ISO 45001 for small businesses: a right-sized safety system, without the bureaucracy

What ISO 45001 requires of a 10- to 50-person organisation

Everything it asks of a large one, with fewer documents and fewer layers. There is no reduced edition: an eight-person electrical contractor and a refinery answer to the same clauses 4 to 10 of ISO 45001:2018 with Amendment 1:2024.

Top management is usually the owner or managing director, who carries the accountability for safety; it cannot be handed to a safety officer. Worker consultation and participation (5.4) can happen in a monthly toolbox talk rather than a formal committee, provided non-managerial workers are asked and their points recorded and acted on. Local law may still require a committee or safety representative; check it in the legal register.

What does not shrink is the operational core: hazards identified for routine and non-routine work, controls chosen in the hierarchy order of 8.1.2, with elimination first and PPE last, contractors under control, a drilled emergency plan and incidents, near misses included, investigated with the people involved.

What has to exist, and what can share one document

The third column is common small-firm practice, not a requirement; ISO 45001 documentation: what you need and what you do not owns the full list of documented information.

Most of the saving comes from merging: one register that also names the permit each task needs, and one log for every event, from a cut finger to an audit finding.

How many people it takes, and for how long

Indicative ranges for one site; high-risk work or many subcontractors push them up.

• Owner or managing director: sets policy and objectives, funds physical controls and chairs the review; a few short sessions.
• Coordinator: an existing manager, around a day a week during the build, then a few hours.
• Supervisors and experienced workers: join short risk assessment workshops for their own tasks.
• Internal auditors: two trained people who can audit each other's areas.
• Everyone, agency staff and regular subcontractors included: awareness of their hazards, relevant incidents and their right to remove themselves from imminent and serious danger.

A small team writes faster, but the system must still operate long enough to produce inspections, a drill, consultation records and an internal audit. ISO 45001 timeline: how long certification takes, stage by stage sets out the stages.

How the certification audit scales for a small scope

A small firm follows the same accredited route: a Stage 1 readiness review, a Stage 2 audit on site, the certification body's decision, annual surveillance and recertification in the third year.

Audit time is set under the IAF rules from the effective number of personnel and the OH&S risk category of the work. Two points surprise small firms. Contractor and subcontractor personnel under your control count towards that number, so a ten-person company that runs thirty subcontracted workers on site is not audited as a ten-person company. And an office-based firm sits in the low risk category, construction in the high one, so firms of equal size receive very different quotes.

Fewer days do not mean a lighter audit: the OH&S audit sees the system during operational activities, so expect a workshop tour and, where you work at client or temporary sites, a visit to one chosen on risk. Remote methods cannot replace witnessing risk controls. ISO 45001 Stage 1 and Stage 2 audits: what auditors check on site covers the visit in detail.

Four mistakes small firms make

• Purchasing a template pack. It assesses hazards you do not have and misses those you do; at Stage 2 a fitter's answer will not match the register.
• Making one person the whole system. When safety lives with the coordinator, supervisors cannot explain their own controls, the system stalls during leave, and nobody independent is left to audit the coordinator.
• Leaving contractors and agency workers outside. They are workers under your control, they often do the riskiest tasks, and they are counted for audit time; induct them, check their competence and include them in consultation.
• Copying a legal register. A list downloaded for another country or sector is not a determination of your legal duties, and the evaluation of compliance cannot be done against it.

Worked example: a right-sized system for a 20-person joinery and fit-out firm

A workshop makes and installs shop fittings with 20 people: a managing director, a workshop manager, a site supervisor, eleven joiners and machinists, three installers, an estimator, a purchasing officer and an office manager. Two subcontracted electricians and agency labourers join installations. Hazards include machinery, wood dust, manual handling, work at height and driving. The workshop manager coordinates.

The result: one policy page, one register, a site pack and a few logs, mostly owned by people other than the coordinator. When the auditor stands at the panel saw, the machinist can explain the guard, the extraction and why push sticks are used, because he helped write that line.

How Sterling's Design™ route fits a small organisation

In Design™, your team builds the system with Sterling's structure, templates and coaching; in Drive™, Sterling's consultants take on the agreed consulting and documentation work. Small firms often choose Design™ because risk assessments must come from the people who face the hazards; Drive™ suits a firm whose supervisors cannot spare the hours. The first stage is described in ISO 45001 gap analysis: what it covers and what you get.

ISO 45001 for small businesses: questions buyers ask