ISO 45001 timeline: how long certification takes, stage by stage, from gap analysis to decision

How long ISO 45001 certification takes

Plan on four to eight months from the first day of the gap analysis to Stage 2, plus two to six weeks for the decision. An office-based organisation with few hazards and a legal register that is already current can be ready in roughly three months. A contractor working across many sites, or a plant with hazardous processes, usually needs the full eight months, and sometimes more.

The reason is not paperwork. An OH&S system is judged at the workface, on hazards identified, controls applied, workers consulted and incidents investigated, and each of those leaves evidence only as the work is done. A certificate promised in ten days has skipped that evidence entirely.

Stage by stage: durations and what moves them

The stages follow the hub's phases for a single site. They overlap, so the ranges do not add up.

The hazard register usually takes longest; ISO 45001 hazard identification and risk assessment explains the method.

How much operating evidence the auditors expect

ISO 45001 does not name a minimum number of weeks, and nor does ISO/IEC 17021-1, which governs how certification bodies audit. What they apply is a test of readiness at Stage 1 and a test of effectiveness at Stage 2, and only records can pass either. For OH&S that means, before Stage 2, at least:

• Risk assessments for each activity and site, done with the workers involved, with controls chosen in hierarchy order.
• A legal register with owners and a first evaluation of compliance.
• Consultation on the record: committee minutes, toolbox talks or hazard reports from non-managerial workers, with actions followed up.
• Drills for each shift or area in scope, with the lessons applied.
• Incidents and near misses investigated through to a revised control.
• A full internal audit of every site and shift, then a management review that takes decisions.

Plan on three to four months of operation. For seasonal work, shutdowns and project sites, time Stage 2 for when the high-risk activity is actually happening.

What can overlap, and what cannot

Weeks are saved by running independent tasks side by side:

• Controls go live one activity at a time: once a task's risk assessment is agreed, its permit and inspections start producing records.
• Contractor controls start early, because inductions take weeks to reach every firm; ISO 45001 contractor management: prequalification to permits sets out the sequence.
• The certification body is booked during the build, so its lead time overlaps your preparation rather than following it.
• Training runs throughout: hazard awareness as controls change, internal auditors before the audit programme begins. ISO 45001 training: who needs what, and the evidence of competence covers the roles.

The rest is a chain: the internal audit needs operating records, the management review needs its results, and Stage 1 needs both. ISO 45001 implementation plan: phases, owners and deliverables assigns the owners.

The certification body's lead times

Quotation. The body works out audit time from effective headcount, contractors under your control included, the number of sites and the OH&S risk category of your work, and confirms it has auditors for your sector. Allow one to two weeks; Choosing an ISO 45001 certification body: accreditation, sector codes and quotes compares quotes.

Booking. Four to eight weeks to the first Stage 1 date is common, longer where few auditors cover a high-risk sector or your language. The international rules for OH&S certification require auditors to see the system during operational activities, including a tour of the work sites, so night shifts and remote or temporary sites may each need a visit, and sites with different risks are not sampled.

Between and after the stages. Allow three to six weeks between Stage 1 and Stage 2, then two to six weeks for your responses, the technical review and a decision by people outside the audit team. A major nonconformity must be verified as closed; if that cannot happen within six months of the last day of Stage 2, Stage 2 is repeated. ISO 45001 Stage 1 and Stage 2 audits: what auditors check on site describes the audits.

A worked calendar: 150 people, one plant, two shifts

The example: a light manufacturing plant, 150 employees on two shifts, about 30 contractor workers, some risk assessments, no legal register and a coordinator free two days a week. Weeks count from kick-off.

The decision lands about seven months after kick-off; a later Stage 1, a major nonconformity, a second site or confined-space work would push it back. Drive™, where our consultants take on the agreed consulting and documentation work, can shorten weeks 3 to 14 when supervisors' time is the constraint; it cannot shorten the operating period.

ISO 45001 timeline: questions buyers ask