Construction team surveying their safe work environment

What is ISO 45001 implementation?

ISO 45001 implementation is the process of designing, building, and embedding an OHSMS that meets the requirements of ISO 45001 – before an accredited certification body independently verifies it.

ISO 45001 is the internationally recognised standard for occupational health and safety, applicable to organisations of all sizes across every industry in Australia.

At its core, it’s a framework for proactive risk management. Rather than reacting to workplace accidents after they occur, a certified OHSMS provides a structured approach to identifying hazards, assessing risks, and implementing appropriate controls. It also supports continual improvement of safety performance, helping create a safe and healthy workplace before incidents happen.

The ISO 45001 certification implementation process

From your first conversation with us to the moment your certificate is issued, your Citation Group auditor guides you through every stage of the ISO 45001 certification process.

Woman wearing a headset and chatting in front of a laptop

Stage 1: Initial enquiry and scoping

We start with a conversation about your organisation – your size, structure, locations, industry, and what you’re hoping to achieve. From there, we define the scope of your OHSMS and provide a transparent, tailored quote.

Getting the scope right at this stage matters more than most businesses realise. A well-defined scope keeps the implementation process manageable, reflects your actual operational risk profile, and ensures your ISO 45001 certificate covers the parts of the business that matter most. It also determines how your ISO 45001 implementation plan is structured.

Two colleagues reviewing papers

Stage 2: Gap analysis

Your Citation Group auditor conducts a gap analysis. This is a structured assessment of your existing safety practices, documentation, and processes against the requirements of ISO 45001.

The gap analysis identifies compliance gaps early, before you invest time building the wrong things. It shows where your health and safety management system already aligns with the standard and where development is needed, producing a clear, practical roadmap for the work ahead. Establishing an implementation team at this stage, with clear internal ownership, is one of the most important steps in a successful implementation.

Woman in high vis using a tablet

Stage 3: OHSMS development

With the gap analysis complete, you build out the elements of your safety management system that need strengthening:

  • Establishing your occupational health and safety policy and objectives.
  • Documenting hazard identification and risk assessment processes.
  • Risk control measures and appropriate controls, including engineering controls where relevant.
  • Emergency preparedness and response procedures.
  • Worker participation mechanisms and communication channels.
  • Integration points with any other management systems you already hold.

Your Citation Group auditor is available throughout. They’ll answer questions and review documentation as your system takes shape. The goal is a system that genuinely manages risks and supports a healthy workplace, not one built for audit purposes alone.

Three colleagues in hard hats

Stage 4: Internal audits and management review

Before your external certification audit, your team must conduct internal audits to verify that your OHSMS is working as designed. This is how you assess compliance with ISO 45001 requirements, collect objective evidence of system effectiveness, and surface corrective actions before your external auditor arrives.

Your senior leaders then hold a formal management review, bringing together audit findings, worker participation data, performance evaluation results, corrective actions, and progress against health and safety objectives. Leadership commitment is a mandatory requirement of the standard. Your auditor will assess it directly, so it needs to be visible and documented.

Stage 5: Certification audit

With your OHSMS implemented, internally audited, and reviewed by management, your Citation Group auditor conducts a two-stage external certification audit. This includes a documentation review followed by an on-site assessment of how effectively your safety management system operates in practice.

Your preparation across the earlier stages determines how smoothly your ISO 45001 certification audit goes. Businesses that arrive at stage five with a thorough internal audit behind them, solid management system documentation, evidence of worker participation, and clear corrective actions in place move through with fewer findings.

Man wearing jacket with hands on hips

Stage 6: Certification and ongoing compliance

Once your certification audit is successfully completed, your ISO 45001 certificate is issued. This is backed by Citation Group’s JAS-ANZ accreditation and recognised nationally and internationally.

ISO 45001 certification is valid for three years. Annual surveillance audits in year one and year two maintain compliance and verify your safety management system continues to operate effectively. A full recertification audit is conducted at the three-year mark. Your named auditor stays with you throughout.

Businesses that treat ISO 45001 as a living system regularly review risk assessments, update control measures, monitor performance, and conduct management reviews. They typically find the ongoing compliance cycle straightforward. Those that treat it as a one-time event tend to find it harder.

Common ISO 45001 implementation challenges

Even with a clear pathway, organisations run into predictable challenges. Knowing them upfront puts you ahead.

Handshake icon

Resistance to change

Introducing a formal OHSMS changes how people work. Resistance to change is one of the most common reasons ISO 45001 implementation stalls, particularly in businesses without an existing safety culture. Effective communication, genuine worker participation, and early engagement across all levels of the business help reduce friction and build lasting buy-in.

Graduation cap icon

Lack of awareness

Lack of awareness across the business is a recurring source of audit findings. A certified system only works if the people responsible for running it understand why it exists and what it requires of them. Build training programs into your implementation plan from the start. Cover awareness, internal auditing, and hazard identification, and measure training effectiveness as you go.

Lightbulb icon

Resource constraints

Resource constraints are a consistent challenge, particularly when building an OHSMS from scratch alongside day-to-day operations. Setting realistic timelines, assigning a dedicated implementation team, and avoiding the temptation to rush the internal audit phase all reduce the risk of delays and non-conformances.

Document icon

Complexity of documentation

ISO 45001’s management system requirements can feel overwhelming without guidance. The standard doesn’t prescribe a format – it requires that your documentation reflects how your business actually manages safety risks, workplace risks, and legal obligations. Keep documentation practical and connected to your operational processes.

Graph icon

Establishing monitoring and measurement systems

Setting up effective monitoring and measurement systems is one of the more demanding parts of ISO 45001 implementation. You need to monitor performance, measure system effectiveness, and demonstrate that your approach to managing OHS is producing measurable results. Build these systems into your OHSMS from the start.

business man accepting a new tendor

Why implement ISO 45001?

  • Fewer workplace accidents and lower costs: ISO 45001 shifts your business from reactive incident management to proactive hazard identification and risk control. Fewer workplace accidents mean fewer workers’ compensation claims, and meaningful cost savings.
  • Legal compliance: A certified OHSMS demonstrates that your organisation has identified its legal obligations under Australian work health and safety legislation and implemented appropriate controls to meet them. It also puts you in a stronger position if your practices are ever scrutinised by a regulator.
  • Better employee engagement: Worker participation is a core requirement of ISO 45001. Employees who have a genuine voice in how safety is managed take greater ownership of safety practices and are more likely to prevent incidents than a policy document sitting in a drawer.
  • Stronger reputation: ISO 45001 certification signals to customers, government procurement teams, and supply chain partners that your approach to OHS is systematic, independently audited, and credible.
Smiling woman sitting in front of laptop

Why choose Citation Group?

When you certify with Citation Group for ISO 45001 implementation, you get:

  • Named auditor throughout: The same person from gap analysis to certification, and across your ongoing surveillance audits.
  • Locally based auditors: Who know your industry and the Australian regulatory environment.
  • Complimentary online training included: Covering internal auditing, hazard identification, and what to expect at your certification audit.
  • 30+ years of ISO certification experience: Across all industries and ISO management system standards.
  • Transparent, tailored pricing: Based on your scope, size, and number of sites.
GET IN TOUCH

Trusted by over 3,300 Australian businesses to solve their compliance challenges

Citation Certification logo
Majestic Services Group

Loved working with the auditors for our ISO Accreditation. They provided me with valuable feedback and observations that will certainly enhance the business. I felt very well supported during this process as it was my first audit experience.

Catherine Trembath, Office Manager

Citation Certification logo
Coral Homes

Thank you for working with us to obtain ISO 45001 Certification. The process was thorough, structured and efficient and the system enhancements we have made to achieve certification will benefit our company greatly.

The breadth of experience and technical expertise you brought to the process was invaluable and really appreciated by all the senior leadership team involved.

Geoff Idzikowski, HSEQ Manager

Citation Certification logo
AutoNexus

The collaborative relationship we’ve developed with Citation Certification has turned into a true partnership where our business needs are holistically understood and supported.

John Hemingway, Regional HSE Manager

Citation Certification logo
Cushman and Wakefield

The auditor that was assigned to us was fantastic. He explained what was expected and required before the audit commenced. And even during the audit process, when things were being identified or uncovered, we could work quite dynamically. He was really accommodating and professional, and really quite pragmatic in the recommendations for improvement, which we’ve taken on board.

James Logan, Operations Risk and Compliance Manager

Citation Certification logo
Swyftx

Our most recent audit cycle was one of the most positive experiences we’ve had since certifying to ISO/IEC 27001:2022, and the relaxed nature allowed us to engage in discourse that was open and honest about gaps and our plans to fix them.

Daniel van Driel, Risk and Governance Lead

Access our latest news and insights

‘Wellness Washing’ is the new in-term. But what is it?
Citation Safety logo
Blogs

‘Wellness Washing’ is the new in-term. But what is it?

Most of the time, wellness washing isn’t intentional – it’s a mismatch between good intent...

15 July, 2026
When employees walk away: managing resignations and abandonment
Citation HR logo
Blogs

When employees walk away: managing resignations and abandonment

Resignations and abandonment of employment require careful handling, particularly in fast-moving retail environments where assumptions...

14 July, 2026
What the Stefanovic case tells us about outside conduct and employment contracts
Citation HR logo
Blogs

What the Stefanovic case tells us about outside conduct and employment contracts

This case highlights a tension that’s becoming more common as side projects, social media and...

10 July, 2026
Liquidation isn’t a loophole: the company’s gone; the debt isn’t.
Citation HR logo
Blogs

Liquidation isn’t a loophole: the company’s gone; the debt isn’t.

Liquidation isn’t a legal escape route.

9 July, 2026
Did you know that your enterprise agreement is about to expire?
Citation Legal logo
Guides

Did you know that your enterprise agreement is about to expire?

Don’t leave your business exposed. Understand your obligations under the Fair Work Act and how...

7 July, 2026

Got burning questions? We’ve got answers.

ISO 45001 is the international standard for occupational health and safety management systems, published in March 2018. It gives organisations a framework to proactively identify hazards, manage safety risks, prevent workplace accidents and ill health, and meet their legal requirements. The standard is applicable across all industries and business sizes in Australia.

ISO 45001 implementation follows six steps:

  • scope your OHSMS;
  • conduct a gap analysis to identify compliance gaps;
  • build and document your system, including hazard identification, risk assessment, risk control measures, worker participation mechanisms, and emergency preparedness;
  • conduct internal audits and a management review;
  • complete a two-stage external certification audit with an accredited ISO 45001 certification company;
  • and receive your certificate.

A dedicated implementation team and strong leadership commitment are critical to success.

In Australia, ISO 45001 certification must be issued by a JAS-ANZ accredited certification body. The process begins with scoping, gap analysis, system development, internal audits, and a management review. It then progresses through two external audit stages: a stage one document review and a stage two on-site assessment. Once both audit stages are passed, your certificate is issued. Certification is valid for three years, with annual surveillance audits in years one and two.

A gap analysis assesses your existing safety practices and documentation against the requirements of ISO 45001. It identifies where your OHSMS already meets the standard and where development is needed, producing a practical implementation roadmap before any building work begins. It is the essential first step in understanding how to implement ISO 45001 for your specific organisation.

ISO 45001 requires top management to demonstrate active accountability for safety outcomes. This means setting occupational health and safety objectives, resourcing the OHSMS adequately, participating in management reviews, and fostering genuine worker participation. Leadership commitment is a mandatory requirement of the standard, and is assessed directly by your external auditor at certification.

ISO 45001 certification is valid for three years. Annual surveillance audits in years one and two verify ongoing ISO 45001 compliance. Citation Group conducts a full recertification audit at the end of the three-year cycle.

Yes. ISO 45001 is structured around identifying and meeting legal obligations relevant to occupational health and safety. In Australia, this includes compliance with state and territory work health and safety legislation. A certified OHSMS provides documented evidence that your business has identified its legal requirements, implemented appropriate controls, and established systems to monitor ongoing compliance. This helps reduce exposure to financial penalties for non-compliance.

Yes. ISO 45001 shares the same high-level structure as ISO 9001 (quality) and ISO 14001 (environmental management). This makes integrating workplace safety into an existing management system straightforward, reducing duplication and improving efficiency across compliance, documentation, and management reviews. Citation Group can advise on the right integration approach for your business.

The main factors that affect the price of ISO 45001 implementation are your organisation’s size, number of locations, and the complexity of your OHSMS. These shape your audit duration, which is where cost is calculated. It’s also worth thinking about the full three-year cycle, not just the initial certification. Head to our ISO 45001 certification costs page or get in touch for more information.