Choosing an ISO 45001 certification body: accreditation, OH&S risk category and how to compare quotes

Why the choice of ISO 45001 certification body matters

An OH&S certificate is read by people who check it: principal contractors running prequalification, client HSE teams, insurers and, in some markets, labour inspectors. What they rely on is the name of the body on the certificate and the accreditation behind it. If either fails a basic check, so does the certificate.

The body also shapes the audit itself. A competent auditor walks the workplace, talks to the people doing the job and tests controls at the point of risk; a weak one reads the manual in a meeting room and leaves you with a certificate that may not survive a customer's site inspection.

The order of events in certification is set out in our ISO 45001 certification process guide. This page covers only the choice of body.

Accreditation for ISO 45001: what to check

Accreditation means an accreditation body has assessed the certification body against ISO/IEC 17021-1, which covers impartiality, auditor competence and how certification decisions are made, and continues to monitor it. Accreditation is granted standard by standard, so a body accredited for ISO 9001 or ISO 14001 is not automatically accredited for ISO 45001. Check the ISO 45001 entry itself.

Do the check yourself, using sources the body does not control:

1. Ask for three facts in writing: the legal entity that will issue the certificate, its accreditation body and its accreditation number. One brand may trade through several companies, and not all hold accreditation.
2. Look up the accreditation body on Global ACI's list. Global ACI names the accreditation bodies it recognises for management system certification; one not on that list gives no internationally recognised standing.
3. Open the scope of accreditation in that accreditation body's directory. Look for ISO 45001, for activities that match yours and for a current status, not suspended or withdrawn.
4. Search IAF CertSearch, the database of accredited management system certificates, which kept its IAF name after the handover. Find a few ISO 45001 certificates the body has issued to organisations like yours.

Checking a certificate someone else holds, such as a subcontractor's, is a different job, covered in how to verify an ISO 45001 certificate.

Sector competence and the OH&S risk category

ISO/IEC 17021-1 requires an audit team with the competence your activities demand. For OH&S that means an auditor who recognises the hazards of your work, such as working at height or chemical storage, and can judge whether controls follow the hierarchy set in 8.1.2. Ask who would lead your audit and what comparable work they have seen.

The international audit-time rules, IAF MD 5, place each OH&S scope in a risk complexity category: high (typically construction, heavy manufacturing or processing), medium (typically light manufacturing with some significant risks) or low (typically office-based work). The category a body assigns drives the audit time it quotes. If two bodies put the same scope in different categories, find out why before comparing their prices.

What an ISO 45001 quote should state

IAF MD 5, reissued by Global ACI in July 2026 as TECH-3-004, sets how audit time is calculated for quality, environmental and OH&S systems. For ISO 45001 it counts effective personnel including contractor and subcontractor workers under your control or influence, and adds time for factors such as accident rates above the sector average, public presence on site, large temporary contractor populations and hazardous substance storage. The body owes you the justification with the contract. A complete quote sets out:

• The certifier: legal entity, accreditation body, accreditation number and the scope of accreditation relied on.
• The basis: activities, permanent sites, temporary sites, shifts and effective headcount including contractors, plus the risk category assigned.
• Audit time: days for Stage 1, Stage 2, each surveillance audit and recertification, with any additions or reductions explained.
• Site coverage: which sites and shifts each audit visits. IAF MD 22 says sampling is not appropriate where sites differ in activities, processes or OH&S risks, and temporary sites are sampled on an evaluation of risk.
• On-site work: a tour of facilities and work sites. Remote methods may replace only the parts of the audit that do not involve witnessing risk control.
• Everything else: travel basis, application, certificate and annual fees, charges for a follow-up visit, special audits and cancellations, and the language of the audit and report.

How these lines add up is explained in ISO 45001 certification cost: what moves the price. Combined audits with ISO 14001 or ISO 9001 are covered in our integration guide.

Comparing three ISO 45001 quotes

The quotes below are illustrative composites, not real offers, for one contractor with a head office, a fabrication yard and several short-term project sites. Compare row by row before the total.

Quote B looks competitive only because it audits a smaller organisation than the one that exists, and its scope cannot carry an accredited ISO 45001 certificate. Quote C prices a document review, not an audit of safe work.

Questions to ask and warning signs

Questions before signing

• Which risk category did you assign to our activities, and on what evidence?
• Did your headcount include our contractors and agency workers?
• Which sites, temporary sites and shifts will each audit cover?
• When would a serious incident or regulatory breach trigger a special audit, and what does it cost?
• How are you preparing for the revised ISO 45001, which ISO expects in the first half of 2027, and will you check the 2024 climate amendment at our audit?

Signs to walk away

• Certification promised before any audit. The decision follows the audit and is taken by people who did not audit you; nobody can guarantee it in advance.
• No workplace tour. An ISO 45001 audit includes evaluating the system during operational activities, on the floor and on site.
• A single visit in place of Stage 1 and Stage 2. Initial certification always has both stages.
• Days far below other accredited quotes, with no calculation; the rules cap reductions at 30% of the tabled time.
• An offer to write your risk assessments and then certify them. Certification bodies may not provide management system consultancy.
• No surveillance in the contract. An accredited certificate is kept alive by audits every year of the cycle.

Sterling's role in choosing a body

Sterling does not certify. The accredited body you appoint audits your OH&S management system and makes the certification decision. We help you compare like with like and arrive prepared.

Choosing an ISO 45001 certification body: questions buyers ask