ISO 45001 Certification for Your OH&S Management System

What is ISO 45001?

ISO 45001 is the international standard for occupational health and safety (OH&S) management systems. It sets out what an organisation has to plan, implement and demonstrate in order to prevent work-related injury and ill health and to provide safe, healthy workplaces. Published in March 2018, it replaced OHSAS 18001, so organisations that want an OH&S management system certified against an international standard today are certified to ISO 45001.

The standard applies to organisations of every size and sector, from a small contractor to a multi-site manufacturer. It does not prescribe specific safety measures; it provides a management framework. Which controls are appropriate follows from your hazards, your legal obligations and the way your organisation works.

Since February 2024 an amendment (Amd 1:2024) requires organisations to determine whether climate change is a relevant issue for their management system; the same change was made to other ISO management system standards such as ISO 9001, ISO 14001, ISO 27001 and ISO 50001. A revision is under way: voting on the draft ISO/DIS 45001 closed in September 2026, and ISO expects the new edition in the first half of 2027. Until then ISO 45001:2018 applies, and the transition period for existing certificates will be set internationally once the new edition is published.

Who needs ISO 45001 certification?

Any organisation that wants to manage health and safety systematically and prove it to others. Certification is particularly common in higher-risk sectors – construction, manufacturing, logistics, energy, waste management, facilities and maintenance – and among contractors working on client sites, where tenders and supplier pre-qualification often ask for evidence of OH&S management.

Small businesses can achieve ISO 45001 certification too. The standard does not require a dedicated department or a fixed amount of paperwork; the extent of documented information may differ with size, activities and risks. A small firm can keep it lean with clear responsibilities, an up-to-date risk assessment and short, regular safety conversations with its workers.

Typical reasons for seeking certification are:

• Clients or tenders require evidence of an OH&S management system.
• You want a structured way to meet and demonstrate your legal health and safety duties.
• Incidents, near misses and lost time should be analysed and reduced systematically.
• You already run ISO 9001 or ISO 14001 and want to bring health and safety into the same system.

ISO 45001 requirements at a glance

ISO 45001 follows the Harmonized Structure shared by ISO management system standards and is built on the Plan-Do-Check-Act (PDCA) cycle.

Two features set it apart from other management system standards. First, non-managerial workers must be consulted and involved in defined areas, such as identifying hazards and choosing controls. Second, top management takes overall responsibility and accountability for preventing work-related injury and ill health – implementation can be delegated, accountability cannot. Controls follow a hierarchy: eliminate the hazard, substitute, use engineering controls and reorganise work, apply administrative controls and training, and only then rely on personal protective equipment.

The auditable requirements are set out in clauses 4 to 10:

• Clause 4 – Context: internal and external issues, the needs of workers and other interested parties, scope of the system.
• Clause 5 – Leadership and worker participation: top management commitment, OH&S policy, roles, and consultation and participation of workers.
• Clause 6 – Planning: hazard identification, assessment of risks and opportunities, legal and other requirements, OH&S objectives.
• Clause 7 – Support: resources, competence, awareness, communication and documented information.
• Clause 8 – Operation: eliminating hazards and reducing risks, management of change, procurement including contractors and outsourcing, emergency preparedness and response.
• Clause 9 – Performance evaluation: monitoring and measurement, evaluation of compliance, internal audit, management review.
• Clause 10 – Improvement: incident, nonconformity and corrective action, and continual improvement.

The ISO 45001 certification process: what auditors look at

Certification with CERTUNION International follows six steps, from your enquiry to the annual surveillance audits (see the overview below). With ISO 45001 the key question is not whether procedures exist on paper but whether they work in practice.

During the certification audit the auditors therefore walk through work areas, workshops or sites, talk to managers and workers, and compare what they see with risk assessments, training records, inspection reports and your analysis of incidents and near misses. Typical questions include: Are all activities covered, including maintenance, cleaning and contractor work? Are controls chosen according to the hierarchy, or does the system fall back on PPE too early? How are workers' concerns and suggestions taken up? After an incident, is the root cause found and the effectiveness of the corrective action checked?

Parts of the audit, such as the document review, can be carried out remotely. For walking the workplace, being on site is usually the more meaningful option with ISO 45001. How the audit is split is agreed when we analyse your enquiry.

How long does ISO 45001 certification take and what does it cost?

Once your OH&S management system is in place and working, the certification process from enquiry to certificate typically takes four to eight weeks, depending on the size and complexity of your organisation. Building the system beforehand is a separate phase; its length depends mainly on where you start. An organisation with complete risk assessments, organised training and working incident reporting will move much faster than one that has to create these foundations first.

With CERTUNION, ISO 45001 certification comes as an annual package together with the platform for your management system. There are three annual packages, priced per year: €789 for one standard (up to 25 employees), €1,499 for up to three standards (up to 100 employees) and €1,949 for all five standards (any number of employees).

The annual price includes the platform with all its modules and that year’s audit: the initial certification in the first year – we issue the certificate once the audit has been passed – and the surveillance audits in the second and third years. The contract runs for three years; in the fourth year, recertification follows at a 20% discount. All prices are exclusive of VAT and apply exclusively to business customers, not to consumers. Travel and accommodation costs for on-site audits are charged as incurred.

Also plan for internal effort – mainly time for risk assessments, training, the internal audit and the management review. The number of audit days depends mainly on:

• the number of workers, including part-time and shift workers,
• the risk level of your activities – an office-based service provider is audited differently from a construction company,
• the number of sites and temporary locations such as construction sites,
• the scope of the certificate and whether ISO 45001 is combined with other standards.

View the annual package price list (in German)

Documentation and prerequisites

ISO 45001 does not require a manual. It requires documented information where the standard asks for it and where your organisation needs it for the system to be effective. An optional pre-audit shows where gaps remain before the certification audit.

Your system should be running for a while before the certification audit. As a rule, the following should be in place:

• an OH&S policy endorsed by top management and measurable OH&S objectives,
• current hazard identification and risk assessments for all activities, including non-routine tasks,
• a register of legal and other requirements and an evaluation of compliance,
• emergency arrangements and records of drills,
• records of competence and training,
• records of incidents, their investigation and corrective actions,
• at least one complete internal audit and management review.

Benefits of a certified OH&S management system

The main benefit is created in daily operations, not on the wall: an effective system makes hazards visible before something happens and ensures that lessons are learned from incidents and near misses. Certification adds an independent view from outside. How much you gain depends on implementation – the certificate confirms conformity with the standard at the time of the audits, not that nothing will ever go wrong.

The key benefits at a glance:

• Fewer injuries and less work-related ill health – the stated aim of the standard, achieved through prevention.
• Better legal compliance, because obligations are identified systematically and compliance is evaluated regularly.
• Credible evidence for clients, tenders and supplier assessments.
• A stronger safety culture, because workers are involved and can report hazards without fear of reprisals.
• Clear responsibilities up to top management.

Is ISO 45001 mandatory?

No. Implementing and certifying ISO 45001 is voluntary, as ISO itself points out. What is mandatory is health and safety law. In the EU, the Framework Directive 89/391/EEC requires employers to assess risks to workers' safety and health and to take the necessary preventive measures. National law builds on this: in Ireland, for example, the Safety, Health and Welfare at Work Act 2005 requires employers to identify hazards, carry out risk assessments and prepare a written safety statement.

These legal duties apply whether or not you hold a certificate. ISO 45001 does, however, require you to identify your legal requirements, fulfil them and evaluate compliance regularly, so a well-run system is a structured way to meet your obligations and have that checked from outside. The standard itself notes that adopting it does not in itself prevent injury and ill health; what matters is how the system is lived.

ISO 45001 vs OHSAS 18001, ISO 9001 and ISO 14001

Compared with OHSAS 18001, ISO 45001 places more weight on the context of the organisation, on top management's accountability and on worker participation, and it adds a risk-and-opportunity approach. It also shares the common structure of ISO management system standards, which OHSAS 18001 did not.

Because ISO 45001, ISO 9001 and ISO 14001 have the same structure, they can be combined into an integrated management system with one policy, one document control process, one internal audit programme and one management review. Health and safety and environmental management often overlap, for example in the handling of hazardous substances or emergency preparedness. If you certify several standards, the audits can be combined to avoid duplication.

For psychological health, ISO 45003 provides complementary guidance. It is not intended for certification but helps you manage psychosocial risks within an ISO 45001 system.

The Certification Process

1. 01

   Enquiry

   In a non-binding initial conversation you tell us about your organisation: activities, sites, number of workers and whether other standards such as ISO 9001 or ISO 14001 should be included.

2. 02

   Analysis and package choice

   We analyse your requirements, agree the scope and estimate the audit effort based on workforce, risk level and sites. You then choose the right annual package.

3. 03

   Pre-audit (optional)

   On request, a pre-audit shows where your system still has gaps – for example in risk assessment, worker participation or the evaluation of legal compliance.

4. 04

   Certification audit

   The auditors review documentation and implementation, on site or partly remotely: workplace walk-through, interviews with management and workers, and samples of training, inspection and incident records.

5. 05

   Certificate

   After a successful audit we issue the ISO 45001 certificate. Any nonconformities found are addressed beforehand with documented corrective actions.

6. 06

   Surveillance

   Annual surveillance audits check that the system remains effective and keeps improving. The certificate is typically valid for three years, followed by recertification.

Frequently asked questions