ISO 45001 Implementation Guide: The 10-Step Roadmap for 2026

Leadership Commitment and Project Scope

ISO 45001 puts leadership at the centre of the system in Clause 5, for good reason. Without visible, genuine commitment from senior leadership, every subsequent step is undermined. Before any gap analysis or documentation begins, put four things in place: an OH&S Policy set by top management (Clause 5.2); responsibilities and authorities assigned by top management, including for making sure the system conforms to the standard and for reporting on its performance (Clause 5.3); a defined scope — which sites, activities and worker groups are in or out (Clause 4.3); and an initial budget and timeline approved at senior level.

The standard does not require a “management representative” by that title. Naming one OH&S management system lead with real authority, time and resources is still good practice — it is a recommendation, not a clause.

The scope decision deserves particular attention. Certification applies to a defined scope — “all manufacturing operations at [Site], including on-site contractors” is a scope. Getting this right at the start prevents expensive re-scoping later. Typical timeline: 2–4 weeks.

Gap Analysis Against ISO 45001:2018

A formal gap analysis compares your current practices against the 10 clauses of ISO 45001. It is one of the most valuable investments in the project — a weak gap analysis wastes effort on areas already compliant and leaves blind spots where you weren’t.

The analysis should cover every clause and produce a prioritized action register. In EHS platforms, audit and corrective-action modules can hold the analysis and track the actions it produces: Intelex lists audit management and CAPA applications, and Ideagen’s quality management software, which now includes Ideagen Q-Pulse, covers CAPAs and audits. Whether a ready-made ISO 45001 assessment template is included depends on the module and configuration, so check with the vendor. Clauses that deserve particular attention, because they ask for evidence that informal practice rarely leaves behind:

• Clause 4.1–4.2 — context of the organization and interested parties (check that the analysis exists in writing)
• Clause 6.1 — hazard identification and risk assessment (check that the method and results are documented, as the clause requires)
• Clause 7.4 — communication (check that you can show what is communicated, to whom and when)
• Clause 9.1 — performance monitoring (check that leading as well as lagging indicators are defined and tracked)
• Clause 10.2 — incident investigation with root-cause analysis (check for root-cause investigation, not only incident reporting)

Typical timeline: 2–4 weeks. Cost: internal resource (best) or consultant (indicatively £3–8K for a single site).

Hazard Identification, Risk Assessment and Legal Register

Clause 6.1 requires a systematic, documented approach to identifying hazards and assessing risks. For many organizations, this is the largest body of work in the implementation.

Your hazard identification must cover routine and non-routine activities, emergency situations, the activities of contractors, visitors and neighbours, past incidents and near-misses, and changes to processes, facilities or workforce. Clause 6.1.3 requires organizations to determine applicable legal and other requirements, maintain access to current information about them, and maintain and retain documented information on them. A legal register is a common way to organize these requirements, but ISO 45001 does not prescribe that specific document format. Keep the information current and establish a defined review process.

Risk assessments should suit your sector: a consequence-likelihood matrix for manufacturing, RAMS (Risk Assessment and Method Statements) for construction, clinical risk methodology for healthcare. Our free Risk Assessment Template provides the 5×5 matrix, the hierarchy of controls and residual-risk scoring aligned to Clause 6.1.

Typical timeline: 4–12 weeks depending on complexity.

Objectives, Targets and the KPI Framework

Clause 6.2 requires documented OH&S objectives that are measurable, monitored, communicated and updated. This is where your KPI framework becomes essential — and where the strongest programs pair leading indicators (proactive measures of what you’re doing) with lagging indicators (reactive measures of what has happened). Track only lagging indicators and you are managing by the rearview mirror.

Example targets for a mid-sized site, to adapt to your size, risk profile and baseline. ISO 45001 sets no numeric targets; Clause 6.2 asks for objectives that are measurable where practicable.

The 200,000-hour base is the US convention — 100 full-time workers × 40 hours × 50 weeks; 1,000,000 hours is the common base outside the US. Compare only rates that use the same case categories, the same counting rules and the same hours base.

The HSE KPI Dashboard includes all of these formulas pre-built, with the denominator logic built in. Typical timeline: 2–3 weeks to establish; ongoing thereafter.

OHSMS Documentation Structure

ISO 45001 requires documented information at specific points but deliberately avoids prescribing a format or volume — you need what is necessary for the effectiveness of the OHSMS, meaning the right amount of documentation, not the maximum. Mandatory documented information includes:

• OHSMS scope (4.3); OH&S Policy (5.2); roles, responsibilities and authorities (5.3)
• Hazard identification methodology (6.1.1); documented information on applicable legal and other requirements (6.1.3); OH&S objectives and plans (6.2)
• Worker competency evidence (7.2); operational controls (8.1); emergency procedures (8.2)
• Performance monitoring results and equipment calibration/maintenance records (9.1, 9.1.1)
• Internal audit programme and results (9.2); management review outputs (9.3)
• Incident investigation records and corrective action records (10.2)

EHS platforms can reduce the documentation burden by recording evidence as the work is done: Mitti (by SafetyCulture) turns checklists into inspection workflows and turns photos or voice notes into actionable issues that teams can track to close-out, and Ideagen lists document control among its quality management solutions. What each tool records depends on the modules and configuration you use. Typical timeline: 6–10 weeks initially; refined throughout.

Operational Controls and Safe Systems of Work

Clause 8.1 requires operational controls for the risks identified in Step 3, applying the hierarchy of controls (Clause 8.1.2). In practice that means defined safe-work procedures, permit-to-work systems where the work calls for them, and documented hierarchy-of-controls decisions for significant hazards. The hierarchy, in preferred order:

Expect assessors to ask how you apply the hierarchy. A risk assessment that jumps straight to “PPE required” for a significant hazard, with no evidence that higher-order controls were considered, generates an audit finding. For contractor management — a common audit focus — document how contractors are selected for safety competence, inducted, permitted, supervised, and how their incidents are captured and investigated.

Training, Competence and Awareness

Clauses 7.2–7.3 require workers to be competent to work safely and aware of their contribution to OH&S objectives. Competence means the right knowledge, skills and experience — not just attendance at a session. Build a competency matrix mapping each role to its safety-competency requirements, the evidence of competency per worker, and the expiry/renewal dates for time-limited certifications (first aid, confined space, LOLER).

Awareness means workers understand the policy, their specific hazards and controls, what to do if an incident occurs, and how to report a near-miss or hazard — evidenced through toolbox-talk records, induction sign-off and communication logs.

Emergency Preparedness and Response

Clause 8.2 requires documented emergency plans for credible scenarios: fire, major injury, chemical release, power failure, evacuation of mobility-impaired workers, and others specific to your operations. Each scenario needs a defined response procedure, named roles, communication contacts (emergency services, regulators, next of kin), and a drill schedule. Crucially, the standard requires that arrangements are tested — and that the test results and any corrective actions are documented.

Internal Audit and Management Review

These are the two self-assessment mechanisms that prove your OHSMS is working and improving — not merely documented and dormant.

Internal audit (Clause 9.2): a planned programme checking that the OHSMS conforms to ISO 45001 and to your own requirements, and is effectively implemented. Auditors must be competent and objective — for example, not auditing their own work. Results feed directly into management review.

Management review (Clause 9.3): a formal senior-leadership review at planned intervals covering the status of prior actions, changes in context and interested parties, OH&S performance data, audit results, incident trends, consultation outcomes and improvement opportunities. Outputs must be documented and followed up.

The standard leaves the frequency of management review to you, as long as reviews happen at planned intervals. Monthly safety-committee meetings with documented minutes can feed ongoing monitoring and the review’s inputs, but they do not automatically replace management review: that requires top management to review every input Clause 9.3 lists and to record its decisions. Findings that emerge here should flow into a tracked corrective-action system — our CAPA Tracker handles that close-out loop, and platforms like Intelex and Cority generate management-review packs directly from OHSMS data.

Certification Audit

ISO 45001 certification is conducted by an accredited third-party certification body (CB) — LRQA, BSI, Bureau Veritas, SGS, NQA and others — in two stages:

Stage 1 (document review): the auditor reviews your OHSMS documentation, on-site or remotely, to confirm readiness for Stage 2. Under ISO/IEC 17021-1, the standard certification bodies work to, Stage 1 also evaluates whether internal audits and management review are being planned and performed. Stage 1 findings, including any areas of concern that could be classified as nonconformities at Stage 2, are documented and communicated to you. The interval before Stage 2 should leave time to resolve them, and depending on the nature of the findings, the certification body decides whether Stage 2 goes ahead as planned or is postponed.

Stage 2 (implementation audit): the auditor visits the site, interviews workers at all levels, observes operations, and samples evidence against the ISO 45001 clauses. Any Major non-conformity (a systemic failure) must be corrected before certification is granted; Minor non-conformities are corrected within an agreed timeframe afterward.

Once certified, surveillance audits occur at least once a year, with a full recertification audit before the three-year certificate expires, under ISO/IEC 17021-1. Use our EHS Audit Checklist (ISO 45001 + OSHA) to run a dry-run internal audit before the CB arrives.