ISO 45001 step by step

Orientation and decision

Before you start, it should be clear why you want ISO 45001 and whether it is the right choice for your organisation. This is the moment to make the business case.

Ask yourself whether clients or principals are asking for it, whether you already have VCA and whether that is enough, what the expected costs and benefits are, and whether there is enough internal support.

Involve the management in this decision. Without commitment from the top, the route will be difficult. The standard explicitly requires management involvement.

If you decide to go ahead, appoint a project leader. This is someone who gets time to drive the route, preferably with an affinity for safety and quality management.

Carry out the gap analysis

The gap analysis shows where you stand against the standard. What have you already arranged? Where are the gaps? This gives direction for the rest of the route.

During the gap analysis, you assess each clause of the standard. For clause 4, you check whether you know which internal and external factors affect occupational safety. For clause 5, you ask whether management is actively involved in safety policy. For clause 6, you examine whether there is a systematic hazard inventory. You go through all the requirements in this way.

The outcome is an overview of what needs to happen, prioritised by urgency and impact. This forms the basis for your implementation plan.

Identify hazards and assess risks

This is the heart of ISO 45001. You systematically map which hazards are present in your organisation and assess the related risks.

Hazards are sources that could potentially lead to injury or illness. Think of machines with moving parts, work at height, exposure to hazardous substances, ergonomic strain, but also psychosocial risks such as work pressure and aggression.

For each hazard, you determine the risk by looking at the likelihood that something will go wrong and the severity of the possible consequences. This gives a priority order: which risks do you tackle first?

This process resembles the legally required RI&E (risk inventory and evaluation), but goes further. ISO 45001 also asks you to identify opportunities: possibilities to improve occupational safety.

Formulate policy and objectives

Based on the identified risks, you formulate policy and objectives. The policy describes the organisation’s intentions regarding health and safety. The objectives make this concrete and measurable.

Good Arbo policy includes a commitment to preventing injury and illness, a commitment to complying with laws and regulations, and a commitment to continual improvement. It is signed by the management and communicated to all employees.

Objectives are specific and measurable. Not “we want fewer accidents”, but “we reduce the number of absence days caused by workplace accidents by 25% within 12 months”. You define what you will do to reach the goal, who is responsible, and how you measure progress.

Set up processes and procedures

Now you set up the processes needed to make the G&VW management system work. This covers both operational controls and the support required for them.

Operational controls cover procedures for hazardous work, work instructions for specific tasks, emergency procedures for incidents, and control of contractors and visitors.

For support, think of competence management and training, internal and external communication about safety, document control for procedures and records, and resources such as personal protective equipment (PPE) and safety facilities.

The art is not to over-document. Describe what is needed, no more. A workable system is better than a perfect system that nobody uses.

Implement and apply

The system does not exist only on paper. You will actually apply it. This is the phase where theory becomes practice.

Train employees in the new system. Make sure everyone knows what is expected of them and why it matters. Involve employees actively, because ISO 45001 places strong emphasis on worker participation.

Start collecting records: incident reports, results of workplace inspections, training records, and minutes of toolbox meetings. You will need this evidence during the audit.

Let the system run for at least two to three months before you plan the internal audit. You need operating evidence: proof that the system works in practice.

Carry out the internal audit

The internal audit is a dress rehearsal for the external audit. You check yourself whether your system meets the standard and whether it works effectively.

The internal audit must be independent. The auditor may not check their own work. In small organisations this is difficult; you can then bring in an external party or use auditors from other departments. Use the ISO 45001 checklist (in Dutch) to tick off, per clause, whether you comply.

The audit produces findings: points where you do not meet the standard or where improvement is possible. You address these findings with corrective actions.

Hold the management review

Before the certification audit, at least one management review must have taken place. In it, the management evaluates whether the system is suitable, adequate and effective.

The input to the management review covers the status of previous actions, changes in internal and external factors, health and safety performance, results of audits and inspections, opportunities for improvement, and feedback from workers.

The output covers conclusions about the system, decisions on opportunities for improvement, and decisions on the resources required.

Choose a certification body

Now that you are ready, you choose a certification body (CB) to carry out the audit. Always choose a body accredited by the Raad voor Accreditatie (RvA, Dutch Accreditation Council) .

Well-known certification bodies in the Netherlands include Kiwa , TÜV , DNV , DEKRA , Bureau Veritas  and LRQA . Request quotes from several parties and compare them not only on price, but also on experience in your sector.

Go through the certification audit

The certification audit consists of two stages. In stage 1, the auditor reviews your documentation and determines whether you are ready for stage 2. In stage 2, the auditor checks on site whether your system works in practice.

The auditor speaks with employees at various levels, reviews records and observes work activities. The aim is to establish whether your G&VW management system meets ISO 45001.

If there are nonconformities, you are given time to resolve them. Minor nonconformities usually do not block the certificate, provided you deal with them within the set period. Major nonconformities require a re-audit.

Read more about the audit process.