What is ISO 45001 Certification?
ISO 45001 is the internationally recognized standard for Occupational Health and Safety Management Systems (OHSMS). It provides a systematic framework for preventing work-related injuries, illnesses, and fatalities while demonstrating your commitment to worker safety. Whether you're a construction company, manufacturer, healthcare provider, or service organization, ISO 45001 helps you create safer workplaces while meeting customer requirements and regulatory obligations.
Why companies pursue ISO 45001:
- Strengthen OSHA compliance and reduce risk of violations and penalties
- Meet contract requirements from major corporations and government agencies
- Reduce workers' compensation costs and insurance premiums significantly
- Demonstrate safety leadership to attract top talent and win more business
What an ISO 45001 consulting engagement actually involves
Most buyers searching for an ISO 45001 consultant want to know what happens after the contract is signed. Here is the sequence on a small to mid-size engagement. The order is the same on every project; the pace depends on company size, the number of sites, and how much of a safety program already exists.
Weeks 1-2: Gap analysis
The work starts on the floor, not in the binder. We walk the site, talk with supervisors and the people doing the highest-risk tasks, and read the safety program you already have: written programs, training records, inspection checklists, and incident logs. The gap analysis measures all of it against clauses 4 through 10 of ISO 45001 and produces a findings report that separates what already conforms, what partly conforms, and what is missing. An established OSHA program covers much of clause 8, the operational controls. The management system around those controls, from worker consultation and objectives to internal audit and management review, is where most of the new work sits.
Weeks 2-4: Scope, legal requirements, and plan
Next we define what the certificate covers: which sites, which activities, and which workers, including contractors on your premises and your own crews working at customer locations. ISO 45001 clause 6.1.3 requires you to determine the legal requirements that apply to your hazards, so this is also when the legal register gets built: the OSHA standards, State Plan rules where your state runs one, and the safety requirements in your customer contracts. The implementation plan is then mapped to your calendar, around peak production, shutdowns, and the certification body's audit dates.
Months 2-3: Building the system
This is the bulk of the work. We document what your crews and supervisors already do and close the gaps, rather than hand over a template manual. Hazard identification and risk assessment come first (clause 6.1.2), because nearly every other requirement depends on them: controls, training, objectives, and what you monitor. Controls follow the hierarchy in clause 8.1.2: eliminate the hazard, substitute something less hazardous, use engineering controls, then administrative controls and training, with personal protective equipment last. Workers take part throughout, because the standard requires it. We provide the structure, the clause mapping, and drafting support; your people make the process decisions.
Months 3-4: Internal audit and management review
Before the certification audit, ISO 45001 requires an internal audit (clause 9.2) and a management review (clause 9.3), and both have to be real. We run the internal audit with your team or train your people to run it, record the findings, and close them out. An internal audit that finds nothing reads to a certification auditor as an audit that did not happen. Management review follows, with top management in the room, covering incidents, audit results, legal compliance, worker consultation, and progress against objectives.
Months 3-6: Certification audit
The certification audit runs in two stages. Stage one reviews your documentation and readiness; stage two is on site, where the auditor interviews workers and managers, walks the operation, and samples records. We prepare your team for the questions auditors ask, attend the audit, and help you close any findings with evidence. From kickoff to certificate, ISO 45001 takes 3 to 6 months for most small and mid-size companies.
What we do versus what stays with you
A consulting engagement works when the split is explicit.
We handle: the gap analysis and its findings report, the implementation plan, the system structure and drafting support, clause mapping, the legal register framework, internal audit execution or co-execution, management review facilitation, corrective action design, certification body selection and scheduling, audit preparation, and attending the certification audit.
You handle: knowledge of your hazards, process decisions, document approvals, and releasing people for working sessions and interviews. One requirement cannot move to a consultant at all: consultation and participation of workers (clause 5.4). Non-managerial workers have to take part in identifying hazards, deciding controls, and investigating incidents, and be consulted on the policy, the objectives, and how legal requirements are met. The standard also requires you to remove the barriers to that participation, such as lack of time or training and fear of reprisal. Our guide to worker participation covers what that looks like in practice.
Who an ISO 45001 consultant is right for
Consulting earns its cost when there is a deadline you cannot move: a customer or prime contractor requiring ISO 45001 from its suppliers, a tender that scores it, or a parent company rolling it out to every site. It also fits companies whose safety program lives with one person, whose leadership team has never run a management system, or whose earlier attempt stalled between the written programs and the audit.
A consultant is the wrong call when you already have a safety manager with management system experience, a realistic timeline, and leadership willing to fund their time. Self-implementation works in that situation. Be wary of anyone who promises certification without your people's involvement: the certificate comes from an accredited certification body, and its auditors interview workers, not binders.
What goes wrong when companies do it without help
Self-built systems tend to fail in the same places, and every one of these costs more to fix after an audit than to avoid before it.
Treating the OSHA program as the whole system. Written programs for lockout, confined spaces, and fall protection cover operational controls. ISO 45001 also requires the management system around them: context, worker consultation, objectives, internal audit, management review, and corrective action. Relabeling the OSHA binder as an ISO 45001 manual covers clause 8 and leaves most of the standard unaddressed.
Worker participation on paper. A safety committee that meets without minutes, or risk assessments signed by workers who never saw the assessment, gives the auditor a finding in the first interview.
A legal register that stops at the list. Clause 9.1.2 requires a periodic evaluation of compliance with each legal requirement. A list of regulations without evidence that you checked your compliance against them does not meet the clause.
Contractors left out. Clause 8.1.4 covers procurement, contractors, and outsourced work. Contractors on your site work under your hazards, and your crews on a customer's site work under theirs; both belong in the system. Our article on contractor safety management walks through the controls.
Records filled in for the audit. Inspection checklists completed in batches, incident investigations that stop at "worker error", and objectives written the week before the audit. Auditors sample records across the whole year, and a retroactive pattern undermines trust in everything else.
ISO 45001 and OSHA: what the certificate does and doesn't do
ISO 45001 is a voluntary standard. OSHA does not require it, and certification does not replace OSHA compliance: OSHA standards apply in full to a certified site. ISO 45001 builds compliance into the system instead, by requiring you to identify your legal requirements (clause 6.1.3) and evaluate your compliance with them on a schedule (clause 9.1.2). ISO does not certify organizations itself; accredited certification bodies do.
The two frameworks fit together. OSHA publishes its own voluntary Recommended Practices for Safety and Health Programs, along with a crosswalk that maps them to ISO 45001 element by element. OSHA's guidance notes that a standard such as ISO 45001 may suit businesses that already run management systems for quality or environmental compliance, and that some sites in OSHA's Voluntary Protection Programs (VPP) base their programs on it.
What the certificate does not do is take you out of OSHA's inspection program. VPP sites are not subject to OSHA programmed inspections while they keep their VPP status; an ISO 45001 certificate carries no such exemption. Its value is the system itself: hazards found and controlled before an incident, and a compliance check that runs on a schedule instead of after a citation.
What ISO 45001 auditors actually check
The certification audit tests whether the system reaches the work, not whether the documents are tidy. These are the areas where auditors dig.
Hazard identification that matches the job. Auditors pick a task, ask the worker doing it what the hazards are, and compare the answer with your risk assessment (clause 6.1.2). Routine and non-routine work, contractors, visitors, and work at customer sites all have to be covered. Our hazard identification guide shows how to build that coverage.
Controls chosen by the hierarchy. When a risk assessment settles on training and personal protective equipment for a hazard that could be engineered out, the auditor asks why (clause 8.1.2).
Legal compliance with evidence. The auditor picks an item from your legal register and asks for the last compliance evaluation against it (clause 9.1.2).
Incidents and near misses. Auditors read investigation records for root cause and for corrective actions that were completed and checked for effectiveness (clause 10.2). A reporting system that logs no near misses over a year signals under-reporting, not safety. See our guide to near miss reporting.
Emergency preparedness. Most sites have a written plan; auditors ask for drill records and what changed after the last drill (clause 8.2). Our emergency preparedness guide covers planning for the scenarios your site actually faces.
Worker consultation. Auditors interview non-managerial workers directly and ask how they took part in identifying hazards and investigating incidents (clause 5.4).
Competence. Auditors check that training matches the risks each role faces and that you evaluate whether the training worked (clause 7.2). Our guide to ISO 45001 training requirements covers what the standard expects.
How long ISO 45001 certification takes
ISO 45001 certification takes 3 to 6 months from kickoff for most small and mid-size companies. Three things set the pace:
- How much of a safety program already exists: written programs, training records, and inspection routines shorten the build
- The number of sites, and how much of the work happens at customer or field locations
- How quickly working sessions and approvals happen, and how early the certification body is booked
The biggest schedule variable is leadership time, not paperwork. A team that attends working sessions and makes decisions in them moves faster than one that hands the whole project to the safety lead. After the certificate, surveillance audits follow in years one and two, and recertification in year three.
What ISO 45001 consulting costs
For small and mid-size U.S. businesses, ISO 45001 consulting and certification together run from $5,000 to $15,000. The range covers the consulting engagement and the certification body's audit fees, and both scale with the same factors: headcount, number of sites, the hazard profile of the work, and how much of a safety program already exists.
What moves the number up: multiple sites, crews working at customer locations, high-hazard operations that need more risk assessment, and starting without written safety programs. What moves it down: an established OSHA program that needs a management system built around it, leadership that engages quickly, and adding ISO 45001 to an existing ISO 9001 or ISO 14001 system. Quotes far below the field usually leave out the certification body, and the registrar's fees are not optional.
We quote transparently before any work starts. What we will not do is lowball the consulting number and leave the registrar, surveillance, and recertification costs for you to discover later.
Moving from OHSAS 18001, or adding ISO 45001 to ISO 9001 and ISO 14001
ISO 45001 replaced OHSAS 18001, and OHSAS 18001 certificates are no longer recognized. The main changes: top management takes overall accountability for the system (clause 5.1), worker consultation and participation has its own clause, the organization has to understand its context and interested parties, and contractors and outsourced work sit inside the system. A company moving from an OHSAS 18001 system keeps most of its hazard controls and rebuilds the management layer around them. Our ISO 45001 vs. OHSAS 18001 comparison covers what changed in detail.
ISO 45001 shares its structure with ISO 9001 and ISO 14001: the same clause numbers, the same plan-do-check-act loop, and the same internal audit and management review requirements. A company already certified to either one adds ISO 45001 faster, because document control, the audit program, and the management review rhythm already exist. One integrated management system with one internal audit program and a combined certification audit is less work to run than three separate systems.
Choosing a certification body (registrar)
Choose a certification body accredited by a recognized accreditation body, such as ANAB in the United States; a certificate from an unaccredited source will not survive a customer's supplier qualification. Beyond accreditation, compare auditor experience in your industry and hazard profile, scheduling flexibility, and price. An auditor who knows construction or heavy industry asks better questions about your actual risks. We help you select and schedule the certification body and prepare your team for its audit style.
On-site versus remote consulting
Safety work needs more floor time than most standards, because hazards have to be seen where the work happens. The gap analysis walkthrough, the hazard identification sessions with crews, and the internal audit interviews happen on site. Document drafting, legal register work, objective setting, and management review preparation run well remotely. Our engagements mix the two: on site for the walkthroughs and audits, remote for the working sessions in between, which keeps travel cost out of the quote.
What happens after certification: the three-year cycle
Certification runs on a three-year cycle. The certificate follows the two-stage initial audit. Surveillance audits come in years one and two; they are shorter than the initial audit and check whether the system still runs: internal audits completed, incidents investigated, corrective actions closed, and management reviews held. Year three brings a recertification audit that renews the certificate for another three years.
Companies that pass surveillance audits without drama keep a standing internal audit schedule, investigate incidents when they happen, and track leading indicators, such as inspections completed and near misses reported, alongside injury rates. Our guide to leading and lagging safety indicators explains which ones to track, and the free indicators worksheet sets the tracking up. We also offer ongoing support: periodic internal audits, management review facilitation, and a check before each surveillance visit.
How the gap analysis works, and what it tells you
The gap analysis is the first paid step of most engagements, so it is worth describing precisely. We assess every clause of ISO 45001 three ways: document review shows what the system claims, interviews show what people actually do, and the site walk shows the hazards and controls as they are. The findings that matter most sit in the gaps between the three.
The output is a findings report organized by clause, with each item classified as conforming, partially conforming, or nonconforming. It is written so that your own safety lead, or any competent consultant, could build the same remediation plan from it. Our article on what to expect from an ISO 45001 gap analysis explains how to prepare. For a first look before paying for anything, the free ISO 45001 gap analysis tool scores your current system clause by clause.
Working with Kaizen on ISO 45001
Kaizen ISO Consulting is a small consultancy based in Salt Lake City and led by Trenton Steadman. The team brings more than 25 years of combined experience, and not a single client has failed a certification audit. We work across ISO 9001, ISO 14001, and ISO 45001, and integrated systems that combine them. You work with the consultant directly, from the first call through the certification audit.
Every engagement starts with a free consultation. We ask what is driving the decision, how many sites and workers are involved, which safety programs exist today, and when you need the certificate. You get a straight read on readiness and a realistic timeline whether or not you hire us. We also run internal audits as a standalone service for certified companies and train internal auditors for teams building the capability in-house. For the requirements themselves, our ISO 45001 clauses explained guide walks through clauses 4 to 10.
