ISO 45001 gap analysis: what Sterling examines on site, what you receive and what happens next

What an ISO 45001 gap analysis answers

Three questions: which requirements of the standard you already meet in practice, which you meet only on paper, and which you do not meet at all. Most organisations already manage safety through inductions, permits, toolbox talks or a client's HSE plan; the gap analysis shows how much of that can carry the system, so implementation starts from what exists.

The measure is ISO 45001:2018 as amended in 2024, which added a recorded decision on whether climate change is a relevant issue for the system. ISO expects a revised edition in the first half of 2027; organisations starting now build to the current text and review the system against the new edition when it is published, as the ISO 45001 revision guide explains.

The six areas that get the closest look

The report covers clauses 4 to 10 in full, but experience shows where OH&S systems usually fall short, and fieldwork time is weighted there.

Hazard identification and risk assessment

Whether the hazard register covers routine and non-routine work, visitors, contractors and changes, and whether risk assessments describe the task as it is really done. Generic assessments copied across activities are the most common gap we record. The hazard identification and risk assessment guide covers the method.

Legal and other requirements

Whether a legal register exists for each jurisdiction in scope, who keeps it current, and whether compliance has actually been evaluated. Client HSE requirements and permit conditions count as "other requirements" and are checked too; the legal register guide goes further.

Consultation and participation of workers

Clause 5.4 expects non-managerial workers to be consulted and to take part, not simply to be told. We look for committee minutes, hazard reports raised from the floor and evidence that concerns changed something.

Operational control

Whether controls follow the hierarchy in clause 8.1.2, with protective equipment as the last resort; whether permits to work are checked; how changes are assessed; and how contractors are selected and supervised, which the contractor management guide covers.

Emergency preparedness

Plans for the emergencies your sites could actually face, drills that were run and reviewed, and whether the lessons reached the plan.

Incidents and improvement

Whether near misses are reported at all, whether investigations involve workers and reach a cause, and whether the risk assessment is revisited afterwards. A register full of "worker not careful" conclusions is a gap in itself.

How the fieldwork runs

1. Pre-read. Existing policies, risk assessments, registers, permits, incident logs and drill reports are read before the visit.
2. Opening with leadership. Top management describes the operations, the intended scope and how accountability for safety is assigned today.
3. Site tour. We walk the workplaces with the responsible supervisor, comparing the work and the controls in use with the risk assessments.
4. Interviews at every level. Managers, supervisors, the safety officer, safety representatives, workers on each shift and, where possible, contractors on site.
5. Record sampling. Permits, inspections, training and competence records, contractor prequalification, management-of-change assessments and incident investigations, chosen to include high-risk tasks and night or weekend work.
6. Closing discussion. Preliminary findings are shared before anything is written, so the report confirms what leadership has already heard.

We report on the system, never on individuals. Workers speak more freely about shortcuts and near misses when they know no name will appear.

The three deliverables

Gap report

Set out by clause, each finding states the requirement, the evidence seen and a status: working as intended, present but falling short, or absent. Good existing practice is named so it is kept.

Prioritised action plan

Every gap becomes an action with an owner, a target date and the resources it needs. Two things set the order. Hazards that could hurt someone now come first, whatever the certification timetable. Next come the items whose evidence takes months to build: completed risk assessments for every activity, the first compliance evaluation, a drill, worker consultation on record and the internal audit programme. Physical controls the risk assessments may call for, such as guarding or segregation of vehicles and pedestrians, are listed separately for management to decide.

Effort and timeline estimate

The hours your people will need, the share of the work Sterling takes on, how long the system must operate before the certification audits, and a realistic window for Stage 1 and Stage 2. Most organisations need four to eight months in total; the ISO 45001 timeline guide explains why.

Who takes part and how long it takes

Typical involvement for one site:

An office-based organisation with few hazards may need a single day on site. A plant or construction contractor with shift work, high-risk activities or a large contractor population needs longer, and every site that runs different activities is visited in its own right rather than sampled. The written report usually follows within two weeks.

From gap report to implementation

Leadership walks through the report with the engagement team, agrees the action plan and chooses how the work will be shared. Under Design™, guided implementation, your team does the work with Sterling's templates, workshops and coaching. Under Drive™, fully managed implementation, our consultants carry the agreed work alongside your managers, who still own safety in their areas. Either way the plan's actions and milestones sit in Effivity from the first workshop, included with the engagement, at no additional cost, and the ISO 45001 implementation plan guide takes the project forward.

What the gap analysis does not do

• It does not certify. There is no pass mark; only an accredited certification body decides, after its Stage 1 and Stage 2 audits, and the Stage 1 and Stage 2 guide describes both.
• It is not a legal compliance audit. It checks whether you have a working process to identify and evaluate your legal duties; it does not give a legal opinion, although any evident serious risk we see is raised on the day.
• It does not replace your internal audit. ISO 45001 requires your own audit programme on the running system; the internal audit guide covers it.

ISO 45001 gap analysis: questions buyers ask