For contractors and vendors in Malaysia’s oil and gas sector, health and safety performance is not only a legal obligation. It is part of how operators decide who gets on the vendor list, who wins the tender and who keeps the contract. An ISO 45001 occupational health and safety management system is one of the clearest ways to show that safety is managed, not left to chance.
What ISO 45001 is
ISO 45001:2018 is the international standard for occupational health and safety (OH&S) management systems. It replaced OHSAS 18001 and follows the same high-level structure as ISO 9001 (quality) and ISO 14001 (environment), which makes it practical to run the three as one integrated management system.
At its core, the standard asks you to:
- show leadership commitment and involve workers in safety decisions;
- identify hazards and assess OH&S risks and opportunities;
- know your legal and other requirements, and evaluate compliance with them;
- plan and control operations, including contractors, procurement and change;
- prepare for emergencies;
- investigate incidents, correct nonconformities and improve continually.
The Malaysian legal backdrop
The Occupational Safety and Health (Amendment) Act 2022 came into force on 1 June 2024. Among other changes, it extends the Occupational Safety and Health Act 1994 to all places of work, adds an express duty for employers to carry out risk assessments, requires certain employers to appoint an occupational safety and health coordinator, and significantly increases penalties. Check the current requirements with the Department of Occupational Safety and Health (DOSH) for your situation.
ISO 45001 does not replace the law, but a working system is a strong way to meet it: the hazard identification, risk assessment, legal register and compliance evaluation the standard requires are exactly the evidence a regulator, or an operator’s auditor, will ask for.
What operators typically look for
Requirements differ by operator and by the risk of the work, but contractor prequalification and audits commonly cover:
- an HSE policy and a management system with defined responsibilities;
- job hazard analysis or risk assessment for the work in scope, with controls in place;
- competence and training records for the people doing the work;
- incident reporting, investigation and safety performance statistics;
- control of subcontractors, equipment and permits to work;
- emergency response arrangements;
- evidence that audits happen and that findings are closed.
Certification to ISO 45001 by an accredited certification body does not guarantee you pass every operator audit, but it shows the system exists, is audited independently and is maintained.
A practical route to certification
1. Gap assessment
Compare what you already do (procedures, permits, toolbox talks, inspections) with the standard’s requirements. Most contractors find they have more in place than they expected, but it is not connected into one system or not recorded.
2. Build the system around the work
Set the scope, the risk assessment method, the legal register, and the procedures that the work actually needs. Avoid manuals no one reads; keep documents short and tied to real activities on site.
3. Run it and gather evidence
Operate the system for a period, typically a few months, so there are records of risk assessments, training, inspections, incidents and corrective actions.
4. Internal audit and management review
An internal audit tests the system against the standard, and a management review confirms it is effective. Both are required before certification.
5. Certification audit
An accredited certification body carries out a two-stage audit. Consultants prepare you for it; they do not issue certificates, and staying independent of the certification body is the point.
Integrate where it makes sense
If you already hold, or need, ISO 9001 or ISO 14001, building one integrated system with shared document control, internal audit and management review saves effort and reduces audit days. Many operators ask about quality and environmental management alongside safety.
Want an independent view of where you stand?
Our senior team in Kuala Lumpur can review your current arrangements and give you a clear, prioritised plan.
This article is general information, not legal or professional advice. Requirements can change; check the current law and guidance, or speak to us about your circumstances.
