ISO 45001 Certification for Occupational Health and Safety Management

ISO 45001 is the international standard for occupational health and safety management systems, and itmad provides independent certification against it, conducted in accordance with the principles of ISO/IEC 17021-1. itmad operates across the Middle East, Asia and Europe, using local auditors and a travelling team, and certifies organisations in all industries. Certification follows a two-stage audit and results in a certificate valid for three years, kept current by annual surveillance audits. Last reviewed: October 2026.

ISO 45001 in brief

The standard asks an organisation to identify hazards, to control the risks they create, to consult its workers, and to show that these arrangements actually work. A certificate is independent confirmation that the occupational health and safety management system exists and operates in practice.

Who the standard applies to

ISO 45001 applies to organisations of any size, type and activity. Customers and supplier programmes often ask for independent proof of a health and safety system, and the standard also requires the organisation to identify the legal and other requirements that apply to it and to evaluate its compliance with them.

What auditors examine

• Hazard identificationA systematic search for hazards in routine and non-routine work, including those that come from work organisation, workload and psychosocial factors.
• Risk assessment and controlAssessment of health and safety risks, with controls chosen by the hierarchy of control: elimination first and personal protective equipment last.
• Legal and other requirementsA maintained register of the requirements that apply, with periodic evaluation of whether they are met.
• Worker consultation and participationReal involvement of non-managerial workers in hazard identification, incident investigation and decisions that affect their safety.
• Leadership and safety cultureVisible top management involvement, and a culture in which workers can report hazards without fear of reprisal.
• Contractor and procurement controlThe system extended to contractors, suppliers and outsourced activities that the organisation controls or influences.
• Emergency preparednessEmergency scenarios identified, the response planned, and the plan tested to prove that it works.
• Incident investigationReporting, investigation to root cause rather than immediate cause, corrective action, and verification that the action was effective.
• Monitoring and measurementLeading and lagging indicators, health surveillance where it is required, and calibration of monitoring equipment.
• Internal audit and management reviewEvidence that the organisation audits itself and that senior management acts on the findings.

Worker participation in practice

Consultation is the clause that most often produces findings, and auditors do not assess it by reading a procedure. They ask workers whether they were consulted on the risk assessment for their own task, whether they can stop unsafe work, and what happened the last time someone raised a concern. Arrangements on paper that workers cannot describe do not demonstrate conformity.

How an itmad audit runs

Stage 1 reviews the documented system, confirms scope and boundaries, examines the hazard identification and the register of legal and other requirements, and raises gaps early. Stage 2 assesses the system on site: whether controls operate as documented, whether workers understand and take part, how incidents were really investigated, and whether corrective actions removed the cause.

The certificate cycle

An ISO 45001 certificate from itmad is valid for three years. An audit takes place in each of the two intervening years, and recertification is completed before the certificate expires.

More than one site or standard

The certificate names the activities and locations covered, and a client checking it looks at whether the scope matches the work being bought: a certificate for head-office administration does not cover site operations. Where several sites share a common system, multi-site certification with sampling is usually more economical than separate certificates. ISO 45001 shares its high-level structure with ISO 9001 and ISO 14001, so an integrated audit covers the common clauses once and cuts audit time and disruption.

Independence

ISO/IEC 17021-1 does not allow a certification body to design, implement or consult on the management system that it certifies, and itmad does not. itmad provides the audit and the certification decision and, if wanted, a pre-assessment that identifies gaps against ISO 45001 without telling the organisation how to close them.

What itmad delivers

• A Stage 1 report on readiness gaps, issued before the main audit
• A Stage 2 audit report whose findings rest on objective evidence
• Nonconformities graded by severity, each with a defined response time
• A certificate of registration naming the certified scope and locations
• The certification mark, for use under itmad's mark and seal policy
• Annual surveillance audits and reports across the three-year cycle

Frequently asked questions

Which organisations can be certified to ISO 45001?

ISO 45001 applies to organisations of any size, type and activity, and itmad certifies organisations in all industries. The standard asks the same questions of a small workshop as of a large operator: whether hazards are found, risks controlled and workers involved.

How do auditors assess worker participation?

Auditors ask workers instead of reading a procedure. They ask whether workers were consulted on the risk assessment covering their task, whether workers can stop unsafe work, and what happened the last time someone raised a concern.

What is the difference between Stage 1 and Stage 2?

Stage 1 reviews the documented system, the hazard identification and the register of legal and other requirements, and confirms readiness. Stage 2 assesses on site whether controls operate as documented, whether workers take part, and whether corrective actions closed the cause.

How long does an ISO 45001 certificate last?

An ISO 45001 certificate from itmad is valid for three years. Audits in each of the two intervening years confirm that the system still works, and recertification is completed before expiry.

Can itmad help build the health and safety system?

No. ISO/IEC 17021-1 prevents itmad from designing, implementing or consulting on a system that itmad certifies. itmad offers an optional pre-assessment that identifies gaps against ISO 45001 without prescribing how to close them.

Does a head-office certificate cover site operations?

No. The certificate names the activities and locations covered, and a certificate for head-office administration does not extend to site operations. Several sites under a common system can be certified together with sampling.