Key Takeaways
- ISO 45001 is the certifiable standard. “ISO 45000” is the name of the family it belongs to — you cannot be certified to ISO 45000.
- The standard contains no electrical clause and never uses the term “arc flash.” It requires proactive hazard identification and risk assessment, and leaves the method to you.
- That silence is the problem. An auditor asking “how do you know your electrical hazards are assessed?” needs evidence, and few facilities can produce it without an arc flash risk assessment and a current one-line diagram.
- NFPA 70E is the recognized method that fills the gap. Section 130.5 requires an arc flash risk assessment before work on equipment energized above 50 volts, reviewed at least every five years or after a major system modification.
First, the naming question: ISO 45000 or ISO 45001?
ISO 45001 is the one you certify to. ISO 45000 is the family designation covering a group of related occupational health and safety documents, not a certifiable standard in its own right. If someone says their company is “pursuing ISO 45000,” what they are almost always pursuing is ISO 45001:2018.
The other members of the family are guidance, not requirements:
- ISO 45001 — the occupational health and safety management system standard. Certifiable through an accredited body via a two-stage audit, then maintained by periodic surveillance.
- ISO 45002 — implementation guidance for ISO 45001.
- ISO 45003 — guidance on psychological health and safety at work.
Only ISO 45001 carries auditable requirements (ISO). For anyone writing internal documents, responding to a customer questionnaire, or searching for what their obligations are, the number that matters is 45001.
What ISO 45001 actually requires
Clause 6.1.2 is where electrical work gets pulled in, and it is worth reading closely because of what it does not say.
Clause 6.1.2.1 requires the organization to establish, implement, and maintain a process for hazard identification that is ongoing and proactive. That process has to account for how work is organized, routine and non-routine activities, past incidents, potential emergency situations, human factors, and people with access to the workplace (ISO 45001:2018).
Notice what is absent. There is no electrical clause. No mention of arc flash, incident energy, approach boundaries, or one-line diagrams. The standard describes the shape of an acceptable process and deliberately leaves the technical method to the organization and to whatever consensus standards apply in its industry.
For most hazards in a plant, that flexibility is fine. Machine guarding, chemical exposure, and fall protection all have well-worn assessment methods that safety managers already run. Electrical hazards are where it tends to break down.
Why electrical hazards create an evidence gap
Here is the practical failure mode. A safety manager assembles the hazard register and writes something like “electrical shock and arc flash; controlled by PPE and qualified-person training.” That reads as a real control. In an audit, it invites one more question: how do you know which PPE, and based on what?
Answering that requires knowing the incident energy at each piece of equipment. Knowing incident energy requires a study. A study requires an accurate one-line diagram, and the one-line is exactly the document that quietly goes stale in a facility that has added, removed, or re-fed equipment over twenty years without updating the drawing.
So the chain runs backwards from a single audit question to a modeling exercise most facilities have not done recently:
- Hazard identification must be proactive. You cannot wait for an incident to establish that arc flash is a hazard.
- Controls must be justified; “we wear PPE” is a control, but selecting the right PPE depends on incident energy at that location.
- Incident energy comes from a study which needs accurate equipment data, protective device settings, and available fault current.
- The study needs a current one-line diagram – and this is where most facilities discover the drawing no longer matches the building.
None of these steps is stated in ISO 45001. All of them follow from taking clause 6.1.2 seriously.
NFPA 70E is the method that closes the gap
Because ISO 45001 does not prescribe a technique, the sensible move is to use the consensus standard that already governs electrical safety in the workplace.
NFPA 70E Section 130.5 requires an arc flash risk assessment before work is performed on equipment energized above 50 volts, and that assessment must be reviewed at least every five years or whenever a major modification changes the arc flash hazard. OSHA reinforces the same expectation from a different direction: 29 CFR 1910.333 requires employers to identify workplace hazards, train employees to work safely around them, and provide appropriate PPE — and OSHA points to NFPA 70E as the recognized way to meet that obligation.
That makes NFPA 70E compliance the cleanest possible answer to the audit question. Instead of describing an internal process, you produce a dated arc flash risk assessment, equipment labels showing incident energy and required PPE, a maintained one-line diagram, and a written electrical safety program. An auditor evaluating clause 6.1.2 is looking for exactly that kind of documented, methodical evidence.
For more on what an arc flash study involves, see our guide to arc flash hazard analysis. If your equipment is also due for condition assessment, infrared thermography and ultrasonic testing feed useful data into the same maintenance record.
What to have ready before the audit
If ISO 45001 certification is on your roadmap, the electrical portion comes down to four artifacts:
- A current one-line diagram reflecting the system as it exists today, not as it was commissioned. Start here, everything else depends on it.
- An arc flash risk assessment within the five-year review window, or newer if the system has been modified.
- Equipment labels showing incident energy, arc flash boundary, and required PPE, so the control is visible at the point of work.
- A written electrical safety program covering energized work permits, qualified-person training records, and how the assessment gets reviewed.
Facilities that already run a maintenance program tend to have pieces of this. The gap is usually the one-line diagram, and it is the longest-lead item, which is why finding out during a gap analysis is uncomfortable and finding out during the audit is worse.
Frequently Asked Questions
Does ISO 45001 require an arc flash study?
Not explicitly. ISO 45001 requires proactive hazard identification and risk assessment without specifying methods for any particular hazard. In practice, an arc flash risk assessment is the standard way to demonstrate that electrical hazards have been assessed and that PPE selection is justified.
Is ISO 45000 the same as ISO 45001?
No. ISO 45000 is the family name for a group of occupational health and safety documents. ISO 45001 is the certifiable standard within that family. Organizations certify to ISO 45001.
How often does an arc flash risk assessment need updating?
NFPA 70E requires review at least every five years, or sooner if a major modification changes the arc flash hazard — a service upgrade, a new transformer, or changed protective device settings all qualify.
We already comply with NFPA 70E. Does that cover the ISO 45001 electrical requirement?
It covers the technical substance well. What certification adds is the management-system wrapper: evidence that the assessment is reviewed on a schedule, that findings drive corrective action, and that the process is documented rather than informal.
If ISO 45001 certification is ahead of you and you are not certain your one-line diagram still matches your building, talk to C&H Electric about an arc flash hazard analysis — the drawing is the long pole, and it is far easier to address before an auditor asks than during.