ISO 45001 guide
Do I need ISO 45001? A decision guide for contractors, plant operators and boards
Clause by clause: ISO 45001:2018 requirements: every clause explained →
Who asks for ISO 45001 and why, how to tell a firm prequalification requirement from an expectation, the alternatives clients accept, a decision table for contractors, plants and boards, and when to hold the audit back.
Key points
- Most organisations need ISO 45001 because a client, a principal contractor or a parent company writes it into prequalification, not because a safety regulator names it.
- Your safety legislation applies whether you certify or not; the certificate is independent evidence that the duties are managed as a system.
- The exact wording of the request tells you whether only an accredited certificate will do, or whether a client's own HSE audit or questionnaire can stand in for now.
- Certification needs months of operating evidence from every site and shift, so decide well before the prequalification window, and never accept a certificate offered without a site audit.
Who asks for ISO 45001, and where the request comes from
The request usually lands in a contractor portal, a vendor registration form or a group directive, with a deadline.
- Clients who hire contractors. A certified client has to control procurement, contractors and outsourced work under the operation requirements of ISO 45001 (8.1.4). Requiring certified contractors is the simplest way to show that control, so construction, maintenance, facilities and logistics firms hear it first.
- Plant owners and operators. Sites running permit-to-work systems often ask vendors on site for a certificate or equivalent evidence.
- Tender panels. Public and private tenders for site-based work frequently score or require OH&S certification alongside quality and environmental certificates.
- Parent companies and boards. A group HSE policy, an acquisition or a serious incident can bring a board decision to certify every operating site on one timetable.
Mandatory, expected or optional: read the request itself
Ask for the clause, form field or directive itself: its words decide what counts as an answer.
| What the document says | How firm it is | What satisfies it |
|---|---|---|
| "Valid ISO 45001 certificate from an accredited certification body" as a pass-or-fail criterion | Mandatory for this work | An accredited certificate whose scope covers the sites and activities in the contract |
| "ISO 45001 or equivalent OH&S management system certification" | Mandatory, equivalents possible | ISO 45001, or another certification the client confirms in writing that it accepts |
| "An OH&S management system in line with ISO 45001" | Expected: a working system, not a certificate | Policy, risk assessments, legal register, incident records and audit results the client can inspect |
| Certification scored in the HSE evaluation | Optional, but it moves the score | Nothing excludes you; a certificate adds marks |
| A prequalification questionnaire asking for injury statistics, procedures and a certificate "if held" | Expected, with alternatives | Complete answers and records; a certificate shortens the review |
Two details decide many submissions. Check that the certificate must be valid on the submission date, and that "accredited" means a certification body accredited to ISO/IEC 17021-1 by an accreditation body recognised through the Global ACI arrangement, which took over from the IAF MLA and ILAC MRA on 1 January 2026. Choosing an ISO 45001 certification body: accreditation, sector codes and quotes explains how to confirm it.
The alternatives, and when each one is enough
The client's own HSE audit or prequalification review
Many principal contractors audit vendors against their own safety requirements. It suits a firm with one or two dominant clients, but nothing carries over to the next buyer.
A documented system without certification
ISO 45001 can be implemented without being certified. Where the request says "in line with" rather than "certified", a working system may satisfy it. Say only what is true: never imply a certificate you do not hold.
A related standard for a narrower risk
ISO 45003 gives guidance on psychosocial risk within an ISO 45001 system; it is a guidance document, not a certificate. Fleets and transport operators whose main exposure is on the road may be asked for ISO 39001 as well. Neither replaces ISO 45001 when a client asks for it by name.
Decision table for contractors, plants and boards
| Your situation | Recommendation | Why |
|---|---|---|
| You are a contractor and a key client makes an accredited certificate a condition of its approved vendor list | Certify, planning back from the renewal or registration date | The condition is pass or fail; the evidence takes months |
| One client offers to audit you against its own HSE requirements this year | Accept the audit, and certify if a second client or a tender asks | An audit answers one client; a certificate answers every client who asks |
| You run a plant with high-risk processes and nobody has asked yet | Implement now; certify when the system has produced a full cycle of records | The reduction in incidents comes from the system; the certificate is the outside proof |
| You are an office-based firm asked for it in a framework tender | Confirm the wording, then certify with a scope matched to your real hazards | A low-risk scope needs fewer audit days, and the certification body sets time by risk category |
| The board wants every site certified after a serious incident | Start with a gap analysis across sites before fixing the timetable | Sites with different activities cannot be sampled and must each be audited |
| You are a subcontractor working under a principal contractor's permits | Ask what evidence the principal needs; certify if it is written into the contract | Its own certificate obliges it to control you, not you to certify |
What the board is really signing up to
ISO 45001 is written for top management, not the safety officer. Certifying commits the board to:
- Accountability. Top management takes accountability for preventing work-related injury and ill health and sets the OH&S policy.
- Worker participation. Non-managerial workers must be consulted and take part in hazard identification, incident investigation and decisions on controls.
- Legal duties evaluated, not assumed. The organisation determines the legal requirements that apply to it and evaluates compliance with them, with records.
- Contractors inside the system. The certification body counts contractor personnel under your control when it sets audit time, and it expects to see them managed.
- Scrutiny after serious events. Under IAF rules the certification body may carry out a special audit after a serious incident or a serious breach of regulation.
- A three-year cycle. Annual surveillance audits follow, with recertification in year three; ISO 45001 surveillance and recertification: the three-year cycle sets out what that involves.
A certificate is not a guarantee that nobody will be hurt. What changes, and what does not, is covered in ISO 45001 benefits: what changes for workers and managers, and what does not.
Questions to settle before you commit
- Who asked, in what words, and by when?
- Which sites, activities and workers must the certificate cover? The contract sets the minimum; ISO 45001 scope: sites, workers, contractors and the mistakes that cost you explains the choices.
- Is the date realistic? Test it against ISO 45001 timeline: how long certification takes, stage by stage.
- Who owns it on the line? Name the supervisors and process owners, not only the safety officer.
- What will it cost over three years? ISO 45001 certification cost: what moves the price lists the drivers, including the physical controls your risk assessments may call for.
- Should ISO 14001 or ISO 9001 come in at the same time? Decide now rather than rebuild later; ISO 45001 in an integrated management system with ISO 9001 and ISO 14001 covers how.
How Sterling helps you decide
A clear answer on whether ISO 45001 is what your clients require, and when.
In a discovery call our expert and experienced consultants read the prequalification clause, tender requirement or group directive with you, confirm what evidence it actually asks for and whether your date can be met, and tell you plainly when a client audit or a documented system will serve you better for now. If you proceed, the gap analysis turns the decision into a plan. We ensure successful certification for our clients. An independent, accredited certification body audits your sites and issues the certificate; Sterling does not certify.
Book a free discovery callWhen not to certify yet
Keep preparing, but delay the audit, when:
- Sites are opening, closing or merging. Set the scope once the footprint is stable.
- Safety still sits with one person. Auditors question supervisors and workers on every shift, and a system only the safety officer understands will not hold at Stage 2.
- Contractors are not yet under control. Bring prequalification, inductions and permits into order first; ISO 45001 contractor management: prequalification to permits shows the method.
- Someone promises a certificate in days. Accredited OH&S certification includes a site audit during operations, and clients' HSE teams check; How to verify an ISO 45001 certificate, and spot a fake one shows how.
The coming revision is not a reason to wait. ISO expects the revised edition in the first half of 2027, with a transition period to follow; a system built now to ISO 45001:2018 with Amendment 1:2024 carries forward with a planned review, as ISO 45001 revision: what is changing and when explains.
Do I need ISO 45001: questions buyers ask
A client's vendor portal asks for ISO 45001 next month. Can we get it in time?
Not from a standing start: the certification body needs risk assessments, a legal register, drills, inspections, an internal audit and a management review before Stage 2. Ask the client whether its own HSE review or a dated project plan will hold your registration open meanwhile.
We are a subcontractor. Does our client's certificate cover us?
No. The client's certificate covers its own system, which includes controlling you as a contractor; it does not certify your company. Whether you need your own depends on what the contract and prequalification require.
Can we say we "follow ISO 45001" in a prequalification form?
Only if it is true and you can show the records behind it, and never in words that suggest a certificate. Clients check such declarations.
Do we need ISO 45001 if our injury record is already good?
A good record helps, but clients asking for the certificate want evidence of a managed system, not only past results. If nobody asks, the choice rests on whether the system would help you control your hazards.
Who should make the decision to certify?
The owner or the board, because the standard makes top management accountable, auditors interview them, and the commitment runs through three years of surveillance and recertification.
More ISO 45001 guides
Every guide in the ISO 45001 series is written for one question and links back to the hub for the whole picture.
- ISO 45001 certification process, step by step
- ISO 45001 for construction
- ISO 45001 contractor management: prequalification to permits
- ISO 45001 certification cost: what moves the price
- ISO 45001 documentation
- Effivity for ISO 45001: the guide
- ISO 45001 for facilities management and security services
- ISO 45001 hazard identification and risk assessment
- ISO 45001 internal audit: planning, conduct and reporting
- ISO 45001 legal register and evaluation of compliance
- ISO 45001 requirements explained, clause by clause
- ISO 45001 revision: what is changing and when
Keep exploring
Explore more about ISO 45001
Watch a video on how to implement ISO 45001 here.
Watch a video on ISO 45001 requirements here.
ISO 45001 resources
Services for ISO 45001
Talk to a consultant
Decide on ISO 45001 knowing exactly what your clients require.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice