Most ISO 45001 projects stall in the same place. The procedures are written, but the evidence an auditor will ask for is scattered across shared drives, inboxes and paper files. This guide walks through ISO 45001 implementation clause by clause, from hazard identification to management review, and shows how software keeps the evidence ready. Book a gap review.
ISO 45001 Implementation Guide: Software, Audits, Evidence
Clause-mapped records, a legal register with change alerts, internal audit scheduling and an AI-built evidence pack for certification audits. Your management system runs on the same platform as incidents, permits and maintenance.
- What each clause asks and what auditors look for
- A step-by-step roadmap to certification
- How to prepare for the 2027 revision
Why ISO 45001 Projects Stall
The system exists. The proof does not.
ISO 45001:2018 is the current edition. Amendment 1 in 2024 added a requirement to consider whether climate change is a relevant issue in clauses 4.1 and 4.2. A full revision has reached the draft international standard stage and is expected in 2027, with a transition period likely to be about three years. Through all of this, the work that slows most sites is the same: gathering evidence that the system runs every day. See how evidence collects itself in a toolkit demo.
Scattered evidence
Records live in drives, inboxes and binders.
Legal drift
Regulations change, the register does not.
Late audits
Internal audits squeezed in before Stage 2.
Thin participation
Worker input not recorded anywhere.
ISO 45001 Clause by Clause
What each clause asks, what auditors look for.
Clauses 4 to 10 carry the requirements. Each one needs documented information or records that show it is working. Ask our ISO team to map your existing records to the clauses.
Clause 5.4 requires consultation and participation of non-managerial workers, including in hazard identification, incident investigation and deciding controls. Auditors will ask workers directly. Records of their input, such as safety committee minutes and observation programs, are some of the strongest evidence you can show.
Implementation Roadmap
From gap analysis to certificate.
Most sites follow the same five steps. The time between building the system and the Stage 2 audit matters most: auditors want to see the system running, usually for at least a few months, not just written. Plan your timeline in a roadmap session.
Gap analysis
Compare current practice with each clause.
Build the system
Policy, registers, procedures and roles.
Run and record
Operate the system and collect evidence.
Audit and review
Internal audit and management review.
Certify
Stage 1 document review, Stage 2 on-site audit.
Keep Audit Evidence Ready Every Day
When records come from daily work, the evidence pack builds itself. No more pre-audit scramble.
The Legal Register
Know your obligations, prove you meet them.
Clause 6.1.3 requires you to determine your legal and other requirements, and clause 9.1.2 requires you to evaluate compliance with them. A legal register lists each obligation, where it applies and how compliance is checked. Ask our support desk how change alerts work.
Obligations
OSHA standards, state rules, permits and customer requirements.
Where and who
Each obligation linked to areas, assets and roles.
Compliance
Evaluation dates, results and evidence.
Changes
Flags when a rule changes or a review is due.
Gaps
Shortfalls raised as corrective actions.
Evidence
Records an auditor can trace in minutes.
Internal Audits and Management Review
The two meetings that prove the system works.
Internal audits under clause 9.2 test whether the system meets the standard and your own rules. Management review under clause 9.3 is where leaders look at the results and decide what changes. Plan both in a audit planning call.
Internal audit, 9.2
- Program covering all clauses and areas
- Auditors independent of the work
- Findings recorded with evidence
- Corrective actions followed up
Management review, 9.3
- Status of past actions
- Incidents, trends and objectives
- Audit results and compliance status
- Worker consultation and participation
Preparing for the 2027 Revision
Expect moderate change, not a rebuild.
Certification bodies following the draft expect the clause structure to stay familiar. Draft topics include work-related well-being and psychosocial risk, return to work after injury or ill health, and stronger controls over external providers. Treat the draft as a direction, not final requirements, and talk to our ISO team about timing.
Well-being
Psychosocial risks and work-related well-being given more weight.
Return to work
New expectations for supporting return after injury or illness.
External providers
Stronger controls on contractors and outsourced work.
Until the new edition is published and your certification body sets a transition date, audits stay against ISO 45001:2018 with Amendment 1:2024. Good records now will carry across.
ISO 45001 Mistakes to Avoid
Paper systems pass Stage 1 and fail Stage 2.
The most common certification problems are not missing documents but missing proof that the documents are used. A short gap review usually finds them.
What works
- Records that come from daily work
- A legal register with owners
- Internal audits spread over the year
- Worker input recorded and acted on
What fails
- Procedures written for the auditor
- A legal register built once
- All audits the month before Stage 2
- Management review as a formality
How iFactory Runs the ISO 45001 Toolkit
Clause-mapped evidence from daily work.
iFactory’s ISO 45001 Toolkit maps records to clauses, keeps a legal register with change alerts, schedules audits and builds an AI evidence pack for certification audits. It runs on the same on-prem platform as incidents, permits and inspections. Fit questions go to our solutions team.
Clause mapping
Every record linked to the clause it proves.
Legal register
Obligations, owners and change alerts.
Audit scheduling
Internal audits planned across the year.
Evidence pack
AI gathers the records an auditor will ask for.
Management review
Inputs pulled together for each review.
Corrective actions
Findings tracked to verified closure.
The toolkit supports your management system; certification decisions rest with your certification body. We map your existing records to clauses during the pilot.
Turnkey AI: Delivered, Connected and Live in 6–12 Weeks
You do not build this. It arrives ready.
iFactory ships as a pre-configured NVIDIA AI server with the software pre-loaded, racked and ready. Rack it, plug in power and Ethernet, and the AI is live on your network. Our team handles cabling, network setup, PLC, SCADA and CMMS integration, migration of existing registers and records, operator training and 24×7 remote monitoring. Data stays on your network. For a scope matched to your plant, request a turnkey quote.
Ship, network and data
Server installed. Policies, registers and records loaded.
Clause mapping and pilot
Records mapped to clauses and gaps listed for one site.
Go-live and training
Toolkit live for all sites in scope. Teams trained. 24×7 monitoring begins.
Frequently Asked Questions
What is ISO 45001?
The international standard for occupational health and safety management systems. It sets requirements for planning, running, checking and improving how an organization manages work-related risk.
Is ISO 45001 being revised?
Yes. A revision is at the draft stage and is expected to be published in 2027. Certification continues against the 2018 edition with its 2024 climate amendment until transition dates are set.
What is a legal register?
A list of the legal and other requirements that apply to your organization, where they apply and how you check compliance.
How long does certification take?
Many sites take several months to a year, depending on how mature their current system is. Auditors usually want to see the system running for a few months before Stage 2.
Does ISO 45001 require worker participation?
Yes. Clause 5.4 requires consultation and participation of non-managerial workers.
Can software make us certified?
No. Software keeps records and evidence. Certification depends on how the system works in practice and is decided by your certification body.
How do we start?
Run a gap analysis against clauses 4 to 10, then start collecting evidence from daily work.
Walk Into Your Audit Ready
In thirty minutes we look at your current system, your registers and where evidence is hardest to find. You keep the notes either way.
- 1Your OH&S policy
- 2Your hazard and legal registers
- 3Last internal audit report
- 4Last management review minutes
- 5One finding you expect an auditor to raise
