ISO 45001 surveillance audit and recertification: what the three-year cycle demands of your OH&S system

What happens after the ISO 45001 certificate is issued?

The certificate starts a three-year programme rather than ending a project. ISO 45001 says nothing about audit frequency; the timetable comes from ISO/IEC 17021-1, the requirements every accredited certification body works to, and from the IAF mandatory documents that add rules for OH&S audits. Counting from the certification decision, the body returns for surveillance at least once in every calendar year that is not a recertification year, the first visit within 12 months of the decision. In year three, recertification renews the certificate before it lapses and opens the next cycle.

The expiry date is a promise with conditions: it stands only while visits happen on time and findings are dealt with. Your independent, accredited certification body writes the audit programme and makes every decision on your certificate; Sterling does not certify.

The ISO 45001 cycle, year by year

Audit days follow IAF MD 5, since reissued by Global ACI: annual surveillance totals roughly one third of the initial certification time, and recertification usually around two thirds of a fresh initial audit. For OH&S the figure is recalculated from effective personnel, which counts contractor and subcontractor workers under your control or influence, and from the risk category of the work, so growth in either lengthens later visits.

What an ISO 45001 surveillance audit examines

A surveillance visit covers part of the system, but ISO/IEC 17021-1 fixes items it never leaves out: internal audits and management review, action on previous nonconformities, complaints, progress against objectives and intended results, continual improvement, continuing operational control, changes since the last visit, and your use of the certificate and references to it.

How that looks in an OH&S audit

• Operational control is watched, not read. IAF MD 22 expects the system to be evaluated during operational activities, through a tour of facilities and work sites. Auditors compare the permit, the machine guarding and the PPE in use with the risk assessment.
• Workers are asked, not only managers: how hazards are reported, what consultation took place, whether they know they may remove themselves from imminent and serious danger.
• Contractors are in the sample: prequalification, induction and supervision of the firms on site.
• Legal compliance is tested through your latest evaluation of compliance and what followed where you fell short.
• Incidents are read for their lesson. An investigation that stops at "worker error" and leaves the risk assessment untouched is a classic finding.
• The climate question. Since Amendment 1:2024, bodies check that you decided whether climate change is a relevant issue and can show how.

Sampling has limits in OH&S. Sites that do not share the same activities, processes and risks cannot be sampled under MD 22; remote techniques may replace only the parts of an audit that do not involve witnessing risk control; temporary sites are chosen on an evaluation of risk. Findings are graded major or minor as at Stage 2; ISO 45001 nonconformities: major, minor and how to close them explains the response.

How ISO 45001 recertification differs from surveillance

ISO 45001 recertification asks a wider question: after three years of change, does the whole OH&S management system still conform, still work and still match the certified scope? The body reviews the cycle's surveillance reports, then audits the entire system on site: its effectiveness through internal and external change, top management's continuing commitment, and the achievement of OH&S objectives and intended results. A new site, a merger or major new legislation can justify an extra Stage 1.

The audit, and the correction and verification of any major nonconformity it raises, must both be complete before expiry, or the certificate is not extended. The body may restore certification within six months once the outstanding work is done; after that it insists on at least a Stage 2 audit. Fix the recertification dates at the year 2 visit.

Changes and events the certification body must hear about

Your certification agreement requires you to inform the body without delay of anything that could affect the system's ability to keep meeting ISO 45001. The first five rows are ISO/IEC 17021-1's examples; the last reflects IAF MD 22.

Adding a site or activity is a formal extension, reviewed and audited by the body, sometimes during surveillance, and certified once it appears on the certificate. ISO 45001 scope: sites, workers, contractors and the mistakes that cost you covers the wording.

Keeping the OH&S system alive between visits

A system that stirs only before the auditor arrives gives itself away: inspection sheets dated the same fortnight, a silent safety committee, risk assessments older than the new machine.

• Inspections and permits on a fixed rhythm, with actions tracked to closure.
• Risk assessments reopened when work changes and after significant incidents. See ISO 45001 hazard identification and risk assessment.
• Consultation that leaves a trail: committee minutes, toolbox talks, hazard reports with responses.
• Internal audits across sites and shifts, nights and contractor work included. See ISO 45001 internal audit: planning, conduct and reporting.
• A management review that decides. See ISO 45001 management review: inputs, outputs and the record.

The ISO 45001 revision and your current cycle

Certificates today are issued against ISO 45001:2018 with Amendment 1:2024. The draft of a revised edition closed its ballot in September 2026, and ISO expects the new edition in the first half of 2027. A transition period is expected, but its length awaits confirmation by the IAF and the accreditation bodies. ISO 45001 revision: what is changing and when tracks the details.

How Sterling supports the three-year cycle

After certification, Sterling's Sustain™ phase covers internal audits, legal updates, drill programmes, refresher learning and the coming revision, as your proposal sets out.

ISO 45001 surveillance audit and recertification: questions buyers ask