What Is ISO 45001, and Does Your Factory Need It?

ISO 45001 is the international standard for occupational health and safety (OHS) management systems. It sets out requirements for identifying hazards, managing risk, and continually improving safety performance, and it replaced the older OHSAS 18001 standard. It is not a legal requirement in Australia, but many manufacturers pursue it anyway — for reasons that have little to do with the law.

This guide covers what the standard actually requires, how "compliant" differs from "certified," and when certification is worth the cost for a small-to-mid Australian manufacturer.

What is ISO 45001?

ISO 45001:2018 is a management-system standard published by the International Organization for Standardization on 12 March 2018. It specifies requirements for an occupational health and safety management system (OHSMS) — the structured way an organisation identifies hazards, assesses and controls risk, and improves safety performance over time.

It doesn't prescribe specific safety controls for specific hazards (that's the job of local regulation, codes of practice, and technical standards). Instead it prescribes a system: how leadership, planning, operational controls, and review processes should work together so that safety management is deliberate rather than reactive.

It applies to organisations of any size or sector, and it's built on ISO's "High Level Structure" (Annex SL), which is why it integrates cleanly with ISO 9001 (quality) and ISO 14001 (environment) for businesses running multiple management systems.

Did ISO 45001 replace OHSAS 18001?

Yes. Before ISO 45001, the widely-used OHS management standard was OHSAS 18001, a British-originated standard rather than a true ISO one. ISO 45001 was designed to replace it.

The transition ran for three years from ISO 45001's March 2018 publication, with an original migration deadline of March 2021. ISO extended that deadline by up to six months — to 11 September 2021 — for organisations affected by COVID-19 disruption. OHSAS 18001 was formally withdrawn after that extended deadline, and any organisation still certified to it needed to migrate to ISO 45001 or lose certification.

If a supplier, contractor, or your own business still references "OHSAS 18001" today, that certification has been superseded for several years — it's a sign the OHS system hasn't been reviewed in a while.

What does ISO 45001 actually require?

Certification isn't paperwork for its own sake. The standard requires an organisation to genuinely operate a management system with these core elements:

Requirement area	What it means in practice
Leadership and commitment	Top management must actively own OHS performance — not delegate it entirely to a safety officer — and integrate it into business planning.
Worker participation and consultation	Workers (not just managers) must be consulted on hazard identification, risk controls, and system changes that affect their safety.
Hazard identification and risk assessment	A documented, ongoing process for identifying hazards and assessing risk — not a one-off audit.
Legal and other compliance obligations	The organisation must identify which OHS laws and regulations apply to it and confirm it's meeting them.
Operational planning and control	Controls for routine work, changes to work, and emergency situations, following a hierarchy-of-controls approach.
Performance evaluation	Monitoring, internal audit, and management review of how the system is actually performing.
Continual improvement (PDCA)	The whole system runs on a Plan–Do–Check–Act cycle: plan controls, implement them, check they're working, act on what's found — repeating indefinitely rather than "setting and forgetting."

That PDCA structure is the standard's backbone. It's what separates a certified OHSMS from a static safety manual: the requirement isn't just to have controls, but to keep checking whether they work and adjusting when they don't.

For manufacturers specifically, the practical overlap with day-to-day operations is large: this is the same territory covered by machine guarding, hazardous substances registers, and the hierarchy of controls — ISO 45001 doesn't replace that work, it wraps a management structure around it.

Compliant vs certified: what's the difference?

This is where most confusion sits, and it matters for both cost and credibility.

	"ISO 45001 compliant"	"ISO 45001 certified"
What it means	The organisation follows the standard's principles and structure informally	A third-party accredited certification body has audited the system against the standard and issued a certificate
Verification	Self-assessed, no independent check	Independently audited, typically with annual surveillance audits
Cost	Internal time only	Audit fees, ongoing surveillance audit costs, corrective-action time
What it proves to others	Nothing verifiable — it's a claim	A documented, third-party-verified claim, checkable via the certification body
Typical use case	Genuinely good OHS management without external pressure to prove it	Tender requirements, supply chain demands, insurer or client scrutiny

"Compliant" is a self-description. It can be entirely genuine — plenty of well-run factories operate to ISO 45001's principles without ever engaging a certification body — but it can't be independently verified by anyone outside the business. "Certified" means an accredited third party has actually checked, which is why certification carries weight in tenders and supply chains where the buyer has no other way to verify your safety system.

Is ISO 45001 mandatory in Australia?

No. ISO 45001 certification is not a legal requirement anywhere in Australia, including Victoria. Your legal OHS obligations come from the Occupational Health and Safety Act 2004 (Vic) and equivalent WHS legislation in other states — not from any ISO standard.

This distinction gets blurred often enough that it's worth stating plainly: ISO 45001 is a voluntary management-system framework; your WHS Act duties are mandatory regardless of whether you ever touch ISO 45001. Certification does not automatically satisfy your legal duties, and a business can be fully certified and still be in breach of the Act if its actual practices don't match what the certificate implies — and conversely, a business with no certification at all can be perfectly compliant with the law if it manages risk properly. Certification and legal compliance are related but separate things.

If your baseline concern is "are we meeting our legal obligations," start there — see what does the OHS Act actually require and what "audit-ready" safety actually means — rather than assuming a certificate answers the question.

When is certification actually worth it for a manufacturer?

Certification makes commercial sense when someone else needs proof, not just when your safety practice is good. The honest triggers are:

• Tender requirements. Government and large corporate tenders increasingly list ISO 45001 certification as a prerequisite or scoring criterion for suppliers, particularly in construction-adjacent manufacturing and supply to larger OEMs.
• Supply chain pressure. If a major customer's procurement policy requires certified suppliers (common with multinational manufacturers and their tier-1/tier-2 chains), certification becomes a condition of doing business, not a safety improvement in itself.
• Insurance and risk positioning. Some insurers and brokers treat certification as a credible risk indicator when pricing premiums or assessing claims history, though it's rarely the sole factor — see how claims history affects your WorkSafe premium.
• Multi-site or growth-stage businesses wanting a consistent, auditable system across locations, where informal practice starts breaking down past a certain size.

When it's not worth it: if none of your customers, tenders, or insurers are asking for it, and your business is small enough that leadership can genuinely see and manage risk directly, a well-run informal system — consistent hazard identification, real worker consultation, documented risk assessments, and a habit of actually reviewing and improving controls — delivers most of the safety benefit without the audit cost. Good OHS practice doesn't require a certificate; it requires doing the things the certificate would check for. Systems like a CMS or CMMS and disciplined training records often deliver more day-to-day risk reduction than the certification process itself.

FAQ

Is ISO 45001 the same as a WHS management system required by law? No. ISO 45001 is a voluntary international standard; your legal WHS/OHS obligations come from the relevant Act and regulations in your state, which apply regardless of whether you adopt ISO 45001.

Can a business be "ISO 45001 compliant" without being certified? Yes — compliance means following the standard's structure and principles, but it's a self-assessed claim with no independent verification. Certification requires a third-party accredited audit.

What happened to OHSAS 18001? It was replaced by ISO 45001, published March 2018, with a transition period that ended (after a COVID-related extension) on 11 September 2021, after which OHSAS 18001 certifications were no longer valid.

Does ISO 45001 certification protect us from a WorkSafe prosecution? No. Certification is not a legal defence and doesn't automatically prove compliance with the OHS Act — what matters legally is whether risks were actually managed so far as reasonably practicable, not whether a certificate exists.

How long does ISO 45001 certification take for a small manufacturer? It varies significantly by starting point, but typically involves gap analysis, system build-out, an internal audit cycle, and a two-stage external certification audit — often several months to over a year for a business starting from an informal safety system.

For manufacturers deciding whether certification is worth pursuing — or wanting a clear-eyed view of what your current safety system would need before an audit — book a safety audit with Ardmor. We work with Victorian manufacturers to build systems that hold up whether or not a certificate is the goal.

This article is general information for manufacturers, not professional advice. Last updated: 20 September 2026.