20 certification schemes

ISO 45001:2018

ISO 45001 Certification

ISO 45001 sets the requirements for an occupational health and safety management system that reduces risk to workers.

Standard
ISO 45001:2018
Indicative timeline
8-14 weeks, depending on scope and readiness
Discipline
ISO Standards
Assessment type
Independent third-party assessment

The standard

Overview

ISO 45001:2018 is the international standard for occupational health and safety management systems. It requires hazard identification, assessment of health and safety risks and opportunities, and controls applied through the hierarchy of controls. It places particular weight on worker participation and consultation, on the duties of top management, and on the control of contractors, procurement and outsourced work.

Certification shows that an independent assessor has examined the arrangements and found them in use rather than only written down. Principal contractors, clients and insurers ask for it as evidence of competent safety management. In the UK it sits alongside duties under the Health and Safety at Work etc. Act 1974 and the regulations made under it; it does not replace them.

UKCert reviews your risk assessments, legal register and consultation arrangements first, then audits the system where the work happens. Speaking to workers and their representatives is a required part of the audit.

Who this is for

  • Construction contractors and subcontractors working on managed sites
  • Manufacturers with machinery, hazardous substances or manual handling risk
  • Logistics, warehousing and transport operators
  • Facilities, maintenance and engineering service providers
  • Organisations asked to evidence safety management at prequalification

What it gives you

Why organisations certify

What a certified ISO 45001:2018 assessment gives you once the certificate is issued.

Fewer incidents

Systematic hazard identification and the hierarchy of controls address causes rather than symptoms, which is what reduces injuries, lost time and repeat events.

Worker participation

The standard requires consultation with workers and, where they exist, their representatives, so controls are designed with the people who face the hazard.

Legal duties mapped

Applicable regulations, approved codes of practice and permits are identified, assigned and evaluated, which supports the duty to manage health and safety under UK law.

Contractor control

Procurement, contractor selection and shared site arrangements are treated as part of the system, closing the gap where responsibility between employers is often unclear.

Prequalification evidence

Client prequalification and principal contractor vetting routinely ask how safety is managed. Certification answers with an audited system and the records behind it.

Insurer and board confidence

Documented risk assessment, incident investigation and management review give insurers and directors a clear view of how safety risk is being controlled.

Scope

What the assessment covers

The areas an assessor works through. Your final scope is confirmed in writing before any audit is booked.

  • Hazard identification and OH&S risk assessment
  • Hierarchy of controls applied to significant risks
  • Worker consultation and participation arrangements
  • Legal and other requirements register
  • Safe systems of work and permit to work controls
  • Contractor, procurement and outsourcing controls
  • Incident reporting, investigation and corrective action
  • Emergency preparedness, response and drills

How it runs

The assessment, stage by stage

From first enquiry to certificate. Each stage is agreed with you before it starts.

  1. Scope and quotation

    We confirm activities, sites, worker numbers including agency and subcontract labour, and shift patterns. Risk level and headcount determine audit duration, and the quotation follows from that.

  2. Gap review

    An optional review of risk assessments, the legal register, consultation arrangements and incident records against the standard, identifying what needs work before formal assessment begins.

  3. Stage 1 assessment

    We examine scope, the hazard identification method, the legal register, objectives and mandatory records, and confirm that internal audit and management review have taken place.

  4. Stage 2 assessment

    An audit at the workface. We observe work in progress, examine permits and controls, and interview workers and their representatives about consultation, training and how concerns are raised.

  5. Certification decision

    Findings are closed with corrective action and evidence. Anything indicating immediate risk to workers must be dealt with first. An independent reviewer then takes the certification decision.

  6. Surveillance and renewal

    Surveillance audits during the three-year cycle examine incidents, investigations, consultation, changes to activities and legal updates, with observation on site each time. Recertification follows before expiry.

Questions

ISO 45001:2018 — frequently asked

Anything here that does not cover your situation, put it to an assessor rather than guessing at it.

Ask a question

Around 8 to 14 weeks for a single site with risk assessments, a legal register and consultation arrangements already working. Audit duration depends on worker numbers, including agency and subcontract labour, and on the risk profile of the work, so multi-site contractors and higher risk operations take longer.

Three years from the certification decision, with surveillance audits during the cycle and recertification before expiry. The certificate states the scope, the sites and the activities covered. Serious findings left unresolved, or refusal of access for a surveillance audit, can lead to suspension or withdrawal of the certificate.

No. Certification is voluntary. UK health and safety law, principally the Health and Safety at Work etc. Act 1974 and the regulations made under it, applies regardless, and certification neither adds to nor reduces those duties. ISO 45001 is a way of organising compliance and demonstrating it, and many principal contractors and public bodies require it contractually.

We sample rather than re-audit everything, and part of each visit is spent observing work and speaking to workers. Incidents and investigations, corrective actions, consultation records, training, legal updates, internal audit and management review are examined each time. The full certified scope is covered across the three-year cycle.

OHSAS 18001 was withdrawn and the migration period closed in March 2021, so it is no longer a valid certification. ISO 45001 keeps the familiar risk assessment and control logic, then adds the common ISO clause structure, explicit worker participation requirements and stronger expectations on leadership, contractors and procurement. Existing arrangements usually transfer with additions rather than a rebuild.

Certifying against more than one standard?

Where you hold several standards, shared clauses are assessed once in a combined visit rather than as separate audits. Talk it through with an assessor before you decide what ISO 45001:2018 should sit alongside.