ISO 45001 has become a common requirement in tenders, supplier prequalification and head contractor panels. If a client has asked whether you’re certified, or you’re planning to grow into larger contracts, this guide explains how certification works and how to get there without drowning in paperwork.
Key takeaways
- ISO 45001 is the international standard for occupational health and safety management systems.
- Certification is carried out by an independent certification body, ideally one accredited by JAS-ANZ.
- The certification audit has two stages, followed by surveillance audits and recertification every three years.
- The biggest factor in how long it takes is how mature your current WHS system is.
- Cost depends on your size, number of sites, risk profile and how much of the system already exists.
What is ISO 45001?
ISO 45001:2018 sets out the requirements for an occupational health and safety management system. It follows the Plan-Do-Check-Act cycle and shares a common structure with ISO 9001 (quality) and ISO 14001 (environment), so the three can be run as one integrated system. In Australia it has been adopted as AS/NZS ISO 45001:2018, which replaced AS/NZS 4801.
In 2024 the standard was amended to require organisations to consider whether climate change is a relevant issue for their system, and a revised edition is in development.
Is ISO 45001 compulsory?
No. Your legal obligations come from the WHS Act and Regulations. But many government agencies, tier one builders and large clients ask for certification, or for evidence of an equivalent system, before they will engage you. A well-implemented system is also one of the best ways to show you are meeting your WHS duties.
The steps to certification
- Gap analysis. Compare your current system and practices against each clause of the standard.
- Plan. Agree priorities, responsibilities, resources and a realistic target date.
- Build or adapt the system. Cover the context of your organisation, interested parties, OH&S policy, roles and responsibilities, worker consultation and participation, hazard identification, risks and opportunities, legal requirements, objectives, operational controls (including contractors and procurement), emergency preparedness, performance monitoring, and incident investigation and corrective action.
- Run it. The system needs to operate for a period so there are records to show it works.
- Internal audit and management review. Test the system yourself before the certification body does.
- Stage 1 audit. The certification body reviews your documentation and readiness.
- Stage 2 audit. The certification body assesses whether the system is implemented and effective in practice. Any major nonconformities must be resolved before a certificate is issued.
- Surveillance and recertification. Expect surveillance audits during the certificate cycle, usually annually, and a recertification audit every three years.
How long does it take?
For a small to mid-sized business with a reasonable existing WHS system, a few months from gap analysis to certification is often achievable. Businesses starting from scratch, or with multiple sites, usually need longer. The biggest time factor is rarely writing documents. It’s giving the system time to run so you have records to show the auditor.
What drives the cost?
- The number of workers, which affects the number of audit days
- The number of sites and locations
- Your risk profile and the complexity of your operations
- How much of the system already exists and works
- The internal time your team can commit
- Whether you’re integrating with ISO 9001 or ISO 14001
- The certification body you choose
Certification body fees are separate from consultant fees. Ask for quotes that show the audit days for Stage 1, Stage 2 and each surveillance year, so you can compare like with like.
Choosing a certification body
Choose a certification body accredited by JAS-ANZ (the Joint Accreditation System of Australia and New Zealand) or another recognised accreditation body, with experience in your industry. Keep your consultant and your certification body separate. A body that certifies a system it helped write isn’t independent, and clients and tender panels know it.
Common reasons businesses struggle at Stage 2
- No evidence of worker consultation and participation
- A legal register that isn’t linked to actual compliance activities
- Objectives without measures or progress tracking
- Internal audits that were rushed, superficial or not done
- A management review missing required inputs
- Contractors not covered by the system
- Incidents without corrective actions followed through to close-out
Planning for ISO 45001?
We’re qualified ISO 45001, ISO 14001 and ISO 9001 lead auditors. We’ll run a gap analysis, build what’s missing and support you through Stage 1 and Stage 2.
Frequently asked questions
Can we get certified without a consultant?
Yes, if you have the time and in-house expertise. Many businesses use a consultant to avoid rework and get through Stage 2 the first time.
Does certification protect us legally?
No. Certification shows you have a structured system, but your WHS duties still apply. A certificate won’t help if the system isn’t working in practice.
We built our system to AS/NZS 4801. Do we start again?
No. Much of a 4801-based system can be kept. The main gaps are usually leadership, worker participation, the context of the organisation, and risks and opportunities to the system.
Sources and further reading
- ISO: ISO 45001:2018/Amd 1:2024 Climate action changes
- JAS-ANZ: Joint Accreditation System of Australia and New Zealand
This article is general information only and is not legal advice. Last reviewed October 2026.