ISO 45003 is 32 pages of international standard language. You should not have to read all 32 pages to understand what it actually requires you to have in place.
Here is what it requires — in plain English — as an Australian employer.
What is ISO 45003:2021?
ISO 45003:2021 is the international standard for psychological health and safety at work. Published by the International Organization for Standardization in June 2021. It sits under ISO 45001 — ISO 45003 is its psychological counterpart.
It is not a certification scheme. There is no ISO 45003 certificate. No accredited third party awards it, no auditor stamps it, no annual renewal is required.
This is worth stating plainly because the terminology causes real confusion in procurement and contract negotiations. When a client asks whether you are "ISO 45003 certified," the correct answer is that ISO 45003 certification does not exist as a formal designation. What exists is alignment — your psychosocial risk management program either follows the ISO 45003 framework or it does not. "ISO 45003 aligned" is the accurate and meaningful claim.
Does ISO 45003 apply to Australian employers?
Not as a legal mandate. But the underlying obligation is fully mandated. Australian WHS regulations require employers to identify, assess, and control psychosocial hazards.
Three practical reasons it applies to you even if it is not law:
Regulators reference it
Safe Work Australia and state regulators point to ISO 45003 in guidance material. When an inspector asks how you are managing psychosocial hazards, a program structured around the standard is the clearest possible answer.
Procurement requires it
Enterprise clients, government contracts, and major tender processes increasingly specify ISO 45003 alignment as a vendor requirement. It has moved from a differentiator to a threshold condition in several industries.
Insurers reward it
Workers compensation and professional liability insurers are beginning to use ISO 45003 alignment as a risk rating factor.
ISO 45003 vs ISO 45001
ISO 45001
The occupational health and safety management system standard. Covers the full OHS management lifecycle. Can be third-party certified.
ISO 45003
Specifically about psychosocial risk. Extends ISO 45001 to address conditions that create psychological harm. Not separately certifiable.
You can implement ISO 45003 without having ISO 45001 certification — the frameworks are compatible but independent.
What ISO 45003 actually requires — a plain-English checklist
After translating 32 pages of international standard language into what an OHS manager actually needs to have in place, there are six things:
1. A hazard identification process
A validated psychosocial hazard survey deployed to your workforce at a defined interval. Not a wellbeing check-in. Not a K10 distress screener. A hazard identification instrument — COPSOQ III (26 scales, covers 14–15 of 17 SWA hazards) or equivalent.
This is the item most organisations have. The remaining five are where most organisations fail.
2. Risk assessment against benchmarks
Group scores must be assessed against a reference population so you know what "high risk" actually means in your industry. A score is not meaningful without a benchmark. Rahimi et al. (2025) provides Australian COPSOQ III norms across 13 industry sectors — the only ANZ-specific benchmark dataset currently available.
3. Documented controls
A written intervention program that addresses the specific hazards identified — not generic EAP referrals. ISO 45003 requires documented control measures that are proportionate to the hazards found. "We have an EAP" is not a documented control program for Role Clarity or Quality of Leadership hazards.
4. Workforce consultation records
Evidence that workers were involved in identifying hazards and designing controls. ISO 45003 requires this. Most organisations do not document it. Regulators check for it. Consultation can be through safety representatives, team briefings, or formal consultative committees — but it must be recorded.
5. Management review
Board or senior leadership sign-off on the psychosocial risk program at least annually. The board does not need to manage the program — it needs to review it, understand the findings, and endorse the controls. This is documented in board minutes or equivalent.
6. Longitudinal monitoring
Re-measurement at defined intervals. ISO 45003 calls for continual improvement — the standard explicitly requires that the program is ongoing, not a one-off assessment. Recommended: full COPSOQ III annually, PSC-12 pulse at six months after a significant intervention. The value compounds over time — by year three you have a trend, not a snapshot.
The most common gap
In 25 years of occupational health practice, the most consistent gap in Australian psychosocial risk programs is item 4 — workforce consultation records — followed closely by item 6 — longitudinal monitoring.
Most organisations have run at least one psychosocial survey. Fewer have documented the intervention program (item 3). Almost none have systematic records of workforce consultation in hazard identification and control design (item 4). And the majority treat the survey as a periodic compliance event rather than a continuous monitoring program (item 6).
Items 4 and 6 are where a regulator audit or a coronial proceeding finds the gaps. They are also the easiest to fix — they require process discipline more than technology investment.
"Aligned" vs "certified"
There is no third-party certification body that issues an ISO 45003 certificate. If a vendor or consultant is offering "ISO 45003 certification" as a deliverable, they are either misinformed or conflating ISO 45003 with ISO 45001.
What you can legitimately claim
- • "Our psychosocial risk program is ISO 45003-aligned"
- • "Our OHS management system is ISO 45001 certified, and our psychosocial risk program aligns with ISO 45003"
What you cannot claim
- • "We are ISO 45003 certified" — no such certification exists
How OccuSpan maps to the six requirements
Common questions
Is ISO 45003 mandatory in Australia?
ISO 45003 is not legally mandated in Australia, but the underlying obligation is. Australian WHS regulations require employers to identify, assess, and control psychosocial hazards. ISO 45003 is the internationally recognised framework for meeting that obligation.
What is the difference between ISO 45001 and ISO 45003?
ISO 45001 is the overarching OHS management system standard — it covers the full safety management lifecycle and can be third-party certified. ISO 45003 sits under ISO 45001 and addresses psychosocial risk specifically. ISO 45003 is not separately certifiable.
Is there an ISO 45003 certification?
No. There is no third-party certification body that issues an ISO 45003 certificate. You can describe your psychosocial risk program as ISO 45003-aligned — meaning it follows the framework — but "ISO 45003 certified" is not a meaningful term.
Where can I download ISO 45003 for free?
ISO 45003:2021 is available for purchase through the ISO store (iso.org) and Standards Australia (standards.org.au). It is not available as a free download.
See OccuSpan's ISO 45003-aligned psychosocial risk platform
COPSOQ III, Australian benchmarks, intervention engine, board report. Everything the standard requires — in one platform.