[ISO 45001 Series] Defining External Interested Parties and External Issues

Origin of This Series

In my second master’s program, I wrote a thesis that used an occupational health and safety management system to structure the content of an employer’s duty of care. Part of the thesis discussed the relationship between management systems and an employer’s duty of care from a predominantly legal perspective, and that part was successfully published as an article.

For further reading, see my article: The Connotation of Employer's Protection Obligation to Prevent Occupational Accidents- Concretized by Occupational Health and Safety Management System.

Most of the thesis, however, was devoted to making ISO 45001 more concrete. Taiwan adopted ISO 45001:2018 as CNS 45001 in 2018, and my aim was to give organizations in different industries enough practical guidance to build an ISO 45001-compliant occupational health and safety management system on their own. Once the thesis was finished, this material seemed destined to remain buried inside it, and it did not readily fit another academic publication. That felt like a waste, especially because the ideas could not reach people who might use them. After thinking it over, I decided to put the material somewhere that the right reader might stumble across it XD. That would still be better than leaving it buried in a sea of theses—and this series was born!

Because this is the first article in the series, I will begin with a brief overview of ISO 45001, the problems created by the way its requirements are written, and why they need to be made more concrete. This is closer to a focused discussion than a basic tutorial, however, so I will not explain the elementary structure and clauses of ISO 45001 in depth. Please do a little background reading first : D.

This article will be easier to follow if you already have a basic understanding of the structure and requirements of ISO 45001.

The Development of Occupational Health and Safety Management Systems

In recent decades, many businesses in industrialized countries have become multinational enterprises and adopted standardized approaches to make their operations easier to manage. Against this background, the International Organization for Standardization (ISO) published the ISO 9000 family for quality management systems and the ISO 14000 family for environmental management systems. Both became widely used in business and corporate management. These standards are voluntary rather than mandatory, and certification may be provided by designated external bodies in each country.

Early occupational health and safety management systems, by contrast, were developed mainly at the national level. The United States introduced the Voluntary Protection Programs (VPP)_[1], while the United Kingdom developed BS 8800, the Guide to Occupational Health and Safety Management Systems_[2]. Following the success of BS 8800, the British Standards Institution developed and published OHSAS 18001 in 1999 using ISO 14001 as a structural model. For almost eighteen years after its publication, countries around the world used OHSAS 18001 as a basis for their own national standards; it is fair to say that OHSAS 18001 dominated the middle period in the development of occupational health and safety management systems_[3]. After reviewing more than twenty management systems worldwide, the International Labour Organization published the Guidelines on Occupational Safety and Health Management Systems, commonly known as ILO-OSH, in 2001. Unlike the preceding standards, ILO-OSH emphasized increasing globalization and cooperation and reflected the need for systems to keep developing as operations changed_[3].

To encourage and assist enterprises in Taiwan to establish autonomous safety and health management systems, the Ministry of Labor and its predecessors have promoted voluntary evaluation systems since 1994. Improving workplace safety and health nevertheless depends on a sound occupational health and safety management system. To expand participation, the government amended legislation to require large and high-risk enterprises to prioritize safety and health management, providing a legal basis for these systems. It then combined ILO-OSH and OHSAS 18001 for the first time under a “union” model and issued the Taiwan Occupational Safety and Health Management System Guidelines (TOSHMS) on August 13, 2007. TOSHMS was designed for organizations of many kinds, and its combination of the two standards allowed certified organizations to obtain OHSAS 18001 certification at the same time_[4]. The growing importance of risk assessment and management can also be seen in Taiwan’s 2013 amendments to the Occupational Safety and Health Act, including risk assessment duties associated with the design, manufacture, and importation of machinery and equipment, engineering design and construction, and health-risk assessment for hazardous chemicals_[5].

After approximately twenty years of OHSAS 18001, ISO drew together OHSAS 18001, ILO-OSH, other widely cited occupational health and safety management systems, and relevant ILO conventions and recommendations. ISO accepted the proposal for ISO 45001 in 2013 and formally published the first ISO standard dedicated to occupational health and safety management systems on March 12, 2018. It also adopted the expression “occupational health and safety” (OH&S), rather than the traditionally used “occupational safety and health” (OSH)_[6]. For organizations already certified to OHSAS 18001, the International Accreditation Forum (IAF) established migration requirements in IAF MD 21. A three-year migration period began when ISO 45001 was published on March 12, 2018; after it ended, OHSAS 18001 certificates were withdrawn unless the organization had migrated to ISO 45001_[7].

After comparing the existing TOSHMS certification criteria with ISO 45001, Taiwan’s Ministry of Labor concluded that their substantive content was largely similar despite structural differences. The day after ISO 45001 was published, the Ministry issued a press release_[8] setting out measures to align Taiwan with the new international standard: (1) adopt ISO 45001 as a national occupational health and safety management-system standard; (2) help organizations holding TOSHMS certificates migrate; (3) amend relevant legislation to require high-risk enterprises and enterprises above specified thresholds to establish occupational health and safety management systems; and (4) revise rules for occupational safety and health awards so that organizations conforming to the national standard would be eligible. ISO 45001 was subsequently adopted as Taiwan’s national standard CNS 45001 on December 14, 2018.

Why ISO 45001 Requirements Need to Be Made More Concrete

The greatest practical difficulty with ISO 45001 is that its requirements are highly abstract and therefore need to be made more concrete. I suspect this is because ISO 45001 was intended to apply broadly to organizations of every size, type, and activity—including sole proprietors, companies, corporate groups, firms, public authorities, partnerships, charities, and academic institutions. If every requirement were written too specifically, the standard could not work across such a wide range of organizations.

Although the standard includes guidance in its annex to explain the clauses, implementation can still feel extremely abstract.

In my thesis, I therefore used the ISO 45001 framework as a structure and drew on Taiwan’s current law and relevant disciplinary knowledge to propose more concrete and workable methods for establishing the management system.

ISO 45001 is extensive and covers many subjects, so this article focuses only on defining the scope of “external issues” and “external interested parties.”

How ISO 45001 Frames the Investigation of External Issues

ISO 45001 places the organization’s initial review, the needs and expectations of workers and other interested parties, and the determination of the scope of the occupational health and safety management system within Clause 4, “Context of the organization.” Taken as a whole, this part comprises two tasks: investigating the context and determining the scope of the management system.

ISO 45001 divides the investigation into internal and external issues. External issues concern the interaction between the organization and its external environment, while internal issues focus on conditions within the organization itself. Before establishing and operating an occupational health and safety management system, an organization must therefore understand not only its own circumstances in depth but also its position in the wider environment and the effects that environment may have.

On external issues, ISO 45001 states only that the organization must determine the external and internal issues relevant to its purpose that affect its ability to achieve the intended outcomes of its occupational health and safety management system.

Annex A.4.1(a) gives more detailed examples of external issues, including: (1) international or regional cultural, social, legal, regulatory, financial, and economic factors; (2) the introduction of competitors, contractors, and partners and the organization’s relationships with them; (3) new technologies, legislation, or occupations; (4) the effects of products on safety and health; (5) trends affecting the organization or its industry; and (6) relationships with external interested parties, including their perceptions and values.

The 2024 Amendment and the 2027 Revision Process

This article was first published on March 21, 2022 and is based primarily on ISO 45001:2018 and the CNS 45001 framework then in force. In 2024, ISO published ISO 45001:2018/Amd 1:2024. Clause 4.1 now expressly requires an organization to determine whether climate change is a relevant issue, while Clause 4.2 notes that relevant interested parties can have requirements related to climate change_[13][14].

In the context of this article, the amendment does not displace the method of using external interested parties to focus the investigation of external issues. Instead, it adds a line of inquiry that cannot be skipped. An organization must genuinely determine whether climate change affects its occupational health and safety management system. When reviewing government agencies, supply chains, contractors, investors, neighbouring communities, and other interested parties, it should also identify climate-related legal, contractual, operational-resilience, working-environment, and emergency-response requirements. Even if the organization concludes that climate change is not relevant, it should be able to explain the process and basis for that determination. The joint IAF–ISO communiqué states that the 2024 additions do not change the original intent of Clauses 4.1 and 4.2, but certification bodies should verify that organizations have considered climate change_[14].

The first full revision of ISO 45001 is currently expected in 2027. As of September 2026, the revision remained at the Draft International Standard (DIS) stage, and the content may still change before final publication_[15]. Public summaries of the DIS indicate that Clause 4 is expected to address climate change, modern ways of working, and broader interested-party expectations more explicitly. Clause 4.1 adds examples of internal and external issues, while Clause 4.2 strengthens consideration of worker diversity when determining needs and expectations_[16][17]. Future use of the method in this article should therefore go beyond listing categories of interested parties and ask whether remote or platform work, emerging technology, differing worker characteristics, and climate risks alter the needs and expectations of the parties or the organization’s OH&S risks. Until the revised standard is formally published and Taiwan completes any corresponding adoption process, however, implementation and certification should follow the formal standards and legislation in force at the relevant time.

Connecting External Issues with Interested Parties: A Practical Method

An organization may face a vast and complicated range of external issues, and it cannot reasonably be expected to understand every one of them. At a minimum, however, it should develop a comprehensive understanding of external issues that are directly relevant to the organization and its purpose and that can affect its ability to achieve the intended outcomes of the occupational health and safety management system.

The examples of external issues in ISO 45001 are broad. Although they indicate subjects that should be investigated, they remain general enough that an organization may struggle to focus on issues that will actually improve the management system. I therefore suggest investigating potential external issues through the organization’s relationships with its “external interested parties.” This approach makes the otherwise abstract scope of external issues more concrete and simultaneously helps meet the standard’s requirement to understand the needs and expectations of interested parties. External issues must include both domestic and international information; the investigation cannot be limited to Taiwan.

Drawing on the clauses and annex of ISO 45001 as well as practical guidance_[3], I group the external interested parties illustrated by the standard into three broad categories: parties that exercise an oversight effect on the organization; parties that compete or cooperate with it; and parties directly or indirectly connected with its products.

The first group includes regulatory authorities, other government agencies, academic and research institutions, investors, and civil-society organizations. Parties directly or indirectly connected with the organization’s products include customers and non-customers who are nevertheless affected by those products. Neighbours, the wider public, and the media should also be considered.

The following diagrams summarize these categories. The sections that follow explain them in greater detail.

Regulatory Authorities

Here, a “regulatory authority” means the competent central or local authority designated by the legislation under which an organization is established or by its organic law. The relevant authority therefore varies with the nature of the organization. ISO 45001 defines “organization” broadly enough to include legally established companies, public and private enterprises, academic institutions, charities, and firms. I suggest treating the competent authority designated by the organization’s governing legislation or organic law as its regulatory authority for this analysis. If that authority delegates, commissions, or entrusts another agency or local government with occupational safety and health matters or matters related to the organization’s purpose, the receiving agency or local government should also be included.

For example, under Article 5, Paragraph 1 of Taiwan’s Company Act, the central competent authority for a company limited by shares is the Ministry of Economic Affairs, while in a special municipality it is the municipal government. Because the Company Act permits particular matters to be delegated, commissioned, or entrusted to other agencies or local governments, those bodies may also need to be treated as regulatory authorities. For a “civil association” governed by the Civil Associations Act, Article 3 designates the Ministry of the Interior at the central level, a special-municipality government within a special municipality, and a county or city government within a county or city. The Ministry and the relevant local governments are therefore regulatory authorities. For national, municipal, or private universities, the University Act and the Private School Law make the Ministry of Education and relevant local governments the applicable authorities. Under Article 11 of the Medical Care Act, the regulatory authorities for medical institutions are the Ministry of Health and Welfare and the relevant local governments.

External issues connected with regulatory authorities may include new policies, the enactment and implementation of legislation, the provision of new knowledge and technology, and supervisory measures taken under statutory authority to assess appropriateness and legal compliance. The authorities’ needs and expectations include the organization’s compliance with the legislation, regulations, orders, or organic law under which it operates.

Other Government Agencies

“Other government agencies” means government bodies other than the regulatory authorities described above that are directly relevant to the organization’s purpose and can affect its ability to achieve the intended outcomes of its occupational health and safety management system. At a minimum, I suggest considering the Ministry of Labor; the National Science and Technology Council (NSTC); the Ministry of Environment and its subordinate agencies; the National Fire Agency, Ministry of the Interior; the Ministry of Health and Welfare; and any other agencies or local governments entrusted, commissioned, or delegated to handle relevant matters. Additional agencies should be considered according to the characteristics of the organization.

The Ministry of Labor and related bodies—such as the Occupational Safety and Health Administration and local labor departments—must be included because the Ministry is responsible for national labor affairs, labor policy, and labor legislation; it provides labor-related knowledge and technology and techniques for preventing occupational accidents_[9]. These responsibilities are inseparable from an occupational health and safety management system. Relevant external issues may include labor-policy initiatives, knowledge and technology for worker health and protection, occupational-accident prevention, the enactment and implementation of labor legislation, and accident-rate requirements and statistics. Related needs and expectations may include compliance with labor laws and regulations, including the Occupational Safety and Health Act and the additional requirements applicable to high-risk industries or industries using hazardous substances; lower frequency and severity of occupational deaths, disabilities, injuries, and illnesses; improved working conditions; stronger organizational OH&S knowledge and technology; and cooperation with labor-policy initiatives.

The National Science and Technology Council (NSTC; the Ministry of Science and Technology when this article was first written) is principally responsible for planning and coordinating Taiwan’s science and technology development policies and allocating related resources_[10]. Technological development encompasses not only new technologies used in an industry or its products but also programs that can improve working conditions and advance hazard prevention or identification. The NSTC can therefore serve as an external interested party and source of external issues involving new knowledge and technology. Its corresponding needs and expectations concern advances in knowledge and technology relevant to industry and occupational health and safety.

The work of the Ministry of Environment, its subordinate agencies, and other agencies or local governments exercising delegated or commissioned authority includes air-quality protection and noise control, water-quality protection, waste management, environmental sanitation and toxic-substance management, regulatory evaluation and dispute resolution, and environmental monitoring_[11]. Organizations may use toxic chemicals or other hazardous substances or generate waste, air pollutants, and noise. These may directly or indirectly affect workers and nearby residents and are plainly connected with OH&S performance and the management system. Relevant external issues may include air and water pollution, waste discharge and control, the use and control of dangerous or hazardous substances, and noise control. Needs and expectations may include supporting policies that reduce pollutant emissions and the use of hazardous substances and that encourage energy- and water-efficient processes.

Fire and explosion are common occupational hazards. Expertise, technology, and systems for prevention and emergency response fall within the responsibilities of the National Fire Agency, related bodies, and local governments_[12]. They should therefore be treated as external interested parties and sources of external issues involving new knowledge, new technology, and disaster-prevention and response systems. Their needs and expectations include effective prevention measures, cooperation with emergency-response policy, the establishment of response systems, and coordination when a disaster occurs.

The purpose of an occupational health and safety management system is ultimately to protect workers’ physical and mental health by improving the working environment, which aligns with the direction and vision of the Ministry of Health and Welfare. Many of the Ministry’s policies affect workers and OH&S systems. The health-care system, for example, provides medical treatment and National Health Insurance coverage following occupational accidents. When establishing its management system, an organization can consider and cooperate with the Ministry’s health education, knowledge, medical system, resources, and related policies. The Ministry’s possible needs and expectations include promoting the physical and mental health of workers and other relevant people and ensuring adequate medical care after occupational accidents.

Academic and Research Institutions

This category should include research organizations such as the Industrial Technology Research Institute and Academia Sinica; foundations and associations working in industrial safety and health; and occupational safety and health departments at universities and colleges. These institutions can be sources of new knowledge, technologies, and OH&S professionals, including knowledge, technology, and talent related to product quality and processes, occupational-accident prevention, occupational health and safety, and pollution prevention. Their needs and expectations may include organizations improving their own knowledge and technology in product quality, processes, and accident prevention; training personnel to an adequate level; and bringing in relevant external talent when needed.

Investors

Investors commit funds or resources that enable an organization to conduct activities consistent with its purpose. Regardless of the type of organization, investors therefore have enough influence to affect its policies and direction, while its performance directly affects their interests. They can accordingly be included among external interested parties that exercise oversight over the organization.

Because ISO 45001 is intended to apply across industries, “investor” should be interpreted broadly here. Anyone who invests funds or resources in an organization and shares its risks and returns may fall within this category. For a company limited by shares, investors may be individual or corporate shareholders; for an academic or charitable institution, they may be donors. Whatever their motivation, investors expect the organization to operate normally in accordance with its stated purpose. In a for-profit enterprise, they may expect high profits and market share; in an academic institution, they may expect strong scholarly output. Expectations vary by organization type. Organizational stability may also be a need or expectation, including sound operations, risk management, public image, and information disclosure.

Civil-Society Organizations

In this context, I interpret civil-society organizations as non-academic and non-research groups, institutions, and organizations concerned with occupational health and safety, environmental protection, labor, human rights, and similar issues. External issues to investigate may include new knowledge and advocacy concerning those subjects as well as the organization’s public image among civil-society groups. Their needs and expectations may be that the organization responds to their concerns and participates in relevant activities.

Partners and Competitors

A cooperative relationship is one in which organizations work from a basis of mutual trust to achieve a shared goal. A competitive relationship is the opposite: organizations pursue their respective goals in rivalry with one another. I call external interested parties that cooperate with an organization its partners and those in a competitive relationship its competitors. Whether another organization is a partner or competitor does not depend on whether it belongs to the same field or industry; it depends on how the organization understands and conducts the relationship. Two organizations in the same industry may be partners if they cooperate, while organizations in different industries may be competitors if they treat the relationship as competitive.

Partners may include technology-development organizations in the same or another field, upstream and downstream suppliers, contractors, and similar organizations pursuing a shared purpose. External issues may include the foundation of trust and coordination between partners, their common objectives, trends across industries or disciplines, and new knowledge and technology. Needs and expectations may include strengthening trust and coordination, actively achieving shared objectives, improving each other’s knowledge and technology, and—in some cases—meeting partner requirements for OH&S performance or management-system certification.

Competitors may include organizations in the same field and industry as well as technology-development organizations in the same or another field. Beyond industry or cross-disciplinary trends and new knowledge and technology, relevant external issues include the threats competitors pose, the organization’s strengths and weaknesses in relation to those threats, and possible responses. A competitor’s principal need or expectation is to achieve its own objectives ahead of other competitors and, in some cases, to exclude them.

Parties Directly or Indirectly Connected with Products and Services

External interested parties directly connected with an organization’s products or services are those who directly receive or use them, including current and potential customers. Indirectly connected parties do not directly receive the products or services but are nevertheless affected by them. Relevant issues often involve the quality of the products or services, risk management, occupational health and safety management, pollution control, or the privacy of the people concerned. Their needs and expectations may include products and services reaching an appropriate level of quality and complying with occupational health and safety, environmental-protection, and personal-data-protection legislation.

The Media

As a channel for information, the media may not exercise the same direct influence as investors or regulatory authorities, but public opinion still affects society. I therefore treat the media as a separate category, including television, radio, online media, newspapers, and magazines. For the organization, related external issues concern the management of its public image; the corresponding need and expectation is mutual understanding between the organization and the media.

Neighbours and the Wider Public

This category includes external interested parties that do not fall within the groups above but coexist with the organization in society. Potential external issues include occupational accidents, environmental pollution, and interactions between the organization and society. Their needs and expectations may include zero occupational accidents, compliance with environmental legislation, and constructive communication with neighbours and the wider public.

Using these categories as a starting point, each organization can define the relevant interested parties and the scope of external issues according to its own characteristics while simultaneously identifying their possible needs and expectations.

Cautions and Conclusion

The preceding sections describe possible external issues and the needs and expectations associated with different types of external interested parties. In practice, however, the boundaries between these groups are not clear-cut, nor can external and internal interested parties always be separated cleanly. In a company limited by shares, for example, a “worker” classified as an internal interested party may also own shares and therefore simultaneously occupy the external role of “investor.” Organizations may adapt the categories in this article according to their own type and characteristics.

The needs and expectations of different external interested parties may also conflict. In a profit-seeking organization, for example, investors may want higher returns, while regulatory authorities expect legal compliance. The pursuit of higher profits can sometimes encourage high-risk or even unlawful methods, creating a direct conflict. When such conflicts arise, I suggest first determining whether legislation governs the matter. If it does, the legal requirement must take priority. If it does not, the organization should coordinate the different needs and expectations and seek an appropriate solution.

ISO 45001 intentionally avoids narrowing its field of application, which makes its requirements abstract. This article proposes a more concrete method for identifying external interested parties, external issues, and related needs and expectations. I hope it helps people who want to establish an ISO 45001 management system meet these requirements more effectively within Taiwan’s current legal framework : D.

I will continue publishing material from my thesis throughout this ISO 45001 series : ). I hope it helps the people who need it.

References

[1] U.S. Department of Labor, Occupational Safety and Health Administration. Voluntary Protection Programs. Last accessed September 3, 2026. https://www.osha.gov/vpp

[2] Health and Safety Executive. Lecture note: Health and Safety management systems, pp. 3–4.

[3] Industrial Development Bureau, Ministry of Economic Affairs. Practical Handbook for Promoting Occupational Health and Safety Management Systems in Manufacturing—ISO 45001, 2019, p. 1.

[4] This passage refers to the General Explanation of the Taiwan Occupational Safety and Health Management System Guidelines.

[5] 林瑞玉、張福慶. “A Brief Discussion of Continual Improvement in Occupational Safety and Health Risk Assessment at Workplaces.” Industrial Safety and Health Monthly, no. 340, 2017, pp. 31–41.

[6] Because trends in occupational health are not the focus of this article, they are not discussed in detail. For further reading, see 傅還然, “The Context of ISO 45001: The International Development of Occupational Health,” Industrial Safety and Health Monthly, no. 323, 2016, pp. 9–33.

[7] International Accreditation Forum, Inc. Requirements for the Migration to ISO 45001:2018 from OHSAS 18001:2007, 2018.

[8] Occupational Safety and Health Administration, Ministry of Labor. “Responding to the Formal Publication of the International Occupational Health and Safety Management System Standard.” Last accessed September 3, 2026. https://www.osha.gov.tw/48110/48417/48419/86592/post

[9] Ministry of Labor, Republic of China (Taiwan). Official website. Last accessed September 3, 2026. https://www.mol.gov.tw/

[10] National Science and Technology Council. Official website. Last accessed September 3, 2026. https://www.nstc.gov.tw/

[11] Ministry of Environment. Introduction to the Ministry of Environment. Last accessed September 3, 2026. https://www.moenv.gov.tw/aboutus/introduction/1096.html

[12] National Fire Agency, Ministry of the Interior. Official website. Last accessed September 3, 2026. https://www.nfa.gov.tw/

[13] International Organization for Standardization. ISO 45001:2018/Amd 1:2024, Occupational health and safety management systems—Requirements with guidance for use—Amendment 1: Climate action changes, 2024. https://www.iso.org/standard/88428.html

[14] International Accreditation Forum. “IAF and ISO Publish Joint Communiqué.” February 23, 2024. https://iaf.nu/en/news/iaf-and-iso-publish-joint-communique/

[15] ISO/TC 283. “ISO 45001 Revision Reaches Draft International Standard Ballot Stage.” June 18, 2026. https://committee.iso.org/sites/tc283/home/news.html

[16] BSI. “ISO 45001:2027 – Key Changes and Guidance.” Last accessed September 3, 2026. https://www.bsigroup.com/en-GB/products-and-services/standards-services/iso-45001-key-changes-and-guidance/

[17] DNV. “Revision ISO 45001: Occupational Health & Safety Management System.” Last accessed September 3, 2026. https://www.dnv.com/assurance/Management-Systems/new-iso/transition/revision-iso-45001/