What Is ISO 45001?
ISO 45001:2018 is the international standard for Occupational Health and Safety (OH&S) Management Systems, published by the International Organization for Standardization in March 2018. It is the successor to OHSAS 18001 and the most widely recognised framework for formal OH&S management system certification worldwide.
The standard specifies requirements for an OH&S management system that enables organisations to proactively improve OH&S performance, prevent work-related injury and ill health, and provide safe and healthy workplaces. Unlike OHSAS 18001, which focused primarily on hazard and risk management, ISO 45001 takes a broader systems approach — requiring organisations to understand their context, engage their workers, and demonstrate visible leadership commitment.
ISO 45001 is structured using the Annex SL High Level Structure — the same framework used by ISO 9001 (Quality Management) and ISO 14001 (Environmental Management). This makes integrated management system (IMS) implementation significantly more efficient for organisations pursuing QHSE certification.
For a broader understanding of how ISO 45001 fits within a complete health and safety management system, see our guide to HSE management systems.
ISO 45001 vs OHSAS 18001: Key Differences
Organisations that held OHSAS 18001 certification were required to migrate to ISO 45001 by March 2021. The standards address the same discipline but ISO 45001 is substantially more demanding in several areas:
| Aspect | OHSAS 18001 | ISO 45001 |
|---|---|---|
| Context of organisation | Not required | Mandatory — Clause 4.1 and 4.2 |
| Leadership emphasis | General management responsibility | Top management must demonstrate active, visible commitment (Clause 5.1) |
| Worker participation | Consultation mentioned | Explicit requirement for consultation and participation at all levels (Clause 5.4) |
| Risk and opportunity management | Hazard and risk focus | Broader risk-based thinking including risks and opportunities beyond hazards (Clause 6.1.1) |
| Structure | OHSAS-specific structure | Annex SL — compatible with ISO 9001 and ISO 14001 for integrated MS |
| Contractor management | Limited requirements | Explicit procurement and contractor management requirements (Clause 8.1.4) |
| Management of change | Implied | Explicit process requirement (Clause 8.1.3) |
| Performance evaluation | Basic monitoring | Structured monitoring, measurement, analysis, and evaluation (Clause 9.1) |
ISO 45001 Clause Requirements (Clauses 4–10)
The normative requirements of ISO 45001 are contained in Clauses 4 through 10. This section provides a practical summary of each clause, its sub-clauses, and how HSETrack supports conformance.
Clause 4: Context of the Organisation
Clause 5: Leadership and Worker Participation
Clause 6: Planning
Clause 7: Support
Clause 8: Operation
Clause 9: Performance Evaluation
Clause 10: Improvement
Conducting an ISO 45001 Gap Analysis
A gap analysis compares your current OH&S management system against the requirements of ISO 45001 and identifies where you are conformant, partially conformant, and not conformant. It is the essential first step in any certification journey — it tells you the scope of work required and prevents unpleasant surprises during the certification audit.
Assemble Your Gap Analysis Team
The gap analysis should be led by the OH&S Manager or a qualified consultant, with input from departmental managers, HSE officers, and worker representatives. Avoid conducting the gap analysis in isolation — the process of discussing requirements with operational teams often surfaces issues that a desk review would miss.
Obtain and Review the Standard
Purchase a copy of ISO 45001:2018 from ISO or your national standards body. Read Clauses 4–10 in full. For each clause and sub-clause, document whether your current system has evidence of conformance, partial conformance, or no conformance.
Review Existing Documentation
Collect all existing OH&S documentation: policies, procedures, risk assessments, legal registers, training records, incident logs, audit reports, and management review records. Assess each document against the relevant ISO 45001 clause. Identify documents that need to be created, revised, or consolidated.
Interview Operational Staff
Document review alone cannot tell you whether procedures are actually being followed. Interview front-line workers and supervisors to understand what actually happens in practice. Discrepancies between documented procedures and actual practice are among the most common nonconformities found in certification audits.
Prioritise Gap Remediation
Categorise each gap by significance: major gaps (likely to result in a major nonconformity that prevents certification), minor gaps (likely to result in an observation or minor nonconformity), and improvement opportunities. Create a remediation plan with named owners, activities, and realistic deadlines for each gap.
Implement Remediation and Verify
Work through the remediation plan systematically, starting with major gaps. After implementing each remediation, verify that the gap has been adequately closed before moving to the next. Allow at least three months of evidence generation (incident reports, inspection records, training completions) before scheduling your Stage 1 audit.
The ISO 45001 Certification Process
ISO 45001 certification is conducted by an accredited Certification Body (CB) — also called a Registrar. The certification audit is a two-stage process followed by ongoing surveillance audits and a recertification audit every three years.
Phase 1: Select a Certification Body
Choose an accredited CB whose accreditation is recognised in your target markets. Key accreditation bodies include UKAS (UK), DAkkS (Germany), ANAB (US), and IAF MLA signatories globally. Request quotes from 2–3 CBs — pricing and auditor expertise vary significantly. Verify that the CB has auditors with experience in your industry sector.
Phase 2: Stage 1 Audit — Documentation Review
The Stage 1 audit (typically 1–2 days on-site or remote) is a documentation review and readiness assessment. The auditor reviews your OH&S MS documentation, confirms that the scope is appropriately defined, assesses your understanding of the standard requirements, and identifies areas of concern for the Stage 2 audit. At the end of Stage 1, you receive a report identifying any issues to address before proceeding to Stage 2.
Phase 3: Stage 2 Audit — Implementation Assessment
The Stage 2 audit (typically 2–5 days on-site, depending on organisation size) assesses whether your OH&S MS is effectively implemented in practice. Auditors conduct interviews, observe work activities, review records, and test the effectiveness of your controls. Any nonconformities (major or minor) must be addressed before or shortly after certification is granted.
Phase 4: Certification Decision and Certificate Issuance
If no major nonconformities are identified, or after major nonconformities are closed, the CB issues your ISO 45001 certificate. The certificate is valid for three years and lists the scope of certification and the accreditation body. Update your company communications, tenders, and pre-qualification submissions to reflect certification.
Phase 5: Surveillance Audits (Years 1 and 2)
Surveillance audits (typically 1–2 days) occur annually in Years 1 and 2 of the certification cycle. They assess continued conformance and progress against improvement objectives. Auditors focus on different areas in each surveillance audit, so you must maintain your OH&S MS consistently throughout the cycle — not just at certification.
Phase 6: Recertification Audit (Year 3)
The recertification audit (similar in scope to the original certification audit) takes place before your certificate expires. It reviews the full OH&S MS to confirm continued conformance and the effectiveness of continual improvement over the three-year cycle. Successfully completing recertification extends the certificate for another three years.
How HSE Software Supports ISO 45001 Conformance
One of the practical challenges in ISO 45001 certification is generating and maintaining the documented evidence required by the standard across Clauses 7.5, 9.1, 9.2, 9.3, and 10.2. Manual documentation approaches — binders, spreadsheets, shared drives — are technically compliant but create significant administrative burden and increase the risk of audit findings related to documentation control.
For organisations pursuing ISO 45001 certification, HSETrack's HSE management system provides a single platform that generates the documented evidence required across all normative clauses — reducing audit preparation time and eliminating the risk of records being unavailable when the auditor arrives.
Accelerate Your ISO 45001 Certification with HSETrack
HSETrack provides the documented evidence required across ISO 45001 Clauses 6–10 — risk assessments, incident investigations, audit reports, training records, and KPI dashboards — all in one auditor-ready platform. Start your free trial today.
Frequently Asked Questions
What is ISO 45001?
ISO 45001:2018 is the international standard for Occupational Health and Safety Management Systems, published in March 2018. It replaced OHSAS 18001 and specifies requirements for an OH&S management system that enables organisations to proactively improve OH&S performance and prevent work-related injury and ill health. It uses the Annex SL High Level Structure for compatibility with ISO 9001 and ISO 14001.
What is the difference between ISO 45001 and OHSAS 18001?
ISO 45001 superseded OHSAS 18001 in 2018, with all OHSAS certificates expiring in March 2021. Key differences: ISO 45001 requires organisations to understand their context (Clause 4), places far greater emphasis on leadership and worker participation (Clause 5), uses a broader risk-based approach beyond hazard management, and is structured using Annex SL for integration with other ISO standards.
How long does ISO 45001 certification take?
Timelines vary by organisation size and OH&S maturity. Small organisations can typically achieve certification in 3–6 months. Medium-sized organisations take 6–12 months. Large, multi-site organisations can take 12–24 months. The certification audit itself is a two-stage process lasting 3–7 days depending on organisation size.
Does ISO 45001 replace OSHA compliance?
No. ISO 45001 is a voluntary international standard; OSHA is mandatory federal law in the United States. ISO 45001 Clause 6.1.3 specifically requires organisations to identify and comply with all applicable legal requirements. Certification supports but does not substitute for OSHA compliance.
How does HSE software support ISO 45001 conformance?
HSE software supports ISO 45001 across multiple clauses: risk assessment modules support Clause 6.1.2; legal register tools support Clause 6.1.3; training records support Clause 7.2; performance dashboards support Clause 9.1; audit management supports Clause 9.2; and incident investigation workflows support Clause 10.2. A platform like HSETrack provides auditor-ready evidence across all normative clauses in a single system.
Build the Evidence Base for ISO 45001 Certification
HSETrack gives you the risk assessment registers, incident investigation records, audit trails, and performance dashboards that auditors look for across ISO 45001 Clauses 6–10. Start your free trial and build your conformance evidence from day one.