ISO 45001 is the international standard for occupational health and safety management systems. It gives you a structured way to prevent work-related injury and ill health, and certification is increasingly asked for in tenders, especially in construction, manufacturing and facilities management.
Does a small business need ISO 45001?
No law requires it: UK health and safety law applies whether or not you are certified. But if your customers or main contractors ask for it, or you want a clear framework to run safety well, ISO 45001 is scalable. A ten-person business does not need the paperwork of a multinational. The standard asks you to decide the extent of documented information that is right for your size and risks.
The core requirements, in plain English
- Context and scope: understand the issues affecting your business, the needs of workers and other interested parties, and decide what the system covers.
- Leadership and worker participation: top management takes responsibility, sets a policy, and genuinely consults and involves workers, including non-managerial workers, in decisions about safety.
- Planning: identify hazards, assess risks and opportunities, identify the legal requirements that apply to you, and set objectives.
- Support: competence and training, awareness, communication and document control.
- Operation: control risks using the hierarchy of controls, manage change, control contractors and procurement, and prepare for emergencies.
- Performance evaluation: monitor and measure, evaluate legal compliance, carry out internal audits and hold management reviews.
- Improvement: investigate incidents, manage nonconformities with corrective action, and keep improving.
A practical route to certification
- Do a gap analysis against the standard: most businesses with good safety practice already meet much of it.
- Build or tidy your legal register, so you know which regulations apply and can show you comply.
- Review your risk assessments, and make sure controls follow the hierarchy of controls.
- Set up consultation, such as a safety committee or regular toolbox talks, with records.
- Run internal audits and a management review, then book Stage 1 and Stage 2 audits with an accredited certification body.
Running ISO 45001 alongside ISO 9001 and ISO 14001
All three standards share the same high-level structure, so policy, objectives, document control, internal audit, corrective action and management review can be run once for all of them as an integrated management system. Many small businesses certify to two or three standards with one set of processes and a combined audit.
Frequently asked questions
What replaced OHSAS 18001?
ISO 45001, first published in 2018. OHSAS 18001 certificates are no longer valid.
How much does ISO 45001 certification cost?
It depends on your size, number of sites and risk level, which together set the number of audit days. Ask two or three UKAS-accredited certification bodies for quotes.
Can ISO 45001 be combined with ISO 9001?
Yes. Because they share the same structure, many businesses run an integrated management system and have both audited together.
This guide is general information for UK businesses, not legal advice. Check the current regulations and HSE guidance at hse.gov.uk, and take professional advice for your situation.