ISO 45003 Explained: How Employers Manage Psychosocial Risk at Work

ISO 45003 is the international guidance standard for managing psychosocial risk at work. Published by ISO in June 2021, ISO 45003:2021 shows organisations how to identify work-related hazards to psychological health, assess the risks, put controls in place and promote wellbeing, all within an occupational health and safety management system based on ISO 45001.

For HR and safety leaders in Asia Pacific, the standard has moved from a nice-to-have reference to a practical benchmark. Malaysia's Department of Occupational Safety and Health (DOSH) builds its 2024 psychosocial risk guideline on it, and Australia now writes psychosocial risk duties into its model work health and safety regulations. This guide explains what the standard says and how to apply it.

What is ISO 45003:2021?

ISO 45003:2021, titled "Occupational health and safety management: Psychological health and safety at work: Guidelines for managing psychosocial risks", is the first edition of the standard. It was developed by ISO technical committee ISO/TC 283, the same committee responsible for ISO 45001. According to the official ISO listing, it gives guidelines for managing psychosocial risk so that organisations can prevent work-related injury and ill health and promote wellbeing at work.

Two definitions sit at its core. A psychosocial risk combines the likelihood of exposure to hazards of a psychosocial nature with the severity of the harm they can cause. Wellbeing at work refers to the fulfilment of the physical, mental, social and cognitive needs and expectations of a worker related to their work.

The standard states that it applies to organisations of all sizes and in all sectors. It is written as guidance, describing good practice rather than auditable requirements.

How does ISO 45003 relate to ISO 45001?

ISO 45001 is the requirements standard for an occupational health and safety (OH&S) management system. It sets out what an organisation must do to plan, run, review and improve its safety system, and it already makes the organisation responsible for protecting workers' psychological health as well as their physical safety.

ISO 45003 is intended to be used together with ISO 45001, and its scope says the guidelines are based on ISO 45001. It adds detail on how psychosocial hazards differ from physical ones. In practice, an organisation certified to ISO 45001 can use ISO 45003 to show auditors how it handles workload, harassment, change and other psychosocial issues inside its existing system.

Can you get certified to ISO 45003?

No, not on its own. European Accreditation states that ISO 45003 is not suitable for stand-alone certification, because it covers only psychosocial risks while an OH&S management system must cover all risks. Organisations typically certify to ISO 45001 and use ISO 45003 to strengthen the psychosocial parts of that system. Be cautious of any claim of "ISO 45003 certification" and ask what is actually being audited.

What psychosocial hazards does ISO 45003 list?

ISO 45003 groups psychosocial hazards into three categories. Summaries published by certification body LRQA describe them as follows.

1. How work is organised. Role clarity, job demands, workload and work pace, management of organisational change, job security, working hours and the degree of control workers have over their tasks.
2. Social factors at work. Organisational and team culture, recognition and reward, supervision and support, work-life balance, relationships at work, and harassment, bullying and victimisation.
3. Work environment, equipment and hazardous tasks. Adequacy and suitability of equipment, and conditions such as working space, lighting, ventilation and noise.

The value of this structure is that it moves the conversation away from individual resilience and towards the design of work. A team with unclear roles, constant restructuring and a manager who never gives feedback faces measurable hazards, whatever the personal coping skills of its members.

Examples HR teams often miss

• Remote and hybrid work that blurs working hours or isolates people from support.
• Customer-facing roles exposed to aggression from clients or the public.
• Repeated reorganisations announced without consultation.
• High workload combined with little say over how or when the work is done.
• Poor investigation of complaints, which turns one incident of bullying into a lasting hazard for the whole team.

Why does ISO 45003 matter for employers in Asia Pacific?

The business case starts with scale. The World Health Organisation (WHO) and the International Labour Organisation (ILO) estimate that 12 billion working days are lost every year to depression and anxiety, costing the global economy nearly US$1 trillion. The WHO guidelines on mental health at work, published in September 2022, recommend acting on organisational risks such as heavy workloads and negative behaviours, and training managers to respond to distressed workers.

The regulatory case is now just as strong in several APAC markets. ISO 45003 gives multinational employers one common method that sits comfortably alongside different national rules.

Malaysia

DOSH launched the Guidelines on Psychosocial Risk Assessment and Management at the Workplace 2024 in October 2024, as reported on the DOSH portal. The guideline, known as PRisMA, states that ISO 45003:2021 provides guidelines within the framework of ISO 45001, and its screening tool for employees, LEO26, is aligned with ISO 45003. It links psychosocial risk assessment to the general risk assessment duty in section 18B of the Occupational Safety and Health Act 1994, as amended. In May 2026, DOSH signalled that protecting psychosocial wellbeing is to be treated as a legal duty under its Occupational Safety and Health Master Plan 2026 to 2030.

Australia

The Work Health and Safety Amendment (Managing Psychosocial Risk and Other Measures) Regulations 2022 added specific psychosocial duties to the Commonwealth WHS Regulations, commencing on 1 April 2023. They define a psychosocial hazard as one arising from the design or management of work, the work environment, plant, or workplace interactions or behaviours, and require businesses to manage the resulting risks. The factors a business must consider when choosing controls, listed in regulation 55D, closely mirror the three ISO 45003 categories. Safe Work Australia also publishes a model Code of Practice on managing psychosocial hazards at work.

Japan

Japan took a screening route. Under an amendment to the Industrial Safety and Health Act, workplaces with 50 or more employees have had to offer an annual Stress Check since 1 December 2015, analyse group results and use them to improve the work environment, as described in the Journal of Occupational Health. That group-level analysis step fits neatly with the ISO 45003 approach of fixing the work rather than only the worker.

How do you implement ISO 45003? A step-by-step approach

The steps below follow the Plan, Do, Check, Act cycle used in ISO 45001 management systems. The time a first cycle takes depends on the size of the organisation and the maturity of its existing safety system.

1. Secure leadership commitment. Agree a written statement from senior leaders that psychological health and safety is part of the OH&S policy, with a named executive owner and a budget.
2. Map your context. Review absence, turnover, grievance, exit interview and EAP trend data alongside business changes such as restructures, growth or new shift patterns.
3. Consult workers. Involve employees and their representatives through focus groups, safety committees and anonymous surveys. ISO 45003 treats worker participation as central, because many psychosocial hazards are invisible to management.
4. Identify hazards. Use a validated survey and structured conversations to check each of the three categories: work organisation, social factors and the work environment.
5. Assess the risks. Rate likelihood and severity for each hazard, by team or site rather than for the whole company, so that hotspots stand out.
6. Choose controls, starting at the source. Redesign workloads, clarify roles, fix rostering and improve complaint handling before relying on individual measures such as resilience workshops.
7. Provide support for those already affected. Make sure confidential counselling, crisis support and return-to-work processes are in place and known.
8. Monitor, review and improve. Repeat the assessment, track agreed indicators and report progress to leadership and workers at least annually.

The hierarchy in step 6 matters. A wellbeing app cannot offset a team that is permanently understaffed. ISO 45003 expects organisations to change the conditions that create risk, and to use individual support as a complement, not a substitute.

How can HR measure psychosocial risk under ISO 45003?

ISO 45003 does not prescribe a single survey. It asks organisations to use methods that are appropriate, reliable and respectful of confidentiality. A balanced measurement plan usually combines three sources.

• Survey data. Short, validated instruments covering symptoms of distress and team climate, run anonymously and reported only at group level.
• Organisational data. Absence, overtime, turnover, grievances, incident reports and EAP usage trends, analysed for patterns rather than individuals.
• Qualitative input. Focus groups, safety committee minutes and manager observations that explain why a number has moved.

ThoughtFull's Organisational Mental Wellness Assessment is one way to gather the survey layer. It takes under seven minutes, draws on the PHQ-2, GAD-7 and the Edmondson psychological safety scale, and reports anonymised results. In Malaysia, employers who need a DOSH-aligned process can use the PRisMA psychosocial risk assessment, which applies the LEO26 and EPC23 tools and produces a report from a certified assessor.

ISO 45003 implementation checklist for HR and safety leaders

Use this checklist to test whether your current system reflects the standard.

• Our OH&S policy explicitly covers psychological health and safety.
• A senior leader owns psychosocial risk and reports on it to the board or executive team.
• We have assessed hazards in all three ISO 45003 categories within the last 12 months.
• Risk assessments are broken down by team, site or role, not only company-wide.
• Workers were consulted when hazards were identified and controls were chosen.
• Most controls target work design, not only individual coping.
• Managers are trained to spot distress, hold supportive conversations and escalate concerns.
• Bullying and harassment complaints are investigated promptly and fairly.
• Confidential support, such as an EAP and crisis line, is available in the languages our people speak.
• Change programmes include a psychosocial impact assessment before announcement.
• We review results and update controls on a fixed cycle.

What are common mistakes when applying ISO 45003?

The first mistake is treating ISO 45003 as a wellbeing programme. Yoga sessions and webinars have a place, but the standard is about risk management, and a calendar of activities does not show that hazards have been controlled.

The second is running a survey and stopping there. Collecting data without acting on it can damage trust and reduce response rates the next time. Always publish what you heard and what will change.

The third is leaving managers out. Line managers shape workload, recognition and conflict every day. Programmes such as ThoughtFull's Psychologically Safe Manager training give them practical skills that match the social factors category of the standard.

The fourth, common across Asia Pacific, is ignoring language and culture. A regional employer with teams in Kuala Lumpur, Manila and Jakarta needs survey tools, support services and manager guidance that work in each local language and context. For a wider view of why this is a structural issue, see our article on why burnout is a systemic workplace issue.

How does an EAP fit into an ISO 45003 system?

An Employee Assistance Programme sits in the "support" layer of psychosocial risk management. It does not remove hazards, but it reduces the harm when exposure has already happened, and its anonymised trend data can point to hazards that need attention.

To make an EAP part of the system rather than a separate benefit, agree in advance which aggregated indicators the provider will report, how often, and who on the risk committee reviews them. Dashboards such as the ThoughtFull Insights Dashboard show anonymised trends to HR without exposing any individual. ThoughtFull also holds ISO 27001 certification for information security, which matters when psychosocial data is involved.

Next steps

ISO 45003 gives employers a clear, internationally recognised method for treating psychological health with the same discipline as physical safety. Start by checking your system against the checklist above, then pick one high-risk team for a full assessment and control cycle.

If you want help with assessment, manager capability or confidential support across Asia Pacific, book a demo with ThoughtFull to see how our regional team can support your psychosocial risk programme.