ISO 45001 Occupational Health and Safety Certificate Explained

An ISO 45001 certificate confirms that your business runs a management system for the health and safety of the people who work for you, based on ISO 45001:2018. You get it either the classic way, through an on-site audit by a certification body, or through a self-assessment such as the one Zertify offers, which is faster and cheaper.

What an ISO 45001 certificate is

ISO 45001:2018 is the international standard for occupational health and safety management systems. It sets out how an organisation arranges its work so that nobody gets hurt by it, and it replaced OHSAS 18001.

You will find no fixed safety limits in it. It does not say how many fire extinguishers to buy or which gloves to wear. What it asks for is a working system: identify hazards, assess risks, set objectives, assign responsibility, act, check the results, improve. The certificate states that such a system exists in your business.

It does not promise that nobody will ever be injured. It shows that you handle the subject in a structured way and can repeat the method.

Who needs one

Most small businesses can operate without it. Legal duties on workplace safety apply to you with or without a certificate, so the certificate itself is voluntary.

Small and medium businesses usually pursue it for one of these reasons:

• A customer asks for evidence of a safety management system in a supplier questionnaire.
• You work on construction sites, in logistics, in manufacturing or in technical services, where safety records come up in every negotiation.
• You want to put your safety practices in order and need a framework to do it.
• You want to show applicants that you look after your staff.
• You already hold ISO 9001 or ISO 14001 and want to apply the same approach to safety.

If none of these fits, the framework can still be worth using. The certificate is the smaller part of the benefit.

What the standard asks for

ISO 45001 uses the same high level structure as other management system standards, so clauses 4 to 10 look familiar if you have worked with ISO 9001. Only the content is specific to health and safety.

Clause 4: Context of the organization

You describe your business, the people and bodies with an interest in your safety performance, and the scope of the system. Those interested parties include employees, temporary staff, contractors, customers, insurers and authorities. You also decide which activities and sites fall inside the system.

Clause 5: Leadership

The owner or management carries the responsibility. That means a written occupational health and safety policy, defined roles and real participation of workers. In a ten-person company, a one-page policy and a named person who looks after safety are enough. Leaving the role undefined is not.

Clause 6: Planning

This clause is the core of the standard. You identify hazards, assess risks and opportunities, and list the legal and other requirements that apply to you. After that you set objectives, such as reducing one specific type of incident or finishing an overdue training round.

Clause 7: Support

Here you provide resources, make sure people are competent, raise awareness, communicate and keep documented information. Keep the documentation lean in a small business: write down what you need to run the system and to prove it works, and nothing beyond that.

Clause 8: Operation

You put controls in place for the hazards you found and manage change, contractors, procurement and emergency preparedness. Instructions, protective equipment, safe procedures and emergency drills all belong here, because this is where the system meets daily work.

Clause 9: Performance evaluation

You measure and monitor, check compliance with legal requirements, run an internal review of the system and hold a management review. The inputs are incidents, near misses, inspection results and the status of your objectives.

Clause 10: Improvement

When something goes wrong, you investigate, find the cause and correct it. The system also gets improved over time, not only after accidents.

Two routes to a certificate

The two routes are different things, so be clear about which one you are choosing.

Route 1: The classic route with an on-site audit

A certification body audits your system on site in several stages. Auditors review documents, visit workplaces, interview staff and check records. If the system conforms, you receive a certificate, and surveillance audits follow in later years.

Outsiders give this route the most weight. It also costs the most time, effort and money.

Route 2: Certificate based on a self-assessment

You work through a structured assessment of your own system, answering questions that follow the requirements of the standard. If you pass, the issuing institute gives you a certificate. No auditor comes to your premises, and the certificate states that your organisation assessed itself against ISO 45001:2018.

This route suits businesses that want to organise their safety work, document their commitment and answer customers who accept a certificate based on a self-assessment. The page on certification without an audit describes how it works in practice.

When you should choose the classic route with an on-site audit

In some cases a self-assessment certificate is the wrong choice. Take the classic route when:

• A tender document names an on-site audit by a certification body as a requirement.
• A customer contract states that the certificate must come from a certification body after an on-site audit.
• A regulator or insurer demands it explicitly.
• Your business operates in a high-risk sector where everyone involved expects independent verification.

Where the requirement is written down, follow it. Before you spend money on either route, ask the party that sets the requirement what exactly it accepts. Many requests only ask for evidence of a safety management system, and a written answer saves you from the wrong decision.

Checklist: are you ready for an ISO 45001 assessment

Go through this list before you start. If you can tick most of the boxes, the assessment will go smoothly. The open items are your to-do list.

• We have defined the scope: which sites, activities and people the system covers.
• We know who our interested parties are, including contractors and temporary staff.
• Management has signed a written occupational health and safety policy.
• Someone is named as responsible for safety, with enough time to do the job.
• Employees can raise safety concerns and are consulted on decisions that affect them.
• We have a list of hazards for each activity and a documented risk assessment.
• We know which legal requirements apply to our business and where to find them.
• We have set at least one measurable safety objective.
• Staff have received the training their tasks require, and we keep records.
• We have controls for our main risks, such as procedures, equipment and supervision.
• We have an emergency plan and have tested it.
• We manage contractors and visitors on our premises.
• We record incidents and near misses and follow up on them.
• We review the system at least once a year with management.

Common mistakes

Copying a template without adapting it. A policy that names hazards you do not have, or misses the ones you do, is useless. Write it for your own workplace.

Leaving workers out. The standard puts consultation and participation of workers at its centre. A system designed at the owner's desk will not hold up on the floor.

Writing too much. Small businesses tend to build a folder nobody opens. Short, usable documents work better.

Treating the certificate as the goal. The certificate records a result. The value lies in the work behind it: fewer incidents, clearer responsibilities, better preparation.

Ignoring contractors. Many incidents involve people who are not on your payroll, and the standard expects you to account for them.

How Zertify fits in

Zertify issues ISO certificates based on a self-assessment. For this topic, that is a certificate for ISO 45001:2018, issued by G6 Agency AG under licence from SICE (Swiss Institute of Certification and Education). SICE reviews every assessment before the certificate is issued. The result is a documented statement that you assessed your occupational health and safety management against the standard.

The process has three steps:

1. You start the assessment online and answer questions that follow the requirements of the standard.
2. If your answers show that your system meets the requirements, you have passed.
3. After payment, Zertify issues the certificate within 4 hours.

The pricing page lists the costs, so you can set them next to the quotes of certification bodies before you decide.

The assessment also works as a check of your system. Any question you cannot honestly answer with yes points to a gap, and that finding is useful even if you later choose the classic route.

How to decide

Three questions settle it.

1. Does anyone require an on-site audit by a certification body in writing? If yes, choose the classic route.
2. Do you want a structured framework and a credible statement of your commitment, without a long audit project? Then a self-assessment certificate fits.
3. Are you early in building your safety system? Start with the self-assessment, see where you stand, and move to the classic route later if your market requires it.

Many businesses begin with the lighter step and switch when a customer or contract demands it.

Next step

Read through the checklist above, mark the gaps and close the simple ones first. Then work through the assessment at your own pace.