Most ISO 45001 risk assessments fail for the same reason: they're treated as a once-a-year paperwork exercise rather than a live part of how the business runs. Clause 6.1.2 asks you to identify hazards and assess risk across routine and non-routine work. Get the method right and it protects people. Get it wrong and it's a filing exercise that collapses at audit.
A generic matrix isn't a methodology
ISO 45001 doesn't tell you which risk assessment method to use — that's left to you. What it does expect is a documented method, applied consistently, and suitable for the hazards you actually have. I've seen businesses buy an off-the-shelf 5x5 matrix, never adapt it to their own activities, and then can't explain why a confined-space job scored the same as routine paperwork. An auditor doesn't fault the matrix itself; they fault the gap between what's written down and what actually happened when someone sat down to score it. If you can't walk through your own logic, neither can your assessor.
Routine work gets covered, non-routine doesn't
Clause 6.1.2 is explicit: you must assess routine and non-routine activities, not just the job that happens every day. In my experience this is where registers fall down hardest — the daily production line is assessed in detail, but the once-a-year roof access, the contractor doing an emergency repair, or the new starter covering someone's shift for the first time isn't. Non-routine work carries more risk precisely because people are less familiar with it. If your register only reflects normal operating conditions, you're missing the situations most likely to cause an actual injury.
Psychosocial risk is still risk
ISO 45001 defines a hazard as a source with the potential to cause injury and ill health — and ill health explicitly includes psychological harm, not just physical. Workload, bullying, unclear roles and excessive hours are all within scope. Most businesses I work with assess trip hazards and manual handling in detail and stop there, leaving workplace stress and mental health risk entirely off the register. That's a gap an auditor is increasingly likely to probe, and more importantly it's a real risk to people left unmanaged. If you haven't assessed psychosocial hazards at all, start there before your next audit does it for you.
Worker participation isn't a signature on a form
Clause 5.4 requires you to consult workers in hazard identification and risk assessment — not inform them after the fact. I regularly see risk assessments written entirely by the health and safety manager, then circulated for a signature nobody reads properly. That satisfies nothing. The people doing the job know where the real hazards are, and an auditor can tell within a few questions whether workers were genuinely consulted or just rubber-stamped the output. Build in an actual mechanism — a toolbox talk, a walk-round, a short structured conversation — and keep a record of what was raised and changed as a result.
Reviewing it once a year is the real failure
A risk assessment written in January and never touched again will always be out of date by the time of your audit, because the business has moved on and the paperwork hasn't. Build in triggers: a new process, new equipment, an incident, a near-miss, or a change in legal requirements should prompt a review there and then, applying clause 8.1.2's hierarchy of controls — eliminate, substitute, engineer, administer, then PPE — not waiting for the annual cycle. That sequence matters to auditors too: PPE as a first response, rather than a last resort, is one of the most common findings I see.
If you can't remember the last time a risk assessment changed because something actually happened in the business, that's worth checking before your assessor does. Pull out your highest-risk activity, walk it with the people who do the job, and see whether the paperwork still matches reality. That conversation costs an hour. Getting it wrong at audit costs considerably more — and a risk assessment nobody's using isn't protecting anyone.
Ready to talk about your business?
Book a free, no-obligation call. We will tell you exactly what certification would involve for your size, sector, and starting point.