ISO 45001:2018: complete guide to implementation, certification and compliance

Structure of the standard: clause map

ISO 45001:2018 follows the High Level Structure (HLS) of the ISO Annex SL, sharing the same 10-clause structure with other management system standards (ISO 9001, ISO 14001). This common architecture facilitates integration between systems. Clauses 1 to 3 are informative (scope, normative references and terms/definitions). Clauses 4 to 10 contain the auditable requirements of the management system.

The standard operates on the PDCA (Plan-Do-Check-Act) cycle, with leadership and worker participation as the central axis that permeates all phases:

Practical guide: clause by clause

This section details each auditable clause (4 to 10) with its sub-requirements, typical conformity evidence and implementation tips.

Clause 4: context of the organization

Clause 4 establishes the foundation of the OH&S MS by requiring the organization to understand its context, identify relevant interested parties and define the scope of the system.

Clause 5: leadership and worker participation

Clause 5 is the central axis of the standard. It differentiates ISO 45001 from OHSAS 18001 by requiring active worker participation (not just consultation) and assigning direct accountability to top management. Leadership must demonstrate visible commitment, not merely delegate to the OHS department.

Clause 6: planning

Clause 6 requires the organization to plan actions to address risks and opportunities, establish measurable OH&S objectives and define how to achieve them. It includes the systematic identification of hazards, assessment of OH&S risks and identification of applicable legal requirements.

Clause 7: support

Clause 7 addresses the resources needed for the OH&S MS to function. It covers competence, awareness, communication and documented information. It defines how the organization ensures the right people have the right skills, receive the right information and that everything is properly documented.

Clause 8: operation

Clause 8 addresses the implementation of planned controls. It includes the hierarchy of controls, management of change, procurement management and emergency preparedness. This is where planning translates into daily operational action.

Clause 9: performance evaluation

Clause 9 requires monitoring, measurement, analysis and evaluation of OH&S performance. It includes internal audits and management review. This is the check phase of PDCA, where the organization determines whether the system is functioning as planned.

Clause 10: improvement

Clause 10 addresses non-conformities, corrective actions, incident investigation and continual improvement. It requires the organization to react to deviations, investigate root causes and implement actions that prevent recurrence.

Documentation requirements

ISO 45001 does not prescribe a mandatory manual, but requires that certain information is documented, maintained and retained. The table below consolidates all documented information requirements of the standard, distinguishing between documents to be maintained (procedures, policies) and records to be retained (evidence).

Note: in addition to the mandatory documents above, the organization may maintain additional documentation as needed for the effectiveness of the OH&S MS.

Implementation roadmap

Implementation of an OH&S MS conforming to ISO 45001 typically occurs in six phases. The total timeframe varies according to the prior maturity of the organization but generally ranges between 8 and 18 months for medium-sized organizations.

Factors that accelerate implementation

• Pre-existing management system (ISO 9001 or ISO 14001) with HLS already implemented
• Visible top management commitment with dedicated resource allocation
• Mature safety culture with active worker participation
• Use of OH&S management software that automates workflows and evidence
• Specialist consultancy to accelerate interpretation of requirements
• Internal team with prior experience in management system audits

Factors that delay implementation

• Lack of leadership commitment, treating the project as the sole responsibility of OHS
• Cultural resistance to documentation and formalisation of processes
• Multiple sites with heterogeneous processes requiring harmonisation
• High staff turnover, compromising competence retention
• Complex or rapidly changing legal requirements that complicate clause 6.1.3
• Attempting to implement without an initial gap analysis, generating rework

Certification process

ISO 45001 certification is granted by accredited certification bodies (accredited by national accreditation bodies that are members of the IAF — International Accreditation Forum). The process follows a standardised model in two audit stages, preceded by the selection of the certification body.

Process stages

1. Selection of the certification body — choose an accredited body, preferably with experience in the organization's sector. Request proposals from at least two bodies for comparison.

2. Stage 1 audit (documentary) — the auditor analyzes the OH&S MS documentation, verifies the scope, evaluates the organization's readiness and identifies areas of attention for Stage 2. May be conducted remotely.

3. Resolution of Stage 1 findings — the organization corrects any documentary gaps identified before proceeding.

4. Stage 2 audit (implementation) — full on-site audit that evaluates the effective implementation of the system. The auditor interviews workers, observes activities and verifies records.

5. Analysis of non-conformities — if major or minor non-conformities are identified, the organization submits corrective action plans within the defined timeframe (typically 90 days for major).

6. Certification decision — the certification body's technical committee analyzes the auditor's report and decides on certificate issuance.

7. Surveillance audits — conducted annually, covering part of the system each cycle, to verify maintenance of conformity.

8. Recertification audit — every 3 years, a full audit for certificate renewal.

Factors that influence the investment

The cost of certification varies significantly according to factors such as number of workers, number of sites, process complexity, risk level of activities, maturity of the pre-existing system and geographical location. The main cost components include:

• Implementation consultancy (optional, but recommended for organizations without prior experience)
• Training and internal capacity building (internal auditors, OH&S managers)
• Infrastructure and engineering control adaptations
• Certification body fees (calculated based on audit days)
• Annual maintenance (surveillance audits + continual improvements)

Organizations should request detailed quotations from accredited bodies to obtain estimates appropriate to their circumstances. The IAF publishes document MD 5 with guidelines for calculating audit days based on the number of workers and risk level.

Most common non-conformities in audits

Based on reports from certification bodies and specialist audit literature for OH&S MS, the following non-conformities are recurrently identified in ISO 45001 certification and surveillance audits:

Source: compilation based on public reports from certification bodies (BSI, Bureau Veritas, DNV) and OH&S MS audit analyses published in safety management journals.

Comparison with related standards

OHSAS 18001 vs. ISO 45001

The table below highlights the most significant structural differences between OHSAS 18001:2007 (discontinued) and ISO 45001:2018. The transition ended in March 2021.

Integration with ISO 9001 and ISO 14001

The main advantage of the High Level Structure is enabling an Integrated Management System (IMS) with shared processes. The most significant areas of overlap include:

Organizations that already hold ISO 9001 or ISO 14001 certification can leverage existing common processes (document control, internal audit, management review), significantly reducing the implementation effort for ISO 45001. The specific OH&S scope (hazard identification, hierarchy of controls, worker participation, emergency preparedness) remains exclusive to ISO 45001.

Examples by industry sector

ISO 45001 is applicable to any sector, but implementation challenges vary according to the risk profile and operational complexity. The table below summarises the most relevant particularities by sector:

The role of technology in ISO 45001 compliance

Digitalization of OH&S processes enables organizations to maintain ISO 45001 compliance more efficiently, reducing administrative burden and increasing the reliability of evidence. The main areas where technology adds value to the OH&S MS include:

Adoption of EHSQ software enables integration of multiple ISO 45001 requirements in a single platform, eliminating information silos and providing real-time visibility of the management system compliance status.