ISO 45001 Implementation

Stage 1: Initial enquiry and scoping

We start with a conversation about your organisation – your size, structure, locations, industry, and what you’re hoping to achieve. From there, we define the scope of your OHSMS and provide a transparent, tailored quote.

Getting the scope right at this stage matters more than most businesses realise. A well-defined scope keeps the implementation process manageable, reflects your actual operational risk profile, and ensures your ISO 45001 certificate covers the parts of the business that matter most. It also determines how your ISO 45001 implementation plan is structured.

Stage 2: Gap analysis

Your Citation Group auditor conducts a gap analysis. This is a structured assessment of your existing safety practices, documentation, and processes against the requirements of ISO 45001.

The gap analysis identifies compliance gaps early, before you invest time building the wrong things. It shows where your health and safety management system already aligns with the standard and where development is needed, producing a clear, practical roadmap for the work ahead. Establishing an implementation team at this stage, with clear internal ownership, is one of the most important steps in a successful implementation.

Stage 3: OHSMS development

With the gap analysis complete, you build out the elements of your safety management system that need strengthening:

• Establishing your occupational health and safety policy and objectives.
• Documenting hazard identification and risk assessment processes.
• Risk control measures and appropriate controls, including engineering controls where relevant.
• Emergency preparedness and response procedures.
• Worker participation mechanisms and communication channels.
• Integration points with any other management systems you already hold.

Your Citation Group auditor is available throughout. They’ll answer questions and review documentation as your system takes shape. The goal is a system that genuinely manages risks and supports a healthy workplace, not one built for audit purposes alone.

Stage 4: Internal audits and management review

Before your external certification audit, your team must conduct internal audits to verify that your OHSMS is working as designed. This is how you assess compliance with ISO 45001 requirements, collect objective evidence of system effectiveness, and surface corrective actions before your external auditor arrives.

Your senior leaders then hold a formal management review, bringing together audit findings, worker participation data, performance evaluation results, corrective actions, and progress against health and safety objectives. Leadership commitment is a mandatory requirement of the standard. Your auditor will assess it directly, so it needs to be visible and documented.

Stage 5: Certification audit

With your OHSMS implemented, internally audited, and reviewed by management, your Citation Group auditor conducts a two-stage external certification audit. This includes a documentation review followed by an on-site assessment of how effectively your safety management system operates in practice.

Your preparation across the earlier stages determines how smoothly your ISO 45001 certification audit goes. Businesses that arrive at stage five with a thorough internal audit behind them, solid management system documentation, evidence of worker participation, and clear corrective actions in place move through with fewer findings.

Stage 6: Certification and ongoing compliance

Once your certification audit is successfully completed, your ISO 45001 certificate is issued. This is backed by Citation Group’s JAS-ANZ accreditation and recognised nationally and internationally.

ISO 45001 certification is valid for three years. Annual surveillance audits in year one and year two maintain compliance and verify your safety management system continues to operate effectively. A full recertification audit is conducted at the three-year mark. Your named auditor stays with you throughout.

Businesses that treat ISO 45001 as a living system regularly review risk assessments, update control measures, monitor performance, and conduct management reviews. They typically find the ongoing compliance cycle straightforward. Those that treat it as a one-time event tend to find it harder.