ISO 45001: health and safety management certification

ISO 45001 is the international standard for occupational health and safety management systems. The current edition is ISO 45001:2018, which replaced the older OHSAS 18001; the migration period ended in 2021, so a supplier still citing 18001 holds a lapsed standard. Certification means an independent body has audited how you manage health and safety risk: hazard identification, legal compliance, worker consultation, incident investigation, and continual improvement.

ISO 45001 or SSIP: which one do buyers want?

They sit at different levels and are asked for differently.

• SSIP member schemes (CHAS, SafeContractor and similar) are pre-qualification assessments: an annual check that your health and safety arrangements meet a shared set of core criteria. This is the near-universal pass-or-fail requirement on site-based public work.
• ISO 45001 certifies a full management system. It is demanded less often, mostly on larger or higher-hazard contracts, and usually as "ISO 45001 or equivalent".

Holding ISO 45001 will normally satisfy an SSIP-type requirement comfortably, since the SSIP schemes recognise it as strong evidence, but the reverse does not hold. For most small suppliers the sensible order is SSIP first, then ISO 45001 when the size of contract you chase starts asking for it.

How to get it

The certification mechanics match the other ISO management standards:

1. Build the system: policy, hazard identification and risk assessment processes, a register of the legislation that applies to you, worker consultation arrangements, incident reporting and investigation, objectives and internal audits. 2. Choose a UKAS-accredited certification body. 3. Pass the stage 1 and stage 2 audits and close any findings. 4. Maintain it on the three-year cycle with annual surveillance audits.

It is commonly certified alongside ISO 9001 and ISO 14001 as an integrated management system, which shares documentation and audit time across the three.

Cost and time

In the same range as the other ISO standards: an initial certification cost in the low thousands of pounds for a small firm, annual surveillance fees, and three to six months of implementation from a standing start. A firm with a current SSIP assessment is already much of the way there on content (policies, risk assessments, training records), if not on the management-system structure around it, which shortens the build considerably.