ISO 45001 by industry
ISO 45001 for facilities management and security services: keeping your people safe on client sites
Clause by clause: ISO 45001:2018 requirements: every clause explained →
What changes when your people work in other organisations' buildings: why FM and security clients ask at tender, what belongs in a scope of client sites and subcontracted specialists, where auditors sample lone working, night shifts, chemicals, maintenance at height and guard safety, and how the system handles contract handovers.
Key points
- Corporate, property and public-sector clients ask FM and security providers for ISO 45001 at tender and supplier registration, because your people work inside their buildings.
- Most of your workforce works on sites you do not own, so the scope has to follow the contract, not the head office address.
- The risks that decide the audit are lone working, night shifts, cleaning chemicals, maintenance work at height and violence and aggression towards guards.
- Contracts start and end all the time: the system needs a routine for mobilising a new site and handing over an old one without losing control of the hazards.
Why facilities management and security clients ask for ISO 45001
The request comes from the client's procurement team, not the regulator. Occupiers, property managers, hospitals and campuses tender cleaning, maintenance and guarding, and their supplier questionnaires ask how the provider keeps its own people safe on the client's premises.
ISO 45001 answers that question with an independently audited system rather than a folder of policies written for the bid. For the general case for and against certification, see Do you need ISO 45001? A decision guide for contractors, plants and boards.
Scope when your people work on client sites
The scope names the head office, regional offices and stores, then describes the services it delivers at client premises: soft services such as cleaning, pest control and reception, hard services such as planned and reactive maintenance, and manned guarding, patrols and control-room monitoring. Client sites sit inside the system for as long as the contract runs.
Every person working under your control is inside the scope: employees, agency staff covering shifts, and the specialist subcontractors you bring in for lifts, fire systems, window cleaning or high-level work. Common mistakes: certifying the office while the risk sits at client sites, leaving out subcontracted specialists, and listing only cleaning when teams also carry out maintenance. The general rules are in ISO 45001 scope: sites, workers, contractors and the mistakes that cost you.
Where the requirements bite in FM and security services
| Requirement area | What it means for an FM or security provider | Evidence the auditor samples |
|---|---|---|
| Hazard identification and risk assessment | Assessments for each contract and post, covering the client's building as well as the task: lone working, night shifts, public contact, chemicals, plant rooms and roof access | Site risk assessments and assignment instructions for the post visited, lone worker assessments, records of review when a site or shift pattern changed |
| Eliminating hazards and reducing risks | The hierarchy of controls applied to everyday tasks: substituting harsh cleaning chemicals, mechanical access instead of ladders, secure posts and lighting for guards before relying on PPE | Chemical inventories and safety data sheets on site, permits to work for maintenance at height or in plant rooms, lone worker check-in logs, PPE issue records |
| Contractors, procurement and client interfaces | Controlling your specialist subcontractors and agreeing with the client who controls shared hazards such as fire systems, access and the client's own permit scheme | Subcontractor approval files, site inductions for your staff and theirs, agreed interface or bridging arrangements with the client, permits issued under the client's system |
| Consultation and participation of workers | Reaching shift workers who rarely see a manager: guards on nights, cleaners before opening hours, mobile technicians | Toolbox talks by shift, hazard reports raised from sites, supervisor visit records, safety committee minutes that include site representatives |
| Emergency preparedness and incident investigation | Knowing each client's emergency plan and your staff's role in it, and investigating assaults, slips, chemical splashes and near misses so the post or method changes | Site emergency roles, drill participation, incident and near-miss reports, investigations with revised assessments or assignment instructions |
How to build the assessments is covered in ISO 45001 hazard identification and risk assessment, and subcontractor control in ISO 45001 contractor management: prequalification to permits.
Client site rules, ISO 41001 and other obligations
Every client adds its own layer: site rules, inductions, its own permit-to-work scheme, incident reporting timelines and contract audits. Recorded as "other requirements" in the legal register, they become part of how each site is run rather than a separate file per contract. National occupational safety law applies country by country, alongside any licensing rules for security services, and the certificate replaces none of them; see ISO 45001 legal register and evaluation of compliance.
Many FM providers also look at ISO 41001, the facility management system standard, which covers how services are planned, delivered and measured for the client; ISO 45001 covers the safety of the people delivering them, and the two share a structure. See ISO 41001 certification. For violence, aggression, fatigue from night shifts and working alone, ISO 45003 gives guidance on psychosocial risk within an ISO 45001 system; it is guidance, not a standard to certify against.
What an FM and security engagement looks like
Duration depends on the number of client sites and countries, the mix of services, the shift workforce, existing site assessments, and how long sites need to run to produce inspection, drill and incident records. Contract managers, site supervisors, the HSE lead, HR and procurement all take part. With Design™, Sterling guides your team to build and own the system; with Drive™, Sterling carries more of the documentation, site visits, internal audit and readiness work so contracts keep running.
How Sterling works with FM and security providers
A safety system that reaches the night shift at every client site.
Our expert and experienced consultants build the system around your contracts, posts and shift patterns, set up a mobilisation and handover routine for sites you win and lose, and test it with an internal audit across client sites before the certification body arrives. Records live in Effivity, included with the engagement, at no additional cost. Sterling does not certify; an independent, accredited certification body audits and decides. We ensure successful certification for our clients.
Book a free discovery callISO 45001 for facilities management: questions providers ask
Does ISO 45001 cover our staff who work at client sites?
Yes. Staff working under your control are inside your system wherever they work, so their hazards, training, supervision and consultation at client premises are your responsibility to manage and evidence.
Will the ISO 45001 auditor visit client sites or only our office?
The auditor visits client sites. Accreditation rules for OH&S audits require the system to be evaluated during operational activities, and where sites carry different activities and risks, the certification body plans its visits accordingly.
How does ISO 45001 deal with lone working and violence against security guards?
Through risk assessment and control. Each post is assessed for lone working, public contact and aggression, and controls such as check-in routines, secure posts, lighting, communication and de-escalation training are put in place and reviewed after incidents.
What happens to our ISO 45001 certificate when we win or lose a contract?
Nothing, if the scope describes your services rather than listing client sites. New sites come under the system through your mobilisation routine, and handed-over sites leave it; the certification body samples the sites active at each surveillance audit.
ISO 45001 by industry
Every guide in the ISO 45001 series is written for one question and links back to the hub for the whole picture.
- ISO 45001 for construction and engineering
- Do I need ISO 45001? A decision guide for contractors, plant operators and boards
- ISO 45001 documentation
- Effivity ISO 45001 guide
- ISO 45001 for facilities management and security services
- ISO 45001 gap analysis
- ISO 45001 hazard identification and risk assessment
- ISO 45001 for healthcare
- ISO 45001 for logistics and warehousing
- ISO 45001 for manufacturing
- ISO 45001 for oil and gas and energy
- ISO 45001 for professional services and offices
Keep exploring
Explore more about ISO 45001
Watch a video on how to implement ISO 45001 here.
Watch a video on ISO 45001 requirements here.
ISO 45001 resources
Services for ISO 45001
Talk to a consultant
Plan an ISO 45001 system that works on every client site and shift.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice