ISO 45001 by industry
ISO 45001 for oil and gas and energy: what operators, contractors and auditors expect on a live site
Clause by clause: ISO 45001:2018 requirements: every clause explained →
What changes when the organisation runs plants, terminals, depots or field crews: why operators ask through contractor prequalification, what belongs in scope, where auditors test permits, SIMOPS, H2S and contractor controls, and how the system links to process safety.
Key points
- Operators and main contractors ask for ISO 45001 through contractor HSE prequalification, where the certificate sits beside the HSE plan, incident statistics and the bid.
- ISO 45001 manages occupational safety; it does not replace the process safety arrangements that control loss of containment, fire and explosion, and the two must be joined, not confused.
- Auditors follow permits to work, gas testing, confined space entry, SIMOPS and H2S controls on a live job, not in a procedure binder.
- Contractor crews count: they are workers under your control, they add to audit time, and the certification body will talk to them on site.
Why oil, gas and energy companies are asked for ISO 45001
The request usually arrives in a contractor HSE prequalification. An operator, a refinery owner, a pipeline company or a power producer sends a questionnaire before a tender or a vendor registration, and the evaluator looks for a certified OH&S management system alongside the HSE plan, lost-time and near-miss statistics and training matrices. Main contractors pass the same requirement down to their subcontractors.
The certificate rarely wins the work on its own. It shows the operator that hazards are assessed with the crews who do the job, that permits are issued and checked, and that incidents lead to changed controls.
Scope for an oil, gas or energy business
A workable scope names every place where your people and your contractors work: processing plants, storage terminals, LPG filling and distribution depots, pipelines and pumping stations, power and utility sites, workshops and the field locations crews move between. Turnarounds and shutdowns sit inside, because that is when contractor numbers and risk both peak.
Three scope mistakes recur. The first certifies the head office and the "main site" while the depots and field crews that generate the incidents stay outside. The second leaves contractor workforces off the headcount, although the certification body counts contractor and subcontractor personnel under your control when it sets audit time. The third assumes one site can stand for all: where sites do not share the same activities and OH&S risks, sampling is not appropriate and each is audited. The general rules are in ISO 45001 scope: sites, workers, contractors and the mistakes that cost you.
Where ISO 45001 requirements bite in oil and gas
| Requirement area | What it means on an energy site | Evidence the auditor samples |
|---|---|---|
| Hazard identification and risk assessment (6.1.2) | Routine and non-routine work assessed with the crews: hot work, confined space entry, work at height, lifting, H2S exposure, energy isolation and shutdown tasks | Job hazard analyses for the task in progress, H2S and confined space assessments, risk assessments revised after incidents |
| Eliminating hazards and reducing risks (8.1.2) | Permit to work, isolation and gas testing applied in hierarchy order, with PPE and breathing apparatus as the last line, not the first | Live permits checked at the worksite, isolation certificates, gas test records, calibration of gas detectors, SIMOPS matrices |
| Contractors (8.1.4) | Contractor crews prequalified, inducted and supervised to your standard, with interfaces agreed where their system meets yours | Prequalification files, induction and competence cards, bridging documents, contractor toolbox talk records |
| Management of change (8.1.3) | Plant modifications, temporary equipment, new chemicals and crew changes assessed for OH&S risk before they happen | Change requests with risk review, pre-start checks, updated procedures and briefings |
| Emergency preparedness and response (8.2) | Plans for H2S release, fire, confined space rescue and medical evacuation, rehearsed with contractors and neighbouring sites | Drill reports with lessons applied, muster records, rescue equipment inspections, emergency team competence |
How these controls are set up for contractors, from prequalification to permit close-out, is in ISO 45001 contractor management: prequalification to permits; the assessment method is in ISO 45001 hazard identification and risk assessment.
Process safety, operator requirements and other obligations
Energy businesses run two safety disciplines side by side. Occupational safety deals with slips, falls, dropped objects, lifting and exposure; process safety deals with loss of containment, fire and explosion. A good lost-time record says little about the second. ISO 45001 does not replace process safety studies, safety-critical equipment maintenance or any regulatory safety regime; the system should link to them so that one hazard register and one change process serve both.
Operators' HSE requirements add a layer: permit rules on shared sites, stop-work expectations, reporting timelines and inductions. Treat these as "other requirements" in the legal register and evaluate them like law. Suppliers of products and services to the industry may also hold ISO 29001 or API Spec Q1 for quality, and ISO 14001 for environment; one integrated system avoids three sets of records. See ISO 45001 in an integrated management system with ISO 9001 and ISO 14001.
What an oil and gas engagement looks like
Duration depends on the number of sites and activities, the size of the contractor population, how current the permit and isolation arrangements are, and the operating time needed for drills, inspections and permit audits to build records. Operations and maintenance managers, the HSE lead, permit issuers, contractor supervisors and emergency teams all take part. With Design™, Sterling guides your HSE team to build and own the system; with Drive™, Sterling carries more of the documentation, internal audit and readiness work so operations keep running.
The technical services manager and the vice-president for operations report that five of the company's sites received ISO 14001 and ISO 45001 certification, with the project completed ahead of schedule and beyond expectation.
How Sterling works with oil, gas and energy companies
An OH&S system that holds up on a live permit.
Our expert and experienced consultants build the system around your permits, isolations, SIMOPS and contractor interfaces, then test it with an internal audit across sites and shifts before the certification body arrives. Records live in Effivity, included with the engagement, at no additional cost. Sterling does not certify; an independent, accredited certification body audits and decides. We ensure successful certification for our clients.
Book a free discovery callISO 45001 for oil and gas: questions buyers ask
Does ISO 45001 cover process safety in oil and gas?
Not on its own. ISO 45001 requires hazards to be identified and controlled, which includes major accident hazards, but it does not replace process safety studies or regulatory safety regimes; the system should link to them through the hazard register, management of change and emergency planning.
Do contractor workers count in an ISO 45001 certification audit?
Yes. Contractor and subcontractor personnel under your control are included in the effective headcount the certification body uses to set audit time, and auditors interview them on site.
Can several terminals, depots or plants share one ISO 45001 certificate?
Yes, under one multi-site certificate, but sampling is not appropriate where sites carry different activities and OH&S risks, so each such site is audited.
How long does ISO 45001 certification take for an oil and gas contractor?
Usually towards the longer end of the typical four to eight months, because multi-site and high-risk operations need more activities assessed and more operating records before the certification body will accept that the system works.
ISO 45001 by industry
Every guide in the ISO 45001 series is written for one question and links back to the hub for the whole picture.
- ISO 45001 for construction and engineering
- ISO 45001 for facilities management and security services
- ISO 45001 for healthcare
- ISO 45001 for logistics and warehousing
- ISO 45001 for manufacturing
- ISO 45001 certification in the Netherlands and Europe
- ISO 45001 nonconformities
- ISO 45001 for oil and gas and energy
- ISO 45001 for professional services and offices
- ISO 45001 requirements explained
- ISO 45001 revision
Keep exploring
Explore more about ISO 45001
Watch a video on how to implement ISO 45001 here.
Watch a video on ISO 45001 requirements here.
ISO 45001 resources
Services for ISO 45001
Talk to a consultant
Plan an ISO 45001 system that holds up on your plants, terminals and field sites.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice