Effivity ISO 45001 guide: hazards, legal registers, contractors, permits and incidents in one system

How does Effivity run ISO 45001?

Effivity runs ISO 45001 as one connected system of safety records. The hazard register links to the risk assessment for each activity, the risk assessment links to the control and the training it depends on, and an incident links back to the assessment it tested. Each record carries an owner, a due date and a history. Your people do the safety work; Effivity records it and prompts them when an inspection or drill falls due.

OH&S evidence is usually scattered: permits on a clipboard at the gate, inductions in the site office, near-miss cards in a drawer. Asked what changed after last month's near miss, a site then needs four people and a delay; with Effivity, one person opens one record.

ISO 45001:2018 does not require software. The case for Effivity is fewer lost records and fewer overdue actions.

ISO 45001 requirements mapped to Effivity

The table follows the clause titles of ISO 45001:2018 with Amendment 1:2024.

The methods behind the three core registers have their own guides: ISO 45001 hazard identification and risk assessment, ISO 45001 legal register and evaluation of compliance and ISO 45001 contractor management: prequalification to permits.

What Sterling configures at the start

Effivity goes live in the opening weeks of a Sterling ISO 45001 engagement, so gap analysis actions and the first risk workshops are recorded in it straight away.

• Sites, areas and shifts. Each location is set up on its own, with night and weekend shifts visible.
• Risk rating method. Your agreed likelihood and severity scales and the hierarchy of controls are built into the assessment form, so every task is rated alike.
• Legal obligations. Laws, regulations, permits and client or group safety rules entered per jurisdiction, each with an owner and a review date.
• Contractors and agency workers. Prequalification criteria, induction content and inspection frequency, so people off your payroll stay inside the system.
• Permits and high-risk work. Forms for hot work, work at height, confined space entry and isolation, as your risk profile requires.
• Emergency scenarios. Those relevant to each site, with a drill calendar.
• Owners and users. Line managers, supervisors and safety representatives own their records

Who needs which training, and how competence is evidenced, is covered in ISO 45001 training: who needs what, and the evidence of competence.

A worked trace: one warehouse near miss

A reach truck reversing out of an aisle passes within a metre of a picker walking to the dispatch bay. Nobody is hurt; the picker reports it from a phone and the warehouse supervisor becomes owner. Under the standard's definition it is an incident, so it is investigated as one.

The picker, the driver and a safety representative investigate. The cause is a pedestrian route crossing a truck aisle, and a risk assessment that trusted painted lines. The supervisor reopens it and works down the hierarchy: the crossing cannot be eliminated, so a barrier and a gated crossing point go in, with briefings as the administrative layer. The corrective action is raised in Non-conformance/Deviation Management with the facilities manager as owner.

Inspections confirm the barrier is used, and after two months without a repeat the owner verifies effectiveness and closes the record; the trend goes to management review. An auditor sampling that warehouse sees the whole chain, dated and owned.

What the certification body's auditor sees in Effivity

At the Stage 1 readiness review the auditor examines design: the scope, the hazard register, the legal register, the audit programme and the plan for management review.

At Stage 2 the auditor tests operation, and on an OH&S audit that includes a tour of workplaces while work is under way. Expect the auditor to watch a task, then ask to see its risk assessment, the permit if one applies, the competence of the people doing it and any recent incident in that area. Your supervisors open those records and explain them.

Where sites carry different hazards, certification bodies do not sample them, so each site's records must stand on their own. Running ISO 14001 and ISO 9001 alongside keeps shared records once; ISO 45001 in an integrated management system with ISO 9001 and ISO 14001 explains how that works.

After certification: surveillance and the coming revision

Each surveillance audit asks whether inspections, drills, compliance evaluations, incident investigations, internal audits and management review continued as planned. Effivity's reminders, escalation and dashboards show a manager what is overdue first. ISO 45001 surveillance and recertification: the three-year cycle covers the audit cycle itself.

A revised edition of ISO 45001 is in progress, which ISO expects in the first half of 2027, with a transition period to follow once confirmed. The update will be made in the same records; ISO 45001 revision: what is changing and when tracks the status. Under Sustain™, Sterling continues internal audits, legal updates, drill programmes and refresher learning in the same system.

What Effivity does not do

Effivity does not certify, and nor does Sterling. It does not decide how serious a hazard is, which control is reasonable, whether a site meets its legal duties or whether a corrective action worked. Those judgements stay with your people.

The weak implementations look alike. Template risk assessments describe tasks the site does not perform. Contractors are recorded at prequalification and never again. Incidents closed the same week, with no check that the control holds, are an easy Stage 2 finding.

Effivity for ISO 45001: questions buyers ask