Revisiting EAP Through ISO 45003 | How to Transform Counseling Welfare into Psychosocial Risk Management

📥 View Psychosocial Risk Factor Checklist

📌 ISO 45003: Why EAP Managers Need to Know It

ISO 45003 is a guideline published by the International Organization for Standardization (ISO) in June 2021. Its official name is "Occupational Health Management – ​​Psychological Health and Safety in the Workplace – Psychosocial Risk Management Guidelines," and it was designed to be used within the ISO 45001 Occupational Health Management System. It can be applied regardless of company size or industry.

The standard is psychosocial risk Potential exposure to work-related psychosocial hazards class The severity of potential injuries and health impairments resulting from it It is defined as viewing it together. What changes is the perspective. Stress and burnout are not viewed as issues of an individual employee's mindset, but rather as risks arising from how work is structured and managed. Therefore, countermeasures also start from changing the work and the organization rather than individual counseling.

ISO 45003 is a guideline containing recommendations, not mandatory requirements. Companies can adopt it as their own internal standard for operation, or they can undergo an audit by a certification body to confirm that they are operating in accordance with this standard.

This standard is important for EAP managers because EAP spans two roles simultaneously. It serves as a support tool to assist affected employees, while also acting as a data source for identifying and assessing risks through aggregated reporting and organizational diagnostics. This provides the basis for transforming EAP, which was previously used merely as a counseling channel, into a key pillar of the risk management system.

⚖️ 4 items that overlap with legally mandated obligations

Although ISO 45003 is an unfamiliar name to domestic officials, its content overlaps significantly with measures already included in the law.

Adopting ISO 45003 does not create new legal obligations. It is useful in practice because it combines these previously separate measures into a single risk identification, a single countermeasure plan, and a reassessment based on the same standards.

🔍 Identifying Psychosocial Risk through 3 Domains | How to Use KOSS Results

ISO 45003 divides psychosocial hazards into three areas. The factors outlined in the standard, when translated into common scenarios observed in domestic workplaces, are as follows:

There is no need to create a new survey from scratch based on this table. The Korea Occupational Safety and Health Agency's Korean Job Stress Assessment Tool (KOSS) is a tool designed for the assessment of job stress factors under Article 669, and its basic form consists of 43 items that measure 8 areas. These 8 areas overlap almost exactly with the three areas of ISO 45003.

• The way work is structured ↔ Job demands, job autonomy, job instability
• Social factors ↔ Relationship conflict, organizational structure, inadequate compensation, workplace culture
• Work environment and equipment ↔ Physical environment

If you have already conducted a survey using KOSS, you can start by reorganizing the results by domain into these three groups. The Corporation's technical support regulations recommend the Emotional Labor-Linked Type (KOSS®19) for customer service tasks, and a shortened 24-item type excluding the physical environment domain for areas with minimal physical environmental factors. However, survey scores only show 'where the scores are high.' The reasons for the high scores become apparent when viewed alongside company data, such as overtime records, shift schedules, and grievance filings.

📊 The difference between operations that only increase consultations and operations that reduce risk

Let's look at a hypothetical example. A logistics company received its quarterly EAP report and found that the proportion of consultations regarding 'job stress' had increased company-wide for two consecutive quarters. During the same period, the outbound team continued to work overtime during the peak season, and the team leader also changed due to organizational restructuring. HR first considers increasing the number of consultation sessions.

If the session is extended, employees who are currently struggling receive help. However, if overtime work and conflicting instructions remain unchanged, consultations for the same reasons will continue in the next quarter. From the perspective of ISO 45003, this is a situation where individual support is being provided, but the risks themselves are not being managed.

You should not attempt to identify the causative department based solely on the EAP report here. Guaranteeing employee anonymity during the EAP operation process is a statutory obligation, and ( Article 83, Paragraph 2 of the Framework Act on Labor Welfare ), the topic of consultation and health status may be sensitive information( Article 23 of the Personal Information Protection Act EAP reports are used as a company-wide signal that 'job stress is increasing,' and the specific department must be identified using company data such as KOSS departmental aggregations, overtime and shift records, and trends in resignations and absenteeism.

🧩 We establish countermeasures for each risk factor in three stages: work, management, and personal support.

ISO 45001, on which ISO 45003 is based, places measures to eliminate risk at its source before personal protection. Adapting this principle to psychosocial risk results in three steps.

1. Measures to change the work itself It reduces sources of risk such as workload, manpower, work schedules, and division of roles.
2. Measures to change management methods It prevents risks from escalating through manager training, response manuals, and reporting and investigation procedures.
3. Measures to support individuals : Helps people who have already been affected through counseling, crisis intervention, and reintegration support.

If there is only the third step, the cause remains, and if there is only the first, those currently struggling are neglected. Therefore, in the actual plan, three steps are assigned to each risk factor and executed together.

The point worth noting is the abusive language from customers. Article 41 of the Enforcement Decree of the Industrial Safety and Health Act It explicitly lists 'support for treatment and counseling related to health impairments caused by verbal abuse, etc.' as a measure that employers can take. This means that individual support is not an added bonus, but a part of the countermeasures. However, ISO 45003 recommends going beyond that and overhauling the response structure and manuals as well.

Roles that can be entrusted to external EAP and deliverables to be received

ISO 45003 includes procurement, contracting, and outsourcing within the scope of operational management. This means that if EAP is outsourced, that vendor's operational methods are also incorporated into the company's psychosocial risk management framework. The specifics of the contract will vary depending on whether only the counseling service is outsourced or if multiple stages of risk management are entrusted together.

The standard emphasizes the importance of providing an early and supportive response to affected workers and explains that problems become apparent early only when there is a belief that confidentiality will be maintained. Therefore, when evaluating an EAP provider, you must check not only the counseling itself but also how personal information is withheld from company reports and who acts in what order during a crisis.

Return to work is also a separate area covered by the standard. Since returning employees are susceptible to re-exposure to risk regardless of the reason, pre-return interviews and job adjustments must be linked with counseling support. Role assignments prior to return are Procedures for return to work for employees on health leave I have organized it in [location].

🗓️ 4 Steps to Execution for a Starting Company

Rather than establishing a company-wide implementation plan, it is more realistic to run a small-scale test using existing data.

STEP 1. Gather existing materials first

Departmental aggregates from recent job stress surveys, overtime and shift records, anonymized grievance and harassment reports, trends in resignations and long-term absenteeism, and company-wide EAP reports are sufficient to get you started. It is not too late to decide whether a new survey is necessary after reviewing this data.

STEP 2. Display three areas by department

Rating the exposure probability and severity of each factor on a scale of 1 to 3 reveals high-risk departments and factors. Small teams are combined with other teams to be viewed as a single unit.

STEP 3. Determine countermeasures for the two or three highest-risk areas

For each selected factor, write a one-line description of the work itself, management methods, and individual support measures, along with the person in charge and a deadline. If you handle multiple tasks at once, it is difficult to identify which ones were effective during a follow-up review.

STEP 4. Review again after 3 to 6 months using the same criteria

We re-evaluate the risk based on the same data and scoring criteria to check if it has decreased. If it remains the same, we shift the countermeasures from individual support or management methods to changing the work itself.

Employee opinions must be included in this process. ISO 45003 emphasizes worker consultation and participation alongside leadership, and Article 669 stipulates that the opinions of relevant workers must be reflected when establishing work plans, such as workloads and schedules. If the workplace has an Occupational Safety and Health Committee, one method is to raise the issue as an agenda item to hear the opinions of the worker representatives. Practical Operation of the Industrial Safety and Health Committee ).

The checklist for indicating risk levels by department and determining the order of improvement is Psychosocial Risk Factor Checklist You can receive it as an Excel file.

❓ FAQ

Recommended Posts

📚 Source and Verification Criteria

• ISO 45003:2021 Psychological health and safety at work (ISO)
• Article 5 of the Industrial Safety and Health Act (Duties of Employers, etc.)
• Article 41 of the Industrial Safety and Health Act (Preventive measures against health hazards caused by abusive language, etc. by customers)
• Article 41 of the Enforcement Decree of the Occupational Safety and Health Act (Measures regarding the occurrence of health impairment, etc. caused by abusive language, etc. by customers)
• Article 669 of the Rules on Occupational Safety and Health Standards (Preventive measures against health hazards caused by job stress)
• Article 76-2 of the Labor Standards Act (Prohibition of Workplace Harassment)
• Article 76-3 of the Labor Standards Act (Measures in Case of Workplace Harassment)
• Article 83 of the Framework Act on Labor Welfare (Worker Support Program)
• Article 55 of the Enforcement Decree of the Framework Act on Labor Welfare (Exceptions to the Guarantee of Anonymity)
• Article 23 of the Personal Information Protection Act (Restrictions on the Processing of Sensitive Information)
• Korea Occupational Safety and Health Agency KOSHA GUIDE EG-2-2025 Technical Support Regulations for the Prevention of Health Illnesses Caused by Job Stress

Legal Verification Date: October 26, 2026. The content of ISO 45003 is summarized based on ISO public abstracts and explanatory materials and does not replace the original standard text. 'Hypothetical examples' are assumptions for illustrative purposes and are not actual cases. The criteria for small group aggregation and the re-inspection cycle are examples of internal standards, not statutory standards. This article is for practical reference only and does not replace legal judgment on individual cases.