ISO 45001 certification process: a step-by-step guide

To get ISO 45001 certified, you build an occupational health and safety management system that meets the standard, check that it works through internal audits and management review, and then pass an external audit by an accredited certification body. The process usually runs through a gap analysis, a plan to close the gaps, implementation, an internal audit, the external audit and then regular surveillance audits to keep the certification.

Certification is voluntary. Many organisations pursue it because clients, principal contractors and tender panels ask for it, or because they want an independent check on their safety system.

What ISO 45001 is

ISO 45001:2018 is the international standard for occupational health and safety (OH&S) management systems. It sets out what your system must do: identify hazards, assess and control risk, comply with legal requirements, involve workers, monitor performance, and keep improving.

It replaced OHSAS 18001 and AS/NZS 4801. The current Australian adoption is AS/NZS ISO 45001:2018, which you can buy from Standards Australia if you want the full text.

The standard differs from the older ones in four main ways:

• Leadership. Top management must take active responsibility for the system, not just sign the policy.
• Risk-based thinking. You identify and plan for risks and opportunities before they become incidents.
• Worker involvement. Workers and their representatives take part in planning, implementing and improving the system.
• Continual improvement. The system is reviewed and improved on a schedule, not just when something goes wrong.

For a plain-English overview of the standard and its benefits, see what ISO 45001:2018 is and how it can benefit your business. Using ISO 45001 doesn't replace your legal duties. Under section 19 of the WHS Act, a PCBU must ensure health and safety so far as is reasonably practicable. The standard is a way to show you're managing that duty systematically. The WHS laws still apply on top.

What the system must cover

ISO 45001 doesn't prescribe a manual, but it does expect you to keep documented information that shows the system works. Most certifications rely on the following:

• The scope of the system, and the operations it covers
• Roles, responsibilities and authorities for OH&S
• The methods and criteria you use to assess risk
• Your OH&S policy and objectives, with plans to reach them
• Emergency preparedness and response plans
• Training, communication and consultation records
• Audit programs and audit results
• Records of incidents, investigations and corrective actions
• Evidence that you've acted on what you learned

Most of these records are things a well-run safety system already produces. The certification effort is mainly about making them complete, current and easy to find.

The plan-do-check-act cycle

ISO 45001 follows the plan-do-check-act (PDCA) cycle. Each stage maps onto the process below.

• Plan. Understand your context, find the hazards, assess the risks, set objectives and allocate resources.
• Do. Put the plans into action: train people, set up controls and run the processes.
• Check. Monitor performance against your objectives, your policy and your legal requirements, and review audit results.
• Act. Fix what isn't working and feed the lessons back into the plan.

Step-by-step: getting certified

1. Learn the standard

Read the full standard and make sure the team understands its terms and structure. Many organisations appoint one person to lead the project and work with a small group from operations, HR and management.

2. Run a gap analysis

A gap analysis compares what you do now with what the standard requires. It shows you where you are and what needs to change. For a business aiming to reduce its recordable injuries, a gap analysis would typically look at:

• Current injury rates and the trend over the last few years
• How hazards are identified and how risks are assessed
• Whether incidents are reported, investigated and closed out
• Whether workers are trained and competent for their tasks
• Whether the system has been reviewed by management

Use a mix of methods: read the policies and procedures, interview workers and supervisors, and walk the site. The gaps you find become the work plan for the next stage.

3. Plan the changes

Turn each gap into an action with an owner and a date. Some gaps are paperwork, such as an out-of-date procedure. Others take longer, such as retraining a crew or changing how a process is controlled. Prioritise the risks first, and keep the plan realistic.

4. Implement

Write or update the procedures, train people on them and put the controls in place. This is where the system starts to run for real. Involve workers early, because the people who do the work will spot the flaws that a manager misses.

5. Check the system works

Before the external audit, check the system yourself:

• Monitor OH&S performance against your objectives each month
• Run an internal audit covering every part of the standard in scope
• Hold a management review, where top management looks at the results and decides what to change
• Track the corrective actions from audits and incidents until they're closed

The internal audit is the most useful rehearsal you can run. If it finds gaps, you can fix them before the certification body does. Our guide on how to conduct a WHS audit covers planning and reporting an audit step by step.

6. Choose a certification body

Look for a certification body that holds accreditation for management system certification. Check the accreditation before you sign anything, and ask for references from clients in your industry. Compare the cost and timing, but don't choose on price alone. The auditors' experience with your type of work matters.

7. Go through the external audit

The certification body runs an audit in two stages. The first checks that your documents and system are in place and ready for the audit. The second checks that the system is working on site. Have your records ready, make sure the people who run the processes can explain them, and show the auditor the site as it actually runs.

The auditor will raise nonconformities where the system doesn't meet the standard. A minor nonconformity usually means a fix within a set period. A major one may stop certification until it's fixed. Treat each one as a corrective action: find the root cause, fix it, and show the auditor the evidence. A non-conformance report is a practical way to record that work.

8. Maintain the certification

Once certified, the certification body carries out surveillance audits during the certification cycle, usually once a year. A recertification audit is needed at the end of the cycle. Between audits, keep the system running: monitor performance, review it, and act on what you find.

Tips for a smooth certification

Get management commitment early. Certification takes time and money. Top management needs to back the project and make the time for management reviews.

Involve workers from the start. The standard expects worker participation, and auditors ask workers about it. Staff who helped build the system will also support it.

Keep the documents current and easy to find. Use one location, clear version control and a named owner for each document. Auditors check for out-of-date versions quickly.

Plan for the surveillance audits, not just the first one. A system that's only prepared for the first audit tends to slip afterwards.

Use the records you already keep. Incident reports, inspection checklists and training registers are evidence. Link them to the standard rather than starting new ones.

Common mistakes

Writing the system for the auditor. The system has to run on site every day. An auditor can tell when the paperwork doesn't match what happens.

Leaving out contractors and visitors. Your system covers the people who work under your control, not just your employees.

Treating the management review as a formality. It must look at real results and make decisions. Minutes that say "all good" won't convince an auditor.

Closing nonconformities without checking. A fix is only real once you've checked that it works.

How SafetyDocs helps

SafetyDocs has ISO 45001 management systems for different industries, including construction, trades, manufacturing, transport and business services. It also has the AS/NZS ISO 45001:2018 internal audit checklist and the registers and forms you'll need to show the system works. Job, client and site details fill themselves in. Each job's activity log is a dated record of posts, photos, issues, and who read and signed what, and when a document changes, everyone who signed is asked to sign the new version.

These documents help you build and evidence a system, but they don't make your business compliant or certified on their own. Certification depends on the system running on site and on the audit outcome.

Common questions

How long does ISO 45001 certification take? It depends on the size of the business and how much of the system already exists. A small organisation with good records can move through the process in several months. Larger or multi-site businesses usually take longer and phase the work.

Do I have to be certified to comply with the WHS laws? No. Certification is voluntary. The WHS laws apply whether or not you're certified. ISO 45001 helps you meet your duties in a structured way.

What's the difference between an internal and an external audit? An internal audit is run by your own trained people and checks the system before the certification body arrives. An external audit is run by an accredited certification body and decides whether you're certified.

What happens if the external audit finds nonconformities? You fix them within the time the certification body sets, and show the auditor the evidence. Minor nonconformities are usually closed with a corrective action. Major ones can delay or stop certification until they're fixed.

This is general information, not legal advice. Check the current law with your WHS regulator.