ISO 45001 · Step-by-step series · Article 7 of 7

ISO 45001 Clause 10: Improvement — Incident Investigation, Corrective Action and Continual Improvement

Clause 10 closes the ISO 45001:2018 High Level Structure and answers the question every occupational health and safety (OH&S) management system ultimately has to answer: what happens after something goes wrong, and how does the organization make sure it keeps getting better at preventing harm? This final article of our seven-part ISO 45001 series walks through the three components of clause 10 — incident investigation, nonconformity and corrective action, and continual improvement — with the practical detail needed to close this out properly.

Structure of clause 10: closing the improvement loop

Clause 10 of ISO 45001:2018 has three subclauses that together close the Plan-Do-Check-Act loop that runs through the whole standard:

• 10.1 General: the organization must determine opportunities for improvement and implement necessary actions to achieve the intended outcomes of the OH&S management system.
• 10.2 Incident, nonconformity and corrective action: the operational core of the clause — what to do when something happens (an incident) or when the system itself fails to meet a requirement (a nonconformity).
• 10.3 Continual improvement: the ongoing, forward-looking obligation to improve the suitability, adequacy and effectiveness of the OH&S management system over time.

It is worth noting the direct thread that runs from clause 9 into clause 10: performance evaluation (9.1), internal audit (9.2) and management review (9.3) are the mechanisms that generate the inputs — incidents, audit findings, review conclusions — that clause 10 requires you to act on. Clause 10 is where those inputs stop being observations and become documented, tracked actions.

10.1 General: determining opportunities for improvement

Subclause 10.1 is short but sets the intent for everything that follows. The organization must determine and select opportunities for improvement and implement the necessary actions to achieve the intended outcomes of the OH&S management system — meaning, in practical terms, the prevention of injury and ill health to workers and the provision of safe and healthy workplaces.

This is a genuinely broad requirement. Opportunities for improvement can come from many sources beyond incidents and nonconformities: worker consultation and participation activities (required under clause 5.4), hazard identification exercises (clause 6.1.2), changes in legal requirements, new equipment or processes, feedback from contractors, or simply operational experience accumulated over time. A mature OH&S system does not wait for an incident to trigger improvement — it actively looks for opportunities in the day-to-day running of operations.

10.2 Incident, nonconformity and corrective action: the core requirement

Subclause 10.2 is the most detailed and most audited part of clause 10. It is important to understand the distinction ISO 45001 draws between an incident and a nonconformity, because the standard treats them under a single, unified process but they are conceptually different:

• Incident: an occurrence arising out of or in the course of work that could or does result in injury and ill health. This includes accidents (where harm occurred) and near-misses (where harm could have occurred but did not, sometimes called "near-hits").
• Nonconformity: non-fulfilment of a requirement — either a requirement of the OH&S management system itself (a missing procedure, a control not implemented as designed) or a legal or other requirement the organization has committed to.

When an incident or a nonconformity occurs, ISO 45001 clause 10.2 requires the organization to:

• React in a timely manner — control and correct the incident or nonconformity, and deal with the consequences.
• Evaluate, with the participation of workers and the involvement of other relevant interested parties, the need for corrective action to eliminate the root cause(s) of the incident or nonconformity, so that it does not recur or occur elsewhere.
• Review existing assessments of OH&S risks and other risks, as appropriate.
• Determine and implement any action needed, including corrective action, in accordance with the hierarchy of controls (elimination, substitution, engineering controls, administrative controls, personal protective equipment) and the management of change process.
• Assess OH&S risks that relate to new or changed hazards before taking action.
• Review the effectiveness of any corrective action taken.
• Make changes to the OH&S management system, if necessary.

Root cause analysis: the step organizations most often shortcut

The standard requires that the organization evaluate the need for action to eliminate the root cause(s) — plural, because incidents rarely have a single cause. A worker slipping on a wet floor is not just "a wet floor": it may also involve a missing drainage design, a delayed cleaning schedule, inadequate signage, or unsuitable footwear not flagged during risk assessment. Common root cause analysis methods used to satisfy this requirement include:

• The "5 Whys": repeatedly asking why a failure occurred until the underlying systemic cause is reached, rather than stopping at the first, most visible explanation.
• Fishbone (Ishikawa) diagrams: categorizing potential causes across people, equipment, methods, materials, environment and management to avoid tunnel vision on a single factor.
• Fault tree analysis: useful for more complex incidents with multiple contributing conditions, mapping how different failures combined to produce the outcome.

Whichever method is used, clause 10.2 requires worker participation in the evaluation — this is not a task to be completed solely by a safety officer at a desk. The workers involved in or familiar with the task where the incident occurred typically have the clearest view of what actually happened operationally versus what the written procedure says should happen.

Information documented and retained

The organization must retain documented information as evidence of:

• The nature of the incidents or nonconformities and any subsequent action taken.
• The results of any action and corrective action, including their effectiveness.

In practice this means an incident/nonconformity register that captures, at minimum: a unique reference, date and location, description of what happened, workers and interested parties consulted, root cause analysis performed, corrective actions decided (with the hierarchy of controls consideration visible), a responsible person and due date, and a subsequent verification that the action was effective — not just implemented, but actually effective at preventing recurrence.

10.3 Continual improvement: beyond reacting to incidents

Subclause 10.3 requires the organization to continually improve the suitability, adequacy and effectiveness of the OH&S management system by:

• Enhancing OH&S performance.
• Promoting a culture that supports the OH&S management system.
• Promoting the participation of workers in implementing actions for the continual improvement of the OH&S management system.
• Communicating relevant results of continual improvement to workers, and where they exist, workers' representatives.
• Maintaining and retaining documented information as evidence of continual improvement.

Two elements of 10.3 are distinctive to ISO 45001 compared to equivalent clauses in ISO 9001 or ISO 14001: the explicit reference to promoting a culture that supports the OH&S system, and the requirement to communicate results back to workers. This reflects the standard's underlying premise that an OH&S management system only functions if workers trust it and actively participate in it — a purely paper-based improvement process that never reaches the shop floor does not satisfy the intent of 10.3.

Most common audit errors on clause 10

Across OH&S audits, the following patterns of nonconformity against clause 10 recur most often:

• Near-misses not investigated: the organization has a solid process for accidents that resulted in injury, but near-misses are logged and closed without any root cause analysis or corrective action.
• Root cause analysis stops at the immediate cause: the investigation identifies "worker did not follow procedure" and closes there, without asking why the procedure was not followed — was it unclear, impractical, or was the worker never adequately trained on it?
• Corrective action jumps straight to PPE or training: the easiest, cheapest fix (a new sign, a toolbox talk, a PPE reminder) is applied without documented consideration of elimination, substitution or engineering controls higher in the hierarchy.
• No effectiveness verification: the corrective action is implemented and the file is closed, but nobody goes back weeks or months later to confirm the same failure mode has not recurred.
• Continual improvement not communicated to workers: 10.3 requires results to be communicated to workers and their representatives, but improvements are often tracked only in management review minutes that never reach the shop floor.

Frequently asked questions about ISO 45001 clause 10

Does ISO 45001 require investigating near-misses the same way as accidents that caused injury?

Yes. Clause 10.2 applies to "incidents," a term the standard defines broadly to include occurrences that could result in injury and ill health, not only those that did. A near-miss where no one was hurt still triggers the same requirement: react, investigate with worker participation, determine root cause, decide on corrective action following the hierarchy of controls, and verify effectiveness. Treating near-misses as lesser events with a lighter process is one of the most common gaps auditors find.

What is the difference between a correction and a corrective action under ISO 45001?

A correction is the immediate action to control and correct the incident or nonconformity and deal with its consequences — for example, cleaning up a spill, providing first aid, or isolating a faulty machine. A corrective action goes further: it addresses the root cause so the same incident does not recur or occur elsewhere. Both are required by clause 10.2, and they are sequential — you correct first, then you investigate and correct the underlying cause.

Why does ISO 45001 specifically mention the hierarchy of controls in clause 10.2?

The hierarchy of controls — elimination, substitution, engineering controls, administrative controls, and personal protective equipment, in descending order of reliability — is a foundational OH&S principle because controls lower in the hierarchy depend on consistent human behavior to work, while controls higher in the hierarchy remove or reduce the hazard itself. ISO 45001 requires that corrective actions be determined in accordance with this hierarchy so organizations do not default to the easiest fix (retraining, a new sign) when a more reliable and permanent fix (removing the hazard, engineering it out) is feasible.

Who must participate in an incident investigation under ISO 45001?

Clause 10.2 requires evaluating the need for corrective action "with the participation of workers" and, where relevant, "the involvement of other relevant interested parties." In practice this typically means the worker(s) directly involved in or affected by the incident, workers familiar with the task or area where it occurred, any workers' OH&S representative or committee member, and — depending on the incident — supervisors, maintenance staff, or contractors if the incident involved contracted work. Excluding the affected worker's perspective from the investigation is a frequent nonconformity.

Is a root cause analysis method like the 5 Whys or fishbone diagram mandatory under ISO 45001?

No. ISO 45001 does not mandate a specific root cause analysis technique. It requires that the organization evaluate the need for corrective action to eliminate the root cause(s) of the incident or nonconformity, and retain documented information as evidence of that evaluation. Methods such as the 5 Whys, fishbone (Ishikawa) diagrams, or fault tree analysis are common, practical ways to demonstrate that a structured root cause analysis was actually performed, but the standard leaves the choice of method to the organization.

How does clause 10 (Improvement) relate to clause 9 (Performance Evaluation) in ISO 45001?

Clause 9 generates the evidence — monitoring and measurement results, internal audit findings, and management review conclusions — that clause 10 requires the organization to act on. An internal audit finding under 9.2, for instance, is a nonconformity that must be processed through the 10.2 corrective action requirements just like an incident would be. Clause 10.3's continual improvement obligation is, in turn, informed by the cumulative pattern of findings and corrective actions generated across clauses 9 and 10 over time — together they form the "Check" and "Act" stages of the OH&S management system's Plan-Do-Check-Act cycle.

Expert ISO 45001 · Updated 2026-07-31 · Step-by-step ISO 45001 series: Article 1 — Clause 4 · Article 2 — Clause 5 · Article 3 — Clause 6 · Article 4 — Clause 7 · Article 5 — Clause 8 · Article 6 — Clause 9