ISO 45001 certification cost: what moves the price, from risk category to contractors

Where the money goes: three budget lines

ISO 45001 certification cost comes from separate organisations, and one of the largest items is paid to neither of them.

Consulting and implementation. An optional consultant's fee covers the gap analysis, hazard and risk work with your supervisors and workers, the legal register, contractor arrangements, emergency planning, training, internal audit and management review. It reflects how much has to be built and who does the work.

Independent certification. The accredited certification body charges for audit time: the Stage 1 readiness review, the Stage 2 audit on site, surveillance audits in the two following years and recertification in year three, plus travel. To stay impartial, it cannot also design your system.

Your own resources and controls. Time from supervisors, safety representatives, process owners and workers in consultation and training, plus the physical changes the risk assessments decide on, which nobody else invoices. Overall, the investment depends on maturity, scope, locations and employees; projects typically run four to eight months.

What moves the price: six drivers

A consultant prices the work of building the system; a certification body prices the time needed to see it working on site. The same facts move both, in different proportions.

How widely you draw the scope feeds almost every row; the ISO 45001 scope guide covers it.

How OH&S audit time is calculated

Accredited certification bodies set OH&S audit time by a shared, documented method, and your quotation should show how they applied it.

1. Count effective personnel. Employees in scope plus the contractor and subcontractor workers under your control or influence. A site with a large agency or maintenance workforce will find the figure higher than its payroll.
2. Place the activities in a risk category. High complexity typically covers construction, heavy manufacturing and processing; medium, light manufacturing with some significant risks; low, office-based work. The category and the headcount together give the starting figure.
3. Apply recorded adjustments. Accident rates above the sector average, public presence on site, legal proceedings, many temporary contractors and stored hazardous substances add time. Reductions, for example for a mature system, may not exceed 30% of the starting figure.
4. Plan the site coverage. The audit includes a tour of facilities and work sites to see the system operating. Remote methods may replace only the parts that do not involve witnessing how risks are controlled.
5. Extend across the cycle. Surveillance takes roughly a third of the initial audit time each year and recertification about two-thirds, so the first certification is less than half of the three-year audit effort.

The justification belongs in the contract. When two bodies quote very different days for the same workplace, look at the headcount, risk category and site coverage each assumed.

The cost your risk assessments decide

This line is particular to occupational health and safety, and budgets often leave it out. ISO 45001 requires hazards to be eliminated and risks reduced in a fixed order of preference: elimination, substitution, engineering controls and reorganisation of work, administrative controls including training, and finally personal protective equipment. Risk assessments done properly, with the people who do the job, sometimes point to changes that cost money.

Examples include machine guarding, local exhaust ventilation, segregated pedestrian routes, safer substitute chemicals or extra supervision on night shifts. The standard sets no spending level; it asks that the risk is understood, the control chosen in hierarchy order and the action planned.

Budget for this after hazard identification, separately from consulting and certification. The method is covered in the ISO 45001 hazard identification and risk assessment guide.

What does not change the price

The certificate itself. An accredited ISO 45001 certificate records a decision about your scope, sites and the standard. When the same certificate is offered for much less, the difference usually lies in fewer days, no workplace tour or no recognised accreditation.

The climate amendment. Amendment 1:2024 asks whether climate change is a relevant issue; auditors check the decision, but there is no separate transition or reissued certificate.

Waiting for the revision. ISO expects a revised edition in the first half of 2027, with a transition period to follow, subject to confirmation. Delaying saves nothing: a system built now to ISO 45001:2018 with the amendment carries into the new edition through a planned review. The ISO 45001 revision guide tracks what is known.

Hidden costs to watch for

• Certificates without a site audit. An OH&S certificate issued from a desk, or by a body without recognised accreditation, tends to fail a client's contractor prequalification or HSE inspection. You then certify again and pay twice.
• Contractors left out of the headcount. A quotation based on payroll alone is revised once the body sees the contractor population on site.
• Special audits. Accreditation rules allow a certification body to carry out a special audit after a serious incident or a serious breach of regulation. That is unplanned audit time.
• Surveillance not quoted. A figure that stops at Stage 2 shows under half the cycle.
• Generic document packs. Bought-in risk assessments that do not describe your work have to be redone.

How to compare ISO 45001 quotations

Compare totals only once quotations describe the same workplace.

Certification bodies

• Accreditation for OH&S management systems by an accreditation body recognised through the Global ACI arrangement, checked on that body's own register.
• The same sites, activities, shifts and effective personnel, contractors included, in every quotation.
• The risk category applied, the audit days for each stage and each year, and the written justification.
• The three-year total, including travel, fixed charges and the rates for follow-up or special audits. See the guide to choosing an ISO 45001 certification body.

Consultants

• An all-inclusive proposal for a written scope, or an open-ended day rate?
• Risk assessments done with your workers on site, or supplied as templates?
• Legal register, contractor controls, emergency drills, internal auditor training and software: included or extra?
• Certification-body fees kept separate; one price for consulting and certificate together is a warning sign.

ISO 45001 certification cost: questions buyers ask