ISO 45003 explained: what it covers, what it does not and the duty that already applies

What the law already asks of every employer

Two pieces of health and safety law do the work, and neither mentions stress. The Health and Safety at Work etc. Act 1974 makes it every employer’s duty to ensure, “so far as is reasonably practicable”, the health, safety and welfare at work of its employees (section 2), and to run its business so that people it does not employ are not exposed to risks to their health or safety, on the same terms (section 3).

The Management of Health and Safety at Work Regulations 1999 say how. Regulation 3 requires a “suitable and sufficient” assessment of the risks to employees’ health and safety at work and of the risks the business creates for anyone else. With five or more employees, the employer must record the significant findings.

The Health and Safety Executive (HSE), the regulator, is explicit that stress is covered: “Employers have a legal duty to protect workers from stress at work by doing a risk assessment and acting on it.” HSE says to assess stress “in the same way as” other work-related health and safety risks and that, for most people, the record “does not need to be a big exercise”: “note the main points about the significant risks and what you decided”.

Put together, the law and HSE’s guidance say: treat stress like any other health risk, act on the assessment and, at five or more employees, write down what it found. The law does not ask for a separate stress document or a stress policy. The written health and safety policy in section 2(3) of the Act is a different rule, which also starts at five employees. This is the law in Great Britain, and the risk it covers is not small.

What ISO 45003 covers

ISO 45003:2021, Psychological health and safety at work: guidelines for managing psychosocial risks, was published by ISO in June 2021. It gives guidelines, not requirements, for managing psychosocial risk within an occupational health and safety management system based on ISO 45001. ISO says it can be used by organisations of all sizes and in all sectors.

In plain terms, psychosocial hazards come from how work is organised, from the social side of work and from the working environment, equipment and hazardous tasks. Among the areas the standard addresses, ISO lists ineffective communication, excessive pressure, poor leadership and organisational culture.

ISO 45001 is the requirements standard for occupational health and safety management systems, and organisations can choose to seek third-party certification to it. ISO 45003 is written to work inside that kind of system, so it fits most naturally where one already runs.

ISO 45003 is about psychological health and safety: protecting people’s mental health from work-related harm. That is a different idea from psychological safety, whether people in a team feel able to speak up, ask questions or admit a mistake, which we cover in our post on psychological safety at work.

What ISO 45003 does not do

Four limits are worth knowing.

• It sets no requirements. ISO 45003 contains guidelines only, so there is no accredited certification to it, unlike ISO 45001. BSI, the UK national standards body, does offer unaccredited certification against it.
• It is voluntary. There is no legal obligation to adopt it.
• It is not the legal test. Of ISO 45001, the requirements standard with accredited certification, HSE says implementing it may help show you are meeting health and safety law but “in some respects, it goes beyond what the law requires”, and that its inspectors rely on a wide range of evidence, not just on whether an organisation claims to meet the standard. Our reading is that the last point holds at least as strongly for guidance: saying you follow ISO 45003 is not, on its own, evidence that the duty is met.
• It does not replace the risk assessment. An organisation that adopts it still has to assess the risk, act on it and, at five or more employees, record the significant findings.

HSE’s own approach is its Management Standards, which it describes as a “yardstick” for gauging performance on the key causes of stress, and even those are not law. HSE says that following the Management Standards approach correctly means “adopting an approach that is considered suitable and sufficient”, and that organisations using an alternative approach can use its workbook to make sure theirs is “suitably equivalent”. Where ISO 45003 fits is our reading, not HSE’s: it can inform either approach, and the legal question stays with the assessment and what was done about it, not the document that shaped it.

How to use ISO 45003, starting from what your assessment found

None of this is a reason to ignore ISO 45003. It can be a useful structure for thinking about psychosocial risk, particularly for an organisation that already runs ISO 45001, and it names areas such as communication, leadership and culture that an assessment focused only on workload can pass over.

The order matters: start from what your psychosocial risk assessment found, which in Great Britain is part of the risk assessment the law already requires, then use the standard to widen and sharpen it.

The same order applies at board level. HSE and the Institute of Directors, in their guidance for directors, say health and safety “must be led by the board”, and HSE treats work-related stress as a health and safety risk. So the first question for a board is not “are we aligned to ISO 45003?” It is what the risk assessment found about work-related stress, and which decisions it led to.

Some findings may be about the work itself: workload, targets, how change is handled. Others may point to line managers, who may notice a change in someone’s work before anyone else does and need to know where to signpost. Training managers to recognise early warning signs is one response to a finding like that. It does not replace the assessment, and it does not fix a finding about the work itself.

Our guide What did your stress risk assessment find? The questions to ask turns that first question into seven, with what strong and weak answers sound like. For the six areas of work HSE’s Management Standards look at, read our post on how pressure differs from stress at work.