Short answer. ISO 45001 is the international standard for occupational health and safety management systems, and UK clients increasingly ask for it, or for a system aligned to it, at tender and pre-qualification stage. Full certification means an accredited body audits your system against the standard; many SMEs get real benefit from building a system aligned to ISO 45001 without going through certification, particularly where a client accepts SSIP schemes or an HSE-based system as evidence instead.
What Is ISO 45001?
ISO 45001:2018 is the international standard for occupational health and safety management systems. It gradually replaced the older OHSAS 18001 standard: organisations certified to OHSAS 18001 had until September 2021 to migrate, and OHSAS 18001 was formally withdrawn at that point.
In plain language, it is a structured framework for managing health and safety across a business, rather than responding to problems as they arise. It covers leadership commitment, worker participation, hazard identification, risk assessment, operational controls, performance evaluation and continual improvement. If a health and safety policy is a statement of intent, ISO 45001 is the system that turns that intent into practice.
Why Clients Ask for It
A few reasons come up repeatedly in tenders and pre-qualification questionnaires.
Risk transfer. When a client hires contractors or suppliers, an incident involving your worker or your process still brings scrutiny to them. Certification gives them some assurance that your safety management is a working system rather than a folder of policies nobody follows.
Supply chain control. Clause 8.1.4 of the standard requires a certified organisation to control the contractors and outsourced processes that affect its own health and safety performance. It does not require every supplier to hold its own certificate, but in practice it often means clients ask suppliers more searching questions, and some go further than the standard requires and ask for certification directly.
Procurement filtering. Many UK tenders and pre-qualification questionnaires accept ISO 45001 certification as one route to evidencing safety competence, alongside SSIP schemes such as CHAS, Constructionline and Safecontractor, or a system built around HSE's own Plan-Do-Check-Act model. Where a tender specifically asks for certification, though, an aligned system without the certificate will not satisfy it.
What the Standard Covers
ISO 45001 follows the same high-level structure as ISO 9001 (quality) and ISO 14001 (environment), which makes it easier to integrate if you already run one of those systems. The main elements are:
| Element | What it covers |
|---|---|
| Context of the organisation | Understanding the business, its stakeholders and the external factors affecting health and safety |
| Leadership | Top management commitment, policy and assigned roles and responsibilities |
| Planning | Identifying hazards, assessing risks and opportunities, setting objectives |
| Support | Competence, awareness, communication and documented information |
| Operation | Operational planning and control, emergency preparedness and response |
| Performance evaluation | Monitoring, measurement, internal audit and management review |
| Improvement | Incident investigation, nonconformity, corrective action and continual improvement |
Certification or an Aligned System?
There is an important distinction between implementing a system aligned to ISO 45001 and achieving third-party certification. Certification means an accredited certification body audits your system and confirms it meets the standard, and requires ongoing surveillance audits to keep it. Many SMEs get significant benefit from a system built to the same structure without going through formal certification: the processes, documentation and evidence of how safety is actually managed, even without a certificate on the wall.
The right approach depends on what your clients actually ask for. If a tender specifies "ISO 45001 certified", you need the certificate. If it asks for a "safety management system" or a system "aligned to ISO 45001", a well-implemented system without formal certification is often enough.
Getting Started
The gap between where most SMEs sit and where ISO 45001 needs them to be is usually smaller than expected. Most businesses already have some elements in place, a health and safety policy, risk assessments, training records, incident reports. The work is normally in pulling these together into a coherent, documented system with proper governance.
A gap analysis is the logical starting point: it maps what you already have against the standard's requirements and identifies what needs developing. From there you can build the missing elements, train your people, and either run the system internally or progress toward formal certification. A phased build over three to six months is realistic for most SMEs and avoids trying to implement everything at once.
Is It Worth It If You Are Not Chasing Certification?
ISO 45001 is voluntary, and it is not the only accepted evidence of safety competence: HSE's HSG65 framework and SSIP-based schemes remain widely accepted in UK procurement, and plenty of tenders are satisfied by a good general safety management system rather than a specific standard. Where ISO 45001 does help is in giving tender evaluators and clients a structured way to check your competence, which matters most for businesses that regularly bid for work with larger organisations or public sector clients.
A safety management system built to the ISO 45001 structure gives you that evidence whether or not you go on to certify, and puts the groundwork in place if a client later insists on the certificate itself.
For more on the leadership commitment ISO 45001 expects, see the role of leadership in safety culture.