ISO 45001 Consulting

A management system is the set of documented policies, procedures and routines a company follows. ISO 14001 is the international standard for an environmental management system, and ISO 45001 is the international standard for an occupational health and safety management system.

Both standards ask for the same kinds of things. You set objectives, keep a register of the legal and other requirements that apply to you, check your own system through internal audits, have top management review its performance, and correct what falls short. Most plants already have more of a system in place than they realize, although much of it is not yet documented.

ISO 14001 is not required by law. It is a contractual requirement, written in by a customer, mandated by a parent company or passed down a supply chain. If a single customer's contract is the reason, find out exactly what that customer is asking for before you build anything, because now and then it is less than full certification.

ISO 45001 usually starts the same way, with a customer requirement or a parent company. Sometimes it starts with a general manager who decides the safety program should no longer live in one person's head.

ISO 14001 covers environmental management, and ISO 45001 covers occupational health and safety. Their ten-clause structures are nearly identical, so a large part of the system only has to be built once. You can run one integrated management system and hold two certificates, which is cheaper than certifying each standard on its own.

An integrated system shares one internal audit program, one management review and one document control system. Some elements stay separate. Identifying environmental aspects and identifying safety hazards are different exercises, and the ISO 45001 clause on consultation and participation of workers has no counterpart in ISO 14001. More on running both as one integrated system.

For a first-time implementation at one site, 6 to 12 months is realistic, and it can go faster if you already have a management system running. A gap assessment in the first few weeks turns the project into a dated plan with names on it. Anyone who quotes you a timeline before seeing the plant is guessing.

One part cannot be rushed: the system has to operate long enough to generate the records an auditor will ask for. For ISO 45001, records of worker consultation and participation have to accumulate over time. The schedule also depends far more on your people's availability than on ours. See the timeline, phase by phase.

There are three separate costs: the fees you pay to the certification body (also called a registrar) that audits you and issues the certificate, the cost of any consulting support, and your own team's time. The third is usually the largest, and the easiest to leave out of a budget.

Having more than one site is the single biggest cost driver. Three other factors raise the cost: a complex operation, starting from nothing, and having no staff time to spare. Programs you already run bring it down, and so does a gap assessment before any other work begins. The certification body's audit fees recur on a 3-year cycle, so budget for the whole cycle. More on what drives cost.

Internal staff time is usually the largest cost of the project, and it rarely shows up in a quote. Your team writes procedures, conducts the first internal audits, takes part in the management review, gathers records and answers questions during audits. Most of that load lands on one person, such as your EHS (environmental, health and safety) lead. For a first-time implementation, it is measured in hundreds of hours, not dozens.

If no one has the capacity for that, the project stalls no matter who you hire, and that is the most common reason ISO projects run long. Every hour your team covers is an hour you do not have to buy.

No. SECA does not issue certificates, and no one who builds your system can. The certificate comes from an accredited certification body (also called a registrar), an outside company that audits your system. The rules those bodies operate under prohibit them from certifying a system they consulted on.

So you hire two companies, by design: we prepare you, and they audit and certify. We stay with you through both audit stages and through corrective action on anything the auditor finds. If one provider offers both services in a single package, ask which accredited body signs the certificate and how the impartiality requirement is being met. Why one company cannot do both.

We start at your facility, not in your binder. The first step is a gap assessment, in which we compare your current practice with the standard, clause by clause, to show what is missing. We then build the missing elements, written to match how your plant actually runs and not how a template says a plant runs.

The work includes an internal audit program and a management review. We then prepare you for both stages of the certification audit, stay on site while it takes place, and help you close any nonconformities the auditor raises. See the steps for ISO 14001 and ISO 45001.

The certification audit has two stages. Stage 1 is a readiness review, in which the auditor reviews your documented system and confirms that your internal audits and management review are being planned and carried out. It typically takes 1 day, and findings are normal.

Stage 2 usually follows 2 to 8 weeks later and typically takes 1 to 3 days, or more depending on size and scope. It tests whether the system works in practice, so the auditor examines records, observes the floor and interviews people who are not managers. The certification decision is made by someone outside the audit team, which is why your auditor cannot tell you on the last afternoon that you passed. More on both stages.

The certificate runs on a 3-year cycle. Your certification body returns for a surveillance audit at least once each calendar year, except in recertification years, and the first one must take place no more than 12 months after the date of the certification decision. In year 3 you go through a recertification audit, which is planned to finish before your certificate expires, and then the cycle repeats.

If you let a certificate lapse, you may be starting over, not renewing. Budget for the full 3-year cycle, not only the first invoice.

SECA is a small Arizona firm, and you deal directly with the person who does the work. Ron Fleming has been walking plant floors since 1993. ISO 14001 and ISO 45001 programs are among the areas he works in, and he plans each project himself. His son Marcus has joined the business and is learning it on site with him.

We do not hold an ISO lead auditor credential, and we will not imply that we do. Consulting does not require one. We are based in Arizona and work on site across the United States.

One clause of ISO 45001, which the standard calls consultation and participation of workers, requires genuine participation by non-managerial workers. They take part in identifying hazards, assessing risks, investigating incidents and selecting controls, and you must also remove whatever obstacles keep them from taking part.

OSHA has no comparable requirement, so most plants start from nothing. It also cannot be produced in the two weeks before Stage 2, the second stage of the certification audit, because the auditor will ask people on the floor directly whether it happened. More on worker consultation and participation.

The auditor will interview non-managerial workers without their supervisor present, and the questions are direct. When something in your area was identified as a hazard, were you asked about it? Were you involved in choosing the control? Has anything you raised actually changed?

You cannot coach a plant floor into giving matching answers, because rehearsed answers stand out and prompt the auditor to dig harder. What works is a routine that leaves records, such as a safety committee that keeps minutes and on which non-managerial workers hold the majority. A realistic lead time is 6 to 12 months of running these routines before the Stage 2 certification audit.

A good part of it, yes. Written programs for hazard communication, lockout/tagout, confined space, respiratory protection and forklifts already cover a lot of ISO 45001, and usually more than people expect.

What is normally missing is the evidence. ISO 45001 expects evidence that the management system is measured, reviewed and improved, and that workers were genuinely consulted in building it. Certification stalls on that half, not on the written programs. OSHA asks you to show that your safety program exists, while ISO 45001 asks you to show that it works.

Eventually, but not yet. ISO 45001:2018 is the current edition, and it is the one you would certify to today. A revision is in progress: the draft went to a 12-week ballot in June 2026, and the new edition is expected in 2027. So no transition is pending for this standard right now.

If you also run ISO 14001, which was revised in April 2026, that makes two transitions inside roughly 3 years. Planning their sequence deliberately is cheaper than reacting to each one at whichever audit happens to catch it.

Not as an update, because the deadline to migrate from OHSAS 18001 passed in September 2021. The exact date was September 11, after a 6-month COVID extension from the original date of March 11, 2021. OHSAS 18001 has been withdrawn, and all OHSAS certificates are void.

If you are still working from OHSAS documents, you are therefore implementing ISO 45001 from scratch. A gap assessment in the first few weeks shows what already exists, and most plants find they have more of a management system than they expected.

If you already run ISO 14001 well, much of ISO 45001 is already in place, because you have the structure, the internal audits and the management review. Adding the occupational health and safety side is usually a smaller job than people fear. We will say so, and we will not quote you a start-from-scratch project.

The same applies if you have a capable safety manager with time available, when the right answer is sometimes a gap assessment and a model to follow. Even with ISO 14001 in place, worker consultation and participation is new work, because that clause has no counterpart in ISO 14001.