The ISO 45001 certification process, step by step: from hazard profile to certificate

How ISO 45001 certification works, and who does each step

Certification to ISO 45001 is a conclusion reached by a certification body after it has audited your OH&S management system in two stages. Three parties share the work. Your organisation owns the system and every control in it. A consultancy such as Sterling helps you design it, implement it with the people who do the work and prepare the evidence. The certification body, independent of any consultant, audits against ISO 45001:2018 with Amendment 1:2024 and decides whether to issue a certificate. It must itself be accredited to ISO/IEC 17021-1 by an accreditation body recognised through the Global ACI arrangement, which replaced the IAF MLA and the ILAC MRA on 1 January 2026.

Two sets of rules add weight to the OH&S route. IAF MD 22 requires the audit to include evaluation of the system during operational activities, typically through a tour of facilities and other work sites, and it restricts sampling where sites do not share the same activities, processes and risks. IAF MD 5 sets audit time from the effective number of personnel, counting contractors under your control or influence, and from the OH&S risk category of the work. Both explain why an ISO 45001 audit cannot be done from a desk.

Steps 1 to 5: preparing the OH&S management system

Step 1: scope and hazard profile

Start by listing what the system will cover: each site, the activities carried out there, the shift pattern, the number of employees, agency staff and contractors, and the jurisdictions whose safety law applies. Record whether a client's prequalification or a tender is driving the timetable, because it fixes the date you plan back from. Writing the boundary and its exclusions belongs to the scope guide; the point here is that the certification body quotes from this profile, so an incomplete headcount now becomes a changed quotation later.

Step 2: gap analysis

Sterling's gap analysis is the first stage of the engagement. It looks at how hazards are identified today, whether a legal register exists and is current, how workers are consulted, which operational controls and permits are in use, how ready the site is for an emergency and what happens after an incident. It keeps what already works and ends with agreed actions, owners, dates and resources. It is not the free online readiness check, which is a short self-assessment, and it is not the certification body's Stage 1, which comes months later.

Step 3: implement the controls

This is the longest step. Risk assessments are completed with the people who do each job, covering routine and non-routine work, and controls are chosen in the order clause 8.1.2 sets: eliminate, substitute, engineering and reorganisation of work, administrative controls including training, then protective equipment. The legal register is built by jurisdiction under 6.1.3, contractors are brought under the controls of 8.1.4, change is managed under 8.1.3 and emergency plans are written under 8.2. The organisation also records its decision on whether climate change is a relevant issue, which Amendment 1:2024 added to clause 4.1.

Step 4: operate the system and let records build up

An auditor has to see the system running. That means safety committee minutes with actions closed, inspections completed and followed up, permits to work that were checked, drills run and reviewed, near misses reported and incidents investigated with workers taking part, as clause 10.2 expects. Neither ISO 45001 nor ISO/IEC 17021-1 sets a minimum period, but a system that has not yet produced these records will generate findings about missing evidence rather than about safety.

Step 5: internal audit and management review

Before the certification body arrives, complete an internal audit under clause 9.2 that reaches every site and shift in scope, including night work and contractor activity, and a management review under 9.3 that makes decisions on the results. Close the internal findings with evidence. The ISO 45001 internal audit guide covers the programme and the conduct of these audits; the management review guide covers the inputs, outputs and record.

Step 6: applying to an accredited certification body

Apply while step 3 is still under way. Certification bodies need your profile to calculate audit time, assign an auditor with competence in your sector's OH&S risks and book dates, and their calendars often fill weeks ahead. Confirm three points before signing: that the accreditation covers ISO 45001 and your activity codes, checked in the accreditation body's directory or IAF CertSearch; that the audit days reflect the full workforce, contractors included, and the risk category of the work; and that every site with different activities and hazards is planned for a visit rather than sampled. How to compare bodies and quotations is set out in the guide to choosing an ISO 45001 certification body.

Steps 7 to 9: the Stage 1 and Stage 2 audits

Step 7: Stage 1, the readiness review

Stage 1 reviews the documented system and whether you are prepared for Stage 2. The auditor confirms the scope, sites and shifts, looks at the hazard register, the legal register and the risk assessments, and checks that internal audits and a management review have been planned and performed. The output is a report of concerns that could become nonconformities, and the plan for Stage 2.

Step 8: close the Stage 1 concerns

Treat each concern as a finding in waiting. Correct it, keep the evidence and be ready to show it on the first morning of Stage 2. Leave enough time between the stages to act, but not so long that the auditor has to repeat parts of the review.

Step 9: Stage 2, the certification audit on site

Stage 2 evaluates implementation and effectiveness across the whole scope. Expect the auditor to walk the workplace, stop at a task in progress and ask the worker what the hazards are and what would make them stop work; to trace a near miss through investigation to a changed risk assessment; to compare a permit on the wall with the conditions around it; and to ask a contractor's supervisor about their induction. The full walk-through of what is checked, day by day, is in the Stage 1 and Stage 2 audits guide.

Steps 10 and 11: corrective action and the certification decision

For each nonconformity you provide a correction, the root cause and a corrective action within the period the certification body sets at the closing meeting. A major nonconformity must be corrected and the action verified, sometimes with a follow-up visit, before certification can be granted; if that verification cannot be completed within six months of the last day of Stage 2, the body repeats Stage 2. For a minor nonconformity the body normally accepts the plan and checks its effectiveness at the next audit. How findings are graded and written is covered in the ISO 45001 nonconformities guide.

The decision is taken by people at the certification body who were not on the audit team. The resulting certificate covers the management system for the scope and sites it names, not a product or a safety record, and it runs on a three-year cycle from the decision.

Step 12: surveillance, special audits and recertification

The body returns at least once a calendar year, apart from recertification years, and the first surveillance audit falls within twelve months of the decision. Each visit samples the system, again during operational activities. Under IAF MD 22 a serious incident or a serious breach of regulation can also prompt a special audit, so an organisation that stops investigating incidents between visits can find the certification body back sooner than planned. A recertification audit before expiry starts the next cycle. Changes in sites, activities or legal entity must be reported to the body. The three-year cycle has its own guide, and the revision expected by ISO in the first half of 2027 is covered in the revision guide.

How long the ISO 45001 certification process takes

Kick-off to Stage 2 typically takes four to eight months. An office-based organisation with few hazards and a current legal register can be ready in about three; a multi-site contractor or a plant with high-risk processes sits at the long end. After Stage 2, the time to a decision depends mainly on the findings to close. A certificate promised in ten days is not ISO 45001 certification: no accredited body can witness risk control on site in that time. Stage-by-stage durations and a worked calendar are in the ISO 45001 timeline guide.

ISO 45001 certification process: questions buyers ask