ISO 45001 Certification Cost & Timeline: 2026 Buyer's Guide

The certification body's quote is only part of what an ISO 45001 project costs. The rest is gap closure, internal time, training, any consulting or software you choose to buy, and three years of surveillance and recertification audits.

This guide explains the rule that governs the certification body's audit days, what else the project has to pay for, and the order the work happens in.

Correction, 22 September 2026. An earlier version of this guide published cost bands by company size (for example $15,000–$40,000 for 10–50 employees), ranges for consulting, software, training and gap closure, and month-by-month timelines. They were editorial estimates with no source, and we have removed them rather than keep numbers we cannot support. It also said surveillance audits cost 30–50% of the initial audit fee, that all OHSAS 18001 certificates expired by March 2021, and that software or a consultant cuts effort or timeline by 30–50% or 40%. The first is replaced below by the accreditation rule on surveillance audit time; the second was wrong, because the migration deadline was extended to 30 September 2021; the reductions had no source. If you built a budget from the earlier figures, rebuild it from written quotes using the method below.

What ISO 45001 is, and who certifies it

ISO 45001 is the international standard for occupational health and safety (OH&S) management systems. The current edition, ISO 45001:2018, was published in March 2018, and a 2024 amendment added climate-change considerations to it. ISO lists a revision under development, at Draft International Standard stage (ISO/DIS 45001), and says it is planned for publication as ISO 45001:2027 (checked 4 October 2026). Until it is published, ISO 45001:2018 stays the edition to certify to.

ISO 45001 replaced the British standard OHSAS 18001. Because of COVID-19, the IAF extended the period for migrating accredited OHSAS 18001 certificates to ISO 45001 to 30 September 2021. Anyone certifying today is certifying to ISO 45001, although existing OH&S documentation can be reused.

Two facts matter for cost:

• ISO does not certify anyone or set certification fees. ISO does not perform certification or issue certificates. Independent certification bodies do, and each sets its own fees.
• Certification is voluntary. ISO describes it as a choice, while noting that in some markets clients, supply chains or public procurement processes request it. Read the tender or prequalification questionnaire that is driving your project, and check whether it asks for a certificate or for evidence of a working system.

See our ISO 45001 software guide for the technical requirements.

What the accreditation rules fix: audit time

An accredited certification body has to calculate audit time under a mandatory accreditation document. That document governs days, not fees. Ask each body to show how its fee is built from those days: its day rate, travel, and any other items in its proposal.

The document is Global ACI-TECH-3-004, Determination of Audit Time of Quality, Environmental, and Occupational Health & Safety Management Systems. It is the former IAF MD 5:2023, reissued without substantive change to the text by the Global Accreditation Cooperation (Global ACI), which took over the roles of the IAF and ILAC on 1 January 2026. The Global ACI document list shows it issued on 10 July 2026 with an implementation date of 28 August 2026 (checked 4 October 2026).

The starting point: people in scope and OH&S risk

Audit time starts from two inputs:

1. Effective number of personnel. All personnel involved within the scope of certification, including permanent, temporary and part-time staff and those on every shift. For OH&S it also includes contractors' and subcontractors' personnel doing work under your control or influence that can affect OH&S performance. Seasonal operations are counted at peak (TECH-3-004, 1.9 and 2.3).
2. Complexity category of OH&S risk. High (typically construction, heavy manufacturing or processing), medium (typically light manufacturing with some significant risks) or low (typically office-based). The document lists example sectors for each in Table OH&SMS 2, and the certification body may move you up or down a category based on your actual activities (TECH-3-004, Annex C).

The table below reproduces part of Table OH&SMS 1, the starting point for the initial audit (stage 1 plus stage 2), in audit days. An audit day is normally 8 hours (TECH-3-004, 1.8).

Source: Global ACI-TECH-3-004 (M), version 1.0, Annex C, Table OH&SMS 1, reproduced in part with acknowledgement to Global ACI. The document treats the bands as a continuum rather than steps. A headcount low in a band attracts less than the band value, so ask your certification body how it reads the table for your headcount.

Adjustments up and down

The table is a starting point, not a quote. The same document lists factors that must be considered. Those that increase OH&S audit time include:

• a rate of accidents and occupational diseases higher than average for your business sector;
• members of the public on site (hospitals, schools, airports, public transport);
• legal proceedings related to OH&S;
• a temporary large presence of contractors, such as a shutdown or turnaround;
• dangerous substances in quantities that create a major-accident risk;
• sites in other countries whose legislation and language the auditors do not know well.

Factors that can decrease it include a very small site for the number of personnel and the maturity of the system. Two others have a narrow meaning for OH&S: "prior knowledge" means already being certified to another voluntary OH&S scheme, and "client preparedness" means already being audited periodically by a national authority under a mandatory governmental OH&S scheme. The preparedness reduction does not apply to an integrated audit under Global ACI-TECH-3-008, where the reduction is calculated from the level of integration instead.

Three further rules apply: the total reduction cannot exceed 30% of the table value (TECH-3-004, 3.9), audit days cannot be cut by programming longer working days (2.2.2), and results are rounded to the nearest half day (2.2.3).

Surveillance and recertification

In the first three-year cycle, TECH-3-004 says the time spent each year on surveillance should be about one third of the initial audit time, and that a surveillance audit is unlikely to be less than one audit day (clause 5). A recertification audit is normally about two thirds of the time a fresh initial audit would need at that point, recalculated from your updated headcount and other current information rather than the original figure (clause 6). ISO describes the same pattern for its environmental standard: surveillance audits usually annually, with a recertification audit every three years.

What the certification body must tell you

Clause 4.4 of TECH-3-004 requires the certification body to give you its audit-time determination and the justification as part of the contract. Ask for it with every quote. It lets you compare quotes on audit days separately from price, and see whether one body has applied reductions another has not.

Two other rules affect what the days are spent on. For OH&S, remote auditing is limited to reviewing documents and records and interviewing staff and workers; process control and OH&S risk control cannot be audited remotely, so expect auditors on site for those parts (TECH-3-004, 4.5). And the audit itself, from the opening meeting to the closing meeting, should typically be at least 80% of the calculated audit time; extra time needed for planning or report writing does not justify shortening it (TECH-3-004, 2.1.2 and 4.1).

A worked example

This is a sample calculation from stated assumptions, not a quote. Assume a single-site metal fabrication business with 275 effective personnel, the top of the 176–275 band, so the table value applies without interpolation. TECH-3-004 lists hot and cold forming and metal fabrication under high OH&S complexity, so the starting point is 13 audit days for stage 1 plus stage 2. A business lower in the same band would start slightly below 13 days, because the bands are a continuum.

With no adjustments, annual surveillance would be about 4.5 days (13 ÷ 3 = 4.3, rounded to the nearest half day), and recertification about 8.5 days (13 × 2/3 = 8.7, rounded to the nearest half day) if headcount is unchanged.

The accreditation rules stop at days. To turn them into a budget, ask each certification body to show how its fee is built from those days, including its day rate, travel and any application, certificate or administration fees in its proposal. We do not quote a day rate: rates are set by each certification body, and we have not collected them.

The costs outside the audit

The certification body's audit days can be checked against the calculation it must give you. The costs below have no equivalent rule, so each has to be estimated from your own gap analysis and quotes.

1. Gap closure, especially legal compliance

Your gap analysis will find missing risk assessments, undocumented controls, training gaps and unmonitored hazards. Each has a remediation cost. Legal compliance needs particular attention, because the accreditation rules make it a condition of certification. Under Global ACI-TECH-3-016, Appendix A, you must be able to show, through your own evaluation of compliance, that you meet the legal OH&S requirements that apply to you before certification is granted.

Where you are not yet compliant, you must show an implementation plan to reach full compliance by a declared date, supported where possible by an agreement with the regulator. Certification can then be granted only exceptionally, where the certification body finds evidence that the plan will be completed on time, that no activities or situations can lead to serious injury or ill health, and that OH&S risks are controlled in the meantime (Appendix A, A.2.3–A.2.4). Deliberate or consistent non-compliance precludes certification.

2. Consultant scope

A consultant engaged to "develop the OHSMS" may not be scoped to train your team, build your risk registers or attend the stage 1 audit. Read the statement of work for each of those before you compare consulting quotes.

3. Software, if you choose it

ISO 45001 lets documented information be held in any format and media (clause 3.24), and ISO notes that for smaller organisations a management system may not need extensive documentation. Software is a choice about how much effort document control, actions and audit evidence take, not a condition of certification. See our QHSE software pricing guide for how vendors price.

4. Internal time

Budget internal labour explicitly, even though the people are already on the payroll. Estimate it as hours multiplied by a fully loaded hourly rate for each group involved: the sponsor, the EHS lead, supervisors, workers' representatives and internal auditors. Include audit days themselves. TECH-3-016 requires the audit team to interview the management with legal responsibility for OH&S, employees' representatives with OH&S responsibility, personnel who monitor employees' health, and managers and permanent and temporary employees, and asks for the first three groups to be invited to the closing meeting.

5. Competence and training

ISO 45001 has a competence clause (7.2). Gaps your analysis finds become training purchases or internal training time.

6. Surveillance, recertification and special audits

Budget for the whole three-year cycle, not the certificate. TECH-3-016 also allows the certification body to carry out a special audit if it learns of a serious OH&S incident or a serious breach of regulation, independently of any regulator's involvement.

Comparing certification quotes side by side

Put each quote into one sheet so the audit-day calculation can be read separately from the price. The table lists what to record and why.

A short worked comparison, using invented quotes for the 13-day case above. Quote A shows 13 days with no adjustment. Quote B shows 11.5 days and cites a reduction for maturity of the system. The rule caps the total reduction at 30% of the table value, so the lowest figure that could be justified for this case is 13 x 0.7 = 9.1 days, and 11.5 days sits inside that limit. Ask Quote B's body what evidence supports the maturity reduction, and ask Quote A's body whether it considered any reduction at all. The difference may be justified, but the rule expects it to be explained in writing.

Questions about the project itself belong in the same sheet. The ISO 45001 readiness page and the internal audit checklist cover what a certification body may ask to see, and the capability map shows how consistently software profiles document ISO-related capabilities if you are considering a tool.

The sequence of work

We do not give a month count. We have not collected project durations, and the documents that govern certification set audit time, not project length. What we can set out is the order the work has to happen in, and what makes each stage longer.

1. Scope and gap analysis

• Name an executive sponsor and agree the budget.
• Decide the scope (clause 4.3): which sites and activities. Scope drives effective personnel, and effective personnel drive audit days.
• Scope can be limited, but requirements cannot be dropped. ISO 45001 states that claims of conformity are not acceptable unless all its requirements are incorporated and fulfilled without exclusion.
• If you run temporary sites such as construction sites, TECH-3-016 requires them to be covered by the OH&S management system of the organisation that controls them.
• Run the gap analysis against every requirement, including legal compliance.

2. Build the system and close gaps

• Hazard identification and OH&S risk assessment.
• Legal requirements and an evaluation of compliance.
• Worker consultation and participation (clause 5.4).
• Competence (clause 7.2), document control and records.
• Software deployment, if you have chosen it.

3. Operate it and generate evidence

ISO describes the route to certification for ISO 14001 as implementing the requirements, carrying out internal audits and management review, then being audited by an independent certification body. Plan ISO 45001 the same way. Ask your certification body how much operating evidence it expects to see before stage 2. Act on internal audit findings and management review decisions before you book the certification audit.

4. Stage 1 and stage 2

The initial certification audit has two stages. TECH-3-004 notes that stage 2 normally takes longer than stage 1, and requires the audit-time factors to be re-examined after stage 1, so the figure can change if what the body finds differs from your application. TECH-3-016 makes the interviews listed above part of conducting the audit without tying them to a stage. Ask the body which it will hold at stage 1 and which at stage 2, and how it handles nonconformities raised at stage 2: which must be corrected and verified before the certification decision, and within what time.

The general requirements for certification bodies, ISO/IEC 17021-1, set what each stage is for. Stage 1 reviews your documented information, site conditions and understanding of the standard's requirements, confirms the scope, checks that internal audits and management review are planned and performed, and establishes whether you are ready for stage 2. Stage 2 evaluates implementation and effectiveness, with evidence of conformity, performance monitoring, legal compliance, operational control, internal audit and management review. The standard distinguishes major from minor nonconformities; the time you have to correct each is set by the certification body, so ask for it in writing.

Readiness checks by clause

Before stage 1, check that you can show evidence for each clause below. The clause numbers and titles are those of ISO 45001:2018; the checks are our working list, not an auditor's checklist.

On the day, answer the question asked, say when you do not know and will find out, and produce evidence promptly rather than explaining around a gap.

5. Certification decision and the cycle

The certification decision follows stage 2. From then on, the three-year cycle of surveillance and recertification described above applies.

Several schedule risks become visible at the gap analysis: open legal compliance gaps, which must be closed, or covered by a plan the certification body accepts only exceptionally, before certification; the number of sites to be covered; how much of the system exists already; and whether you already run another management system you can build on.

How to reduce cost and time

1. Build on an existing management system

ISO 45001 follows ISO's common structure for management system standards, designed to benefit users implementing several of them. If you hold ISO 9001 or ISO 14001 (see our ISO 14001 implementation guide), reuse the shared elements. If the systems are genuinely integrated, an integrated audit can reduce the combined audit time by up to 20% under Global ACI-TECH-3-008 (2.1.2); the same rule also allows the certification body to increase the time for the added complexity of an integrated audit. As noted above, TECH-3-004's "prior knowledge" reduction for OH&S applies to organisations already certified to another voluntary OH&S scheme, not simply to holders of ISO 9001. Our integrated management systems guide covers integration in detail, and the ISO management software guide covers managing several standards together.

2. Use software where it removes real effort

We do not give a percentage saving for software. We have not found a study that isolates the software's effect from the rest of the programme. What software can do is specific, even though the size of any saving is not established. Make a vendor demonstrate each of these with your own records:

• mapping your documents and records to ISO 45001 clauses;
• risk assessment templates, and which method they implement, so you can check it against the method your organisation has chosen;
• document control with version history and acknowledgement tracking;
• internal audit checklists by clause, with findings linked to actions;
• a management review pack assembled from live data;
• action tracking for nonconformities, incidents and improvements.

This guide does not name software vendors. Compare researched platforms in our Compare EHS Platforms hub and our list of safety management software.

3. Build internal audit capability

ISO describes ISO 45001 as setting criteria for an OH&S policy, objectives, planning, implementation, operation, auditing and review, so you will run internal audits in any case. Trained internal auditors give you the chance to find problems before the certification body does. Get quotes for auditor training alongside your certification quotes.

4. Choose the scope deliberately

A narrower initial scope means fewer effective personnel and fewer audit days. Sites can be added later. Under Global ACI-TECH-3-001, where your sites are audited on a sample basis, the certification body decides what it must do before adding new sites to the certificate, including whether to audit them (6.1.4); where sampling is not appropriate, each new site must be audited before it is included (6.2.3). For OH&S, TECH-3-016 adds that sampling is not appropriate where sites do not cover the same activities, processes and OH&S risks. Make sure the scope you certify matches what your customers think they are buying.

5. Choose the certification body carefully

ISO's advice is to evaluate several certification bodies, check that the body uses the relevant CASCO standard, and check whether it is accredited. Accreditation is not compulsory, but it gives independent confirmation of competence, and certificates from accredited bodies can be checked in IAF CertSearch. Compare quotes on the audit-time determination each body must give you, not on the total alone.

FAQs

How long does ISO 45001 certification last?

Certification runs on a cycle of normally three years, with surveillance audits in between and a recertification audit before the cycle ends (TECH-3-016; ISO).

Can I get certified at one site and add others later?

Yes. Where sites perform very similar processes, TECH-3-001 allows sampling: at the initial audit, the number of sites visited is at least the square root of the number of sites, rounded up (6.1.3.3). Not every multi-site organisation is eligible, certification bodies must restrict sampling where risk or complexity makes it inappropriate, and for OH&S sampling is not appropriate where sites do not cover the same activities, processes and OH&S risks. If your sites are audited on a sample basis, the certification body decides what it must do before adding a new site, including whether to audit it; if sampling is not appropriate, each new site is audited before it is added to the certificate (TECH-3-001, 6.1.4 and 6.2.3).

Is ISO 45001 mandatory?

No. Certification is voluntary, but in some markets clients, supply chains or public procurement request it. Check exactly what the contract or questionnaire asks for.

Can we transition from OHSAS 18001 instead of starting fresh?

No longer. The migration period for accredited certificates ended on 30 September 2021. You certify against ISO 45001:2018, but existing OH&S documentation can be reused.

What's the difference between ISO 45001 and OHSAS 18001?

ISO lists a stronger emphasis on leadership engagement, the addition of context analysis and risk-based thinking, greater alignment with other ISO management system standards, and more focus on improving OH&S performance (ISO 45001 FAQ).

Will the 2027 revision affect us?

ISO says the revision is planned for publication as ISO 45001:2027. When ISO 14001 and ISO 9001 were revised in 2026, Global ACI published transition requirements with deadlines for existing certificates (30 April 2029 for ISO 14001 and 30 September 2029 for ISO 9001, according to its news items of 14 and 16 September 2026); our integrated management systems guide lists them. Ask your certification body how it will handle a revised ISO 45001 during your cycle.

Do I need a consultant?

Not necessarily: the certification rules cited in this guide do not require one. Scope any engagement against the gaps in your gap analysis that your own team cannot close, and check that the statement of work covers training, risk registers and stage 1 attendance if you need them.

---

Looking for software that fits your ISO 45001 project? Take our Get Matched quiz to build a shortlist, then test each platform against the checks above.

Sources

• ISO: ISO 45001:2018, Occupational health and safety management systems, including its FAQ and the planned ISO 45001:2027 revision, and ISO 45001:2018/Amd 1:2024, climate action changes
• ISO: Certification, ISO 45001 explained, Management system standards and ISO 14001:2026 (certification cycle)
• Global ACI: TECH-3-004, determination of audit time for QMS, EMS and OH&SMS, TECH-3-016, certification of OH&S management systems, TECH-3-008, audits of integrated management systems and TECH-3-001, multi-site certification, all version 1.0, issued 10 July 2026 (document list)
• ISO: ISO/IEC 17021-1, requirements for bodies providing audit and certification of management systems (stage 1 and stage 2 objectives, major and minor nonconformities)
• IAF: launch of Global ACI on 1 January 2026 and FAQ on the extended OHSAS 18001 migration deadline

Updated 4 October 2026: the ISO 45001, ISO 45001 Amendment 1 and certification pages, the Global ACI audit-time, OH&S certification, integrated-audit and multi-site documents (version 1.0, issued 10 July 2026) and the Global ACI document list, launch announcement and ISO 14001 transition notice were opened again and the cited tables, clause numbers and dates were confirmed; the revision status of ISO 45001 was updated, and a section on comparing quotes was added. The guide still gives no month count.

Corrected 23 September 2026: statistics without a primary source were sourced, labelled as examples or removed, and the standards and accreditation rules cited now link to their official texts.

Updated 24 September 2026: merged the sourced sections of How to Pass Your ISO 45001 Audit the First Time.