The short answer
ISO 45001 certification is independent confirmation that your occupational health and safety (OH&S) management system meets ISO 45001:2018. You get it by identifying hazards, involving workers, controlling risks and meeting legal duties, running the system, then passing a Stage 1 and Stage 2 audit by a certification body. ISO 45001 replaced OHSAS 18001.
On this page
- What is ISO 45001?
- What does ISO 45001 require?
- How does hazard identification work under ISO 45001?
- Why does worker participation matter in ISO 45001?
- How do you get ISO 45001 certification?
- How does ISO 45001 integrate with ISO 9001 and ISO 14001?
- How much does ISO 45001 certification cost?
- Why Sovereign Secure
- Next step
ISO 45001 certification is independent confirmation, by a certification body, that your occupational health and safety (OH&S) management system meets ISO 45001:2018. Sovereign Secure provides the consultancy: gap analysis, system design, documentation, training, internal audit and support through the audits. The Stage 1 and Stage 2 certification audits are carried out by an independent certification body, which makes its own certification decision.
Sovereign Secure Ltd is an ISO 27001-certified UK consultancy headquartered in Accrington, Lancashire. ISO 45001 sits within our wider ISO certification service, alongside ISO 9001, ISO 14001, ISO 22301 and other management system standards.
What is ISO 45001?
ISO 45001 is the international standard for OH&S management systems (ISO 45001 on iso.org). Its purpose is to prevent work-related injury and ill health and to provide safe and healthy workplaces, by managing hazards systematically and improving OH&S performance over time. It applies to any organisation, whatever its size, sector or level of risk. It is built on plan, do, check, act, the same approach HSE sets out in Managing for health and safety (HSG65), so it fits how health and safety is already run in Great Britain.
| Date | What happened |
|---|---|
| March 2018 | ISO 45001:2018 published, replacing OHSAS 18001 |
| 2021 | The migration period for OHSAS 18001 certificates ended |
| February 2024 | Amendment 1 added climate action changes to clause 4 |
| Now | ISO is revising the standard; ISO 45001:2018 with Amendment 1 stays current until a new edition is published |
Why did OHSAS 18001 change to ISO 45001?
OHSAS 18001 was a specification published by BSI rather than an international standard, so ISO developed ISO 45001 to give occupational health and safety one internationally agreed standard, built on the same structure as its other management system standards. ISO 45001 replaced OHSAS 18001 when it was published in March 2018. Compared with its predecessor, it puts more weight on top management accountability, on the context of the organisation, on worker consultation and participation, and on managing contractors and outsourced work. It also uses the same clause structure as ISO 9001 and ISO 14001, which makes an integrated management system far simpler.
What does ISO 45001 require?
ISO 45001 requires a management system that covers clauses 4 to 10:
| Clause | What it requires | Common gap |
|---|---|---|
| 4 Context | Internal and external issues (including whether climate change is relevant), the needs of workers and other interested parties, the scope | Contractors and visitors left out of interested parties |
| 5 Leadership and worker participation | Top management accountability, an OH&S policy, roles, consultation and participation of workers | Consultation limited to a safety committee that rarely meets |
| 6 Planning | Hazard identification, assessment of OH&S risks and opportunities, legal and other requirements, OH&S objectives | Risk assessments never revisited after changes |
| 7 Support | Resources, competence, awareness, communication, documented information | Training records with no link to the risks of the role |
| 8 Operation | Eliminating hazards and reducing risks, management of change, procurement, contractors and outsourcing, emergency preparedness | Emergency drills planned but not run or reviewed |
| 9 Performance evaluation | Monitoring and measurement, evaluation of legal compliance, internal audit, management review | Legal register with no evidence of compliance checks |
| 10 Improvement | Incident investigation, nonconformity and corrective action, continual improvement | Incidents closed without root cause analysis |
How does hazard identification work under ISO 45001?
Hazard identification must be an ongoing, proactive process, not a one-off risk register. The standard expects you to consider how work is organised and its social factors (including workload, working hours, harassment and bullying), routine and non-routine activities, past incidents, potential emergencies, everyone affected (workers, contractors and visitors), and changes to work, equipment or knowledge.
Once risks are assessed, controls are chosen using the hierarchy of controls set out in clause 8.1.2:
| Level | Approach | Example |
|---|---|---|
| 1 | Eliminate the hazard | Move work at height to ground level |
| 2 | Substitute with something less hazardous | Switch to a less harmful cleaning chemical |
| 3 | Engineering controls and reorganising work | Guarding on machinery, changing shift patterns to reduce fatigue |
| 4 | Administrative controls, including training | Permits to work, safe systems of work, inductions |
| 5 | Personal protective equipment | Gloves, eye protection, hearing protection |
This builds on duties employers in Great Britain already have. Regulation 3 of the Management of Health and Safety at Work Regulations 1999 requires a suitable and sufficient assessment of risks. ISO 45001 turns that into a managed process with owners, reviews and records an auditor can follow.
Why does worker participation matter in ISO 45001?
Worker participation is one of the main differences between ISO 45001 and older approaches, and certification auditors test it directly. Clause 5.4 requires a process for consulting workers, and their representatives where they exist, at all applicable levels and functions. It gives particular weight to non-managerial workers, who must be consulted on matters such as the OH&S policy, legal requirements, objectives and contractor controls, and must take part in identifying hazards, deciding controls, setting training needs and investigating incidents.
You must also give workers the time, training and information to take part, remove barriers to participation, and protect them from reprisals when they report incidents, hazards and risks. Expect the auditor to talk to people on the shop floor or in the field, not only to managers. UK law already requires employers to consult employees on health and safety; ISO 45001 goes further by asking for genuine participation in how the system works.
How do you get ISO 45001 certification?
You get ISO 45001 certification by building and running an OH&S management system, then passing a two-stage audit by an independent certification body.
- Agree the scope. Which sites, activities and workers must the certificate cover, including contractors working under your control?
- Gap analysis. Compare current practice with every clause of ISO 45001 and with your legal duties.
- Legal register and hazard identification. Record the legal requirements that apply and assess hazards across routine, non-routine and emergency work.
- Design and document the system. OH&S policy, objectives and only the procedures and records you need.
- Run it. Produce the records auditors sample: inspections, consultation, training, incident investigations, contractor checks and emergency drills.
- Internal audit and management review. Both must be complete before Stage 2.
- Stage 1 audit. The certification body reviews documentation and readiness.
- Stage 2 audit. Interviews, site observation and record sampling confirm the system works. The certificate is issued once any major nonconformities are closed and the certification body accepts your plan for any minor ones.
The certificate lasts three years, with surveillance audits in years two and three and a recertification audit before expiry.
What does our ISO 45001 consultancy include?
| Service | What you get | When |
|---|---|---|
| Gap analysis | Current practice rated against clauses 4 to 10, with a prioritised plan | First; it sizes the project |
| System design | Scope, context, interested parties, OH&S policy and objectives | Before documents are written |
| Risk and legal workshops | Hazard identification, risk assessment and legal register structure | During build |
| Documentation | Proportionate procedures and records, not a template pack | During build |
| Worker consultation | A consultation and participation process that works for your workforce | Before go-live |
| Internal audit | Impartial audit with corrective actions | Before Stage 2, then yearly |
| Management review | Inputs and minutes that meet clause 9.3 | Before Stage 2, then yearly |
| Audit support | Help at Stage 1 and Stage 2, and with closing findings | Every certification body visit |
We work alongside your health and safety lead or adviser, who brings the technical knowledge of your hazards. Our job is to make sure the management system around that work meets the standard and stands up at audit.
How does ISO 45001 integrate with ISO 9001 and ISO 14001?
ISO 45001, ISO 9001 and ISO 14001 share the same clause structure, so many organisations run them as one integrated management system with a single set of policies, internal audits and management reviews. Two of the three have new editions: ISO 9001:2026 was published in September 2026 and ISO 14001:2026 replaced the 2015 edition earlier in 2026, while ISO 45001 remains on its 2018 edition, amended in 2024, with a revision under way.
| Shared across all three | Specific to each standard |
|---|---|
| Context, interested parties and scope | ISO 9001: customer requirements and product or service conformity |
| Policy, objectives and leadership | ISO 14001: environmental aspects and compliance obligations |
| Competence, awareness and document control | ISO 45001: hazards, OH&S risks and worker participation |
| Internal audit, management review and corrective action | ISO 14001 and ISO 45001: emergency preparedness and response |
Building to the current editions from the start avoids rework at transition. See our ISO 9001 consultancy and ISO 14001 certification pages for those standards. Whether the certification audits can be combined is for the certification body to decide. For manufacturers, where all three standards are common, our page on manufacturing cyber security covers the security requirements customers often add.
How much does ISO 45001 certification cost?
There is no fixed price. The cost has two parts: consultancy to build the system and the certification body’s audit fees across the three-year cycle. The same factors drive both:
| Factor | Why it matters |
|---|---|
| People in scope | Sets the certification body’s audit time and the number of people to train and consult |
| Number of sites | Each site may need sampling at audit, and its own hazards and emergency arrangements |
| Hazard level of the work | Construction, manufacturing and logistics need more assessment than office work |
| Contractors and shared sites | Adds procurement, contractor control and coordination work |
| What already exists | Sound risk assessments or an ISO 9001 or ISO 14001 system shorten the build |
We do not publish ISO prices because scopes vary so widely. Tell us your headcount, sites and type of work and we will give you a fixed quote.
Why Sovereign Secure
- One consultancy for your management systems. We provide consultancy for ISO 45001, 9001, 14001, 22301, 27001 and other ISO standards, including ISO 55001 asset management, so an integrated system is designed once.
- ISO 27001 certified ourselves, so we run a certified management system as well as advising on them, and can bring ISO 27001 into the same integrated system if you need it.
- Independent certification. Certification audits are carried out by an independent certification body that makes its own decisions. Our partner certification body is MQA International, accredited for ISO 45001 by IAS, the International Accreditation Service, and we confirm the certification body for your ISO 45001 scope when we quote.
- UK based, established 2012. Headquartered in Accrington, Lancashire, with offices in Los Angeles, Singapore, Dubai and Dhaka.
Next step
Contact us or call +44 161 523 5276 with your headcount, sites and the type of work you do, and we will send a fixed quote for ISO 45001 consultancy and a plan to certification.
Last reviewed October 2026 by the Sovereign Secure assessment team.
