ensures resources points to top management.

Tip 3 - Worker participation is a requirement, not a nicety. Expect questions where an organization has a sophisticated system but failed to involve non-managerial workers in hazard identification, incident investigation, or audits. The deficiency is in the leadership and participation element.

Tip 4 - Know both hierarchies and the one-word difference. ISO 45001 has five levels; Z10 has six because it inserts warnings. If an answer choice places warnings above engineering controls, it is wrong.

Tip 5 - Management review is at planned intervals by top management. Distractors will say annually by the safety committee or whenever an incident occurs. Also know the inputs (audit results, incidents, objectives status, legal compliance, worker consultation, changes, previous review actions) and the outputs (decisions on continual improvement, changes to the system, resource needs).

Tip 6 - Internal audits must be objective and impartial. An auditor should not audit their own work. Audits assess conformity to the organization's own requirements and the standard, and effectiveness of implementation - not just regulatory compliance.

Tip 7 - Correction versus corrective action. Fixing the guard is a correction. Determining why the guard was removed, changing the maintenance procedure, and verifying effectiveness is corrective action. Exam questions often ask which response constitutes true corrective action.

Tip 8 - Preventive action trap. If a question asks which clause of ISO 45001 covers preventive action, the correct response is that ISO 45001 has none as a separate clause; prevention is handled through risks and opportunities in planning. Z10, by contrast, explicitly includes corrective and preventive actions.

Tip 9 - Certification trap. ISO 45001 is certifiable by accredited registrars. Z10 was not written as a certification standard. If a stem describes seeking third-party registration to a globally recognized OHSMS standard, the answer is ISO 45001.

Tip 10 - Contractors and outsourcing are inside the system. Both standards require control of contractors and purchased goods and services. An answer that says contractor safety is solely the contractor's responsibility is wrong.

Tip 11 - Management of change triggers. New or modified equipment, processes, materials, staffing levels, organizational structure, legal requirements, and new knowledge about hazards all trigger MOC. Z10 adds the design review front end. If a stem describes an incident after an unreviewed equipment modification, the failed element is MOC or design review.

Tip 12 - Objectives must be measurable and resourced. Vague objectives such as improve safety culture fail the standard. Correct answers include what will be done, resources, responsibility, completion dates, and how results will be evaluated.

Tip 13 - Leading versus lagging indicators. Both standards expect monitoring of proactive (leading) measures - inspections, training completion, near-miss reports, corrective action closure - as well as reactive (lagging) measures such as injury rates. The best answer for evaluating system effectiveness typically includes leading indicators.

Tip 14 - Legal and other requirements. Legal requirements are only one input; other requirements include corporate standards, customer requirements, voluntary commitments, and consensus standards. Compliance evaluation is part of performance evaluation, not just planning.

Tip 15 - Read for the word that changes the answer. Words like first, best, most effective, primary, ultimately, and according to ISO 45001 versus according to Z10 signal exactly which fact is being tested. Underline them mentally before reading the options.

Practice Questions with Reasoning

Question 1. An organization implementing ISO 45001 has assigned a safety manager to be accountable for the OHSMS and to approve the OH&S policy. Which requirement is most clearly not met?
Answer: Clause 5 Leadership and worker participation. Top management must take overall responsibility and accountability and establish the policy; this cannot be delegated to the safety manager.

Question 2. Under ANSI/ASSP Z10, which control level sits immediately below engineering controls?
Answer: Warnings. Z10 hierarchy: elimination, substitution, engineering controls, warnings, administrative controls, PPE.

Question 3. A plant installed a new conveyor without a formal hazard review; an amputation occurred within a week. Which management system element most directly failed?
Answer: Design review and management of change (Z10 Section 7 / ISO 45001 Clause 8.1.3). The hazard should have been identified and controlled before the equipment entered service.

Question 4. Which of the following best describes the relationship between internal audit and management review?
Answer: Internal audit results are an input to management review; management review uses them to decide on changes and resources for continual improvement.

Question 5. A company wants a globally recognized OHSMS standard against which it can obtain third-party certification and integrate with its ISO 14001 system. Which standard best fits?
Answer: ISO 45001, because it is certifiable and shares the Annex SL Harmonized Structure with ISO 14001 and ISO 9001.

Question 6. After a nonconformity is found in an audit, the supervisor immediately replaces a missing lockout device. According to ISO 45001, what has been completed?
Answer: A correction only. Corrective action requires evaluating the cause, acting to prevent recurrence, and reviewing effectiveness.

Question 7. Which statement about ISO 45001 and preventive action is correct?
Answer: ISO 45001 does not contain a stand-alone preventive action requirement; the concept is addressed through actions to address risks and opportunities in Clause 6.

Quick Recall Summary

- Both standards: PDCA, top management accountability, worker participation, hazard identification and risk assessment, hierarchy of controls, MOC, procurement and contractors, emergency preparedness, competence and training, monitoring and measurement, incident investigation, internal audit, corrective action, management review, continual improvement.
- ISO 45001:2018: international, certifiable, Annex SL, Clauses 4-10, five-level hierarchy, documented information, risks and opportunities, no preventive action clause, replaced OHSAS 18001.
- ANSI/ASSP Z10.0-2019: U.S. voluntary consensus standard, originally 2005 (AIHA), ASSP secretariat, Z10.100 guidance manual, nine sections, six-level hierarchy with warnings, design review and MOC, initial review, corrective and preventive action, feedback to planning, not written for certification.
- On the exam: find the PDCA phase, assign responsibility to top management, climb the hierarchy, fix the system not the symptom, and watch for the words that distinguish ISO 45001 from Z10.