What Is ISO 45001:2018?<\/h2>\n\n\n\n ISO 45001:2018 is the international standard for Occupational Health and Safety Management Systems, published by the International Organization for Standardization. It replaced the earlier OHSAS 18001 standard, which organisations transitioned away from over a migration period that concluded several years ago, making ISO 45001:2018 the current global benchmark for occupational health and safety management.<\/p>\n\n\n\n
The standard provides a framework that enables an organisation to proactively identify and control health and safety risks, reduce the potential for workplace accidents and ill health, comply with applicable legal and regulatory requirements, and continually improve its safety performance. Like other modern ISO management system standards, ISO 45001:2018 follows the Annex SL high-level structure, the common framework shared across ISO 9001, ISO 14001, and ISO 27001, which makes it considerably easier for organisations already certified to one of these standards to integrate occupational health and safety management into an existing management system rather than building an entirely separate structure.<\/p>\n\n\n\n
The standard is built around the Plan-Do-Check-Act cycle: planning the occupational health and safety management system based on identified risks and opportunities, implementing the planned controls and processes, checking performance through monitoring, measurement, and audit, and acting to continually improve the system based on what those checks reveal.<\/p>\n\n\n\n
Why ISO 45001:2018 Matters for Indian Businesses<\/h2>\n\n\n\nReducing Workplace Risk Systematically<\/h3>\n\n\n\n The core value of ISO 45001:2018 is that it requires an organisation to move from reactive safety management, responding to incidents after they occur, to proactive risk management, identifying hazards and implementing controls before incidents happen. For manufacturing facilities, construction sites, warehousing operations, and any business with significant physical operations, this shift has direct value in reducing accident rates, lost work time, and the associated human and financial costs of workplace injuries.<\/p>\n\n\n\n
Tender and Contract Eligibility<\/h3>\n\n\n\n A growing number of government tenders, particularly for infrastructure, construction, and public works contracts, specify ISO 45001:2018 certification as an eligibility or scoring criterion for bidders. Large enterprise clients in manufacturing, EPC contracting, and logistics increasingly require their vendors and subcontractors to hold the certification as part of vendor qualification and ongoing supplier audits. For businesses competing for this category of work, certification is increasingly a practical commercial necessity rather than a purely voluntary quality initiative.<\/p>\n\n\n\n
Legal and Regulatory Alignment<\/h3>\n\n\n\n While ISO 45001:2018 certification itself is voluntary under Indian law, the systematic risk assessment and control framework it requires supports compliance with India’s occupational safety legislation, including the Occupational Safety, Health and Working Conditions Code, 2020, and sector-specific safety regulations applicable to factories, construction sites, and other workplaces. Organisations that have implemented ISO 45001:2018 are generally better positioned to demonstrate compliance during regulatory inspections, since the documentation and risk assessment records required by the standard substantially overlap with what regulators expect to see.<\/p>\n\n\n\n
Insurance and Investor Considerations<\/h3>\n\n\n\n Insurers increasingly factor an organisation’s safety management maturity into premium calculations for workplace liability and related coverage, and ISO 45001:2018 certification provides a recognised, third-party-verified indicator of that maturity. Institutional investors and private equity firms conducting due diligence on manufacturing and infrastructure businesses increasingly review occupational health and safety management as part of their environmental, social, and governance assessment, and certification provides concrete, auditable evidence in this area.<\/p>\n\n\n\n
Key Requirements of ISO 45001:2018<\/h2>\n\n\n\n The structure of ISO 45001:2018 follows ten clauses, with Clauses 4 through 10 setting out the substantive requirements an organisation’s management system must satisfy.<\/p>\n\n\n\n
Context of the Organisation (Clause 4)<\/h3>\n\n\n\n The organisation must determine the internal and external issues relevant to its purpose that affect its ability to achieve the intended outcomes of its occupational health and safety management system, identify the needs and expectations of workers and other interested parties, and define the scope of the management system clearly, including which sites, activities, and worker categories are covered.<\/p>\n\n\n\n
Leadership and Worker Participation (Clause 5)<\/h3>\n\n\n\n ISO 45001:2018 places a strong emphasis on top management leadership and accountability for occupational health and safety, requiring demonstrated commitment rather than delegation of the entire function to a safety officer disconnected from senior decision-making. The standard also places significant emphasis on worker participation and consultation, requiring organisations to establish processes through which workers, including non-managerial workers, are consulted on matters affecting their health and safety and participate in hazard identification, incident investigation, and the development of policies and objectives. This worker participation requirement is one of the more distinctive features of ISO 45001:2018 compared to its predecessor standard.<\/p>\n\n\n\n
Planning: Hazard Identification and Risk Assessment (Clause 6)<\/h3>\n\n\n\n This is the analytical core of the standard. The organisation must establish a process for the ongoing identification of hazards, taking into account routine and non-routine activities, situations including emergencies, human factors, and how work is actually organised. Based on identified hazards, the organisation assesses occupational health and safety risks and opportunities, determines applicable legal and other requirements, and establishes documented objectives and plans to achieve them. This planning stage also requires the organisation to identify opportunities to eliminate hazards and reduce risks, following a defined hierarchy of controls: eliminating the hazard, substituting with less hazardous processes or materials, implementing engineering controls, implementing administrative controls, and using personal protective equipment as the last line of defence.<\/p>\n\n\n\n
Support (Clause 7)<\/h3>\n\n\n\n The organisation must determine and provide the resources needed for the management system, ensure the competence of workers whose work affects occupational health and safety performance, ensure awareness of the safety policy and relevant hazards among all workers, establish appropriate internal and external communication processes, and maintain documented information required by the standard and necessary for the effectiveness of the management system.<\/p>\n\n\n\n
Operation (Clause 8)<\/h3>\n\n\n\n The organisation must plan, implement, and control the processes needed to meet its occupational health and safety management system requirements, including establishing controls based on the hierarchy of controls identified at the planning stage, managing change in a way that controls associated risks, managing procurement and contractors to ensure their activities do not introduce unacceptable risk, and establishing emergency preparedness and response procedures.<\/p>\n\n\n\n
Performance Evaluation (Clause 9)<\/h3>\n\n\n\n The organisation must monitor, measure, analyse, and evaluate its occupational health and safety performance, conduct internal audits at planned intervals to determine whether the management system conforms to the organisation’s own requirements and to the requirements of the standard, and conduct management reviews at planned intervals to ensure the continuing suitability, adequacy, and effectiveness of the system.<\/p>\n\n\n\n
Improvement (Clause 10)<\/h3>\n\n\n\n The organisation must determine opportunities for improvement and implement necessary actions, react to incidents and nonconformities by taking action to control and correct them, evaluate the need for action to eliminate the causes of nonconformities, and continually improve the suitability, adequacy, and effectiveness of the occupational health and safety management system.<\/p>\n\n\n\n
The Certification Process: Step by Step<\/h2>\n\n\n\nStep One: Gap Analysis<\/h3>\n\n\n\n Before formal implementation begins, most organisations conduct a gap analysis comparing their current occupational health and safety practices against the requirements of ISO 45001:2018. This identifies what is already in place, what needs to be developed, and what the realistic scope and timeline for implementation should be. A thorough gap analysis at this stage prevents the implementation project from being either underscoped, missing requirements that surface as problems during the certification audit, or overscoped, spending time and resources building documentation and controls beyond what the organisation’s actual risk profile requires.<\/p>\n\n\n\n
Step Two: Define the Scope of the Management System<\/h3>\n\n\n\n The organisation determines which parts of the business, which sites, and which activities will be covered by the ISO 45001:2018 management system. For an organisation with multiple locations or business lines with materially different risk profiles, this scoping decision affects the complexity and cost of implementation and should be made deliberately rather than defaulting to either the narrowest or broadest possible scope without analysis.<\/p>\n\n\n\n
Step Three: Conduct Hazard Identification and Risk Assessment<\/h3>\n\n\n\n Working from the defined scope, the organisation conducts a systematic hazard identification exercise across its operations, covering routine activities, non-routine activities, and emergency scenarios. For each identified hazard, the associated risk is assessed and prioritised, and the organisation determines what controls are needed, following the hierarchy of controls principle of eliminating or substituting hazards where possible before relying on administrative controls or personal protective equipment.<\/p>\n\n\n\n
Step Four: Develop the Management System Documentation<\/h3>\n\n\n\n Based on the risk assessment, the organisation develops the required documentation: the occupational health and safety policy, defined roles and responsibilities, risk assessment records, legal and other requirements register, objectives and plans for achieving them, operational control procedures, emergency preparedness and response procedures, and the records required to demonstrate that the system is operating as documented, including training records, incident records, and audit and management review records.<\/p>\n\n\n\n
Step Five: Implement the Management System and Train Personnel<\/h3>\n\n\n\n The developed policies, procedures, and controls are implemented across the organisation, and personnel at all levels are trained on their roles and responsibilities under the new or updated management system. Worker participation mechanisms, such as safety committees or consultation processes, are established and made operational, not merely documented on paper.<\/p>\n\n\n\n
Step Six: Conduct an Internal Audit<\/h3>\n\n\n\n Before the external certification audit, the organisation conducts an internal audit to verify that the management system is functioning as documented and conforms to the requirements of ISO 45001:2018. This internal audit, conducted either by trained internal personnel or by an external consultant acting in an internal audit capacity, identifies nonconformities and gaps that can be corrected before the formal certification audit, significantly reducing the risk of major nonconformities being raised during the external assessment.<\/p>\n\n\n\n
Step Seven: Conduct a Management Review<\/h3>\n\n\n\n Top management reviews the performance of the occupational health and safety management system, including audit results, incident data, progress against objectives, and the adequacy of resources allocated to the system. This review demonstrates the leadership engagement that ISO 45001:2018 requires and produces a documented record that the certification auditor will expect to see.<\/p>\n\n\n\n
Step Eight: Stage One Certification Audit<\/h3>\n\n\n\n The organisation engages an accredited certification body to conduct the formal certification audit, which is typically structured in two stages. The Stage One audit is a documentation review: the certification body’s auditor reviews the organisation’s management system documentation to confirm that it addresses the requirements of the standard and to assess the organisation’s readiness for the more detailed Stage Two audit. The auditor also uses Stage One to plan the focus areas and timing of Stage Two.<\/p>\n\n\n\n
Step Nine: Stage Two Certification Audit<\/h3>\n\n\n\n The Stage Two audit is the substantive on-site assessment, where the auditor verifies that the management system is not only documented but actually implemented and operating effectively. This involves site visits, interviews with workers at various levels, observation of actual work practices against documented procedures, and review of records demonstrating that controls, training, incident management, and audit processes are genuinely functioning as required. Where the auditor identifies nonconformities, these are categorised as major or minor, and the organisation must address them within a specified timeframe before certification is granted.<\/p>\n\n\n\n
Step Ten: Certification and Ongoing Surveillance<\/h3>\n\n\n\n Once the organisation has satisfactorily addressed any nonconformities identified during Stage Two, the certification body issues the ISO 45001:2018 certificate, generally valid for three years. During this three-year period, the certification body conducts periodic surveillance audits, typically annually, to confirm that the management system continues to operate effectively. At the end of the three-year cycle, a recertification audit is required to renew the certificate.<\/p>\n\n\n\n
Documentation Required for ISO 45001:2018<\/h2>\n\n\n\n Several categories of documented information are mandatory under ISO 45001:2018 and form the evidentiary backbone that auditors examine during certification and surveillance audits. These include the defined scope of the occupational health and safety management system, the occupational health and safety policy, documented objectives and plans for achieving them, records of hazard identification and risk assessment, the register of applicable legal and other requirements, evidence of worker consultation and participation, competence and training records, records of internal communication and, where applicable, external communication, operational control procedures, emergency preparedness and response procedures and records of testing them, internal audit programme and audit reports, management review records, and records of incidents, nonconformities, and corrective actions taken.<\/p>\n\n\n\n
Organisations should build their documentation around what is genuinely useful for managing safety risk in their specific operations rather than treating documentation as a checklist exercise disconnected from how the business actually operates. Auditors are generally more concerned with whether the documentation reflects real, functioning practices than with documentation volume.<\/p>\n\n\n\n
Choosing a Certification Body<\/h2>\n\n\n\n ISO 45001:2018 certification should be obtained from a certification body accredited by a recognised accreditation authority, such as the National Accreditation Board for Certification Bodies in India, or an equivalent body recognised under the International Accreditation Forum’s multilateral recognition arrangement, such as UKAS, ANAB, or JAS-ANZ. Certification from an unaccredited body may not be recognised by tender authorities, enterprise clients, or international partners who specifically require accredited certification as part of their vendor qualification criteria.<\/p>\n\n\n\n
When evaluating certification bodies, businesses should confirm the body’s accreditation status and scope, its experience certifying organisations in the relevant industry sector, the qualifications and experience of the auditors who will conduct the assessment, and the body’s track record and reputation among other organisations in the sector. A lower-cost certification body that lacks genuine accreditation or sector experience can result in a certificate that does not carry weight with the clients, tender authorities, or partners the certification was meant to satisfy.<\/p>\n\n\n\n
Timeline and Cost<\/h2>\n\n\n\n The implementation timeline for ISO 45001:2018 certification varies considerably depending on the organisation’s size, the complexity and risk profile of its operations, and how mature its existing safety practices are at the outset. For a small to mid-sized organisation with a relatively straightforward operational risk profile and a focused commitment to the implementation project, the process from gap analysis through to certificate issuance typically takes a small number of months. For larger organisations with multiple sites, complex operations, or higher inherent risk (such as heavy manufacturing, construction, or chemical processing), the implementation and certification timeline is correspondingly longer, often extending to the better part of a year when accounting for the time needed to build genuine operational maturity rather than documentation alone.<\/p>\n\n\n\n
Certification costs depend on factors including the size of the organisation, the number of sites and employees covered by the scope, the complexity and risk level of the operations, whether external consulting support is engaged for gap analysis and implementation, and the certification body’s fee structure, which itself varies based on the number of audit days required to assess the defined scope. Organisations should obtain quotations from multiple accredited certification bodies and should budget separately for implementation support (if external consultants are engaged) and the certification body’s audit fees, which are distinct cost components.<\/p>\n\n\n\n
Common Mistakes That Delay or Complicate Certification<\/h2>\n\n\n\n Several patterns recur consistently among organisations pursuing ISO 45001:2018 certification and are worth addressing proactively.<\/p>\n\n\n\n
Treating the implementation as a documentation exercise disconnected from actual operational practice is the most common and most damaging mistake. Auditors during Stage Two specifically probe whether documented procedures match what workers actually do and understand, and a gap between paper and practice is one of the most frequent sources of nonconformities.<\/p>\n\n\n\n
Underinvesting in worker consultation and participation, treating it as a formality rather than building genuine mechanisms through which workers contribute to hazard identification and safety decision-making, is a frequent source of findings, since this is one of the areas ISO 45001:2018 specifically emphasises relative to predecessor standards.<\/p>\n\n\n\n
Conducting a superficial hazard identification exercise that misses non-routine activities, emergency scenarios, or the way work is actually organised in practice (as distinct from how it is formally described) results in a risk assessment that does not capture the organisation’s genuine risk profile, undermining the value of the entire system regardless of how well-documented it appears.<\/p>\n\n\n\n
Failing to secure genuine top management engagement, leaving the entire occupational health and safety function to a safety officer without visible senior leadership involvement in policy-setting, objective review, and management review meetings, is inconsistent with the leadership requirements of Clause 5 and is readily apparent to an experienced auditor during Stage Two interviews.<\/p>\n\n\n\n
![\"ISO](\"http:\/\/quickstartupindia.com\/blog\/wp-content\/uploads\/2026\/06\/ISO-45001-2018-img-1024x576.png\" "\\"\\"")