Untested Emergency Plans Are the Weak Spot Auditors Keep Finding Under ISO 45001

Emergency plans that have never been rehearsed, first-aiders and fire safety officers who have never been trained, and contact lists that went stale years ago. These are among the most common gaps auditors uncover when they assess workplaces against ISO 45001, the international standard for occupational health and safety management systems.

Clause 8.2 of ISO 45001:2018 sits at the heart of the rulebook. It obliges organisations to run a structured process for emergency preparedness and response — organising first aid, delivering targeted training, carrying out regular tests and emergency drills, and systematically revising plans after exercises or real incidents.

Untested plans and untrained first-aiders are exactly the kind of gap that turns a routine audit into a costly finding. A free toolkit gives you ready-to-use risk assessments, first-aid and fire-safety checklists, and training templates you can put to work on site straight away. Download the free Risk Assessment Toolkit

Reaching everyone matters as much as the plan itself. Employees, external contractors, visitors, rescue services and authorities all need to be informed, and documented information on these processes and plans must be retained.

Where companies fall short

Beyond untested plans and untrained personnel, frequent weaknesses include outdated contact lists or plans and a failure to notify night-shift staff, outside firms and visitors in good time.

The standard also demands that hazard sources be identified in detail down to the level of individual workstations and tasks — explicitly including irregular activities and outsourced work. Risks are assessed through a matrix combining severity of harm with likelihood of occurrence.

For countermeasures, ISO 45001 sets a fixed hierarchy of controls. Eliminating hazards entirely comes first, followed by substitution, engineering controls and organisational measures. Personal protective equipment (PPE) is the last resort.

What certification audits flag

Specific nonconformities recur in certification audits. Hazards are sometimes recorded only at department level rather than per workstation; regular reviews are skipped; identified deficiencies are not fully corrected.

Auditors also frequently criticise training records that contain no concrete examination result, or the exclusion of temporary and external staff from protection concepts.

Small and medium-sized enterprises get no minimum headcount requirement under the standard and may use simplified documentation — but identifying hazards remains mandatory. The full certification process typically runs several weeks from application to certificate issuance.

Behaviour, not just rules

Introducing protection measures in the real world takes more than regulatory tweaks. Laboratories, for instance, must prepare and document risk assessments under the German Occupational Health and Safety Act (ArbSchG §§ 5, 6), as well as the Workplace Ordinance, the Industrial Safety Ordinance, the Ordinance on Occupational Medical Prevention and DGUV Regulation 1.

On the digital side, GÜDEL AG is piloting the industry solution "Safely" under practical conditions. Uwe Kaiser, Quality & HSSE Specialist at the company, gave a positive interim assessment, saying the solution bundles safety-relevant information in one place and improves traceability. Measurable figures on time spent or process quality are not yet available at GÜDEL AG; a step-by-step rollout with a focus on clear responsibilities is recommended.

Employee behaviour is a major factor with any new safety rule. Psychological ownership of existing working practices can breed resistance, incomplete implementation or a clinging to old routines.

In Italy, Article 28 of Decree Dlgs 81/2008 requires assessment of all safety risks including work-related stress, flanked by information and training duties under Articles 36 and 37. Experts therefore recommend transparent communication of the reasons behind changes and involving the workforce.

Germany's BG ETEM — the statutory accident insurance body for the energy, textile, electrical and media industries — likewise advises companies not to limit safety training to frontal instruction, but to make hazards and protective measures tangible through practical exercises.

Getting started

For a general rollout of an HSE management system based on OHSAS 18001 and ISO 14001, structured checklists exist with 20 main items and 95 sub-items, covering the formation of a steering committee, the recording of permits and the creation of a legal register.

Building a management system from scratch is far easier when the groundwork is already done for you. A free toolkit bundles risk assessments, checklists and toolbox talks aligned to key UK regulations, so your team can focus on getting safety right rather than drafting documents. More than 37,000 UK businesses already rely on it — grab your copy today. Download the free Health & Safety Toolkit