ISO 45003 Psychological Health & Safety Certification

ISO 45003:2021 is the first international standard focused specifically on psychological health and safety at work. It provides guidance on identifying psychosocial hazards, assessing the risks they create, and putting controls in place to manage them. Rather than sitting apart from your existing safety system, it’s written to work within the framework of ISO 45001, extending your occupational health and safety management system to cover psychological risk alongside physical risk.

ISO 45003 provides guidelines rather than requirements, which means it can’t be certified under JAS-ANZ accreditation the way ISO 45001 can. What you can obtain is independent third-party assessment against the standard, most commonly conducted alongside your ISO 45001 audit. The assessment applies the same rigour and evidence standards as an accredited audit, and gives you documented, independent confirmation that your psychosocial risk management aligns with the international benchmark.

ISO 45001 sets out the requirements for an occupational health and safety management system covering the full scope of workplace risk. ISO 45003 zeroes in on one part of that scope: psychosocial risk. Where ISO 45001 tells you what your system must do, ISO 45003 explains how to apply those same principles to hazards like excessive job demands, poor support, bullying, and role conflict. The two are designed to be used together.

No, but it makes the process considerably simpler. ISO 45003 follows the same high-level structure as other management system standards, so organisations already certified to ISO 45001 can bring psychosocial risk into scope without building a separate system from the ground up. If you’re not yet certified to ISO 45001, ISO 45003 can still be used as standalone guidance, though most organisations find it more efficient to establish the broader system first.

Psychosocial hazards are aspects of how work is designed, organised and managed that have the potential to cause psychological or physical harm. Common examples include excessive or unrealistic job demands, low job control, poor support from managers or colleagues, unclear or conflicting role expectations, bullying and harassment, exposure to traumatic material, remote or isolated work, and poorly managed organisational change. ISO 45003 provides detailed guidance on identifying these across different work settings.

No. ISO 45003 is a voluntary standard. However, every Australian jurisdiction now has explicit legal obligations requiring employers to identify, assess, control and review psychosocial hazards, and regulators have moved firmly from education into enforcement. ISO 45003 isn’t the law, but it gives you a recognised framework for meeting those duties and, just as importantly, for demonstrating that you’ve met them if a regulator, insurer or client asks for evidence.

It gives you the structure and the evidence trail. Australian WHS regulations require a documented process of identifying psychosocial hazards, applying the hierarchy of controls starting with work design, consulting workers, and reviewing controls over time. A wellbeing policy or an EAP alone won’t satisfy that. ISO 45003 builds exactly this process into your management system, so your controls are systematic and reviewable rather than reactive. It doesn’t replace legal advice on your specific duties.

An auditor examines how psychosocial risk is managed as a system, not whether you’ve run a wellbeing initiative. That means looking at how hazards are identified, how workers are consulted, what controls are in place and whether they address hazards at the source, how incidents and concerns are handled, and how leadership monitors and reviews performance. Our gap analysis checklist walks through the same territory, so you can see where you stand before booking an audit.

It depends on your size, the complexity of your operations, and how mature your existing safety system is. Organisations already certified to ISO 45001 with psychosocial risk partly addressed will move faster than those starting from scratch, since much of the underlying framework is already in place. The most reliable way to gauge your timeline is a gap analysis, which shows exactly what needs to be built before an assessment can proceed.

Either can lead, and in practice it varies from business to business. What matters more is that the two functions work together, because psychosocial hazards sit at the intersection of how work is designed and how people are managed. WHS teams bring the risk management discipline; HR brings visibility of workload, conflict, role design and change. Leadership involvement is essential either way, since most effective controls involve decisions about how work itself is structured.

Yes. The standard was written to be scalable, with guidance that applies to organisations of every size. Smaller businesses often carry more concentrated psychosocial risk, since one difficult working relationship or one overloaded role represents a much larger share of the workforce. The legal duty to manage psychosocial hazards applies regardless of headcount, and a smaller organisation typically has less documentation to build, which can make implementation quicker rather than harder.