Frequently asked questions about ISO 45001
When you explore ISO 45001 certification, the same questions keep coming up. The official standard is available from NEN , and certification takes place through the RvA . Below you will find practical answers.
Is ISO 45001 mandatory?
Certification is not legally required. The Arbowet (Dutch Working Conditions Act) requires you to provide a safe workplace and to have an RI&E (risk inventory and evaluation), but it does not require you to be certified to ISO 45001.
In practice, it is requested more and more often. In tenders, especially for industrial projects and large clients, you regularly see ISO 45001 as a requirement or a preference in the award criteria. International clients often do not know VCA and ask for ISO 45001 instead.
What is the difference from OHSAS 18001?
OHSAS 18001 was the predecessor of ISO 45001 and has not been valid since March 2021. Organisations that held OHSAS 18001 had to switch to ISO 45001.
The most important differences are that ISO 45001 follows the High Level Structure, which makes combining it with other ISO standards easier. ISO 45001 also places more emphasis on worker participation, the context of the organisation and leadership. Its scope is broader, with attention to psychosocial risks and the entire working environment.
What is the difference from VCA?
VCA is a checklist that prescribes how you must manage safety. ISO 45001 is a management system that prescribes what you must arrange, but leaves you free in how you do it.
VCA is recognised only in the Benelux, while ISO 45001 is recognised worldwide. VCA focuses on construction, industry and technical work; ISO 45001 can be applied in any sector. VCA has levels, namely VCA*, VCA** and VCA Petrochemie; ISO 45001 has no levels.
Read the full comparison on ISO 45001 vs VCA.
Can I combine ISO 45001 and VCA?
Yes, you can. Some organisations hold both certifications, for example because Dutch clients in construction ask for VCA and international clients ask for ISO 45001.
There is overlap: both focus on occupational safety. The approach differs, however. You can integrate the systems so that you do not do the same work twice. Many parts of your ISO 45001 system can be used to meet VCA requirements.
What does ISO 45001 certification cost?
The total investment in the first year varies widely:
| Company size | Total cost first year |
|---|---|
| Small (1-25) | €6,500 - €16,000 |
| Medium-sized (25-100) | €19,000 - €45,000 |
| Large (100+) | €45,000 - €110,000 |
This covers advisory costs, internal hours and the certification audit. Read more on costs and timeline.
How long does the route take?
The timeframe depends on your starting position:
| Situation | Timeframe |
|---|---|
| Small business with a good foundation | 4-6 months |
| Medium-sized business | 6-9 months |
| Large business | 9-12 months |
If you already have ISO 9001 or ISO 14001, it can go faster because you can reuse a lot.
How long is the certificate valid?
An ISO 45001 certificate is valid for three years. Every year the auditor visits for a surveillance audit to check that you maintain the system. After three years, a recertification audit follows.
Can I do it myself without an adviser?
You can, but it is not simple. You need to know the standard thoroughly and have experience with management systems. The official standard and information from SCCM provide guidance.
The advantage of doing it yourself is cost savings. The disadvantages are a longer timeframe and a greater chance of nonconformities at the audit. A middle way is limited support for critical parts.
What is worker participation?
Worker participation is a core requirement of ISO 45001. It means that workers are actively involved in the management system, not just informed.
In practice, this means workers are consulted when identifying hazards, determining measures and setting policy. They can report unsafe situations, make improvement proposals and take part in incident investigations.
This goes further than a suggestion box or an annual survey. The auditor asks how workers are actually involved and wants to see evidence.
Is the RI&E enough for ISO 45001?
The legally required RI&E is a good starting point, but ISO 45001 asks for more. The standard requires a systematic process for identifying hazards and assessing risks that is maintained on an ongoing basis.
Where an RI&E is often a snapshot, ISO 45001 requires continuous attention. You must also identify opportunities and assess the risks of the management system itself.
You can still use your existing RI&E as input for your ISO 45001 hazard identification.
Do I need a prevention officer?
Under the Arbowet, every organisation must have at least one prevention officer (preventiemedewerker). This is separate from ISO 45001.
For ISO 45001 you do not need to create a specific role, but you do need to assign roles and responsibilities for the G&VW management system. This is often combined with the prevention officer or a KAM coordinator.
Can I combine ISO 45001 with ISO 9001?
Yes, and this is even advisable if you want both. The standards follow the same structure, the High Level Structure, which makes many elements reusable.
You can set up one integrated management system for quality and occupational safety. You can combine management review, internal audits, document control and corrective actions. You can also have the certification audits combined, which saves costs.
Can I combine ISO 45001 with ISO 14001?
That works very well too. ISO 14001 for the environment and ISO 45001 for occupational safety complement each other. Both follow the HLS and overlap in their systematic approach.
Many organisations combine ISO 9001, ISO 14001 and ISO 45001 in a KAM system: Kwaliteit (quality), Arbo (occupational health and safety) and Milieu (environment). You then have one integrated system and can combine the audits.
What if I do not pass the audit?
For minor nonconformities, you are given time to resolve them, typically ninety days. The certificate is issued as soon as you provide evidence that the nonconformities have been resolved.
Major nonconformities require a re-audit. The auditor returns to verify that the serious shortcomings have been resolved.
Not passing the audit is not the end. Most nonconformities can be resolved. Use the feedback to improve your system.
Does ISO 45001 help with the Nederlandse Arbeidsinspectie (Netherlands Labour Authority)?
The Nederlandse Arbeidsinspectie (Netherlands Labour Authority) supervises compliance with the Arbowet. An ISO 45001 certificate shows that you have organised your occupational health and safety matters systematically.
Certification does not provide immunity. The inspector can still check and enforce. But a working G&VW management system makes it more likely that you meet the legal requirements, and it reduces the chance of problems during an inspection.
What are the advantages of ISO 45001?
The main advantages are fewer accidents and absence due to systematic risk management, access to tenders where certification is required, international recognition in contrast to VCA, structure and an overview of your safety approach, and better compliance with laws and regulations.
What are the disadvantages of ISO 45001?
The disadvantages are the costs and time the route requires, the administrative burden of maintaining the system, and the annual audit costs. For small businesses with limited risks, the investment can be disproportionate.
Is ISO 45001 suitable for a small business?
The standard is scalable and can be applied to any organisation. But for a small business with limited risks, the investment can be relatively large.
First consider whether your RI&E is in good order. If clients do not ask for ISO 45001 and you have no significant risks, certification may be overkill. If you do have risks, or if certification is commercially necessary, it can also be worthwhile for a small business.
Next step
Still have questions? If you see “ISO 45000” in a quote or requirement, read ISO 45000 or ISO 45001?. Also explore the other pages: