ISO 45001 Consulting, Safety Audits and Mentoring

A safety system earns its keep long before an auditor turns up: fewer incidents, a crew that goes home in one piece, and the quiet confidence that you can show your due diligence if anyone ever asks. ISO 45001 is the international standard for work health and safety management, a practical way to find hazards before they cause harm and keep the risks under control.

Streamline designs, audits and mentors WHS management systems your team will actually use, including the psychosocial hazards Australian WHS regulations now require you to manage, with certification from any JAS-ANZ accredited body.

In plain English: ISO 45001 is about keeping your people safe: finding workplace hazards before they cause harm and managing the risks, including the psychosocial ones.

What ISO 45001 certification involves

Two things. A work health and safety management system that genuinely meets ISO 45001:2018, and a two stage audit by an accredited certification body. Certification is issued by that body, not by a consultant, so anyone offering to certify you directly is not describing the process accurately.

Worth separating two things people conflate. Meeting your WHS legal duties is not the same as holding a certificate, and a certificate does not discharge those duties. What certification adds is independent evidence that the system finding and controlling your hazards actually works, which is a different and more useful claim.

What our ISO 45001 clients say

The process, step by step

1. Scope and context. Decides what the system covers and which of your sites and activities are in it.
2. Hazard identification and risk assessment. Across your activities, sites, plant and substances, with psychosocial hazards in the register alongside the physical ones from the start.
3. Legal register and controls. The WHS laws and codes of practice that apply to you, with controls chosen by working down the hierarchy of controls rather than starting at training and personal protective equipment. Consultation arrangements get set up here, not retrofitted later.
4. Incident reporting and investigation. Because an auditor will follow an incident from report to root cause to the control that changed as a result.
5. Operate the system. A system that has not run yet produces no records, and records are what an auditor samples.
6. Internal audit and management review. At least one independent internal audit and one management review before a certification body will book its main visit.
7. Certification audit. Stage 1 and Stage 2, then annual surveillance audits with full recertification every three years.

Stage 1 checks whether your documented system meets the standard. Stage 2 checks whether you do what your documents say, which is where systems assembled from purchased templates tend to unravel, because the records do not match the paperwork.

How long does it take?

Three to six months for most small and medium organisations, and the range matters in both directions. Anything shorter is usually rushed, because the system has to run for a while before there is enough evidence to audit and no amount of consulting speeds that up.

Anything much longer and the project loses momentum, which in our experience derails more certifications than any technical problem. Larger, multi-site and multinational organisations run longer, and that is a different conversation.

What does it cost?

Two separate bills, and it helps to see them apart. Consultant support to design and implement the system, and the certification body’s own fee for the two stage audit, which they set according to your size, scope and number of sites.

Taken together, most small to medium Australian businesses land in the region of $7,000 to $25,000 in the first year. Our ISO 45001 certification cost and timeline guide works through how the two add up.

If you are certifying more than one standard, expect to pay considerably less than doing them separately. The management system clauses are shared, so a standard built as part of an integrated system generally runs 50% to 75% of its standalone cost, and the more you build at once, the further toward the lower end that goes.

Do you need ISO 45001?

Almost nobody arrives at ISO 45001 by choice. Where information security certification usually turns up in a customer contract, ISO 45001 usually turns up through the law or through a gate you need to get through, and it comes from one of four directions.

A prequalification scheme or a principal contractor expects it. For a lot of Australian businesses this is the first encounter: a question on a prequalification questionnaire, a condition of getting on site, or a criterion in a tender.

Certification does not win the work on its own. What it does is keep you in contention, and the commercial risk of not holding it is being quietly passed over in favour of a competitor who does, and never being told that is why.

Your officers need to be able to show due diligence. The model WHS laws put a positive, personal duty on officers, which includes taking reasonable steps to understand the hazards of the business and to make sure there are resources and processes to eliminate or minimise the risks.

A certified management system is the most defensible evidence available that the duty was discharged, because it produces dated records of exactly those steps rather than a recollection of good intentions. If you sit on a board or hold an officer role, this is worth reading properly: officer due diligence and personal liability for directors.

Something has already happened. An incident, a near miss that frightened everybody, an improvement notice, a regulator asking questions, or an insurer starting to take an interest. Systems built after an event tend to be the ones that get used, because the reason for them is still fresh.

You simply want fewer people hurt. Some organisations get here on their own, without a gate to pass or a duty to prove, and it is the best reason of the four.

On size, small organisations can and do certify, often faster than large ones, because the scope is tighter and there are fewer people to bring along. Size changes the effort, not the eligibility.

Our safety work runs across construction, civil and infrastructure, engineering and metal fabrication, the trades carrying the sharpest risk profiles including plumbing, excavation and roofing, arboriculture and landscaping, commercial diving and marine services, mining services, food and seafood processing, transport and fleet, aged care, home care and community health, and laboratories.

We also work with data centres, technology firms and professional services practices, where the significant hazards are ergonomic and psychosocial rather than physical, and where the officer duty described above is often the whole reason the conversation starts.

Benefits of ISO 45001 certification

• Stay in contention for tenders and prequalification schemes that require it.
• Fewer incidents, and dated evidence that your officers exercised due diligence.
• Psychosocial hazards managed to the standard Australian WHS regulations already set.
• Workers consulted properly, which is the clause auditors test hardest and the one that changes behaviour.
• A foundation for adding ISO 9001 or ISO 14001 as a single integrated system.

What ISO 45001 is

ISO 45001 is the international standard for an occupational health and safety management system. In Australia it is adopted as AS/NZS ISO 45001:2018, which carries the same requirements as the international edition, so a system built to one is a system built to the other. That distinction matters mainly at tender time, because Australian prequalification forms often cite the AS/NZS designation. It superseded AS/NZS 4801 and the international OHSAS 18001.

The phrase carrying the weight is “management system”. This is not a safety manual, a stack of safe work method statements, or a set of forms, and the projects that go badly are usually the ones that started by treating it as paperwork.

What the standard asks for is a working loop: understand your context, find your hazards, assess and control the risks, know which laws and codes apply, consult your workers, make people competent, capture incidents, audit yourself, and have management review whether any of it is working. You can run a physically safe site and still fail an ISO 45001 audit, because what gets audited is whether you can demonstrate the system found the hazards and controlled them.

One gap is worth understanding before you start. Australian WHS law already requires duty holders to manage psychosocial hazards, meaning the features of how work is designed and managed that cause psychological harm: unreasonable job demands, low control over the work, poor support, role confusion, bullying, harassment and exposure to traumatic material.

NSW brought that duty in on 1 October 2022 and Victoria was the last jurisdiction to follow on 1 December 2025, so wherever you operate, it now applies to you. ISO 45001:2018 does not address psychosocial risk explicitly. The edition being drafted now does, and that is the single biggest change coming.

So a system built only to the letter of the current standard can leave you holding a valid certificate and still short of your legal obligation. We put psychosocial hazards into the risk register alongside the physical ones from the beginning, which meets the regulation as it stands and leaves little to do when the new edition lands. Our full guide to psychosocial hazards and what Australian law requires sets out the duty jurisdiction by jurisdiction.

Two related pieces worth reading if this is new to you: NSW codes of practice became enforceable on 1 July 2026, and SafeWork NSW has published what it intends to inspect, which between them tell you where regulator attention is going.

Where ISO 45001 projects come unstuck

These five account for most of the trouble we see. Sometimes we are involved early enough to design around them. Just as often we meet them reviewing a system already in place and not working as well as it should.

The workers were never really consulted. Clause 5.4 requires consultation and participation of workers, and it is the clause ISO 45001 systems most often fail on, because management wrote the system alone and then told everyone about it.

It is easy for an auditor to test and hard to fake: pick a control, ask which worker was involved in choosing it, then ask a worker on the floor what changed as a result. If the answers do not meet, the finding writes itself. This is also the area being sharpened in the next edition, which is a fair signal about how often it is done poorly now.

Psychosocial hazards were treated as an HR matter. They sit with the employee assistance provider and a wellbeing policy, and never appear in the risk register with an assessed risk rating and a control. That is the most common gap we now find, and the one with a live regulatory duty behind it rather than just a standard.

Incidents get recorded but not investigated. The register fills up, the same injury type keeps appearing, and no control ever changes. An auditor picks one incident and follows it through to what was done differently afterwards. If the trail stops at a form, so does the credibility of the system.

Emergency preparedness stops at a muster point. Clause 8.2 asks you to identify the emergencies your work can create and plan a hazard matched response to each. A confined space rescue, a chemical spill, a fall from height and a plant entrapment need different equipment, different training and different people standing by.

There is no project plan. Without a schedule naming the key dates and milestones, timelines creep, the internal audit and management review get left too late, and the certification body cannot fit you in when you are finally ready.

We produce a project plan at the start and share it with your certification body, so they can schedule Stage 1 and Stage 2 around your actual milestones rather than a guess. Dates still move, but everyone stays across where the project really is instead of discovering a problem in the last fortnight.

Three ways to get there with Streamline

• We build it. End to end WHS management system development, standalone or integrated with quality and environment.
• You build it, we mentor. ISO mentoring guides your team through the build, so the system stays in your own hands.
• You have built it, we check it. A gap analysis audit or a certification readiness review tells you where it will fail before a certification body finds it.

Why Streamline

You work directly with a qualified ISO Lead Auditor from the first conversation through to your certification audit. Whichever route you take, the scope gets argued out properly at the start, psychosocial hazards go in the risk register with the physical ones, consultation is built in rather than bolted on, and your internal audits under clause 9.2 are independent rather than self marked.

We work across Australia, on site and remotely, and can integrate ISO 45001 with ISO 9001 and ISO 14001 into a single lean system rather than three that duplicate each other. See the other ISO standards we work with.

Common questions

Should we wait for the next edition of ISO 45001?

No. ISO 45001:2018 is the current edition and the one you certify against today. The draft of the next edition is at international ballot, which closes on 8 September 2026, with publication expected during 2027 and a three year transition expected to follow. On the evidence of the recent ISO 9001 and ISO 14001 revisions, this will be a refinement rather than a rebuild, so a system you build now carries over. Waiting costs you the certificate for a year or more and saves very little work.

Does ISO 45001 cover mental health and psychosocial risk?

Only implicitly, in the current edition. It requires you to identify hazards and control risks to health, and psychosocial hazards are hazards to health, but the 2018 text does not spell them out. Australian WHS regulations do spell them out, in every jurisdiction, so the obligation exists regardless of what your certificate says. We build for the regulation, which is the higher bar of the two.

Does ISO 45001 replace AS/NZS 4801?

Yes. ISO 45001:2018 superseded AS/NZS 4801 and the former OHSAS 18001. If your system is still written against 4801, the practical work is the Annex SL structure, the stronger consultation requirements, the explicit treatment of risks and opportunities, and leadership duties that sit with top management rather than with a safety officer.

Is AS/NZS ISO 45001:2018 different from ISO 45001:2018?

No. It is the Australian and New Zealand adoption, with the same requirements. A certificate to ISO 45001:2018 satisfies a tender asking for AS/NZS ISO 45001:2018.

Do we need ISO 45001 to win work?

Often, yes. Many construction, government and resources tenders require ISO 45001 certification or an equivalent WHS prequalification before you can bid at all.

Speak with an ISO 45001 consultant

Tell us what you are starting from and we will map a realistic path. If a principal contractor or a prequalification scheme has asked for certification, send us what they wrote and we will tell you what it actually requires.