Getting a safety management system ready for ISO 45001:2018 isn’t mainly a writing exercise. Policies and procedures matter, but the parts that are hardest to show an auditor are the ones you can’t produce the night before: records of worker consultation, hazard identification that happens before an incident rather than after, and corrective actions someone has actually checked.

Here are six areas worth testing honestly before you book a certification audit.

1. Worker consultation and participation (clause 5.4)

ISO 45001 puts real weight on workers — not just managers — being consulted and taking part in decisions about hazards, incidents and controls. Having a safety committee or regular toolbox talks is a start. The question is whether you can show it happened, what was raised, and what changed as a result.

2. Proactive hazard identification (clause 6.1.2)

It’s easy for hazard identification to become reactive — something that happens after an incident rather than before one. The standard expects an ongoing, proactive process that also covers non-routine work — maintenance, shutdowns, contractors on site, changes to how work is done.

3. Your legal register (clause 6.1.3)

You need to know which safety laws and other requirements apply to you, and keep that list current. In Victoria that starts with the Occupational Health and Safety Act 2004 and the OHS Regulations 2017, and usually goes further — dangerous goods, return-to-work duties and WorkSafe compliance codes, for example. Interstate, it starts with your state or territory’s WHS laws.

4. The hierarchy of controls (clause 6.1.4)

Controls should be chosen by working down the hierarchy — eliminate, substitute, engineer, then administrative controls and PPE. A system that defaults to “write a procedure and issue PPE” hasn’t really worked down the hierarchy.

5. Internal audit and management review (clauses 9.2 and 9.3)

At your Stage 1 audit, the certification body checks whether internal audits and management reviews are planned and being carried out, and whether you’re ready for Stage 2. In practice, expect to need at least one completed internal audit and management review, with actions recorded. Confirm what your certification body requires when you book. Plan these in, rather than squeezing them in at the end.

6. Corrective actions that are checked (clause 10.2)

Closing a corrective action isn’t the same as confirming it worked. Look for evidence that someone went back and checked the fix was effective.

One important distinction

ISO 45001 certification and legal compliance are not the same thing. A certificate doesn’t show that you’ve met your duties under the OHS Act 2004 (Vic) or, interstate, your state or territory’s WHS laws — those need to be confirmed separately. And certification itself is issued by an independent, JAS-ANZ-accredited certification body, not by a consultant. PSMG builds and prepares your management system and readies you for audit.

This article is general information, not legal advice. Clause references are to ISO 45001:2018, for orientation only.