For UK contractors, health and safety is no longer something you can prove with a folder of policies. Main contractors, facilities managers and public sector buyers want evidence that safety is managed systematically, that risks are controlled and that performance keeps improving. ISO 45001 is the international standard designed to show exactly that.
This guide explains what ISO 45001 is, why it matters for contractors, what the key requirements are, how worker consultation and risk assessment work under the standard, and how to prepare for certification.
What Is ISO 45001?
ISO 45001:2018 is the international standard for occupational health and safety (OH&S) management systems. It sets out requirements for a system that helps organisations prevent work-related injury and ill health, and provide safe and healthy workplaces.
ISO 45001 replaced the older British standard OHSAS 18001, which has now been withdrawn. It follows the same high-level structure as other ISO management system standards, including ISO 9001 for quality and ISO 14001 for environmental management, which makes it straightforward to integrate them.
ISO 45001 does not replace UK health and safety law. The Health and Safety at Work etc. Act 1974, the Management of Health and Safety at Work Regulations 1999 and, for construction, the Construction (Design and Management) Regulations 2015 still apply. ISO 45001 provides a framework for managing your legal duties and other risks in a structured way.
Why Contractors Need ISO 45001
ISO 45001 is voluntary, but contractors are often asked for it, especially when bidding for larger or higher-risk work. The main benefits are:
- Winning work: many main contractors, FM providers and public sector frameworks score or require ISO 45001 in tenders
- Reducing incidents: a structured system helps you identify hazards and control risks before someone gets hurt
- Legal confidence: the standard requires you to identify and evaluate compliance with your legal obligations
- Supply chain credibility: certification from a UKAS-accredited body is independent evidence of your safety management
- Fewer questionnaires: some clients and pre-qualification schemes give credit for an accredited ISO 45001 certificate
Key OH&S Requirements
| Clause | What It Covers | What It Means for Contractors |
|---|---|---|
| 4. Context | Issues, interested parties and scope | Understand your clients, workers, subcontractors, regulators and the work you carry out. |
| 5. Leadership and worker participation | Management commitment, policy, roles, consultation | Leaders take ownership of safety and involve workers in decisions. |
| 6. Planning | Hazards, risks, opportunities, legal requirements, objectives | Identify hazards, assess risks, track legal duties and set improvement objectives. |
| 7. Support | Resources, competence, awareness, communication, documents | Make sure people are trained and competent, and information is controlled. |
| 8. Operation | Operational control, change, procurement, contractors, emergencies | Control site work, manage subcontractors and prepare for emergencies. |
| 9. Performance evaluation | Monitoring, compliance evaluation, internal audit, management review | Check the system works and review performance regularly. |
| 10. Improvement | Incidents, nonconformity, corrective action, continual improvement | Investigate incidents properly and fix root causes. |
Worker Consultation and Participation
One of the biggest differences between ISO 45001 and older approaches is its emphasis on worker consultation and participation. The standard expects workers, including non-managerial workers, to be involved in health and safety decisions, not just told about them.
For contractors, that typically means:
- Consulting workers on hazard identification, risk assessments and new procedures
- Involving workers in incident investigations and deciding corrective actions
- Making it easy to report hazards, near misses and concerns without fear of reprisal
- Using toolbox talks, safety meetings or site briefings as two-way conversations
- Removing barriers to participation, such as language, literacy or time pressure
Auditors often talk to workers on site. If operatives cannot explain how they report hazards or how they have been consulted, it is likely to be raised.
Hazard Identification and Risk Assessment
ISO 45001 requires an ongoing, proactive process for identifying hazards. For contractors, this should cover:
- Routine and non-routine activities, including maintenance, emergency and one-off tasks
- Work on client sites and in shared workplaces
- Hazards from subcontractors, visitors and members of the public
- Physical, chemical, biological and psychosocial hazards, including stress and fatigue
- Changes, such as new equipment, new sites or new work methods
Risk assessments and method statements should be specific to the task and site, not generic. The standard also expects you to apply the hierarchy of controls: eliminate the hazard where possible, then substitute, then use engineering controls, then administrative controls and finally personal protective equipment.
Managing Subcontractors
Most contractors rely on subcontractors at some point. ISO 45001 requires you to control the risks they bring, including:
- Checking subcontractor competence before appointing them, for example through SSIP accreditation, references and insurance
- Agreeing safety requirements and sharing site rules and risk information
- Monitoring subcontractor performance on site
- Reviewing performance and incidents before reusing a subcontractor
If you are not sure which pre-qualification schemes to ask for, read SSIP Accreditation: Which Scheme Is Right for Your Business?
Implementation Steps
- Gap analysis: compare your current safety management against ISO 45001.
- Scope and policy: define the scope and agree the OH&S policy with senior management.
- Legal register: identify the health and safety laws and other requirements that apply.
- Hazards and risks: review and improve your risk assessment process.
- Procedures and controls: develop procedures for site control, subcontractors, emergencies, incidents and change.
- Training and consultation: train staff, set up consultation arrangements and raise awareness.
- Operate the system: run the system long enough to generate records.
- Internal audit and management review: check the system works before certification.
Integration With Other Standards
Because ISO 45001, ISO 9001 and ISO 14001 share the same high-level structure, many contractors run them as an integrated management system. Document control, internal audit, management review, corrective action and competence can be shared, reducing duplication and making audits more efficient.
ISO 45001 also sits well alongside SSIP schemes such as SafeContractor and CHAS. Your SSIP evidence, such as policies, risk assessments and training records, forms part of your ISO 45001 system.
Certification Process and Costs
Certification is carried out by an independent certification body, ideally UKAS-accredited, in two stages:
- Stage 1: a review of your documentation and readiness
- Stage 2: an assessment of how the system works in practice, often including site visits and conversations with workers
Certificates normally run on a three-year cycle, with surveillance audits in between and recertification at the end. Costs depend on your size, number of sites, risk profile and scope. The main elements are certification body fees, any consultancy support and your team’s internal time. Ask several accredited certification bodies for quotes based on your specific scope.
Common Mistakes
- Generic risk assessments that do not match site conditions
- No real evidence of worker consultation
- Weak subcontractor controls
- Incident investigations that stop at “human error” without finding root causes
- An incomplete or out-of-date legal register
- Treating ISO 45001 as paperwork instead of how the business manages safety
How ESC Support Can Help
ESC Support helps contractors design and implement ISO 45001 systems that fit how they work. Our ISO 45001 consultancy covers gap analysis, legal registers, risk assessment, procedures, worker consultation, subcontractor controls, internal audit and certification preparation. It works alongside our wider health and safety services and SSIP support.
Frequently Asked Questions
Is ISO 45001 a legal requirement?
No. ISO 45001 is voluntary. UK health and safety law still applies whether or not you are certified. ISO 45001 is a framework for managing those legal duties and other risks systematically.
What replaced OHSAS 18001?
ISO 45001 replaced OHSAS 18001, which has now been withdrawn. Organisations previously certified to OHSAS 18001 needed to migrate to ISO 45001.
Do we need ISO 45001 if we already have SafeContractor or CHAS?
Not always. SSIP schemes pre-qualify your health and safety competence. ISO 45001 is a full management system certified by an independent body. Some clients ask for both, especially for larger or higher-risk work.
How long does ISO 45001 take to implement?
It depends on your size, how mature your current safety management is and how much time you can commit. Many small and medium-sized contractors take several months to be ready for certification.
Can ISO 45001 be combined with ISO 9001 and ISO 14001?
Yes. The standards share the same structure, so many contractors operate an integrated management system and have them audited together.
Will the auditor visit our sites?
Usually, yes. Certification auditors often visit active sites and speak to workers to confirm the system works in practice.
Get ISO 45001 Ready With Confidence
Gap analysis, risk assessment, worker consultation, subcontractor controls and certification preparation for UK contractors, delivered by ESC Support.