ISO 45002 · Guidelines for implementing ISO 45001
ISO 45002 guidance, applied to a safety system your workers actually use.
ISO 45002 is the ISO guide to implementing an ISO 45001 occupational health and safety management system. It carries no certificate of its own. Sterling's expert and experienced consultants use it to shape each part of your system around your hazards, your sites and your workforce, and take you on to ISO 45001 certification when you want it. We help our clients put it into practice and prove it.
- Fixed scope, one proposal: consulting, Effivity software, Sterling Academy access and internal auditor training, as applicable to your standard, in one proposal
- A team of expert and experienced OH&S consultants, with occupational health and safety systems consulting delivered across sectors and countries since 2003
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not certify; for ISO 45001, an accredited body audits and decides
8,100+ client engagements in 60+ countries.
Why clients choose Sterling
What it is
What is ISO 45002 and what is it used for?
ISO 45002 gives general guidelines for implementing ISO 45001, the requirements standard for occupational health and safety management systems. Where ISO 45001 says what a system must achieve, ISO 45002 explains how organisations of different sizes and sectors have gone about achieving it, with practical advice and real-life examples. It comes from ISO/TC 283, the committee behind ISO 45001 and ISO 45003.
The guidance is deliberately non-binding. Its "should" statements do not weaken or add to anything ISO 45001 requires, and its examples show one way an organisation did something, not the only acceptable way. That makes it useful in two situations: when you are designing a system for the first time and want to see what good looks like, and when an existing system passes audits but does little to change what happens on the shop floor or the construction site.
Current edition. ISO 45002:2023, first edition, published by ISO in February 2023 and written against ISO 45001:2018. ISO lists a revised ISO 45001 as under development, expected to replace the 2018 edition in the first half of 2027; as at 30 September 2026, no revision of ISO 45002 is announced on iso.org.
Who it is for
Who uses ISO 45002?
No customer can ask you for an ISO 45002 certificate, because there is none. What they ask for is a working safety system, usually evidenced by ISO 45001 certification. ISO 45002 is the tool that helps you build that system well. Organisations bring it to Sterling from four starting points:
- A customer or tender wants ISO 45001. A principal contractor, an energy operator or a multinational buyer makes certification a condition of prequalification. The guidance helps you build a system that survives their HSE inspection, not only the certification audit.
- A tender scores safety management, not just the certificate. Bid evaluators increasingly ask how workers are consulted, how contractors are controlled and how incidents lead to change. ISO 45002's examples help you design arrangements you can describe and prove.
- A regulator or inspector expects a systematic approach. Occupational safety law sets duties by jurisdiction. ISO 45002 does not replace them, but it helps you organise hazard identification, legal compliance and emergency readiness so those duties are met consistently. We work alongside your legal advisers on the legal duties themselves.
- A group company needs one method across sites. A parent company sets a group safety standard and subsidiaries in different countries run safety differently. The guidance gives every site a common reference for how each part of the system should work.
Structure
How is ISO 45002 structured?
ISO 45002 contains guidance, not requirements. After its scope, normative references and terms, it follows the clauses of ISO 45001 from 4 to 10, giving advice and examples for each one, so every requirement you have to meet has matching guidance beside it. The list below is a plain-language map at clause-title level.
- Clause 4 Context of the organisation: how to understand the issues and interested parties that shape your OH&S system, and how to set a scope that covers the work and workers under your control.
- Clause 5 Leadership and worker participation: how top management shows accountability, sets the policy and assigns roles, and how consultation and participation of workers can work in practice.
- Clause 6 Planning: how to identify hazards, assess risks and opportunities, determine legal and other requirements and set OH&S objectives with a plan to reach them.
- Clause 7 Support: resources, competence, awareness, communication and documented information that fit the size of the organisation.
- Clause 8 Operation: operational planning and control, including eliminating hazards, managing change, procurement and contractors, and emergency preparedness and response.
- Clause 9 Performance evaluation: monitoring, measurement and evaluation of performance, internal audit and management review.
- Clause 10 Improvement: incidents, nonconformities and corrective action, and continual improvement of the system.
What evidence shows the guidance has been applied?
ISO 45002 itself is never audited, so the proof lies in the ISO 45001 system it helped you build: risk assessments that workers contributed to, a legal register with a recent compliance evaluation, minutes showing concerns raised and acted on, contractor controls that operate at the gate, emergency drills with lessons applied and incident investigations that changed a control. We set those records up in Effivity from the first workshop, so evidence builds as the work is done.
Putting it into practice
How do you put ISO 45002 into practice?
You apply ISO 45002 by using it to design and test your ISO 45001 system, requirement by requirement. There is no ISO 45002 assessment to pass; the independent check comes only if you choose ISO 45001 certification, and that decision belongs to the certification body.
- 01Agree the scope and the outcome.Confirm sites, activities, shifts, workers and contractors in scope, and whether the goal is an aligned system, ISO 45001 certification or both.
- 02Gap analysis: compare current arrangements with ISO 45001, using ISO 45002 as the benchmark.The gap analysis shows which arrangements already meet the requirement, which fall short of the practice the guidance describes, and what to change, with owners and dates.
- 03Build and apply the improvements.Rework risk assessments with the people who do the job, strengthen consultation, bring contractors under control and run drills, keeping records as the work happens.
- 04Audit and review internally.Internal audit across sites and shifts and a management review that takes decisions; findings are raised by us first and closed with evidence.
- 05Sustain the system, or take it to ISO 45001 certification.Keep monitoring and improving, and, where agreed, prepare for the certification body's Stage 1 readiness review and Stage 2 audit against ISO 45001.
Check the route before you sign. Anyone offering an "ISO 45002 certificate" is offering something the standard does not provide. If you go on to ISO 45001, ask which certification body will audit, confirm that it is accredited for ISO 45001 by an accreditation body within the Global ACI arrangement, and verify the accreditation and scope with that accreditation body directly. How to choose a credible ISO 45001 provider · The certification buyer's checklist
Cost
How much does ISO 45002 implementation cost?
The cost of ISO 45002 lies in the work of applying it, not in the guidance. A single office with low-risk activities needs far less than a contractor running high-risk work across several sites. A Sterling proposal shows every component and states everything that is included.
| Cost component | What affects it |
|---|---|
| Consulting and implementation | Current safety maturity, the risk level and variety of activities, sites and shifts, the contractor population and whether you choose Design™ or Drive™ |
| Independent certification (optional) | Only if you go on to ISO 45001: the certification body's audit time, sites, risk category, travel and surveillance audits |
| Internal resources | Time from supervisors, safety representatives and workers for consultation, risk assessment and training, and any physical controls the assessments call for |
| Software and learning | Included in a Sterling engagement: Effivity for the OH&S system and Sterling Academy access for your people, with users, courses and access period confirmed in the proposal |
| Continued support | Internal audits, legal updates, drills and the move to the revised ISO 45001 under Sustain™ |
What moves the price
- How many sites, countries and shift patterns are in scope
- The hazard profile: office work, plant operations or high-risk field work
- The number of contractors and agency workers you control
- How much of the current system can be kept
- Whether ISO 45001 certification is part of the goal
What a Sterling proposal always shows
- Deliverables, responsibilities, assumptions and exclusions, in writing
- Any certification-body fees shown separately, never bundled
- Effivity, training and Academy access itemised at no additional cost
- Milestones linked to deliverables
- One all-inclusive proposal. No surprises, ever
Timeline
How long does ISO 45002 implementation take?
A gap assessment against ISO 45001, benchmarked on ISO 45002, typically takes two to six weeks. Building the improvements and running them long enough to produce evidence usually takes four to eight months in total; these are estimates, and your plan sets the real dates.
| Phase | What determines the pace |
|---|---|
| Scope and gap analysis | Access to sites and shifts, existing risk assessments, permits and incident history |
| Build and implementation | The number of activities to reassess, physical controls to install and contractor arrangements to change |
| Evidence and review | Operating time for inspections, drills and incident handling, then internal audit and management review |
| Certification assessment (optional) | The certification body's calendar for Stage 1 and Stage 2 against ISO 45001, and time to close findings |
If a tender or client deadline is driving the work, tell us on day one. We will say what is achievable and which decisions must come early.
Your engagement
What your ISO 45002 engagement includes
Sterling OS™ organises the work. You choose one support level: Design™, where our consultants guide and your team builds, or Drive™, where we manage and carry most of the work. Sustain™ keeps the system running after implementation, or after certification where that is the goal, and Automate™ is Effivity, running your system from the first day. Sterling does not certify; ISO 45002 has no certificate, and ISO 45001 certification is decided by an independent, accredited certification body.
Scope, gap analysis and plan
Your arrangements compared with ISO 45001 and the practice ISO 45002 describes, with owners and dates agreed.
Procedures built with your workers
Risk assessments, permits, contractor controls and emergency plans shaped on site, on Sterling's template sets.
Effivity ISO & GRC software
Your OH&S system runs in Effivity from day one, included with the engagement at no additional cost.
Training for everyone
Internal auditor training for your audit team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.
Internal audit and management review
Conducted or facilitated as agreed, with findings closed on evidence.
ISO 45001 readiness, where agreed
Preparation for Stage 1 and Stage 2, and support until the certification body decides.
ISO 45002 carries no certificate; any ISO 45001 certification decision remains with the independent certification body.
Often combined with
Standards organisations pair with ISO 45002
- ISO 31030ISO 31030 travel risk management, put into practice: policy, destination risk assessment and emergency response for staff who travel.
- ISO 39001ISO 39001 certification consulting to reduce death and serious injury from road traffic crashes you can influence, ready for an accredited certification audit.
- ISO 45001ISO 45001 certification consulting to prevent work-related injury and ill health, with an OH&S system built with your people and audit-ready, in 60+ countries.
- ISO 45003ISO 45003 psychosocial risk consulting: manage work-related stress and wellbeing within your ISO 45001 system.
- Process safety management (OSHA PSM and Seveso III)Process safety management compliance and requirements for OSHA PSM and Seveso III sites: applicability, gap analysis and programme build.
Effivity · ISO and GRC software, included in every engagement
How Effivity helps you apply ISO 45002 and fulfil, automate and simplify the requirements of ISO 45001:2018.
Every Sterling engagement built on ISO 45002 includes Effivity, the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures the OH&S workspace within the agreed scope, so hazards, risk assessments, legal requirements, consultation records, contractor controls, drills, incidents, audits and management review sit in one place and the practice the guidance describes becomes daily routine. Sterling consulting clients get their Effivity subscription included with the engagement, at no additional cost.
Scope, issues and interested parties
Sites, activities, workers and contractors in scope, with the issues and interested parties behind them, held in one register and reviewed when the operation changes.
Policy, roles and consultation
The OH&S policy, responsibilities and a record of consultation: committee meetings, toolbox talks and concerns raised by workers, each with its action and response.
Hazards, risks and legal requirements
A hazard register by activity and site, risk assessments with controls, a legal register with owners, and objectives tracked against their plans.
Competence and documented information
Training and competence records for each worker, linked to Sterling Academy, and controlled documents so only the current version reaches the site.
Controls, contractors and emergencies
Permits to work, management of change, contractor prequalification and inductions, and emergency drills with their lessons recorded.
Inspections, audits and review
Inspection schedules, compliance evaluations, internal audit programmes and a management review that records its decisions and actions.
Incidents and corrective action
Incidents and near misses reported, investigated with the workers involved and closed with evidence that the corrective action worked.
Your forms, workflows and reports
Checklists, forms and dashboards adapted to your sites and languages without code, so supervisors record safety work where it happens.
What this means at the audit
If you take the system to ISO 45001 certification, the auditor will ask for risk assessments, the legal register, consultation records, drill reports and incident investigations. In Effivity each is a screen with owners, dates and evidence attached, ready without a last-minute search. After implementation, Sustain™ runs in the same workspace.
In your engagement
- Subscription included with the engagement, at no additional cost
- Configured by your Sterling consultant within the agreed scope
- Existing risk assessments, registers and records migrated, not retyped
- Admin and user training for your team
- Modules for QMS, EMS, ISMS and more when you integrate other standards
Sterling Academy · OH&S e-learning
Train every worker on health and safety, not just the safety officer.
Sterling Academy provides e-learning for the whole workforce and for the people who run the safety system: video lessons with practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online. Sterling consulting clients benefit from preferential Sterling Academy course access and special pricing through their Sterling consultant, including complimentary awareness training for their people as part of the engagement.
- Health and safety awareness for every worker, as evidence of competence and awareness
- Practitioner learning for supervisors, safety representatives and the OH&S lead
- Internal auditor training for your audit team, as applicable to your standard, as part of the engagement
- Progress by site and department, with a training status report
- New starters and contractors trained as they arrive
- A Sterling consultant reachable when a learner needs one
Keep exploring
Explore more about ISO 45002
Why Sterling
Why work with Sterling on ISO 45002?
Guidance helps only when it is turned into arrangements that fit your hazards, workforce and countries. Sterling does that with your supervisors and workers, keeps what already works and changes what does not, so one safety method holds across every site.
OH&S systems in 60+ countries since 2003
Safety systems built for contractors, plants, logistics operators, facilities providers and offices, with offices in 21 countries and one engagement team accountable across your locations.
All-inclusive proposal
Consulting, Effivity, training and Academy access in one proposal, with any certification-body fees shown separately. No surprises, ever.
Built on site, not in a binder
Risk assessments, permits and emergency plans written with the people who face the hazards, so the system is used between audits.
Expert and experienced consultants
Consultants who have advised on occupational health and safety systems across sectors and countries since 2003, and who apply the guidance with judgement rather than copying its examples.
The Sterling Promise
What the Sterling Promise means for ISO 45002
We stay with you until your agreed ISO 45002 outcome is achieved, whether that is a system aligned with the guidance or ISO 45001 certification, supporting implementation, preparation and the resolution of any assessment findings. Included software and employee learning turn the investment into lasting capability.
The engagement identifies the standard, scope, outcome and responsibilities. Your organisation supplies accurate information and puts the agreed controls into use. ISO 45002 has no certificate; where ISO 45001 certification is the goal, the independent certification body assesses conformity and retains its decision. Our commitment concerns the agreed support, not a promise of every future tender award or an incident-free workplace.
FAQs
Frequently asked questions about ISO 45002
Can you get certified to ISO 45002?
No. ISO 45002 is a guidance document with no requirements to certify against. Organisations that want a certificate are certified to ISO 45001 by an accredited certification body, and ISO 45002 helps them get there.
What is the difference between ISO 45001 and ISO 45002?
ISO 45001 sets the requirements an OH&S management system must meet; ISO 45002 explains ways of meeting them. The first is what an auditor checks, the second is what an implementation team reads for practical advice and worked examples.
Will a certification auditor audit us against ISO 45002?
No. The certification audit is against ISO 45001 alone. The "should" statements in ISO 45002 do not add requirements, so choosing a different approach from its examples is not a nonconformity if your approach meets ISO 45001.
Is ISO 45002 still valid while ISO 45001 is being revised?
Yes. ISO 45002:2023 is the current edition and is written to ISO 45001:2018. ISO expects the revised ISO 45001 in the first half of 2027; no ISO 45002 revision is announced yet, so we check the guidance against the new edition once it appears.
Do we need our own copy of ISO 45002 to implement ISO 45001?
Not necessarily. Many organisations work from ISO 45001 with a consultant who knows the guidance. A copy of ISO 45002 is useful for the person leading the system, and ISO sells it alongside ISO 45001 through its store and national standards bodies.
Talk to a consultant
Put ISO 45002 to work in your safety system.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice