ISO 45001 Management of Change: What Clause 8.1.3 Requires and How to Run It

Change is where new hazards slip into a workplace unnoticed: a new machine, a new contractor, a new shift pattern, a smaller team on nights, a guard taken off “just for today”. ISO 45001:2018 deals with this in clause 8.1.3, management of change. It is a short clause, but it touches most of the standard, and it is one of the places where auditors find the gap between what a system says and what a site does.

This article explains what the clause requires, what should trigger it, a procedure that works in practice, and examples from offices and industrial sites.

What clause 8.1.3 requires

The organisation must have a process for implementing and controlling planned temporary and permanent changes that affect OH&S performance. The clause lists what that covers:

1. New products, services and processes, or changes to existing ones, including changes to:
   • workplace locations and surroundings
   • work organisation
   • working conditions
   • equipment
   • the workforce
2. Changes to legal requirements and other requirements
3. Changes in knowledge or information about hazards and OH&S risks
4. Developments in knowledge and technology

It also requires the organisation to review the consequences of unintended changes and act to reduce any adverse effects where necessary. A note adds that changes can bring opportunities as well as risks.

The guidance in Annex A.8.1.3 describes the purpose: to improve health and safety by keeping new hazards and risks out of the workplace as technology, equipment, facilities, work practices, design specifications, raw materials, staffing, standards or regulations change. It leaves the method to the organisation, suggesting design review as one example.

What should trigger it

The commonest weakness is a process that only ever catches engineering changes. The clause reaches much further. A useful trigger list:

People and organisation

• restructuring, redundancies or a reduction in headcount on a shift
• new shift patterns, longer shifts, extra overtime
• a change of supervisor or the loss of a key competent person
• a new contractor, or a contractor taking over in-house work
• moving work between sites or bringing in a new type of worker, such as agency staff

Place and equipment

• new or modified machinery, plant, vehicles or tools
• changes to layouts, traffic routes, storage or access
• moving into new premises, refurbishing, or temporary site set-ups
• changing a chemical, a supplier of a hazardous substance, or a process parameter

Rules and knowledge

• a new or amended law, permit condition or client requirement
• a safety alert, an incident elsewhere, or new information about a hazard
• new technology that changes how a task is done, or makes a better control available

Temporary changes

• an interlock or alarm bypassed for maintenance
• equipment borrowed or hired in
• a procedure suspended during a shutdown or emergency

Climate change

ISO 45001:2018/Amd 1:2024, published in February 2024, added to clause 4.1 a requirement to determine whether climate change is a relevant issue. It did not change clause 8.1.3. But where climate change is relevant, it often shows up as exactly the kind of change the clause lists: hotter working conditions that call for changed work hours and rest breaks, more frequent extreme weather, or new tasks such as installing solar panels on roofs. ISO/PAS 45007:2026, published in January 2026, gives guidance on health and safety risks from climate change and climate action.

A practical procedure

The process should be proportionate. Changing a desk layout does not need the same treatment as modifying a pressure system. A procedure that works in most organisations has eight steps.

Step	What happens	Evidence
1. Raise	Anyone proposing a change completes a short change request: what, where, why, when, permanent or temporary	Change request form
2. Screen	A competent person decides whether the change affects health and safety, and if so whether it is minor or significant	Screening questions on the form
3. Assess	Hazards and risks are identified with the people who do the work, before anything changes	Risk assessment, with names of workers involved
4. Decide controls	Controls follow the hierarchy in clause 8.1.2: eliminate, substitute, engineering controls, administrative controls, then PPE	Control list
5. Approve	Sign-off at a level matching the risk. Significant changes go to a manager with authority over resources	Approval signature and date
6. Prepare	Procedures, drawings and registers updated; training given; contractors briefed; equipment checked under procurement controls (clause 8.1.4)	Updated documents, training records
7. Implement	A pre-start check confirms the controls are in place before the change goes live	Pre-start checklist
8. Review and close	After an agreed period, check that the change worked and caused no new problems. Temporary changes are reversed by their end date, or re-assessed	Close-out record

Keep a change register. It is the single document that lets a manager, an internal auditor or a certification body see every change, its status and what is overdue. It is also the input that management review should look at under changes in internal and external issues.

Unintended changes

Not every change is planned. A supplier substitutes a different product without saying so. A team quietly drops a step because it is slow. Staffing drifts below the level the risk assessment assumed. Clause 8.1.3 requires the organisation to review the consequences of these and deal with any adverse effects.

The way to catch them is through the routines the system already has: workplace inspections, incident and near-miss reports, worker consultation, purchasing checks on goods received, and internal audit. When one is found, run it through the same process from step 3: assess, decide controls, record.

Examples

Office and services settings

• Moving to new premises or refitting a floor. Fire escape routes, assembly points, first aid cover and fire wardens all need to be reset. Contractors working in an occupied building need controls.
• Hybrid or home working. A change to work organisation and working conditions: display screen arrangements, lone working, and the psychosocial risks of isolation or longer hours.
• Restructuring or a reduction in headcount. Workload, stress and the loss of trained first aiders or fire wardens are the common effects, and they are often missed because nothing physical changed.
• A new cleaning or facilities contractor. Different chemicals, different equipment and people unfamiliar with the building.

Industrial and construction settings

• New or modified machinery. Guarding, isolation points, noise, maintenance access and operator training, checked before the machine runs.
• Bypassing a safety device for maintenance. A temporary change that needs authorisation, a time limit and a check that the device is reinstated.
• Changing a chemical or its supplier. A new safety data sheet, possibly different exposure limits, PPE and storage requirements.
• Moving from eight-hour to twelve-hour shifts. Fatigue, heat exposure, supervision cover and rest arrangements.
• A shutdown with a large contractor workforce. Many simultaneous changes, unfamiliar workers and suspended routines, which is why shutdowns usually get their own change assessment.
• A new traffic route or storage area. Pedestrian and vehicle separation, visibility and lighting.

Findings auditors commonly raise

• Organisational changes never go through the process. The register is full of equipment changes and has nothing on restructuring, staffing or shift patterns.
• Assessment after the event. The risk assessment is dated after the change went live.
• No worker involvement. The assessment was written in the office by the HSE team alone, despite clause 5.4 e).
• Temporary changes never closed. Items marked temporary remain open months later.
• Documents not updated. The change went through, but the procedure, the drawing or the training matrix still describes the old way.
• An empty register. No changes recorded in a year in which the site obviously changed. Auditors read this as a process that exists on paper only.

Where this fits

Management of change is one of the areas certification bodies probe at surveillance, because it shows whether the system keeps up with the business. Our article on how often ISO audits happen explains the audit cycle, and our introduction to ISO 45001 covers the standard as a whole. If you run ISO 14001 alongside ISO 45001, a single change process can serve both, as we describe in integrated management systems.

How ESGweise helps

We design management of change procedures sized to the organisation, train the people who will raise and assess changes, and test the process during internal audits. For organisations with several sites, we run the system month by month, including the change register, and we prepare organisations for certification.