FROID NR-1 · ISO 45003
When discussing ISO 45003 and psychosocial risks, it is important to separate the management framework, the chosen instrument and the documentation produced by the organization.
The FROID NR-1 proposal treats ISO 45003 as a reference for discussing psychosocial risk management. This does not mean that FROID is certified, approved or endorsed by ISO.
A map guides the route; it does not prove that the journey was made. In the same way, citing a standard does not prove that measures were carried out or that an instrument is of good quality.
Conformity assessment and regulatory interpretation are the responsibility of the technical and legal professionals. The software organizes records but does not replace that work.
The product structures the path from the campaign to the follow-up records. The project must spell out the documents and the responsibilities, rather than presenting a mention of ISO as a universal guarantee.
See the management cycle · Define scope and responsibilities
The reference
Precision matters here, because most of the market describes this standard wrongly — and describing it wrongly is the first thing a management-system auditor notices.
“This document gives guidelines for managing psychosocial risk within an occupational health and safety (OH&S) management system based on ISO 45001.”
“This document is intended to be used together with ISO 45001, which contains requirements and guidance on planning, implementing, reviewing, evaluating and improving an OH&S management system.”
ISO 45003:2021 — Occupational health and safety management — Psychological health and safety at work — Guidelines for managing psychosocial risks. Committee ISO/TC 283, first edition, June 2021. Applies to organisations of every size and sector.Being a guidance standard rather than a requirements standard, ISO 45003 does not constitute an accredited system and therefore falls outside accredited certification scope. A vendor advertising “ISO 45003 certification” is selling something that does not exist in those terms — and that is one of the few claims a management-system professional dismantles in seconds.
We do not certify either. Saying so is part of being anchored in it honestly.
ISO 45003 does not measure, does not classify and does not produce a risk inventory. It describes categories of psychosocial hazard and how to manage them inside the system — and it has to be combined with an assessment methodology that it does not itself provide.
So there is a consolidated global reference and a methodological vacuum underneath it. That vacuum, not the standard, is what FROID occupies. We are not a competing framework: we are the instrument that operates the framework that is already the reference.
The argument that decides
This is the most important passage on the page, and it is literal. The Brazilian labour ministry's guide is quoted because it is the clearest written statement of a test that audits apply everywhere — and because that same guide cites ISO 45003 twice in the body and once in its formal bibliography, alongside ISO 45001:2018.
“Regarding assessment tools/questionnaires/surveys, the MTE does not define or suggest any specific methodology. This is a matter the organisation, together with its OH&S professionals, needs to examine and decide.”
“That specific tool must be appropriate to the risk or circumstance under assessment.”
“When using a specific tool, one must verify whether it is scientifically grounded — that is, whether there is a scientific study or a national or international OH&S body or institution that provides it with grounding and support.”
“If any kind of questionnaire is used [...] it is very important to preserve anonymity, and to guarantee it to the worker.”
Guide to Work-Related Psychosocial Risk Factors — Ministry of Labour and Employment, Brazil, 2025. Literal excerpts, translated from the Portuguese original; the wording that carries legal weight is the Portuguese one, reproduced on the Portuguese edition of this page.Read the sequence closely. The regulator (1) refuses to name a methodology, leaving the burden of the choice with the employer; (2) requires the tool to be appropriate to the risk; and (3) requires backing from an occupational health and safety body or institution, national or international.
ISO is literally that international body, and ISO 45003 is literally that backing. Being anchored in it is not marketing positioning — it satisfies the very criterion a regulator wrote down for accepting an instrument. Nothing in that test is specific to one country: an auditor anywhere asks the same question in different words.
And the fourth excerpt closes the circle: the guide requires anonymity guaranteed to the worker, which is precisely what a boundary enforced by the database delivers — and what a policy promise does not.Why the method was hardened
The distinction is not national pride — it is the technical explanation of why an instrument built there arrives in other jurisdictions with room to spare.
Several countries have required psychosocial risk assessment for more than a decade, by different routes. What sets the Brazilian regime apart is not the date: it is the nature of the requirement. Where most regimes impose a duty of conduct — act so far as is reasonably practicable — the Brazilian rule demands an artefact.
The obligation is one of means: identify, control and review psychosocial risks so far as is reasonably practicable. The defence, when called for, is to show that you acted reasonably. What is examined is conduct.
The obligation is one of documented result: a risk inventory with nine minimum data points, an action plan with a schedule, an owner, a follow-up method and a verification method for each measure, a written record of the risk-management criteria — and a clause requiring the effectiveness of measures already implemented to be taken into account when grading probability. What is examined is the paperwork.
Hence the asymmetry that matters to anyone operating outside Brazil. An instrument built to survive documentary scrutiny satisfies a duty-of-conduct regime without effort. The reverse is not true: whoever only had to act reasonably does not have, on the day of the challenge, the calculation trail, the versioned criteria and the cycle-over-cycle comparison that a documentary requirement forces you to produce from day one.
We were not the first. We were the strictest — and it is the strictness, not the date, that travels.The subject did not begin with the Brazilian rule or with ISO 45003. The line below is what supports the claim that Brazil inaugurated nothing — and that what it did differently was something else.
For companies that already run a management system
That is the difference between a proposal that demands a strategic decision and one that completes a structure you already chose.
By ISO's own definition, 45003 is the psychosocial layer of a system based on ISO 45001. If your company already runs 45001 certified and audited, the reference is not new — it is the part of it that still had no instrument.
An anchored instrument, floors enforced in the database, grading by severity and probability, and a like-for-like effectiveness comparison between cycles. It enters as a component of a mature system, not as a replacement for it.
We do not issue expert reports, we do not sign your risk-management programme and we do not replace your occupational health service. Responsibility for managing risk remains entirely the organisation's, and the instrument exists to inform it — not to assume it.
Limits
