ISO 45001:2018 is the international standard for occupational health and safety management systems, replacing OHSAS 18001 in 2021. UK construction, FM, and infrastructure tenders increasingly require it. Standalone certification costs £1,500–£4,000; added to existing ISO 9001 + 14001 the marginal cost drops to £800–£1,500.
What is ISO 45001?
ISO 45001:2018 is an international standard for occupational health and safety management systems. It sets out a framework for identifying workplace risks, putting controls in place to manage them, monitoring how well those controls work, and continuously improving safety performance. It applies to any organisation regardless of size or sector.
ISO 45001 replaced OHSAS 18001 in March 2021. Any business still holding an OHSAS 18001 certificate is now uncertified — the standard was formally withdrawn. If a tender refers to "OHSAS 18001 or equivalent", ISO 45001 is the equivalent.
Like ISO 9001 and ISO 14001, the standard uses the Annex SL structure — meaning the ten clauses, document control approach, and management review cadence are identical across all three. Businesses certifying for multiple standards usually do them as an integrated management system to avoid duplicate audits.
Why government buyers ask for ISO 45001
Health and safety is the single biggest legal risk in public sector contracts that involve physical work — construction, maintenance, fit-outs, grounds maintenance, plant operation, refuse collection, and most facilities management. ISO 45001 gives procurement teams confidence that a contractor has a real, documented system for managing safety, not just a policy in a binder.
You'll see ISO 45001 in PQQ requirements for most council, NHS, education, and housing association construction frameworks. It often appears alongside CHAS, SafeContractor, or Constructionline — buyers use the combination to filter out contractors who haven't invested in safety as a discipline.
Even where ISO 45001 isn't a strict requirement, it scores well in the social value and management capability sections of tender evaluations. The trend is toward stricter H&S expectations, not looser.
How to get ISO 45001 certified: step by step
Step 1: Hazard identification and risk assessment
ISO 45001 starts with a comprehensive hazard identification exercise covering every work activity, every site, and every category of worker (including contractors and visitors). For each hazard, you assess the likelihood and severity of harm, then rank the risks. This becomes the foundation of your OH&S management system.
For most SMEs, hazards fall into recognisable categories — manual handling, working at height, electrical, hazardous substances, slips/trips/falls, vehicle movements, and a few sector-specific items. Existing risk assessments (which UK employers must have under HSE regulations) provide the starting input.
Step 2: Worker consultation
The 2018 standard puts significant emphasis on worker consultation — meaning ISO 45001 isn't a management-imposed system. You have to demonstrate that the people doing the actual work were involved in identifying hazards, designing controls, and reviewing performance. For SMEs this can be a regular toolbox talk plus a simple mechanism for staff to raise safety concerns.
Step 3: Operational controls and emergency preparedness
For each significant hazard, you define operational controls — PPE requirements, safe working procedures, training, supervision, equipment maintenance, permit-to-work systems where appropriate. You also need an emergency preparedness plan covering first aid, evacuation, accident reporting, and serious incident response.
Step 4: Audit and certification
As with ISO 9001 and 14001, initial certification is split into Stage 1 (document review) and Stage 2 (implementation audit). UKAS-accredited certification bodies carry out both. The Stage 2 auditor will typically visit a work site as well as the office to verify that safe systems of work are actually being followed by frontline staff, not just documented.
How long does ISO 45001 take?
Three to four months from start to certificate is typical for a business starting from scratch. If you already hold ISO 9001 and ISO 14001, the marginal time for ISO 45001 is six to eight weeks — most of the management system structure carries over, and the audit can be combined with your existing surveillance visit.
Most construction and FM SMEs end up with all three standards (9001 + 14001 + 45001) as a tri-cert because the cost premium for adding each is so much smaller than doing them standalone.
How much does ISO 45001 cost for a small business?
Standalone ISO 45001 certification typically costs £1,500 to £4,000 for SMEs in the first year, plus £500 to £1,500 annually for surveillance audits. When added to an existing ISO 9001 + 14001 cert, the incremental cost is usually £800 to £1,500 in the first year. A full integrated 9001 + 14001 + 45001 certification for an SME falls in the £3,000 to £6,000 first-year range.
ISO 45001 vs CHAS vs SafeContractor
Buyers sometimes accept any of these. They are not the same thing. ISO 45001 is a full international management-system certification — most rigorous, most expensive, most respected. CHAS and SafeContractor are UK-specific pre-qualification schemes covering health and safety, less comprehensive than ISO 45001 but cheaper and faster to obtain. For lower-value contracts CHAS or SafeContractor is usually enough. For high-value framework contracts buyers increasingly want ISO 45001 on top.
How ENKII helps with ISO 45001
ENKII identifies which of your matched tenders require ISO 45001 specifically vs accept CHAS or SafeContractor as an alternative. It shows you the readiness score impact of getting certified and recommends UKAS-accredited certification bodies experienced with businesses your size.
Once certified, add ISO 45001 to your ENKII profile. Your readiness score updates, new tenders unlock, and ENKII tracks your certificate renewal date so it never lapses unnoticed.
Frequently asked questions
I had OHSAS 18001 — does that count?
OHSAS 18001 was withdrawn in March 2021. Even if your certificate hasn't formally expired, certifying bodies and procurement teams treat it as obsolete. You need to transition to ISO 45001 — most certification bodies offer a streamlined transition process rather than full re-certification.
Is ISO 45001 worth it for a small services business?
It depends on your sector. If your work involves physical risk, supervised teams, equipment, or site visits, almost certainly yes — buyers will ask. If you're a desk-only services business with no field activity, ISO 45001 is usually not required for the contracts you target. ENKII shows per tender which H&S certifications are actually requested.
Can I bid with ISO 45001 in progress?
Some buyers accept "working towards ISO 45001" with a documented implementation plan and evidence of progress (gap analysis, draft OH&S manual, scheduled audit). Others require the certificate from day one. Read the tender wording carefully — if the requirement is mandatory at award, a pending certificate won't get you past PQQ.