Everything About NOM-035: Complete Guide

NOM-035-STPS-2018 was officially published on October 23, 2018, and went into effect in its first phase on October 23, 2019. By October 23, 2020, the standard should have been fully implemented at every workplace in Mexico.

Several years after it took effect, many workplaces are still tracking their progress in preventing psychosocial risk factors. In this guide, our goal is to walk you through exactly what compliance with the standard involves and how to get the most out of it.

What Is NOM-035?

The standard's official purpose is to establish the elements needed to identify, analyze, and prevent psychosocial risk factors, as well as to promote a favorable organizational environment in the workplace.

In other words, the standard levels the playing field across all companies, aiming for every worker to enjoy a sense of well-being that positively influences both their professional and personal lives, while preventing psychosocial risk factors.

NOM-035 applies to every workplace established in Mexico, although the obligations vary depending on the number of employees.

Why Was NOM-035 Created?

NOM-035 was created in response to a recommendation from the World Health Organization (WHO), which found years ago that workers' mental health is strongly affected by the quality of the workplace where they work.

For years, Mexico has led the world in workplace stress levels, which isn't surprising, since we're among the countries with the longest working hours and the longest workdays. Several studies have found a very high correlation between the number of hours worked and people's emotional well-being.

That's why the STPS (Mexico's Secretariat of Labor and Social Welfare) began developing this standard. It's worth noting that many other countries have similar regulations, including Spain, Chile, Canada, Australia, and the European Union.

NOM-035 Platform

Roll out NOM-035 intuitively with automatic reports and guaranteed compliance.

Learn More

Who Must Comply with NOM-035?

Every workplace in Mexico must comply with NOM-035. Depending on the number of employees, the obligations vary:

NOTE: The employee counts below apply per workplace. For example, a company with 500 employees total, spread across 20 branches, must evaluate each branch separately — each one counts as a distinct workplace.

a. Fewer than 15 employees

For organizations with fewer than 15 employees, compliance mostly comes down to prevention measures rather than full-blown actions. They must:

• Disclose and apply a Psychosocial Risk Prevention Policy.
• Disclose and apply Psychosocial Risk Prevention Measures.
• Identify severe traumatic events among employees using Reference Guide I.
• Provide support to employees who experienced severe traumatic events.
• Maintain safe, confidential reporting mechanisms.

b. Between 15 and 50 employees

In addition to the requirements for workplaces with fewer than 15 employees, this tier must also implement:

• Implement Reference Guide II to identify and analyze psychosocial risk factors, and disclose the results.
• Implement Control Measures to address psychosocial risk factors.
• Keep documentation of actions and measures.

c. More than 50 employees

In addition to the requirements for workplaces with fewer than 50 employees, this tier must also implement:

• Implement Reference Guide III to identify and analyze psychosocial risk factors and evaluate the organizational environment, and disclose the results.

These are the standard's general requirements, but each of the points above requires a detailed analysis to achieve full compliance — and to make sure it actually benefits the company.

NOM-035 Requirements by Section (Numerales)

NOM-035 is organized into several numbered sections, each with its own responsibilities or actions to carry out. Here's a summary:

5.1 Establish in writing, implement, maintain, and disclose a psychosocial risk prevention policy at the workplace

5.2 Identify and analyze psychosocial risk factors, per sections 7.1(a) and 7.2 of this standard, for workplaces with between 16 and 50 employees

5.3 Identify and analyze psychosocial risk factors and evaluate the organizational environment, per sections 7.1(b), 7.2, and 7.3 of this standard, for workplaces with more than 50 employees

5.4 Adopt measures to prevent and control psychosocial risk factors

5.5 Identify employees who experienced severe traumatic events during or because of their work

5.6 Perform medical exams and psychological evaluations on employees exposed to workplace violence and/or psychosocial risk factors

5.7 Disclose and provide employees with information about NOM-035-STPS-2018

5.8 Keep records on the implementation of Reference Guides I, II, and III

5.1 Psychosocial Risk Prevention Policy

The policy required by NOM-035 is one of the first steps toward compliance, and probably one of the most important. It's the declaration of principles and commitments the employer establishes to prevent psychosocial risk factors and workplace violence, and to promote a favorable organizational environment — all aimed at building a culture of decent work and continuous improvement of working conditions.

What's established in this policy sets the stage for every following step and requirement of the standard, and serves as a guide and introduction to help employees understand NOM-035.

What Must It Contain to Comply with NOM-035?

The promotion of a favorable organizational environment; the prevention of psychosocial risk factors; the prevention of workplace violence; and the disclosure of the psychosocial risk prevention policy throughout the workplace.

Who Should Draft and Sign the Policy?

Drafting the Psychosocial Risk Prevention Policy should be the responsibility of the organization's established NOM-035 committee. We recommend involving the Legal, HR, and Management teams in creating it.

If the organization has a large operational workforce or a union, it's important to involve the leaders of those groups — they play a major role in getting the standard accepted and implemented. As for signing the policy, we recommend it be signed by the organization's CEO and the director or manager of each workplace, as well as whoever is responsible for NOM-035.

Who Should Have Access to This Policy?

The entire organization should have access to the policy at all times. Publishing it on an online portal isn't enough if some employees don't have easy access to that portal.

Recommendations on Content and Format

The requirements we covered earlier define the content the standard needs. As for format, we strongly recommend not using the boilerplate policy text published in the DOF (Official Gazette) as-is. Use this as an opportunity to make sure that when employees read the policy, they truly understand why the standard matters and see that the organization is taking it seriously.

5.2-5.3 Applying Reference Guides II / III

Administering the questionnaires — called Reference Guides in the standard — is a core part of NOM-035. They trigger the control actions, along with several other steps needed for compliance.

Which Reference Guide Should You Apply?

The rules are simple and vary depending on the number of employees per workplace (note: it's the count per workplace, not per legal entity or employer group).

• Fewer than 15: only Guide I
• Between 15 and 50: Guides I, II, and V
• More than 50: Guides I, III, and V

Guides I and V are not mandatory and can be replaced. Guide I can be replaced with mechanisms for detecting and addressing severe traumatic events. For Guide V, the key data point to capture is the employee's gender — the remaining demographic fields can be adjusted to fit each workplace's reality.

Apply Them to the Right Number of Employees

• Guide I to all employees
• Guide II to all employees
• Guide III can be applied to a randomly selected sample, as long as it matches the real gender breakdown of the workplace. The formula for calculating the sample size is: n = 0.9604*N / 0.0025 (N - 1) + 0.9604
• Guide V to every employee who answers Guide II or III

Don't Modify Guide II/III

While NOM-035 does allow modifications to the questionnaires, the requirements for doing so are difficult to meet. It's better not to take the risk — apply the questionnaires without modifying them.

Apply Them the Right Way

It doesn't matter whether it's digital or on paper, as long as you meet these requirements:

• Explain to employees why the questionnaire is being administered and make sure they understand the standard's purpose.
• Have someone available to answer employees' questions about the standard or the questionnaires.
• Guarantee the confidentiality of the questionnaires.

Calculating Results Under NOM-035

This part is a bit tricky to explain in words — you need to rely on the scoring tables provided by NOM-035.

A few things to watch for: although the standard uses a 1-to-5 scale, results are scored on a 0-to-4 scale per question, and some options — like "Always" — can be worth either 0 or 4 points depending on whether the question is phrased positively or negatively.

Sharing Results with Employees

NOM-035 requires that results be shared with all employees at the workplace as a group, so they can see the risk levels for each category and domain.

There's no need to share individual results, and results from Guide I or V should not be shared either.

The reports must include the following information:

• Name of the workplace (can include the legal entity name)
• Address of the workplace
• Evaluation method
• Evaluation objective
• Administrator's name and professional license number, if applicable
• Main activity of the workplace
• Date administered
• Conclusions from the results

5.4 Prevention and Control Measures

NOM-035 covers two types of measures — prevention and control — that every workplace must define in order to reduce psychosocial risk factors and promote a favorable organizational environment.

Prevention Measures

NOM-035's prevention measures are all the actions you need to carry out at the workplace to prevent psychosocial risks and promote a favorable organizational environment.

What Areas Must They Cover?

Unlike control measures, prevention measures must cover every area required by NOM-035, regardless of whether the risk levels from Reference Guides II or III came out low.

Quoting the standard's requirements as published in the Official Gazette of the Federation (DOF):

• a) Establish actions to prevent psychosocial risk factors that promote social support, the dissemination of information, and training.
• b) Provide safe, confidential mechanisms for receiving complaints about practices that go against a favorable organizational environment, and for reporting workplace violence.
• c) Carry out actions that build employees' sense of belonging to the organization; provide training for properly carrying out assigned tasks; clearly define responsibilities for each member of the organization; encourage proactive participation and communication among team members; distribute workloads appropriately, with regular working hours per the Federal Labor Law; and evaluate and recognize performance.

The standard goes on to describe the rest of the requirements in detail, which we've summarized below by topic:

• a) Leadership and workplace relationships
• b) Workloads
• c) Control over work
• d) Social support
• e) Work-life balance

Recommendations for Defining Them

In our experience, almost every workplace already has something in place that directly ties into several of the prevention measures the standard requires. All you need to do is gather documentation of those actions and map them to the prevention measure requirements.

What matters here is letting employees know that these actions are now also part of the standard's compliance efforts. This helps them see their importance, and also helps them connect these actions to their own emotional well-being.

Control Measures

Control measures must be implemented based on the risk levels obtained in the questionnaires. Wherever a category or domain came out at medium, high, or very high risk, that's where control measures need to be put in place.

Both control and prevention measures must be communicated to employees, and you need to keep records that document their implementation across the organization.

5.5-5.6 Identifying and Referring Severe Traumatic Events

Identifying severe traumatic events is probably one of the least understood sections of the standard — not because it's complex, but because of what it involves and how difficult many of the situations it covers can be.

Severe traumatic events are identified through Reference Guide I, which must be applied to all employees. Any employee identified as needing support should be referred to a doctor or occupational psychologist.

What Are Severe Traumatic Events?

A severe traumatic event is one experienced during or because of work that involves death, or that poses a real danger to the physical safety of one or more people, and that can trigger post-traumatic stress disorder in those who experience or witness it. Examples include major explosions, collapses, and fires; serious or fatal accidents; violent robberies; kidnappings; and homicides, among others.

Are Severe Traumatic Events Outside of Work Covered by NOM-035?

No — only events that happened at the workplace or because of work count. This means that if an employee is robbed on their way to work, it should be counted as a severe traumatic event. However, if an employee experienced one at a shopping mall, it wouldn't fall under this standard.

5.7-5.8 Disclosing NOM-035 and Keeping Records

An important step that shouldn't be overlooked is keeping documentation of everything done in the previous points. Remember that during an STPS inspection, this documentation is the first thing they'll ask for to decide whether to dig deeper into your compliance.

Disclosing it is just as important — during an STPS inspection, whatever is publicly posted will be one of the first things they check, and it also plays a key role in getting employees to embrace NOM-035.

What Should Be Disclosed and Documented?

• a) The psychosocial risk prevention policy.
• b) The measures adopted to combat practices that go against a favorable organizational environment and acts of workplace violence.
• c) Prevention measures and actions and, where applicable, control actions for psychosocial risk factors.
• d) The mechanisms for filing complaints about practices that go against a favorable organizational environment and for reporting workplace violence.
• e) The results of identifying and analyzing psychosocial risk factors for workplaces with between 16 and 50 employees, and the results of identifying and analyzing psychosocial risk factors plus the organizational environment evaluation for workplaces with more than 50 employees.
• f) Possible health effects from exposure to psychosocial risk factors.

5.8 Keep Records On:

• a) The results of identifying and analyzing psychosocial risk factors and, for workplaces with more than 50 employees, the organizational environment evaluations.
• b) The control measures adopted whenever the results of the risk factor identification, analysis, and environment evaluation call for them.
• c) The names of employees who underwent clinical exams or evaluations and were confirmed to have been exposed to psychosocial risk factors, workplace violence, or severe traumatic events.

Do Employees Have Obligations?

While the penalties for non-compliance fall on the employer, employees do have their own obligations under the standard.

• Learn about and follow the prevention measures established at the workplace.
• Refrain from engaging in practices that go against a favorable work environment.
• Help identify and report risk factors.
• Report if they've been a victim of, or witnessed, any improper conduct.
• Undergo medical exams or psychological evaluations when required.

Frequently Asked Questions

About the author

Integratec

HR Team

Integratec is the leading talent development platform. We share specialized content on human resources, performance evaluation, and organizational well-being.