Polarisk

Guide · Psychosocial risk

ISO 45003 explained: managing psychosocial risk at work

ISO 45003 is the international standard for managing psychological health and safety at work. It gives employers a practical way to identify psychosocial hazards, assess the risk they create, and put controls in place.

Polarisk module: psychosocial risk. The wider platform runs statutory health surveillance.

By Dr Kirath Sidhu, occupational health physician. Reviewed 26 July 2026.

ISO 45003 is guidance rather than a certifiable standard: you cannot be certified to it the way you can to ISO 45001. It sits alongside your legal duty to protect staff from work-related stress, and gives you a recognised method for meeting that duty. This guide explains what it covers, what good control looks like, and where to start.

What ISO 45003 is, and what it is not

ISO 45003 was published in 2021 as guidance for managing psychosocial risk within an occupational health and safety management system. It describes the hazards to look for, how to assess them, and the kinds of control that work.

  • It is a standard for the organisation, not the individual. It looks at how work is designed and managed, not at diagnosing any employee.
  • It is guidance, not certification. There is no pass or fail audit for ISO 45003 on its own. It is used to show that an employer has taken reasonably practicable steps.
  • It complements your local duty. In the UK the duty comes from the Health and Safety at Work Act and the Management Regulations. ISO 45003 is a method for meeting whichever duty applies to you.

The psychosocial areas to assess

ISO 45003 groups psychosocial hazards into how work is organised, the social factors at work, and the work environment. In practice, these are the areas to look at.

  • Workload and job demandsToo much or too little work, time pressure, and how demands are monitored.
  • Job controlHow much say people have over how their work is done.
  • Manager and peer supportWhether managers are equipped to recognise and respond to psychosocial risk.
  • Role clarityWhether people know what they are accountable for, and whether they are given conflicting responsibilities.
  • Workplace relationshipsIncluding the prevention and resolution of bullying and harassment.
  • Change managementWhether major changes are assessed for their psychosocial impact and communicated properly.
  • Recognition and fairnessWhether recognition and decisions are consistent and are seen to be fair.
  • Work environment and exposureIncluding remote, isolated, frontline and trauma-exposed work.
  • Governance and processWhether you assess psychosocial risk on a set cycle, with a confidential channel to raise concerns. This is the backbone a regulator looks for first.

What good control looks like

ISO 45003 describes a process you can repeat and evidence, not a single survey. Good practice assesses psychosocial risk at work-unit level so no individual is identified, acts on the highest risks first, and reviews on a cycle so you can show whether the controls worked. A one-off survey that sits in a drawer does not meet that intent.

The most common mistake. Treating it as a wellbeing measurement exercise. ISO 45003 asks about the conditions of the work, not about how people feel. A score that tells you morale is low gives nobody anything to do; a finding that demands are unachievable in the hours available does.

How it connects to your legal duty

  • United KingdomEmployers must assess and manage work-related stress under the Health and Safety at Work Act and the Management Regulations. The HSE Working Minds campaign has made this an enforcement priority.
  • AustraliaManaging psychosocial hazards is a legal duty across the states and territories, with Victoria's regulations having commenced on 1 December 2025. The free government People at Work survey is scheduled to close in October 2026, so employers relying on it need another way to assess and evidence their controls.
  • United StatesThere is no federal mandate, but exposure is real through the OSHA General Duty Clause, rising mental-health compensation claims and human-capital disclosure. ISO 45003 is the benchmark employers adopt ahead of regulation.

Where to start

Establish where you stand before deciding what to buy. The two-minute readiness check scores your position across the areas above and shows the three gaps worth closing first. If you already know psychosocial risk is a problem, a scoped assessment with a clinician's signature is the faster route to something a board will act on.

Questions

Common questions

Is ISO 45003 mandatory?

No. ISO 45003 is guidance. What is mandatory is your local duty to manage psychosocial risk, which exists under UK health and safety law, Australian work health and safety law and equivalents elsewhere. ISO 45003 is a recognised way to meet that duty.

Can you be certified to ISO 45003?

Not on its own. Unlike ISO 45001, ISO 45003 is a guidance standard with no pass or fail audit. Some bodies verify alignment with it, usually alongside an ISO 45001 audit. Anyone selling you ISO 45003 certification is selling something that does not exist.

Who should run a psychosocial risk assessment?

The duty sits with the employer. Many providers can run a survey; the question is who reads the results. A registered occupational health doctor can read the pattern clinically and sign a defensible report, which a survey platform alone cannot. That signatory is always a clinician registered in the jurisdiction the report is issued in, named with their register and number. This page's author, Dr Kirath Sidhu, leads the clinical method and is registered in Malaysia, so he is not the signatory for UK reports. Why we say so.

How often should we reassess?

On a set cycle, and after any significant change. An annual cycle is common, and it is the second measurement that carries the value, because it is the one showing whether the controls you put in place actually moved the risk.

How does this relate to statutory health surveillance?

They are separate duties with separate budgets. Statutory health surveillance is a hard legal requirement attached to specific exposures such as noise, vibration and hazardous substances, on a fixed cadence. Psychosocial risk is a duty of care that boards increasingly want evidenced. Polarisk runs both, and for exposure-heavy employers the usual order is surveillance first. See the six statutory programmes.

Where to start

See where your organisation stands

The readiness check scores your position against ISO 45003 and your local duty in about two minutes. No sign-up, and nothing about any individual employee.

Take the readiness check Book an intro call