ISO 45001 Consulting: What Implementation Involves

ISO 45001 asks you to prove your safety program works, while OSHA asks you to prove it exists. Those are different questions, and the gap between them is where projects stall.

ISO 45001 is the international standard for occupational health and safety management systems. If you have written programs for hazard communication, lockout/tagout, confined space, respiratory protection and forklift operation, you already hold a large share of an ISO 45001 system.

What you probably do not have is the part ISO 45001 really cares about: evidence that the system is managed, measured, reviewed and improved. ISO 45001 also wants evidence that workers were genuinely consulted in building it.

Certification fails on that second half, not on the written programs.

The clause that catches everyone

It is clause 5.4, consultation and participation of workers.

OSHA has nothing like it, and it is the requirement that most often holds a project up. Telling workers what the policy says is not enough. The standard requires established processes for non-managerial workers to take part in identifying hazards, assessing risks, investigating incidents and selecting controls. It also requires you to remove whatever barriers stand in the way of participation.

You cannot produce this in the 2 weeks before a Stage 2 audit, the second stage of the certification audit. It is a trail of records that has to exist over time, and an auditor will ask non-managerial workers directly whether it happened.

Plan for it from the start.

What we do

A gap assessment against ISO 45001:2018, clause by clause, which gives you a prioritized plan to close the gaps and an honest read on what your current OSHA programs already cover.

Hazard identification and risk assessment (clause 6.1.2). Note how this clause is structured: it covers hazard identification (6.1.2.1), assessment of health and safety risks (6.1.2.2), and assessment of health and safety opportunities, or chances to improve (6.1.2.3). Auditors often write up nonconformities against that third part, because a register with risk entries and no opportunity entries answers only half of the clause.

If you have exposure monitoring or noise survey data for your workers, that data is direct evidence for hazard identification and for the effectiveness of your controls (clause 8.1.2). A risk matrix built on judgment meets the clause, but measured data is much stronger evidence. → Air monitoring · Noise surveys

Legal requirements and other requirements (clause 6.1.3). We base the list on the OSHA standards that actually apply to your work, not on a generic list.

Consultation and participation of workers (clause 5.4). We build it as a working routine that leaves records, not as a policy statement.

The hierarchy of controls (clause 8.1.2). The standard requires that the hierarchy be applied, which means documenting why you ruled out eliminating the hazard, and substituting something safer, before you settled on personal protective equipment (PPE). “We issue respirators” is not a control decision. It is the bottom of a hierarchy you have to show you worked down.

Management of change (clause 8.1.3), which is often missing entirely in companies that have never had a formal process for it.

Procurement and contractors (clause 8.1.4), with contractors covered in 8.1.4.2 and outsourced work in 8.1.4.3.

Emergency preparedness and response (clause 8.2). We tie it to the emergency action plans you already have.

Setting up your internal audits and management review (clauses 9.2 and 9.3). An internal audit is your own check on the system, and a management review is the review of the system by top management.

Certification support. We prepare you for Stage 1 and Stage 2 of the certification audit and are on site for it, and afterward we help you close any nonconformities the auditor writes up.

Where the standard stands

ISO 45001:2018 is being revised. ISO lists it at stage 90.92, which means “International Standard to be revised.” The draft, called ISO/DIS 45001, was registered in April 2026 and went to a 12-week ballot in June 2026. The second edition is expected to be published in 2027, and people in the trade already call it ISO 45001:2027.

ISO 14001, the companion environmental standard, has already changed, in April 2026. If you run or plan one integrated management system for both, that is two changes of edition inside roughly 3 years. Sequencing them deliberately costs less than reacting to each one at whichever audit catches you. → The transition to ISO 14001:2026

A note on OHSAS 18001: the deadline to migrate from it passed in September 2021. The exact date was September 11, after a 6-month COVID extension from the original date of March 11, 2021. OHSAS 18001 is withdrawn, and all OHSAS certificates are void. If you still work from OHSAS documents, you are not updating a system. You are implementing one from scratch.

Who does the work

Our angle, stated plainly: we came to ISO 45001 from the regulatory side, not from the management system side. We have done industrial hygiene work, meaning air monitoring and noise surveys, for years, and the management system is the layer we put on top of work we already do.

That matters most in the clause on the hierarchy of controls (8.1.2), where you have to show the hierarchy was actually applied. Showing that you considered engineering controls such as ventilation is much easier when someone can measure whether they worked.

We do not hold an ISO lead auditor certificate, and we will not imply that we do. Consulting does not require one. Auditor competence is a requirement on your certification body, the outside company that audits you and issues the certificate (the requirement is in ISO/IEC 17021-1). That is a separate company doing a separate job.