ISO 45001:2018 is the international standard for occupational health and safety management systems. Its aim is to prevent work-related injury and ill health.

What the standard is for

ISO 45001 gives an organisation a framework to provide safe and healthy workplaces, prevent work-related injury and ill health, and improve its occupational health and safety performance. It covers employees, contractors and others who work under the organisation’s control.

Key requirements

• Leadership and accountability of top management
• Consultation and participation of workers
• Hazard identification and assessment of risks and opportunities
• Legal and other requirements
• Operational controls, management of change, and control of contractors and procurement
• Emergency preparedness, incident investigation, audit and improvement

The hierarchy of controls

When a risk needs to be reduced, the standard expects controls to be chosen in order: eliminate the hazard; substitute with something less hazardous; use engineering controls; use administrative controls such as procedures and training; and only then rely on personal protective equipment.

Steps to certification

Start with a baseline review of hazards, incidents and legal requirements. Involve workers from the beginning, not only at the end. Build the system, run it long enough to have records, complete an internal audit and a management review, and then invite the certification body. The structure matches ISO 9001 and ISO 14001, which makes an integrated system straightforward.

ISO 14001 is the international standard for environmental management systems. It helps an organisation control its environmental impacts, meet legal obligations and improve performance.

What the standard is for

ISO 14001 sets out the requirements for a system to manage an organisation’s interaction with the environment: the resources it uses, the emissions and waste it produces, and the risks of pollution. It does not set performance levels; the organisation sets its own objectives in line with its legal obligations and its policy.

Key requirements

• Understand the context and the needs of interested parties
• Identify environmental aspects and decide which are significant, taking a life-cycle perspective
• Determine compliance obligations and evaluate compliance
• Set objectives and plan how to achieve them
• Control operations and prepare for emergencies
• Monitor, audit and review performance, and improve

Benefits

• Lower energy, water and waste costs
• Evidence of legal compliance
• Meeting customer and tender requirements
• Fewer incidents and a clearer response when they happen

Steps to certification

Carry out an initial environmental review and a legal register, define the scope, and build the system around your real operations. Operate it for long enough to have monitoring data, an internal audit and a management review before the certification audit. ISO 14001 shares its structure with ISO 9001 and ISO 45001, so the three can be run as one integrated system.

Retailers and manufacturers increasingly ask suppliers for a GFSI-recognised certificate. This guide explains what GFSI is, which schemes it recognises and how to choose one.

What is GFSI?

The Global Food Safety Initiative is an industry collaboration that sets benchmarking requirements for food safety certification programmes. A programme that meets them is “GFSI-recognised”. The aim is that a certificate from one recognised programme is accepted by many buyers, which reduces duplicate audits.

Which scheme should you choose?

• Ask your customers first. Some retailers specify a scheme.
• BRCGS Food Safety is a prescriptive standard with detailed site and process requirements, widely requested by UK and international retailers.
• FSSC 22000 is built on ISO 22000 and sector prerequisite programmes, and integrates easily with ISO 9001 and ISO 14001.
• IFS and SQF are common in parts of Europe and in North America respectively.

The route to certification

• Gap analysis against the chosen standard
• Senior management commitment and a food safety team
• Prerequisite programmes and the HACCP-based plan
• Food defence, food fraud and food safety culture plans
• Internal audit and management review
• Certification audit by an approved certification body, then closing any nonconformities

Common pitfalls

Starting documentation before the site standards are fixed, underestimating the time needed for records to build up before the audit, and treating culture and fraud requirements as paperwork. Plan for several months of operating the system before the certification audit.

HACCP is the international method for controlling food safety hazards. HARPC is the preventive-controls approach required by US law for most food facilities. Exporters to the United States need to understand both.

HACCP in brief

Hazard Analysis and Critical Control Points is built on seven principles: hazard analysis, critical control points, critical limits, monitoring, corrective action, verification and record keeping. It is the basis of ISO 22000 and of the GFSI-recognised schemes.

HARPC in brief

Hazard Analysis and Risk-Based Preventive Controls is the approach set by the FSMA Preventive Controls for Human Food rule. Facilities that must register with the US Food and Drug Administration need a written food safety plan prepared, or overseen, by a preventive controls qualified individual (PCQI).

The main differences

• Origin: HACCP is an international Codex method; HARPC is a US legal requirement.
• Hazards: HARPC explicitly adds radiological hazards and hazards introduced intentionally for economic gain.
• Controls: HACCP focuses on critical control points; HARPC requires preventive controls for process, allergens, sanitation and the supply chain, whether or not they are CCPs.
• Limits: HACCP sets critical limits at CCPs; HARPC uses parameters and values where they apply.
• Other elements: HARPC requires a written recall plan and reanalysis of the plan at least every three years.

Which one do you need?

If you supply the US market, your importer will expect a plan that meets the preventive-controls rule. If you already have a sound HACCP system, extend it rather than starting again: review the hazard analysis, add the missing preventive controls and the recall plan, and make sure a qualified individual oversees it.

A HACCP plan can pass an audit and still miss the point. Risk-based thinking means spending most of your effort on the hazards most likely to harm consumers.

Compliance is not the goal

Many HACCP plans are written to satisfy an auditor: long hazard tables, generic controls and critical limits copied from a template. The plan looks complete, yet the team cannot say which three hazards worry them most. Risk-based thinking starts from that question.

What risk-based thinking looks like

• Hazard analysis that uses real data: complaints, recalls in your sector, supplier performance, environmental monitoring results
• A clear ranking of hazards by likelihood and severity
• Controls matched to the risk: critical control points, operational prerequisite programmes or prerequisite programmes
• Validation that the control can actually achieve the limit
• Root cause analysis when something goes wrong, not only correction

Use your data

Monitoring records show that checks were done. Trends show whether the process is drifting. Review deviations, near misses and verification results together, and ask whether resources still match the risk. If most of the team’s time goes to low-risk paperwork, the system is out of balance.

Culture makes it work

Operators need to understand why a control matters, and managers need to respond well to bad news. A site where problems are reported early has a better food safety outcome than one with a perfect file.

Annual GMP refresher training is often the session everyone forgets. Short, practical and site-specific sessions change behaviour far more than slides.

Why refresher training matters

Good manufacturing practice depends on what people do when nobody is watching: washing hands, wearing protective clothing correctly, keeping allergens apart, reporting problems. Knowledge fades and shortcuts creep in, which is why standards expect training to be refreshed and its effectiveness checked.

Make it practical

• Run short sessions of 20 to 30 minutes on one topic each, at the line where possible
• Use photographs from your own audits and ask the team to spot what is wrong
• Walk the site in small groups and let operators audit an area they do not work in
• Use real complaints and near misses as case studies
• Give supervisors the role of trainers; they set the daily standard

Topics worth refreshing

• Personal hygiene and handwashing
• Allergen handling and changeovers
• Foreign-body controls, including glass and knives
• Cleaning and inspection after cleaning
• Pest awareness and what to report to the pest control contractor
• Why records must be completed at the time of the check

Check that it worked

Combine a short knowledge check with observation on the floor in the following weeks, and track the related findings in internal audits. If the same issue returns, change the training method rather than repeating the session.

GFSI-recognised schemes require a documented food fraud vulnerability assessment and a mitigation plan. Here is what they expect and how to build one.

What counts as food fraud?

Food fraud is the intentional substitution, dilution, addition, mislabelling or misrepresentation of food, ingredients or packaging for economic gain. The motive is profit, not harm, but the result can still be a food safety hazard, for example an undeclared allergen or a toxic adulterant.

What the standards require

A documented vulnerability assessment covering raw materials and, where the scheme requires it, the wider supply chain; a mitigation plan for the significant vulnerabilities; and a review at defined intervals and when new information appears.

Building the assessment step by step

• List materials and group them sensibly
• Gather information: history of fraud, price and availability, how easy the material is to adulterate, and the length and transparency of the supply chain
• Rate each material for likelihood of fraud and likelihood of detection
• Decide mitigation for the high-rated ones: supplier approval and audits, certificates of analysis, targeted testing, changes to specifications or sourcing
• Record the decisions and who made them

Keeping it alive

Review the assessment at least annually, and sooner after a price shock, a shortage, a new supplier or a published fraud alert. Train purchasing staff as well as the food safety team: they see the commercial signals first.

Remote audits are now a normal part of food safety assurance. They work well when the technology, the documents and the site tour are planned in advance.

When a remote audit makes sense

Remote techniques suit document and record review, interviews, supplier audits and follow-up of corrective actions. They are harder to rely on for hygiene, pest control and the condition of buildings and equipment, where the auditor needs to see, hear and sometimes smell the site. Many programmes therefore use a blended approach: documents remotely, then a shorter visit on site.

Before the audit

• Agree the scope, the agenda and which parts are remote
• Test the platform, cameras and connectivity in every area to be shown, including production and storage
• Share documents securely in advance and name a person responsible for retrieving records
• Plan the route of the live tour on a site map
• Agree how confidential information and recordings are handled

During the audit

• Let the auditor direct the camera, not the site
• Show wide views first, then details such as labels, seals and gauges
• Keep interviews with operators unscripted
• Record requests for evidence so nothing is missed

After the audit

Findings are reported and followed up in the same way as an on-site audit. Review what worked and what did not, and keep the technology and document arrangements ready: they are also useful for internal and supplier audits.

Quality is not a department or a final inspection. It is how consistently an organisation meets what its customers need – and ISO 9001 is the framework for managing that.

What do we mean by quality?

There is no single agreed definition of quality, which is why the word causes so much confusion. In management-system terms the meaning is practical: quality is the degree to which a product or service meets the requirements of the customer and any legal requirements that apply. A budget hotel and a five-star hotel can both deliver quality, as long as each consistently delivers what it promised.

That is also why quality cannot be inspected into a product at the end. It is the result of how work is planned, done and checked every day.

Quality control, quality assurance and quality management

• Quality control checks the product or service and catches defects.
• Quality assurance builds confidence that requirements will be met, through planned processes and controls.
• Quality management directs the whole organisation: policy, objectives, resources, processes and improvement.

How ISO 9001 turns quality into a system

ISO 9001 asks an organisation to understand its context and customers, define its processes, address risks and opportunities, provide competent people and resources, control operations, measure results and improve. Top management is accountable for the system, and decisions are based on evidence rather than opinion.

• Fewer errors, complaints and rework
• Clear responsibilities and consistent ways of working
• A recognised basis for tenders and supplier approval
• A structure for continual improvement

Where to start

Start with a gap analysis against the standard, agree the scope, and map your core processes before writing any procedures. Train an internal audit team early: internal audits are the fastest way to find out whether the system works in practice.