ISO 45001 Implementation Guide for South African Companies: From Zero to Certification

What is ISO 45001:2018?

ISO 45001:2018 is the international standard for Occupational Health and Safety Management Systems (OH&S MS). It replaced OHSAS 18001 and provides a framework for organisations to manage OH&S risks, improve safety performance, and demonstrate compliance to stakeholders.

For South African companies, ISO 45001 is increasingly becoming a competitive differentiator — required for government tenders, multinational supply chains, and B-BBEE compliance portfolios.

Why South African Companies Need ISO 45001

Legal Alignment

ISO 45001 aligns naturally with the OHSA (Act 85 of 1993). Implementing the standard helps organisations systematically comply with South African legislation while achieving international best practice.

Tender Advantage

Major clients — including mining houses, government departments, and multinationals — increasingly require ISO 45001 certification from their contractors and suppliers.

Insurance Benefits

Certified organisations often negotiate lower insurance premiums due to demonstrated risk management maturity.

B-BBEE Scorecard

Enterprise development and compliance elements of the B-BBEE scorecard can be enhanced through ISO 45001 implementation.

The 10 Clauses of ISO 45001

ISO 45001 follows the High-Level Structure (HLS) shared by all ISO management system standards:

Clause 1-3: Scope, References, Terms

These introductory clauses define what the standard covers and key definitions.

Clause 4: Context of the Organisation

• Understand internal and external issues affecting OH&S
• Identify the needs and expectations of interested parties (workers, regulators, clients, communities)
• Define the scope of your OH&S management system
• Establish the OH&S management system processes

South African context: Consider the OHSA, Construction Regulations, MHSA (if applicable), COIDA, and industry-specific regulations as key external issues.

Clause 5: Leadership and Worker Participation

• Top management must demonstrate leadership and commitment
• Establish an OH&S policy
• Assign roles, responsibilities, and authorities
• Ensure worker consultation and participation

Key point: ISO 45001 places more emphasis on worker participation than OHSAS 18001 did. This aligns with the OHSA's requirements for SHE Representatives and Health and Safety Committees.

Clause 6: Planning

• Address risks and opportunities using risk-based thinking
• Identify hazards and assess OH&S risks and opportunities
• Determine legal and other requirements
• Set OH&S objectives and plan to achieve them
• Plan for management of change

Practical tip: Use a HIRA (Hazard Identification and Risk Assessment) methodology that satisfies both ISO 45001 and OHSA requirements simultaneously.

Clause 7: Support

• Provide necessary resources (people, infrastructure, budget)
• Ensure competence of workers (this is where NEBOSH qualifications become essential)
• Build awareness of the OH&S policy and individual contributions
• Establish communication processes (internal and external)
• Manage documented information (policies, procedures, records)

Clause 8: Operation

• Plan and control operational processes
• Manage procurement and outsourced processes
• Establish emergency preparedness and response procedures

Clause 9: Performance Evaluation

• Monitor, measure, analyse, and evaluate OH&S performance
• Conduct internal audits (requires trained auditors — ISO 45001 Lead Auditor course)
• Conduct management reviews at planned intervals

Clause 10: Improvement

• Address incidents and nonconformities with corrective actions
• Drive continual improvement of the OH&S management system

Step-by-Step Implementation Roadmap

Phase 1: Preparation (Month 1-2)

1. Secure leadership commitment

• Present the business case to top management
• Obtain budget approval and resource commitment
• Appoint a project leader and implementation team

2. Conduct a gap analysis

• Assess current OH&S practices against ISO 45001 requirements
• Identify what you already have vs what needs to be developed
• Prioritise gaps based on risk and effort

3. Define the scope

• Determine which sites, processes, and activities are covered
• Consider the boundaries of your management system

Phase 2: System Development (Month 3-6)

4. Establish the context and interested parties

• Document internal/external issues
• Identify stakeholders and their requirements
• Map applicable legal requirements (OHSA, regulations, standards)

5. Develop the OH&S policy

• Aligned with organisational strategy
• Commits to safe working conditions, legal compliance, and continual improvement
• Commits to worker consultation and participation

6. Build the risk management framework

• Implement HIRA processes
• Create a legal requirements register
• Establish risk treatment plans and operational controls

7. Develop documented information

• Procedures, work instructions, and forms
• Don't over-document — focus on what adds value and is required by the standard

Phase 3: Implementation (Month 6-9)

8. Train your people

• NEBOSH IGC for safety officers and managers — provides the competency foundation
• ISO 45001 Lead Auditor for internal audit team
• HIRA Training for risk assessors
• General awareness training for all workers

9. Implement operational controls

• Put procedures into practice
• Establish emergency response plans
• Implement contractor management processes

10. Begin monitoring and measurement

• Track leading and lagging indicators
• Conduct workplace inspections
• Record and investigate incidents

Phase 4: Verification (Month 9-11)

11. Conduct internal audits

• Trained auditors assess compliance with ISO 45001 requirements
• Identify nonconformities and opportunities for improvement
• Report findings to management

12. Management review

• Top management reviews the OH&S management system
• Considers audit results, incident trends, performance data
• Makes decisions on improvements and resources

13. Corrective actions

• Address all nonconformities from audits
• Implement improvements identified during management review

Phase 5: Certification (Month 11-12)

14. Select a certification body

• Choose a SANAS-accredited certification body
• Accredited bodies in South Africa include BSI, Bureau Veritas, SGS, DEKRA, and others

15. Stage 1 audit (documentation review)

• The certification body reviews your documented management system
• Identifies any major gaps before the full audit

16. Stage 2 audit (implementation audit)

• On-site audit to verify implementation and effectiveness
• Auditors interview staff, observe processes, and review records
• Nonconformities must be closed before certification

17. Certification decision

• If successful, you receive your ISO 45001 certificate
• Valid for 3 years with annual surveillance audits

Common Implementation Mistakes

1. Making it a paper exercise — ISO 45001 must be lived, not just documented
2. Insufficient leadership involvement — without top management commitment, implementation stalls
3. Ignoring worker participation — the standard specifically requires consultation with workers
4. Over-complicating documentation — keep it practical and usable
5. Treating it as separate from daily operations — integrate OH&S into business processes
6. Underestimating training needs — competence is a core requirement; invest in qualifications
7. Rushing to certification — build a solid system before inviting auditors

Typical Costs for South African Companies

Note: Costs vary significantly based on organisation size, number of sites, and industry complexity. Small companies may achieve certification for under R200,000 while large multi-site organisations may invest significantly more.

How OHS Compliance Group Supports Your ISO 45001 Journey

We provide the training foundation for successful implementation:

• ISO 45001 Lead Auditor Course — qualify your team to conduct internal and external audits
• NEBOSH IGC — build the core competence required by Clause 7
• HIRA Training — implement the risk assessment processes required by Clause 6
• Incident Investigation — establish the incident management processes required by Clause 10

Our courses are delivered by experienced facilitators who have implemented ISO 45001 in real organisations across South Africa.