Edit this article

Last edited 26 Aug 2026

ISO 45001 Certification: A Practical Guide to Getting Started

[edit] Introduction

Organisations that consider ISO 45001 certification often recognise the importance of managing occupational health and safety systematically. ISO 45001 provides a framework for establishing an occupational health and safety management system (OH&S MS) that can help organisations identify hazards, assess and control risks, involve workers, meet applicable requirements and improve health and safety performance.

ISO 45001 is a management system standard rather than a set of specific workplace safety rules. It requires organisations to establish processes appropriate to their activities, risks and operating context. Certification provides independent assessment of conformity with the requirements of the standard, but it does not itself guarantee that workplace incidents will not occur or replace statutory health and safety duties.

A practical implementation should therefore focus on improving actual health and safety management rather than creating documentation solely for certification. The process involves understanding the standard, assessing existing arrangements, securing leadership commitment, establishing appropriate controls, involving workers, operating the system and evaluating its effectiveness.

[edit] Preparing for ISO 45001 implementation

[edit] Understand the requirements

Many organisations already have workplace health and safety arrangements in place. ISO 45001 requires these arrangements to be managed as part of a structured OH&S MS. The organisation needs to understand its context, identify hazards, assess OH&S risks and opportunities, establish objectives, determine controls, provide appropriate resources and evaluate performance.

The standard also places emphasis on leadership and worker participation. Senior management is expected to demonstrate leadership and commitment to the OH&S MS, while workers should be consulted and, where applicable, actively involved in processes that affect occupational health and safety.

ISO 45001 follows a management system cycle involving planning, implementation, evaluation and improvement. This means that health and safety should be treated as an ongoing organisational responsibility rather than a one-time certification project.

[edit] Assess existing arrangements

Before making changes, the organisation should review its existing health and safety arrangements and compare them with the requirements of ISO 45001. A gap assessment can consider areas such as hazard identification, risk assessment, legal and other requirements, operational controls, emergency preparedness, training, incident investigation, worker participation, monitoring, internal auditing and management review.

Frontline workers can provide valuable information during this assessment because they have direct experience of workplace activities and may identify hazards or practical difficulties that are not apparent from management documentation. Their involvement can help produce controls that are realistic and appropriate to the work being undertaken.

The assessment should distinguish between arrangements that are already effective and genuine gaps that require action. This provides a practical basis for setting priorities rather than introducing unnecessary procedures.

[edit] Secure leadership commitment

Leadership commitment is an important part of ISO 45001. Senior management should provide the resources, direction and support necessary to establish, implement and maintain the OH&S MS. This can include allocating responsibilities, providing appropriate training and resources, setting objectives and reviewing health and safety performance.

A signed policy alone is not sufficient evidence of effective leadership. Employees are more likely to engage with the management system when they can see that health and safety is incorporated into normal management decisions and operational activities.

The purpose of implementation should also be communicated clearly. Employees should understand that the objective is to improve the management of occupational health and safety and not simply to obtain a certificate.

[edit] Establishing the core management system

[edit] Identify hazards and assess risks

Hazard identification is a central element of ISO 45001. Organisations should establish a systematic process for identifying hazards arising from their activities, workplaces and processes. This can include hazards associated with equipment, materials, work activities, workplace conditions, contractors, visitors, changes to operations and reasonably foreseeable emergency situations.

Hazard identification should not be restricted to obvious physical hazards. Depending on the organisation, relevant hazards may include chemical, biological, ergonomic, physical and psychosocial hazards, as well as those arising from work organisation, workplace design and interactions between different activities.

The organisation should assess OH&S risks associated with identified hazards and determine appropriate controls. Controls should be proportionate to the risks and should reflect the hierarchy of controls, giving preference to eliminating hazards and reducing risks at source before relying on administrative measures or personal protective equipment.

[edit] Establish worker participation

ISO 45001 places particular emphasis on consultation and participation of workers. Organisations should establish appropriate mechanisms through which workers can contribute to hazard identification, risk assessment, control selection, incident investigation and improvement activities.

Suitable arrangements may include safety committees, workforce meetings, toolbox talks, surveys, reporting systems and other forms of direct consultation. The appropriate approach will depend on the size, structure and nature of the organisation.

Worker participation should have a practical effect on health and safety decisions. Organisations should consider feedback and provide appropriate information about actions taken as a result.

[edit] Establish operational controls

Operational controls should help ensure that activities are carried out under defined conditions where necessary to manage OH&S risks. These may include procedures, work instructions, equipment controls, maintenance arrangements, competency requirements, permits, contractor controls and emergency arrangements.

Controls should reflect actual workplace activities rather than being based solely on generic documentation. When processes, equipment, materials, personnel or facilities change, the organisation should consider whether the change introduces new hazards or alters existing risks.

External providers and contractors may also affect occupational health and safety. Their activities should be appropriately controlled and coordinated with the organisation's own OH&S processes.

[edit] Operating and evaluating the system

[edit] Give the system time to operate

Organisations should not rush directly from creating procedures to formal certification assessment. Employees need time to understand and use the new or revised processes, while management needs an opportunity to determine whether the system is operating as intended.

Inspections, incident investigations, monitoring, internal audits and corrective actions can provide evidence about the effectiveness of the OH&S MS. These activities can identify weaknesses that should be addressed before an external certification assessment.

Documentation should support the system rather than become an objective in itself. A well-designed management system should reflect actual workplace practices and provide useful evidence of how health and safety is being managed.

[edit] Conduct internal audits and management review

Internal audits can assess whether the OH&S MS conforms to the organisation's planned arrangements and the requirements of ISO 45001, and whether it has been effectively implemented and maintained. Auditors may examine documented information, interview workers and managers, observe workplace activities and review records relating to incidents, inspections, training and corrective actions.

Audit findings should be based on objective evidence and should identify the relevant requirement or process where a nonconformity has been established. Corrective actions should address the cause of nonconformities where appropriate, and their implementation and effectiveness should be evaluated.

Management review provides an opportunity for senior management to consider the continuing suitability, adequacy and effectiveness of the OH&S MS. Information considered may include audit results, incident and nonconformity data, performance against objectives, changes affecting the organisation, worker consultation and participation, resource requirements and opportunities for improvement.

[edit] Common implementation challenges

[edit] Avoid treating certification as a documentation exercise

ISO 45001 certification is not achieved simply by producing a set of procedures. A documented system may be comprehensive while workplace practices remain ineffective. Certification assessment considers whether the management system has been implemented and is functioning in accordance with the standard.

Documentation should therefore describe and support the organisation's actual processes. Procedures that employees cannot understand or reasonably apply are unlikely to provide effective controls.

[edit] Allow sufficient time and resources

Implementation requires time from managers, health and safety personnel, supervisors, process owners and workers. Responsibilities should be allocated clearly and implementation activities incorporated into normal work planning.

The resources required will depend on the organisation's size, complexity, existing management arrangements and the nature and significance of its OH&S risks. Some organisations may be able to develop the system using existing personnel, while others may require additional expertise or resources.

[edit] Address immediate safety risks

Existing health and safety risks should be addressed as a priority rather than waiting for the certification process. ISO 45001 implementation can help strengthen hazard identification, risk control and corrective action, but it should not be treated as a reason to postpone measures needed to protect workers.

The management system should support the organisation's existing legal and operational responsibilities and should provide a framework for identifying and addressing weaknesses systematically.

[edit] Sustaining progress towards certification

ISO 45001 implementation can be divided into manageable stages. An organisation might begin with a gap assessment, establish priorities, address significant weaknesses, develop or improve processes, provide training, operate the system, conduct internal audits and complete management review before seeking certification.

Clear milestones can make progress easier to monitor, while regular communication can help maintain worker engagement. Recognising practical improvements and involving employees in problem-solving can also help sustain participation.

The amount of effort required will vary between organisations. Higher-risk activities may require more detailed hazard identification and operational controls, while lower-risk organisations may have fewer significant hazards. However, organisations with relatively low physical risks still need to consider relevant issues such as ergonomics, psychosocial hazards, emergency preparedness, electrical safety and risks associated with contractors or other activities.

[edit] Preparing for certification

Once the OH&S MS has been implemented and has generated sufficient evidence of operation, the organisation can arrange an independent certification assessment. The certification body will assess the management system against ISO 45001 within the agreed scope.

The organisation should ensure that employees understand the system and can explain how relevant processes operate in practice. Records should demonstrate that required processes have been implemented and that monitoring, internal audits, management review and corrective action have taken place where applicable.

Certification is not the end of the management process. Maintaining certification requires the OH&S MS to remain operational and effective, with continuing evaluation and improvement. Surveillance and reassessment activities may form part of the certification cycle.

[edit] Conclusion

Getting started with ISO 45001 certification involves more than preparing documentation for an audit. Organisations should first understand the requirements of the standard, assess their existing health and safety arrangements, establish leadership commitment and involve workers in the development of the OH&S MS.

The organisation can then establish systematic processes for identifying hazards, assessing and controlling risks, managing operational activities, monitoring performance and addressing nonconformities. Internal audits and management reviews provide opportunities to evaluate whether the system is working as intended and identify areas for improvement.

The most effective approach is to use ISO 45001 as a framework for improving actual occupational health and safety management. When the system is integrated into everyday planning, supervision and decision-making, certification becomes an assessment of an established management process rather than the primary objective.