ISO 45001 certification,
explained plainly

ISO 45001 is the international standard for occupational health and safety management. It does not certify that your workplace is accident-free. It certifies that your organization runs a working OH&S management system: a defined way of identifying the hazards in your work, assessing the risks, controlling them in a mandated order, involving the people who do the work, investigating what goes wrong and improving, over and over.

Published in March 2018, it replaced OHSAS 18001, the British specification most of the world had used until then, and it was the first OH&S standard issued by ISO itself. Amendment 1:2024 added the same sentence ISO added to all its management system standards: the organization must determine whether climate change is a relevant issue, which for worker safety means heat, extreme weather and changed working conditions. A revision of the 2018 edition is under way, with a draft circulating in 2026; until the new edition is published and its transition begins, ISO 45001:2018 remains the edition you certify against.

Clause 4 is context: the issues that affect worker safety, the workers and other interested parties and their needs, and the scope, which must include every activity under your control or influence that can affect OH&S performance. Clause 5 is leadership and worker participation: top management takes overall accountability for preventing injury and ill health, sets the OH&S policy with its five commitments, assigns roles at every level, and establishes consultation and participation of workers. Clause 6 is planning: hazard identification, assessment of risks and opportunities, legal and other requirements, planned actions along the hierarchy of controls, and OH&S objectives.

Clause 7 is support: resources, competence including the ability to identify hazards, awareness including the right to refuse dangerous work, communication that accounts for language, literacy and disability, and documented information. Clause 8 is operation: operational controls, the hierarchy of controls, management of change, procurement, contractors and outsourcing, and emergency preparedness and response including first aid. Clause 9 is performance evaluation: monitoring with leading and lagging indicators, evaluation of compliance, internal audit and management review. Clause 10 is improvement: incident investigation, nonconformity and corrective action, and continual improvement.

Clause 5.4 is what makes ISO 45001 different from every other ISO management system standard. Workers at all levels, and their representatives where they exist, must be consulted on the policy, the roles, the legal requirements, the objectives, the controls, outsourcing and monitoring, and must participate in hazard identification, risk assessment, control selection, competence needs, communication, incident investigation and improvement. The standard singles out non-managerial workers, because they are the ones who know where the real hazards are.

The organization must provide the mechanisms, time, training and information for this, and must identify and remove the barriers: language, literacy, fear of reprisal, lack of time. Auditors test it directly. They ask workers whether they were consulted on the last risk assessment, whether they know how to report a hazard, and what happened the last time someone did.

Hazard identification under ISO 45001 is ongoing and proactive, not an annual form. It covers how work is organized, workload and psychosocial factors, routine and non-routine work, past incidents, emergencies, contractors and visitors, workplace design and every planned change. Risks are assessed with documented criteria and with existing controls taken into account, and opportunities to design hazards out are assessed as well.

When it comes to treating the risks, the standard mandates an order. Eliminate the hazard first. If that is impossible, substitute a less hazardous process, material or equipment. Then engineering controls and reorganization of work. Then administrative controls such as procedures and training. Personal protective equipment comes last. Every control decision has to show that the higher rungs were considered, and a risk assessment that jumps straight to a helmet and gloves is the finding auditors raise most often.

Certification is carried out by an accredited certification body in two stages. Stage 1 is a readiness review: the auditor checks that the system exists as documented information, that the scope, policy, hazard register, risk assessments and legal requirements are in place, and that internal audit, compliance evaluation and management review have been planned or done. Stage 2 is the certification audit proper: the auditor walks the workplaces, follows hazards into the controls that manage them, interviews workers about consultation, hazards and their right to refuse dangerous work, checks contractor management and tests emergency preparedness.

From a serious start, most small and mid-size organizations reach Stage 2 in six to twelve months, driven mostly by how mature hazard identification and worker participation already are. The certificate is then valid for three years, with a surveillance audit in each of years one and two and a full recertification in year three.

The certification body charges for the Stage 1 and Stage 2 audits and for each surveillance audit, scaled to the number of sites, workers and risk level in scope. That fee is usually the smaller part. The larger cost is building and running the system: hazard identification with worker participation, risk assessments, legal requirements, safe work procedures, contractor management, emergency drills, competence and training, monitoring, compliance evaluation, audits and reviews, and keeping all of it current through every audit.

Two levers move that cost more than the certification fee. Scope, because certifying the sites and activities your customers and regulators actually ask about is cheaper than certifying everything at once. And integration, because if you also run ISO 9001, ISO 14001 or ISO 27001, one context analysis, one audit programme, one management review and one corrective-action process can serve every certificate, and certification bodies commonly audit them together.