Skip to main content
    QHSEtech
    Updated 22 September 2026
    Standards Guide · Reviewed 22 September 2026

    ISO 45001 software: what the clauses require

    No software certifies a management system, and no product in our researched catalogue carries an ISO 45001 claim we were able to verify against its own documentation. What software can do is hold the records a certification body will ask to see. This guide works backwards from those records — the hazard register, the risk decision and who made it, the investigation, the controlled procedure, the audit finding and its closure — and gives you the questions that establish whether a quoted product actually holds them.

    Jump to the 40 products

    Editorial responsibility: Dimitris Mitsios (Founder of The QHSE Standard; product marketing at Tekmon) · Tekmon pays for sponsored placements on this site (disclosure) · How pages are made · LinkedIn · Content date: 22 September 2026

    TekmonAd

    Explore its published safety, quality and maintenance workflows. Confirm modules and pricing in a scoped proposal.

    On this page (9 sections)

    Separate the software from the certificate

    ISO explains that independent certification bodies perform certification and that ISO itself does not issue certificates. A template, a clause-mapped dashboard or an "ISO 45001 ready" label in a feature list does not establish that your management system meets the standard. ISO: Certification — ISO does not issue certificates

    Check which edition of the standard your certification body is auditing against and keep the interpretation of its requirements with the people accountable for it. The standard record is the authoritative reference for scope and status. ISO 45001 standard record

    Software earns its place by making the evidence retrievable: the current version of a procedure and the one it replaced, who approved a risk decision and when, what an investigation concluded, and whether a corrective action was reviewed by someone other than its owner. Evaluate those retrievals in a demonstration, not the clause labels on a marketing page.

    Four clauses, and the record each one leaves behind

    Clause 6.1 — Hazard ID and risk assessment

    A hazard register that shows the assessment date, the assessor, the controls chosen from the hierarchy and the reassessment trigger. Ask who is permitted to change a score after approval, and whether the previous value is retained.

    Clause 7.5 — Documented information

    A controlled procedure with an approver, a distribution record and a review date. Ask to see the superseded version alongside the current one, and how someone working offline knows which they hold.

    Clause 9 — Performance evaluation

    An internal audit programme, the findings it produced and the management review that considered them. Ask how a finding is linked to the evidence behind it, and who signs the review.

    Clause 10 — Improvement

    An investigation, its stated cause, the corrective action and an effectiveness review performed later by a second person. Ask the reviewer to reject inadequate evidence and check that the rejection is retained.

    Other clauses, and the records to ask for

    ClauseRecord a certification body can ask forWhat to establish in a demonstration
    4.1 and 4.2 — Context; needs and expectations of workers and other interested partiesA register of internal and external issues and of interested parties with their requirements, and its review dateWho reviews the register, and whether a change to it can trigger a review of the related risks
    5.4 — Consultation and participation of workersConsultation records, and evidence that non-managerial workers took part in hazard identification and in decisionsWhether a report or suggestion from the field shows what was decided and who told the worker; whether anonymous reporting is available where needed
    6.1.3 and 9.1.2 — Legal and other requirements; evaluation of complianceA register of legal and other requirements and a dated evaluation of compliance against each, with actions on any gapWho maintains the register content (the vendor, you or a third party) and how each requirement links to the controls that meet it
    8.1.3 — Management of changeA change record with its assessment of OH&S risks, approvals, communication to affected workers and a review after the changeWhether a change can be tied to the risk assessments and procedures it affects, and reopen them
    8.1.4 — Procurement, including contractorsContractor selection criteria, the hazards communicated to contractors and records of their work under your controlWhether contractor records sit in the same system as your own workers' records or need a separate portal licence
    8.2 — Emergency preparedness and responseEmergency plans, drill records and the changes made after each drillWhether drill findings create actions that are tracked to closure like any other finding
    9.3 — Management reviewReview inputs and outputs, including the decisions and actions takenWhether the review pack is assembled from live records, and whether its actions are tracked

    Researched product scope for the records above

    Starting points for investigation, not a ranking, a shortlist of equivalents or a claim that any of them supports ISO 45001 certification. None of the researched profiles carries an ISO 45001 claim verified against its own sources, and no product was tested hands-on. Each line is this guide's note or the record's own capability, with its source.

    Tekmon pays for a sponsored placement (above); its place in this list follows the same rule as every entry. How lists are ordered

    Same rule for every product: tagged “EHS Management”, “Safety Management” or “ISO Management”, with a sourced hazard, risk-assessment, investigation or corrective-action capability in its record, or one the vendor stated to us, labelled as vendor-stated. 40 qualify; the first 8 are shown, then the other 32.

    Also meet the rule, in the same order (32)

    Run this demonstration before you compare feature lists

    1

    Raise a hazard and record the decision

    Enter a hazard from a real task. Record the assessor, the date, the controls selected and the residual risk. Then have a second person change the score and confirm the original value and the reason are both retained.

    2

    Revise the procedure that controls it

    Issue a revised version of the related procedure, approve it and distribute it. Retrieve the superseded version. Show what a worker on a device with no connection sees, and how they learn a newer version exists.

    3

    Investigate an event against that control

    Log an event where the control did not work. Record the investigation, the stated cause and the corrective action with an owner and a due date.

    4

    Reject the closure evidence

    Have the action owner submit inadequate evidence. Ask a reviewer to reject it and check the rejection, its reason and the next owner are retained. This is the step most demonstrations skip.

    5

    Produce the audit pack

    Export the hazard record, both procedure versions, the investigation and the closure trail as one set. Confirm the export is readable without a licence to the platform, because your certification body will not have one.

    Questions that separate candidates

    Who may change an approved risk score, and is the previous value retained?
    Can a reviewer reject closure evidence, and is the rejection kept?
    Are current and superseded procedure versions both retrievable?
    How does an offline user know their document version is out of date?
    Is the legal register maintained by the vendor, by you, or by a third party?
    Does the training matrix record competence, or only course completion?
    Can worker consultation records be produced for a specific period?
    What does the evidence export contain, and can it be read without a licence?
    Which applications are in the quoted tier, named individually?
    What happens to your records at the end of the contract?

    Sources and evaluation limits

    5 sources

    Certification scope and ISO's own role: ISO: Certification — ISO does not issue certificates; ISO 45001 standard record. Clause numbers and titles: ISO Online Browsing Platform: ISO 45001:2018 preview (clause titles).

    For the improvement cycle the clauses describe, US OSHA's recommended practices and Great Britain's HSE guidance both set out program evaluation independently of any standard, which is useful when your sites span jurisdictions. Neither is a specification for software. US OSHA: recommended practices — program evaluation and improvement; Great Britain HSE: managing for health and safety (HSG65)

    Each linked product profile carries the date its sources were checked. No hands-on testing was performed, no certification outcome is claimed or implied, and this page does not rank the products. Certification timelines depend on your existing system, scope and certification body; we do not publish an estimate because we have not measured one and have not verified a published figure worth repeating.

    Continue the evaluation

    For multiple standards together, see the ISO management software guide. For the environmental equivalent of this page, see ISO 14001 software. To compare platforms on broader safety scope, see safety management software.

    Get ISO 45001 Recommendations

    Related Guides

    ISO Management Software GuideISO 14001 SoftwareBest Safety Management SoftwareRisk Assessment SoftwareIncident Management SoftwareBest Audit Management Software

    More related guides

    Frequently Asked Questions

    What is ISO 45001?
    ISO 45001 is the international standard for occupational health and safety management systems. It replaced OHSAS 18001 and sets out requirements for how an organisation plans, operates, evaluates and improves its OH&S management system. Check the current edition with your certification body before treating any clause list — including ours — as the operative version.
    Does software make my organisation ISO 45001 certified?
    No. ISO states that independent certification bodies perform certification and that ISO itself does not issue certificates. Software holds records; a certification body assesses your management system. Treat any product marketed as delivering certification as a claim to verify, not a feature.
    Do I need software for ISO 45001?
    The standard does not require it. Whether you need it depends on how many records you must keep current and retrievable, across how many sites, and who has to produce them at short notice. Establish what your current process cannot do before comparing products; a system that works on paper for one site is not a failure to fix.
    Which ISO 45001 clauses does QHSE software usually touch?
    Commonly 6.1 (hazard identification and risk assessment), 7.5 (documented information), 8.1 (operational planning and control), 9.1 and 9.2 (monitoring, measurement and internal audit) and 10.2 (incident investigation and corrective action). Coverage varies by the modules in your quote, not by the platform name — ask for the applications to be listed individually.
    How long does ISO 45001 certification take?
    We do not publish an estimate. The range depends on your existing management system, the scope and number of sites, internal audit capacity and your certification body's schedule, and we have not measured it or verified a published figure. Ask your chosen certification body for a timeline against your actual scope; treat a vendor's claim to shorten it as something to evidence.