ISO 45003 and psychosocial risks: how to build an effective management system

Do you want to turn psychosocial risk management from a wellbeing initiative into a structured risk management process?

AR19 supports organisations in Italy and the UAE in assessing, managing and integrating psychosocial risks into occupational health and safety systems, in line with the principles of ISO 45003 and ISO 45001.

Contact us to assess your organisation’s maturity and develop an operational roadmap.

Managing psychosocial risks requires more than an employee climate survey or wellbeing initiatives. ISO 45003 provides organisations with an international reference for identifying, assessing and managing psychosocial factors within their occupational health and safety management system.

In this article, we explore how to turn ISO 45003 into a practical process, from initial assessment and leadership to organisational measures and KPIs. We also explain how AR19 can support companies in Italy and the UAE in developing a structured approach to psychological health and organisational performance.

From awareness to psychosocial risk management

In recent years, companies have paid increasing attention to stress, burnout, psychological wellbeing and the quality of the working environment. The next step is to turn this attention into a genuine management system.

Psychosocial risk concerns more than how an individual responds to pressure. It also involves how an organisation designs work, distributes responsibilities, manages workloads, communicates, introduces change and supports its people.

In 2026, the International Labour Organization dedicated World Day for Safety and Health at Work to the psychosocial working environment. The ILO highlights factors such as workload and working hours, role clarity, autonomy, support and fairness in organisational processes.

When these factors become problematic, they can affect people’s health. They can also influence attention, communication, collaboration and the quality of decision-making.

This is why a mature organisation should ask more than:

“How can we help people manage stress better?”

It should also ask:

“Which dynamics within our organisation may generate or amplify risk?”

This is where ISO 45003 plays a practical role. More importantly, this is where building a system that helps the company prevent work-related stress and its consequences becomes essential.

What is ISO 45003?

ISO 45003:2021, Psychological health and safety at work – Guidelines for managing psychosocial risks, gives organisations a structured reference for identifying, assessing and managing psychosocial risks within an occupational health and safety management system based on ISO 45001.

The standard supports the organisation throughout the management process: from identifying risk factors and defining control measures to monitoring results and pursuing continual improvement.

Organisations of any size and in any sector can apply it.

One point requires clarification: ISO 45003 is not a standalone certification standard.

Its value lies in providing criteria and practical guidance to strengthen the management of psychological health and psychosocial risks. Companies that already use an ISO 45001 system can integrate these elements directly into their existing processes.

The aim, therefore, is not to create a separate system dedicated to mental health.

The approach is to integrate psychosocial risks into the organisation’s overall management, linking them to responsibilities, decision-making processes, objectives, improvement actions and performance.

Psychological health thus becomes a full part of the occupational health and safety management system and of organisational governance.

ISO 45001 and ISO 45003: what is the difference?

ISO 45001 and ISO 45003 address two complementary levels of occupational health and safety management.

ISO 45001 defines the requirements for a structured management system. It helps the organisation identify hazards, assess risks, define responsibilities and improve its health and safety performance over time.

ISO 45003 explores psychosocial risk management in greater depth. It examines factors associated with the organisation and management of work that can influence psychological health, wellbeing and, more broadly, people’s ability to work under sustainable conditions.

The two standards therefore complement each other.

ISO 45001 provides the system architecture. ISO 45003 helps the organisation integrate a more informed and structured approach to psychosocial risk management within that system.

For a company that already applies ISO 45001, this means addressing the issue by strengthening existing processes without creating parallel ones.

Why a stress survey is not enough

Questionnaires and surveys help companies understand how people perceive their working environment.

On their own, however, they do not provide the full picture.

Psychosocial risk management requires a broader view. Organisations need to connect people’s perceptions with how they actually structure activities, responsibilities, resources and decision-making processes.

An assessment can therefore examine factors such as:

• workload and pace of work;

• working hours and opportunities for recovery;

• clarity of roles and responsibilities;

• autonomy and control over one’s work;

• quality of support from managers and colleagues;

• internal communication;

• organisational change;

• conflict and inappropriate behaviour;

• remote work and hyperconnectivity;

• availability of resources;

• conflicting objectives or unclear priorities.

The organisation should combine this information with the data it already holds.

Turnover, absenteeism, overtime, errors, near misses, incidents, reports, conflicts, complaints or significant changes in performance can help identify signals that deserve attention.

The aim is not to diagnose individuals.

It is to understand whether and how the work system may create, amplify or sustain particular risk conditions.

How to turn ISO 45003 into a practical process

Applying ISO 45003 involves more than introducing new procedures. It means building a process that connects work organisation, leadership, employee participation, data and continual improvement.

A structured approach can follow seven steps.

1. Define governance and responsibilities

Psychosocial risk management cannot remain confined to HR. It requires involvement across several levels of the organisation. Top management, HSE, HR, operational managers, occupational physicians and other relevant functions need to understand their roles and contribute to defining priorities.

The first step is therefore to clarify responsibilities and objectives.

Does the organisation want to address specific risk factors? Improve change management? Strengthen managerial support? Increase leaders’ ability to recognise weak signals?

Defining these priorities turns a general initiative into an organisational development process.

Without clear governance, the organisation risks multiplying disconnected activities that fail to produce meaningful change.

2. Understand how work actually happens

Procedures, organisation charts and job descriptions tell part of the story. Actual work may tell another. Organisations therefore need to observe how people handle tasks, priorities, pressures, unexpected events and change in practice.

Interviews, focus groups, workshops, observations and document analysis help build a more complete understanding of the context.

This approach also helps avoid overly generic assessments.

A manager, a production operator, a technician who travels frequently and a predominantly remote worker do not necessarily face the same risk factors. The assessment must therefore reflect the real characteristics of their work.

3. Identify and assess risk factors

Once the organisation understands its context, it can identify risk factors and determine their significance and priority. This requires combining different sources.

Quantitative data helps identify trends, recurring patterns and anomalies. Qualitative information helps explain their causes and meaning.

People’s involvement is therefore central.

Those who carry out an activity every day can reveal pressures, difficulties or contradictions that procedures and conventional indicators do not capture.

An effective assessment should go beyond assigning a risk level.

It should help the organisation understand where to intervene, which causes to address and what to prioritise.

4. Address causes as well as effects

This is one of the most important differences between a wellbeing programme and genuine psychosocial risk management.

Psychological support, mindfulness programmes and wellbeing initiatives can make a valuable contribution.

However, they cannot replace organisational action when a problem stems from how the company designs or manages work.

If excessive workloads, unclear roles, conflicting objectives, insufficient resources or ineffective decision-making processes emerge, the company must address these factors too.

Actions may therefore involve processes, roles, shifts, workloads, communication, change management, resources, supervision and leadership.

Prevention becomes more effective when it addresses organisational causes before they affect people and performance.

5. Develop leadership and skills

Managers form one of the most important points of contact between the organisation and its people. They often translate strategic objectives into operational priorities, distribute workloads, manage pressure and navigate change.

Psychosocial risk management therefore requires more than procedures and technical tools. It also requires leadership skills.

The ability to communicate clearly, listen, manage priorities, recognise weak signals and take timely action can make a significant difference.

Management training, workshops, coaching and activities based on real situations help leaders better understand how their decisions affect risk, people and organisational performance.

6. Measure what is changing

Psychosocial risk management also requires indicators. Focusing solely on final outcomes, however, may not be enough.

High turnover, prolonged absences or burnout may reveal a problem only after it has already had serious consequences.

A more mature system therefore combines lagging indicators with early warning signals.

The organisation can monitor, for example, workload trends, team stability, perceptions of managerial support, participation in initiatives, the quality of organisational routines and its ability to complete improvement actions.

The aim is to understand both what has already happened and how the conditions that influence risk are evolving.

At AR19, we consider this a central step: combining traditional indicators with predictive KPIs helps identify weak signals, behavioural changes and potential organisational problems at an early stage. The goal is to support more timely decisions and intervene before risks affect people, processes or performance.

7. Review and improve over time

No management system is ever final. People, technologies, processes, organisational models and external conditions can change. Risks change as a result.

Management therefore needs to review results, indicators and actions periodically. It must understand which measures are producing results, where problems persist and which new signals are emerging.

This continuity distinguishes an occasional assessment from a genuine management system.

ISO 45003 points in precisely this direction: turning psychosocial risk management into a dynamic, integrated process that supports continual improvement.

Psychosocial risks in Italy: beyond work-related stress assessment

In Italy, Legislative Decree 81/2008 requires employers to assess and manage work-related stress as part of the overall assessment of health and safety risks.

For years, INAIL’s methodology has provided companies with a structured reference for this process. Meanwhile, work itself has changed.

Digitalisation, hybrid models, hyperconnectivity, organisational transformation and new ways of collaborating have introduced factors that require an increasingly broad perspective.

Assessment tools are also evolving to capture emerging psychosocial risks associated with remote work and technological innovation, for example.

ISO 45003 can help companies take a further step forward.

Assessment becomes connected to governance, leadership, work organisation, indicators and continual improvement.

The company thus moves from an approach focused mainly on assessment towards a more mature model of psychosocial risk management.

ISO 45003 in the UAE and Dubai

AR19’s experience in complex markets such as the United Arab Emirates confirms that psychosocial risk management requires an approach that can adapt to different regulatory, cultural and organisational contexts.

Occupational health and safety in the UAE is becoming increasingly structured. The federal framework requires employers to ensure safe and appropriate working conditions and adopt measures to protect people from occupational risks.

Locally developed references complement this framework. In Abu Dhabi, for example, ADOSH-SF Code of Practice 9.2, Managing Work-Related Stress, directly addresses work-related stress management and links the quality of work organisation to productivity, human error and performance.

In these contexts, ISO 45003 can offer a useful international reference for establishing a common language and method for psychosocial risk management, particularly for multinational groups, organisations operating in several countries and companies that already use ISO management systems.

From our perspective, the standard’s value lies precisely in its ability to provide a common structure while recognising local circumstances.

ISO 45003 does not replace applicable legislation, which may vary according to the emirate, sector and activity. It can, however, help organisations integrate psychological health, occupational safety, human factors, leadership and organisational performance more consistently.

For AR19, working across different markets means maintaining a sound method and adapting it to the real context in which people and organisations operate.

How AR19 supports companies in applying ISO 45003

AR19 addresses psychosocial risk as a component of organisational management. The aim is to connect people, the management system, culture, leadership and performance within an integrated approach, rather than treating wellbeing as an isolated project.

The process can start with a gap assessment against ISO 45003 principles and a review of the company’s existing system.

This helps establish the organisation’s maturity, identify priority areas and develop a roadmap proportionate to its actual needs.

AR19’s support can include:

• analysis of the organisational context and processes;

• assessment of psychosocial risk factors;

• surveys, interviews and focus groups;

• analysis of organisational data and indicators;

• integration with the ISO 45001 system;

• definition of governance, responsibilities and procedures;

• development of an improvement plan;

• training for managers and key personnel;

• safety leadership and human factors programmes;

• management and operational coaching;

• wellbeing and stress management programmes;

• definition of leading and lagging KPIs;

• audits and system reviews.

AR19’s approach starts with assessment, develops leadership and skills, and measures the effectiveness of actions over time through indicators and reviews.

The process varies according to the organisation.

An SME has different needs from a large industrial business. A company that already has an ISO 45001 system starts from a different position from an organisation that has yet to structure its HSE management model.

The method must therefore maintain rigour and consistency while adapting to the context.

The aim is to build a system that helps the organisation manage risks already present in everyday work, without adding unnecessary complexity.

When should a company start taking action?

Waiting for burnout, high absenteeism or obvious conflict often means intervening after the problem has already caused harm.

Many signals appear earlier.

Rapid growth, restructuring, mergers, changes in working models, rising turnover, difficulties retaining people, conflict between functions, intense pressure to deliver results, shift work and safety-critical activities may all indicate the need for closer examination.

The same applies to organisations with international teams or those undergoing significant technological and organisational transformation.

A structured assessment helps interpret these signals before they become established problems.

It can also be a natural step for companies that want to strengthen their ISO 45001 system and develop more mature health and safety management.

Managing psychosocial risk does not mean reducing business objectives or lowering performance expectations.

It means creating organisational conditions that enable people to work, collaborate and make effective decisions even as complexity increases.

From wellbeing to organisational performance

Psychosocial risk management therefore calls for a change in perspective. Individual support remains important, but asking people to become more resilient is not enough if the organisation does not also examine the conditions in which they work.

ISO 45003 helps shift attention from individual responses alone to the quality of the work system. Leadership, human factors, organisation, employee participation and measurement become parts of a single process.

This is where psychological health, safety culture and organisational performance come together.

An organisation that better understands its psychosocial risks can act earlier, make more informed decisions and create working conditions that sustain people and results over time.

AR19 supports companies in Italy and the UAE in assessing and managing psychosocial risks, integrating ISO 45003 principles into ISO 45001 systems, and developing programmes focused on leadership, organisational culture, human factors and wellbeing.

For information: info@ar19.eu

UAE: uae@ar19.eu

FAQ

Can an organisation obtain ISO 45003 certification?

No. ISO 45003 is a guidance standard and does not provide for standalone certification. Organisations can use it to strengthen psychosocial risk management, including within an ISO 45001 system.

What is the difference between ISO 45001 and ISO 45003?

ISO 45001 defines the requirements for an occupational health and safety management system. ISO 45003 provides specific guidance for identifying and managing psychosocial risks within that system.

What are the main psychosocial risks at work?

The main factors include excessive workloads, long working hours, unclear roles, limited autonomy, poor communication, lack of support, conflict, inappropriate behaviour and ineffective management of organisational change.

Is work-related stress assessment mandatory in Italy?

Yes. Legislative Decree 81/2008 requires employers to assess and manage work-related stress as part of the overall assessment of health and safety risks.

Is ISO 45003 mandatory in Italy?

No. ISO 45003 is a voluntary international reference. However, it can help organisations develop a structured and integrated approach to psychosocial risk management.