What the standard actually requires
ISO 45001 is about whether people are hurt at work, and what your organisation does to stop that happening. Of the standards on this site it is the one where failure has the most immediate human consequence, and it is written accordingly.
The clause structure is the familiar one, with requirements that are specific to this standard:
- Hazard identification and risk assessment. Not only the obvious physical hazards, but how work is organised, social factors, workload, and the hazards created by changes to any of them.
- Legal and other requirements. OH&S law that applies to you, and how you evaluate your compliance with it.
- Consultation and participation of workers. This is the requirement that distinguishes ISO 45001 from every other standard here. Workers — including non-managerial workers — must be consulted and must participate in the OH&S management system, and the organisation must remove obstacles to that participation. An auditor will talk to your people, not only to your managers, and a system that exists entirely in the safety manager’s office will not pass.
- Emergency preparedness and response, and incident investigation — including finding the underlying causes rather than stopping at what the injured person did.
- Procurement, contractors and outsourcing. The people on your site who do not work for you are within the scope of your system.
Do you actually need it?
It is usually worth it when you work in construction, industrial services, manufacturing, logistics or facilities management in the UAE, where it is commonly a condition of prequalification; your clients require it of contractors; your insurers ask; or you have had incidents and need a systematic answer rather than a set of individual fixes.
It is worth saying plainly that a certificate does not make a workplace safe. What it does is make the arrangements visible, consistent and auditable — which, over time, is how workplaces become safer. Organisations that treat it as a document exercise get a document.
What a UMA certificate against ISO 45001 does and does not assert
It asserts that we audited your occupational health and safety management system against ISO 45001:2018, for the scope stated on the certificate, and that on the evidence we saw it conforms.
It does not assert that your workplace is safe, that nobody will be injured, that you comply with occupational health and safety law, or that any regulator has approved your arrangements. A certified organisation can still have an accident. Certification is not a defence, and no competent auditor would present it as one.
How audit time is worked out for this standard
Audit duration for ISO 45001 is determined from the IAF MD 5 occupational health and safety table.
The inputs are the effective number of personnel — including contractors and temporary workers under your control, which for a construction business can be a much larger number than your payroll suggests — and a risk category reflecting the hazards inherent in your sector. High-risk activity attracts more audit time, and it should.
The number of sites matters more here than in almost any other standard, because the work is done at the sites rather than in an office, and a system that works at one location does not automatically work at another. Where ISO 45001 is audited alongside ISO 9001 or ISO 14001, the shared parts of the management system are audited once. We show you the calculation with the quotation.
The cycle
Stage 1, then stage 2, then a certification decision taken by someone who had no part in the audit. Three years, with surveillance in each of the two intervening years — the first due within twelve months of the decision — and recertification before the three years are up.