ISO 45003: A Practical Guide for Employers
Aug 04, 2026
Organizations increasingly recognize that psychological health and safety cannot be managed through wellbeing benefits and individual support alone. ISO 45003 provides an international framework for identifying and managing the workplace conditions that can contribute to psychological harm.
By César Gamio, Founder and Managing Director · 9-minute read
Key takeaways
- ISO 45003 provides international guidance for managing psychosocial risks within an occupational health and safety management system.
- It focuses on how work is designed, organized, and managed, including workload, control, support, relationships, leadership, role clarity, and organizational change.
- Effective implementation requires evidence, employee consultation, clear ownership, practical controls, and continual improvement, not simply a policy, survey, or training program.
Psychological health and safety needs a management approach
Many employers have invested significantly in employee mental health and wellbeing.
They may provide employee assistance programs, counseling, mental health awareness training, wellbeing apps, resilience workshops, flexible benefits, or occupational health support.
These resources can be valuable. They may improve access to help, reduce stigma, strengthen awareness, and support employees experiencing difficulty.
However, they do not create a complete system for managing psychological health and safety.
An employee assistance program cannot correct a chronically excessive workload. Mental health awareness training cannot create role clarity. A wellbeing app cannot resolve bullying, conflicting priorities, or a culture in which employees are afraid to raise concerns.
These interventions primarily support people after difficulties arise. They do not necessarily identify or control the workplace conditions contributing to those difficulties.
The World Health Organization distinguishes organizational interventions from individual support. Organizational interventions assess workplace risks to mental health and then seek to mitigate, modify, or remove them. Its international guidance recommends combining these interventions with manager training, employee training, individual support, return-to-work programs, and measures that help people with mental health conditions participate in employment.
Psychological health and safety requires organizations to examine not only how they support employees, but also how work is designed, organized, and managed.
ISO 45003 helps employers make that shift.
What is ISO 45003?
ISO 45003 is the international standard providing guidance on psychological health and safety at work and the management of psychosocial risks.
Its formal title is:
ISO 45003:2021 Occupational health and safety management, Psychological health and safety at work, Guidelines for managing psychosocial risks.
The standard was developed to complement ISO 45001, the international requirements standard for occupational health and safety management systems. However, organizations can use ISO 45003 even when they have not implemented a formal ISO 45001 management system.
ISO 45003 applies to organizations of every size and sector. It is intended to help prevent work-related injury and ill health, promote wellbeing at work, and support the development, implementation, maintenance, and continual improvement of healthy and safe workplaces.
ISO 45003 does not replace an organization’s mental health or wellbeing strategy. It provides a framework for managing the workplace risks that strategy should address.
What is psychosocial risk?
The term psychosocial risk can initially sound technical.
In practice, it refers to the possibility of harm arising from the way work is designed, organized, managed, and experienced.
The International Labour Organization explains that psychosocial hazards may arise from any aspect of work design or management that increases the risk of work-related stress. These may involve job demands, workload, work pace, control, organizational culture, career development, job security, workplace relationships, and the boundary between work and personal life.
Examples may include:
- Excessive or conflicting demands
- Limited control over work
- Inadequate staffing, information, or support
- Bullying, harassment, violence, or discrimination
- Unclear roles and responsibilities
- Poor communication
- Harmful leadership behavior
- Poorly managed organizational change
- Job insecurity
- Isolation and inadequate social connection
- Exposure to traumatic or emotionally demanding work
- Unfair or inconsistent treatment
- Inadequate recognition or development
- Unhealthy expectations about availability
These conditions do not affect every employee in precisely the same way. Experience, health, personal circumstances, role, exposure, and access to support can all influence how risk is experienced.
However, differences between individuals do not remove the organization’s responsibility to identify foreseeable hazards and take proportionate action.
Psychosocial risk management asks what aspects of work could cause harm, who may be exposed, and what the organization can do to reduce that risk.
ISO 45003 is broader than mental health support
Organizations sometimes assume that managing psychological health and safety means helping employees who are already struggling.
That is an important part of the response, but ISO 45003 takes a broader and more preventive view.
It encourages organizations to understand their operating context, identify psychosocial hazards, assess risks, implement controls, monitor outcomes, and continually improve their approach.
This requires leaders to ask questions such as:
- Are workloads achievable within reasonable working patterns?
- Do employees have appropriate influence over how work is completed?
- Are roles, priorities, and decision rights clear?
- Do managers have the capability and authority to support their teams?
- Can employees raise concerns without unreasonable fear?
- Are harmful behaviors addressed consistently?
- Is change communicated and managed effectively?
- Are employees consulted when decisions affect their health and safety?
- Does the organization learn from absence, turnover, complaints, incidents, and employee feedback?
These questions reach further than asking whether employees know how to access counseling.
Both support and prevention matter, but they serve different purposes.
Support helps employees when difficulties arise. Risk management works to prevent avoidable harm from arising in the first place.
The principles behind effective implementation
ISO 45003 follows a structured management system approach. Although implementation should be proportionate to the organization, several principles are central.
Leadership commitment and accountability
Psychological health and safety cannot be delegated entirely to HR, Occupational Health, or a wellbeing team.
Senior leaders influence staffing, workloads, targets, resources, technology, organizational change, and the standards applied to workplace behavior. They therefore influence many of the conditions that create psychosocial risk.
Leadership commitment must become visible through decisions, resources, responsibilities, and accountability.
A policy statement is not enough when leaders continue rewarding output achieved through chronic overload or tolerate harmful behavior from commercially valuable individuals.
Leadership commitment becomes credible when psychological health and safety influences operational and commercial decisions.
Employee consultation and participation
Employees often have the clearest view of how work is actually experienced.
They understand where processes fail, where workloads accumulate, which expectations conflict, and which concerns feel difficult to raise.
ISO 45003 emphasizes consultation and worker participation because psychosocial risks cannot be understood through leadership assumptions alone.
Consultation might include confidential assessments, interviews, focus groups, workshops, employee forums, worker representatives, or structured team discussions.
Employees also need confidence that their participation will be treated seriously and that confidentiality will be protected appropriately.
Collecting feedback without visible follow-through can reduce trust and weaken the reliability of future consultation.
Employee voice is not simply a cultural benefit. It is a critical source of risk information.
Hazard identification
Organizations need to identify the workplace conditions that could contribute to psychological or physical harm.
Useful evidence may include:
- Employee assessment data
- Working hours and overtime
- Sickness absence
- Turnover and exit information
- Grievances and complaints
- Occupational health information
- Anonymized employee assistance trends
- Staffing and workload data
- Workplace incidents
- Organizational change programs
- Interviews and focus groups
- Reports of bullying, harassment, or conflict
- Information from managers and employee representatives
No single source provides a complete picture.
Low absence does not necessarily indicate low risk. Employees may continue working while unwell, avoid reporting concerns, or leave rather than request support.
High use of an employee assistance program may demonstrate good access, but it may also indicate significant underlying strain.
Effective hazard identification combines organizational evidence with employees’ lived experience.
Risk assessment and prioritization
Once hazards have been identified, organizations need to evaluate the associated risks.
This involves considering who may be exposed, how harm could occur, which groups or roles may face greater exposure, what controls already exist, and whether those controls are effective.
Risk can differ between teams, locations, levels of seniority, employment arrangements, and stages of organizational change.
Overall results may appear acceptable while one operational team experiences severe overload. A flexible working model may benefit most employees while leaving some remote workers isolated or disconnected from development opportunities.
The purpose is not to produce a list of every workplace concern. It is to identify significant risks and determine where action can make the greatest difference.
A useful assessment converts employee experience into clear organizational priorities.
Controls and practical action
Organizations then need to select and implement controls.
The strongest controls address the source of risk wherever reasonably possible.
For excessive workload, action might involve changing priorities, improving staffing, simplifying processes, adjusting deadlines, or redesigning responsibilities.
For poor role clarity, the organization may need to clarify decision rights, reporting lines, responsibilities, and competing expectations.
For weak psychological safety, action may require leadership development, safer reporting routes, stronger protection against retaliation, and more consistent responses to employee concerns.
Counseling, resilience development, and individual support can remain valuable. However, they should not be the only controls when the underlying hazard is organizational.
The strongest control changes the condition creating the risk rather than asking employees to tolerate it more effectively.
Monitoring and continual improvement
Psychosocial risks change as the organization changes.
Growth, restructuring, acquisitions, cost reduction, new technology, leadership transitions, remote working, and changing customer demands can all affect how work is experienced.
Organizations therefore need to monitor whether their controls are effective and whether new risks are emerging.
This may involve reviewing action plans, repeating assessments, examining relevant organizational data, consulting employees, and learning from incidents or complaints.
ISO 45003 is not a one-time initiative. It is a framework for continual organizational learning and improvement.
What ISO 45003 does not require
Misunderstanding the standard can create unnecessary resistance.
ISO 45003 does not require employers to eliminate every source of pressure.
It does not suggest that employees should never experience uncertainty, disagreement, challenging goals, or demanding periods.
It does not make managers responsible for diagnosing mental health conditions.
It does not require organizations to control every aspect of an employee’s personal wellbeing.
It also does not mean that every employee preference must be accommodated.
Healthy work can include challenge, accountability, deadlines, change, and difficult decisions.
The objective is to identify workplace conditions that could cause harm and manage the associated risks responsibly and proportionately.
Psychological health and safety is not about making work comfortable at all times. It is about managing foreseeable workplace risks responsibly.
Can an organization become certified to ISO 45003?
ISO 45003 is a guidance standard rather than a requirements standard. This means that certification is not accredited in the same way as certification to ISO 45001.
However, organizations may still be able to pursue independent certification against ISO 45003 through certification bodies offering that service.
BSI, for example, states that it offers unaccredited ISO 45003 certification to organizations with or without an existing ISO 45001 management system. An organization pursuing this route must implement its approach and successfully complete the certification body’s assessment and audit process.
Where the organization meets the certification body’s assessment criteria, it may receive an ISO 45003 certificate from that body.
It is important to distinguish between certification and accredited certification. An organization should not describe ISO 45003 certification as accredited unless a recognized accreditation arrangement specifically applies.
ISO 45001 remains the certifiable requirements standard that ISO 45003 was designed to support.
The strongest objective is not simply to obtain a certificate. It is to build a functioning psychological health and safety approach that can withstand independent scrutiny and produce meaningful workplace improvement.
Common implementation mistakes
Treating ISO 45003 as an HR project
HR may coordinate the work, but many psychosocial hazards are created through operational and commercial decisions.
Workload, staffing, targets, technology, restructuring, and job design are shaped across functions. Effective implementation therefore requires cross-functional ownership.
Relying on a generic engagement survey
Engagement data can provide useful context, but it may not assess psychosocial hazards with enough specificity.
Employees can remain engaged with their organization’s purpose while experiencing excessive demands, limited control, or burnout risk.
A focused psychosocial risk assessment is usually required.
Starting with training before diagnosis
Manager training may be valuable, but organizations should first understand which risks and capability gaps matter most.
Otherwise, they may invest in supportive conversations when the more urgent problem is workload, role conflict, or harmful senior leadership behavior.
Focusing mainly on resilience
Resilience can help employees navigate unavoidable pressure.
It cannot make chronic understaffing, bullying, or impossible priorities safe.
A credible implementation plan combines employee support with organizational prevention.
Collecting evidence without acting
Assessment can damage trust when employees see no meaningful response.
Organizations should explain what they learned, which priorities will be addressed, who owns the action, and how progress will be reviewed.
How employers can begin
A practical starting sequence is to:
- Establish senior sponsorship and governance.
- Clarify why the organization is adopting ISO 45003.
- Review existing policies, evidence, controls, and support.
- Consult employees and relevant representatives.
- Identify psychosocial hazards across roles and locations.
- Assess and prioritize significant risks.
- Develop an action plan with clear ownership and timelines.
- Strengthen leadership and manager capability where needed.
- Communicate findings and progress transparently.
- Monitor effectiveness and review the approach regularly.
An ISO 45003 Gap Analysis and a Psychosocial Risk Assessment serve different but complementary purposes.
The gap analysis examines the organization’s current management framework, governance, processes, and alignment with the standard.
The risk assessment examines the psychosocial hazards and risks employees may be experiencing through work.
Together, they help an organization understand both the strength of its management approach and the conditions requiring action.
ISO 45003 supports better business decisions
Psychosocial risk management is not only a wellbeing or compliance concern.
The conditions that create psychological risk can also affect quality, productivity, retention, collaboration, innovation, customer service, and decision-making.
An overloaded employee may make more errors. A team with low psychological safety may conceal emerging risks. A manager with too many direct reports may delay important conversations and decisions. Poorly managed change may reduce trust and slow implementation.
The ILO describes the psychosocial working environment as being shaped by how jobs are designed, how work is organized and managed, and the wider policies and practices governing work. This reinforces the importance of treating psychosocial risk as an organizational and operational concern.
ISO 45003 helps employers examine these issues as connected elements of the operating system rather than isolated employee problems.
From wellbeing activity to psychological health and safety
Many organizations have already taken meaningful steps to support mental health.
The next stage is to connect that support with prevention, governance, employee consultation, and risk management.
Employers should therefore ask more than:
“What mental health and wellbeing resources do we provide?”
They should also ask:
“How do we identify, assess, control, and review the workplace conditions that could cause psychological harm?”
ISO 45003 provides an international framework for answering that question.
Build a structured approach to ISO 45003
Dharma helps organizations translate ISO 45003 into a practical and proportionate approach to psychological health and safety.
Our support can include an ISO 45003 Gap Analysis, Psychosocial Risk Assessment, leadership guidance, governance, action planning, and advisory support through implementation.
Dharma Centre for Workplace Wellbeing has been appointed by the British Standards Institution as a BSI Associate Consultant for ISO 45003.
