Confirming that your OHSMS is ready for certification
Once your Occupational Health and Safety Management System has been implemented and is working in practice, the next step is independent ISO 45001 certification.
Certification is the process through which an external certification body assesses whether your management system meets the requirements of ISO 45001:2018 and is effectively implemented across the agreed certification scope.
The certification journey typically includes confirming your readiness, selecting an appropriate certification body, agreeing the certification scope, completing Stage 1 and Stage 2 audits, addressing any nonconformities and progressing through the certification decision.
Certification does not end when the certificate is issued. Surveillance audits continue throughout the certification cycle, followed by recertification at the end of the cycle.
The external audit should not be the first time anyone seriously tests whether the management system works. Before the certification body arrives, your organisation should already have implemented its occupational health and safety controls, conducted an internal audit, completed management review and addressed significant weaknesses.
Implementation builds the system. Certification independently verifies it.
Confirming that your OHSMS is ready for certification
Selecting an appropriate independent certification body
Confirming the certification scope
Certification is the process through which an external certification body assesses whether your management system meets the requirements of ISO 45001:2018 and is effectively implemented across the agreed certification scope.
Once your Occupational Health and Safety Management System has been implemented and is working in practice, the next step is independent ISO 45001 certification.
Before the certification body arrives, your organisation should already have implemented its occupational health and safety controls, conducted an internal audit, completed management review and addressed significant weaknesses.
The exact process and timing depend on the certification body and your organisation.
ISO 45001 certification is independent confirmation that an organisation has implemented an Occupational Health and Safety Management System that meets the applicable requirements of ISO 45001.
The current published standard is ISO 45001:2018, together with its 2024 climate-action amendment.
ISO 45001 certification is generally voluntary.
However, organisations may pursue certification because:
Certification does not mean that workplace risk has been eliminated.
Nor does it mean incidents can never occur.
It demonstrates that an independent certification body has assessed the management system used to identify hazards, manage OH&S risks, involve workers, monitor performance and continually improve.
An independent certification body issues ISO 45001 certification.
ISO develops and publishes the standard.
It does not certify individual organisations.
An ISO consultant also does not issue the certificate.
The roles are different.
Helps your organisation:
Independently:
ISO Specialist South Africa supports implementation and certification readiness.
The independent certification body makes the certification decision.
Keeping these functions separate protects the credibility of certification.
SANAS, the South African National Accreditation System, is South Africa's national accreditation body.
SANAS does not directly certify individual organisations against ISO 45001.
Instead, it accredits certification bodies for defined scopes.
A certification body's accreditation provides formal recognition that it is competent to perform specified conformity-assessment activities.
When ISO 45001 certification matters for:
it is important to understand what accreditation the certification body holds and whether the relevant scope covers the certification service being offered.
Do not assume that every company selling an "ISO certificate" has equivalent standing.
Before applying for certification, make sure the Occupational Health and Safety Management System has actually been implemented.
Your organisation chooses the independent certification body that will conduct the certification process.
The certification body needs information about your organisation to determine the audit programme.
The Stage 1 audit is the first formal certification stage.
Where Stage 1 identifies issues requiring attention, address them before proceeding.
Stage 2 is the main certification assessment.
When a nonconformity is raised, avoid reacting only to the immediate evidence.
Certification is not normally granted by the auditor simply announcing:
Following a positive certification decision, the certification body issues the ISO 45001 certificate.
Once certified, the organisation must continue operating its OHSMS.
At the end of the certification cycle, the organisation undergoes recertification.
Before applying for certification, make sure the Occupational Health and Safety Management System has actually been implemented.
Your organisation should normally be able to demonstrate that:
A certification auditor needs evidence.
A procedure saying an inspection occurs monthly is not enough.
There should be evidence that the inspections actually happen, findings are addressed and the process is effective.
Before booking the external audit, ask:
If not, additional implementation may still be required.
Your organisation chooses the independent certification body that will conduct the certification process.
Consider more than the initial audit price.
Factors worth evaluating include:
If ISO 45001 is being pursued because of a tender or customer requirement, check exactly what is expected.
For example:
Clarifying this before selecting the certification body can prevent expensive problems later.
The certification body needs information about your organisation to determine the audit programme.
This may include:
This information affects:
The scope ultimately tells customers what the certified management system covers.
Consider a contractor whose actual business is construction and engineering.
A certificate scoped only around:
"Administrative activities at head office"
may not satisfy a customer expecting the organisation's construction operations to be covered.
The certification scope should align with:
Get this right before the audit programme is finalised.
The Stage 1 audit is the first formal certification stage.
Its primary purpose is to evaluate whether the organisation appears sufficiently ready for the detailed Stage 2 assessment.
The auditor may review areas such as:
The exact approach depends on the certification body and organisation.
Fundamentally:
The auditor needs confidence that Stage 2 can meaningfully evaluate implementation.
For example, if:
the organisation may not be genuinely ready for Stage 2.
Do not view Stage 1 as an inconvenience that needs to be passed as quickly as possible.
It can identify readiness weaknesses before the main certification audit.
That gives the organisation an opportunity to fix problems before the more extensive Stage 2 assessment.
Where Stage 1 identifies issues requiring attention, address them before proceeding.
Potential issues could include:
Do not simply produce more documents to make the issue disappear.
Ask:
Then correct that.
Stage 2 is the main certification assessment.
This is where the auditor determines whether the Occupational Health and Safety Management System has been effectively implemented in practice.
The auditor will generally use a combination of:
Stage 2 should feel very different from a desk-based document review.
The auditor needs to see how occupational health and safety is actually managed.
When a nonconformity is raised, avoid reacting only to the immediate evidence.
Use the finding to improve the system.
A structured response may involve:
The auditor finds that a scheduled machinery inspection was not completed.
Correction:
Complete the missed inspection.
But the organisation then investigates why it happened.
Perhaps:
Corrective action addresses that underlying problem.
That is much stronger than simply completing the missing form.
Certification is not normally granted by the auditor simply announcing:
"You passed."
Following the assessment and appropriate closure of findings, the certification body completes its certification review and decision process.
This supports impartiality.
Where applicable certification requirements have been satisfactorily met, certification can be granted.
Following a positive certification decision, the certification body issues the ISO 45001 certificate.
The certificate normally identifies information such as:
The certificate should be reviewed carefully once issued.
Check:
This matters particularly where customers or tenders will rely on the certificate.
A certificate saying only:
"ISO 45001 certified"
does not tell the customer what activities are actually covered.
The scope does.
Once certified, the organisation must continue operating its OHSMS.
The certification body periodically conducts surveillance audits.
These audits may review areas such as:
Surveillance confirms that the management system has not disappeared after initial certification.
Some management systems fall into this pattern:
Auditor coming → update everything → survive audit → ignore system → repeat next year.
That is exactly what ISO 45001 should avoid.
The OHSMS should operate continuously because the workplace risks operate continuously.
At the end of the certification cycle, the organisation undergoes recertification.
Recertification provides a broader assessment of whether the Occupational Health and Safety Management System remains suitable and effective and whether certification should continue into a new cycle.
The organisation should be able to demonstrate that its management system has evolved as the business has changed.
Changes might include:
A static OHSMS becomes outdated quickly.
The auditor will evaluate whether the management system works across the certification scope.
This can include whether:
The auditor will not only ask:
"Do you have a risk assessment?"
They may ask:
"Show me how this hazard was identified."
"Why was this control selected?"
"How do workers participate?"
"Show me evidence the control works."
"What happened after the last incident?"
That difference is important.
The exact schedule varies, but a Stage 2 audit may include several activities.
The certification auditor explains:
Top management may be asked about:
Management needs to demonstrate ownership.
The safety officer cannot answer every leadership question on management's behalf.
Auditors generally need to observe actual work.
Depending on the organisation, that could include:
Employees may be asked about:
Employees do not need to memorise ISO 45001 clause numbers.
They should understand how to work safely and how the management system affects their role.
The auditor may review evidence such as:
At the end of the audit, findings and next steps are explained.
A nonconformity exists where an applicable requirement has not been fulfilled.
Examples might include:
The certification body determines how findings are classified under its procedures.
Not necessarily.
An audit finding means the organisation needs to address an identified gap.
The effect on certification depends on factors such as:
Significant unresolved nonconformities can prevent certification from being granted until they have been appropriately addressed.
Management-system certification generally operates through a three-year certification cycle.
Certification is not simply issued and left untouched for three years.
Surveillance audits take place during the cycle to confirm that the management system continues to meet certification requirements.
Towards the end of the cycle, recertification takes place.
A typical pattern is:
Initial certification → surveillance → surveillance → recertification
The exact schedule should always be confirmed with the certification body.
There is no universal certification timeframe.
The external certification process depends on factors such as:
Importantly:
The time needed to build and operate the OHSMS.
The time required for the independent external audit and certification decision.
This distinction matters for organisations pursuing certification because of a tender deadline.
Starting the process shortly before the required certificate date creates risk.
The certification-body cost is separate from the implementation cost unless expressly stated otherwise in a quotation.
Certification fees can be affected by:
There are also ongoing certification-cycle costs.
These can include:
For a full cost breakdown, see ISO 45001 Certification Cost in South Africa.
ISO 45001 certification can become commercially important where tenders, clients or contractors require evidence of a certified Occupational Health and Safety Management System.
If certification is being pursued for a tender, check the exact wording.
Important questions include:
Do not assume.
Tender requirements vary.
Suppose a tender is for civil construction.
If your certificate covers only:
"Corporate administration services"
that certificate may not demonstrate that the relevant construction activities are within the certified OHSMS.
Certification should solve the commercial requirement you actually have.
ISO 45001 certification and compliance with South African occupational health and safety legislation are related but different.
ISO 45001 is an international management-system standard.
The Occupational Health and Safety Act and applicable regulations create legal duties for organisations within their scope.
ISO 45001 helps create a structured process for:
But certification does not replace:
Nor should an ISO 45001 certificate automatically be interpreted as proof that every South African OH&S legal requirement has been satisfied.
Where organisations operate an Integrated Management System, certification can potentially be coordinated across:
These systems share management-system elements such as:
An integrated external audit may therefore reduce unnecessary duplication.
The discipline-specific requirements remain distinct.
For example, an integrated audit of contractor management could consider:
ISO 9001: contractor quality controls
ISO 14001: contractor environmental controls
ISO 45001: contractor occupational health and safety controls
The certification body determines the actual integrated audit programme and any resulting efficiencies.
The audit date should follow readiness.
Not the other way around.
A consultant helps build and prepare the system.
The independent certification body certifies it.
The cheapest certificate is not necessarily the most commercially useful certification arrangement.
Check accreditation and customer requirements.
The certificate needs to cover what customers or tenders actually expect.
Stage 1 is there to evaluate readiness.
Use the findings constructively.
Employees do not need scripted ISO responses.
They should genuinely understand hazards, controls and their responsibilities.
A management system that identifies, investigates and improves problems is stronger than one pretending problems never happen.
A risk assessment document does not prove risks are controlled.
Go to the workplace.
The certification auditor may discover the same unresolved weakness.
ISO 45001 requires continued management and improvement.
The certificate is not the finish line.
Before proceeding to certification, confirm that:
If several of these remain incomplete, the organisation may benefit from further implementation work before Stage 1.
The OHSMS scope is clearly defined.
Organisational context has been addressed.
Relevant interested parties are understood.
Leadership responsibilities are established.
Worker consultation and participation are functioning.
Hazards have been identified.
OH&S risks have been assessed.
Opportunities have been considered.
Legal and other requirements are managed.
OH&S objectives are established and monitored.
Operational controls are implemented.
The hierarchy of controls is appropriately applied.
Contractors and procurement are addressed where relevant.
Competence and awareness requirements are implemented.
Emergency arrangements are established.
OH&S performance is monitored.
Incidents and nonconformities are managed.
Internal audit has been completed.
Management review has been completed.
Significant corrective actions have been closed.
Employees can explain the safety controls relevant to their work.
The intended certification scope is correct.
An appropriate certification body has been selected.
The process normally involves implementing the Occupational Health and Safety Management System, completing internal audit and management review, selecting an independent certification body, completing Stage 1 and Stage 2 audits, addressing applicable nonconformities and receiving certification following a successful certification decision.
Independent certification bodies issue ISO 45001 certificates. ISO itself does not certify organisations. SANAS accredits certification bodies for defined scopes but does not directly certify individual businesses.
Stage 1 primarily evaluates whether the organisation's OHSMS is sufficiently established and ready for the more detailed Stage 2 certification assessment.
Stage 2 is the main implementation assessment. The auditor evaluates whether the OHSMS meets the applicable requirements and works effectively across the certification scope.
The auditor may evaluate leadership, worker participation, hazard identification, risk assessment, legal requirements, operational controls, competence, contractor management, emergency preparedness, monitoring, incidents, internal audits, management review and corrective action.
Significant unresolved nonconformities can prevent certification from being granted. Audit findings normally need to be addressed according to the certification body's procedures before certification can proceed where required.
Yes. Internal auditing is part of the ISO 45001 management-system requirements and should be implemented before certification.
Yes. Management review is part of the OHSMS and should be implemented before the external certification assessment.
Management-system certification generally operates through a three-year certification cycle, with surveillance audits during the cycle and recertification towards its end.
No. ISO develops and publishes the standard. Independent third-party certification bodies conduct certification.
SANAS is South Africa's national accreditation body. It accredits certification bodies for specified conformity-assessment scopes rather than directly certifying businesses to ISO 45001.
No. ISO 45001 provides a management framework for addressing applicable legal requirements, but certification does not replace South African occupational health and safety legislation or automatically prove compliance with every applicable legal requirement.
Yes. Organisations operating an Integrated Management System may be able to coordinate certification across multiple standards. The certification body determines the appropriate integrated audit programme.
The current published edition is ISO 45001:2018, together with Amendment 1:2024 relating to climate-action changes. A revision of ISO 45001 is under development, but the replacement edition has not yet superseded ISO 45001:2018.
The certification audit should confirm what your organisation already knows:
By the time Stage 1 begins, you should have a clear understanding of:
ISO Specialist South Africa can help your organisation move from implementation to certification readiness.
We help identify remaining gaps, strengthen the management system, support internal-audit preparation and prepare your organisation for independent certification.
The certification body issues the certificate.
Our job is to help make sure the system behind that certificate actually works.
Not sure whether your organisation is ready for ISO 45001 certification?
Our ISO 45001 Readiness Checklist helps you assess the key areas of your Occupational Health and Safety Management System before you start implementation or prepare for certification.
It gives you a practical way to review how you identify hazards and manage risks, meet your legal requirements, involve workers in health and safety, and handle incidents. You’ll see where you’re already strong, where the gaps are, and what steps you need to take to become certification-ready.