ISO 45001 Explained.
The Standard, The Process, And What Auditors Actually Check
ISO 45001:2018 is the international standard for an Occupational Health and Safety Management System. This guide covers how certification works, the clauses an auditor will test, and the site-level evidence they expect to see.
the certification journey
Stage 1 To Recertification.
Certification runs on a three-year cycle. For ISO 45001 the auditor will want to see your actual work locations, not just your office — so plan site access early.
Stage 1 — Readiness Review
Is the system documented?
The auditor reviews your OH&S policy, legal register, hazard identification and risk assessments, worker consultation arrangements and internal audit records. Findings raised here must be closed before Stage 2.
Stage 2 — Certification Audit
Is it working on the ground?
Typically 2–8 weeks after Stage 1. Expect site visits, walk-arounds and interviews with non-managerial workers. The auditor checks controls exist in practice, not just on paper.
Surveillance — Years 1 & 2
Has it stayed alive?
Shorter annual audits. Incident records, corrective actions, inspection findings, worker consultation and any change to sites, activities or legal duties are always in scope.
Recertification — Year 3
Does it still hold up?
A full audit of the whole OH&S management system, similar in depth to Stage 2, before a new three-year certificate is issued.
clauses 4 to 10
The Processes Auditors Audit.
Clauses 4–10 are the mandatory requirements. ISO 45001 goes further than most standards on one point in particular — workers must be consulted, and the auditor will test that directly.
Clauses 4 & 5 — Context & Leadership
Scope, accountability and worker voice.
Defining scope and interested parties, an OH&S policy, visible top-management accountability, and Clause 5.4 consultation and participation of workers — including non-managerial workers.
Clause 6 — Planning & Risk
Hazards, legal duties and objectives.
Ongoing hazard identification, assessment of OH&S risks and opportunities, a maintained legal and other requirements register, and measurable OH&S objectives with plans to achieve them.
Clauses 7 & 8 — Support & Operation
Competence and control.
Competence, training and awareness records, communication and documented information, plus operational planning: the hierarchy of controls, management of change, procurement and contractors, and emergency preparedness.
Clauses 9 & 10 — Evaluation & Improvement
Measure, investigate, improve.
Monitoring and measurement, evaluation of legal compliance, internal audit, management review, and incident investigation with corrective action under Clause 10.2.
hazard control in practice
The Hierarchy Of Controls.
Clause 8.1.2 requires OH&S risks to be controlled in a set order of preference. Auditors check you applied it in that order — not that you jumped straight to PPE.
Eliminate & Substitute
Remove the hazard first.
Design the hazard out, or replace it with something less hazardous. Auditors look for evidence this was considered before lower-order controls were chosen.
Engineering Controls
Isolate people from harm.
Guarding, ventilation, edge protection, interlocks and reorganisation of work — physical measures that do not rely on someone remembering.
Administrative Controls
Safe systems of work.
Permits to work, method statements, signage, job rotation, training and supervision — plus the site inspections and toolbox talks that keep them alive.
PPE — The Last Resort
Only after the rest.
PPE sits at the bottom of the hierarchy. Auditors expect issue records, fit testing where relevant, inspection and replacement — and justification for why higher controls were not reasonably practicable.
keeping controls alive
Toolbox Talks & Site Inspections.
These are the day-to-day activities that turn a written system into a working one. They are also the first records an auditor asks for when they arrive on site.
What A Toolbox Talk Is
Short, task-specific, on site.
A brief pre-work briefing on a single hazard or task — typically 5–15 minutes, delivered where the work happens, before it starts or whenever conditions change.
What To Record
If it is not signed, it did not happen.
Date, topic, who delivered it, an attendance list signed by those present, and any issues or questions raised — with follow-up actions where needed.
Site Inspections
Planned and recorded.
Scheduled workplace inspections against a defined checklist, with findings graded, owners assigned and closure dates tracked. Ad-hoc safety tours count too, provided you record them.
Closing The Loop
Findings must go somewhere.
Issues from talks and inspections should feed your corrective action process and, where they reveal a new hazard, your risk assessments. That link is exactly what auditors follow.
audit evidence
Evidence, Not Intentions.
Auditors sample. They pick a control, ask to see it working, and follow the trail. These four areas account for most ISO 45001 findings.
Worker Consultation You Can Prove
Clause 5.4 is tested directly.
Safety committee minutes, worker representatives, and evidence that non-managerial workers were consulted on hazards and controls — the auditor will ask them.
Incident Investigation
Root cause, not blame.
Incidents and near misses recorded, investigated to root cause, corrective action taken and its effectiveness reviewed under Clause 10.2.
Legal Compliance Evaluation
A register alone is not enough.
You must maintain a legal and other requirements register and periodically evaluate compliance against it — with the evaluation itself recorded.
Contractors & Procurement
Your site, your duty.
Contractor selection, induction and control of outsourced work under Clause 8.1.4. Auditors routinely sample contractor records while on site.
Need Help Getting ISO 45001 Certified?
We build and run ISO 45001 health and safety management systems for businesses across the UK, Ireland and the Isle of Man — and we stand with you at Stage 1 and Stage 2.
