If a tender, head contractor, or client has asked you for ISO 45001 and you’re starting from scratch, here’s what it actually involves — not the marketing version, the practical one.
What ISO 45001 actually is
ISO 45001 is the international standard for occupational health and safety (OHS/WHS) management systems. It replaced AS/NZS 4801 as the standard Australian certification bodies audit against, and it’s built around the same logic as ISO 27001 or ISO 9001: a management system with defined roles, risk assessment, documented controls, and a cycle of audit and improvement — just applied to workplace safety instead of information security or quality.
It is not a safety checklist or a single policy document. It’s a system for how your organisation identifies hazards, assesses risk, controls it, and keeps improving — with evidence a certification auditor can test.
Who actually needs it
- Construction, trades, and infrastructure businesses, where it’s frequently a prequalification requirement before you can even bid on a tender.
- Manufacturing and logistics, where physical hazards (plant, vehicles, manual handling) are a core part of daily operations.
- Any business in a government or head-contractor supply chain, where ISO 45001 is increasingly requested as a condition of being an approved supplier — sometimes even for roles that look low-risk on paper.
- Businesses that have had a safety incident, insurance review, or client due diligence process raise WHS governance as a gap.
What the certification process actually involves
- Discovery and scoping — defining which sites, teams, and activities sit inside the management system, and understanding your actual hazard profile.
- Gap analysis — a clause-by-clause review against what you already have: hazard registers, safe work procedures, incident records, training logs.
- Framework implementation — building out hazard identification and risk assessment processes, the hierarchy of controls, worker consultation mechanisms, and emergency preparedness plans, based on how your sites actually operate, not a generic template.
- Internal audit — a full simulated audit before the real one, to catch and close non-conformances while they’re still cheap to fix.
- Certification audit (Stage 1 and Stage 2) — your certification body tests whether the system you’ve documented actually operates in practice, including site visits where relevant.
What it costs
As with any ISO certification, cost splits into two buckets: implementation/consulting (building the management system) and certification body audit fees (paid separately to an accredited certifier like DNV, BSI, or SAI Global). The biggest cost driver isn’t headcount on its own — it’s how hazardous the actual work is and how many sites are in scope. A single-site professional services business with low physical risk costs meaningfully less to certify than a multi-site operation running plant, vehicles, and subcontractors.
We quote fixed-price after a scoping conversation rather than billing hourly, specifically because WHS projects involve a lot of site-specific detail that’s hard to estimate accurately without actually looking at your operation first.
What happens after certification
Like every ISO standard, ISO 45001 runs on a three-year cycle: annual surveillance audits in years one and two, then a recertification audit in year three. The system needs to keep operating in practice — hazard registers updated, incidents investigated, worker consultation genuinely happening — not just exist as a folder of documents from the original certification project.
Getting a real number for your business
Ranges only get you so far. If you want an accurate, fixed-price quote, book a free consultation and we’ll scope it against your actual sites, hazards, and current safety documentation.