Build the safety system with the people who use it.
A safety management system your operators helped build. That's what meaningful worker consultation and participation should look like, and it produces a system people are far more likely to understand and use once the consultant has gone.
Establish the starting position before the full implementation is priced.
Standalone ISO 45001 implementation, fixed after the gap analysis.
Build, participation, operation, internal audit, review and certification readiness.
DBIM is built around hands-on Health & Safety and QHSE experience in operational SMEs. That matters with ISO 45001 because the difficult part is rarely writing a policy. It is making consultation, risk control, supervision, reporting and improvement work consistently when production pressure and normal day-to-day demands return.
ISO 45001 should make worker involvement visible in the way Health & Safety is managed. If consultation only appears in the procedure, but operators cannot explain how they influence risk and control decisions, the management system has missed one of the standard's most important requirements.
Usually something has made safety harder to leave informal.
ISO 45001 rarely starts with a desire for another certificate. Usually a client requires it, the organisation has outgrown informal arrangements, an incident has focused attention, or an old OHSAS 18001 system needs bringing back into useful life.
Certification has become a condition of winning the work.
A main contractor, customer or tender framework now expects ISO 45001 certification before the business can join the supplier list, remain approved or progress through procurement.
The business has become too large for safety to live in people's heads.
More workers, supervisors, shifts, contractors or sites create more interfaces and more opportunities for inconsistent control. Directors want a management framework that makes responsibilities and performance visible.
Something happened and the board wants confidence it will not simply repeat.
An incident or serious near miss creates attention that day-to-day arrangements may not have received before. The project becomes about building a system that learns, controls and follows through.
The old certificate disappeared, but the foundations may still exist.
A business previously held OHSAS 18001, allowed certification to lapse, and has now been asked for ISO 45001. That does not automatically mean rebuilding everything from zero.
Start by checking exactly what the customer requires.
Some customers want evidence of competent Health & Safety management. Others specifically require accredited ISO 45001 certification as a procurement condition.
Where the wording is unclear, establish the requirement before committing to certification. Building more than the customer needs is expensive. Building less than the tender requires can cost the work.
Direct supervision no longer reaches every task or shift consistently.
Different managers begin interpreting expectations in different ways.
Procurement, coordination and contractor controls become more important.
New processes, equipment and working patterns need a consistent route into risk control.
A lapsed system may still contain useful risk assessments, operational controls, incident arrangements, audit history, responsibilities and management routines. The gap analysis establishes what is still usable and what needs changing for ISO 45001, particularly around leadership, worker consultation and participation, hazard identification and the hierarchy of controls.
Build the Health & Safety management system around the current operation and workforce.
Strengthen a system that exists on paper but is not controlling Health & Safety consistently.
Reuse suitable foundations from an old OHSAS 18001 system and build the ISO 45001 requirements around them.
The trigger explains why ISO 45001 matters now. The gap analysis tells us how much of the system genuinely needs building. That distinction matters because a first implementation, a weak existing system and a lapsed OHSAS 18001 framework should not be priced or approached as the same project.
The thing 45001 asks for that changes how you build the system.
ISO 45001 requires structured consultation and participation of workers. That means the people exposed to workplace risk need meaningful routes to influence how hazards are identified, controls are developed and the Health & Safety management system is improved.
People operate inside the management system.
Quality and environmental management systems still require communication, competence, awareness and effective implementation. But the workforce does not occupy the same specific consultation and participation role that ISO 45001 gives workers.
Consultation may be valuable across any management system, but ISO 45001 gives worker consultation and participation a specific formal role.
Workers help shape how Health & Safety is managed.
Consultation and participation need to be built into the management system, with particular attention to non-managerial workers and the people closest to the risks being controlled.
The strongest evidence is what workers can explain about how safety decisions are actually made.
What happens when the auditor talks to operators?
Workers should be able to describe how hazards are raised, how concerns reach management, how changes to controls are influenced and what happens after somebody reports a problem.
If the management-system paperwork describes extensive consultation but the people doing the work cannot recognise the process, the gap becomes visible quickly.
Workers contribute knowledge about how tasks are actually performed.
People affected by new equipment, methods or controls contribute before implementation.
Investigation uses the knowledge of the people closest to what happened.
The workforce has routes to raise problems and see what happened afterwards.
You can buy a template procedure. You cannot buy genuine worker participation. That has to be built into the way hazards are discussed, decisions are made and improvements are followed through inside the organisation.
Consultation and participation are not the same thing.
The distinction matters when building ISO 45001. Consultation is about seeking workers' views before decisions are made. Participation is about workers being actively involved in the activity or decision itself.
Give affected workers a meaningful opportunity to provide information, experience and opinion before the organisation makes the decision.
Create practical opportunities for workers to contribute directly to the processes through which Health & Safety decisions and improvements are made.
Consulted on
Areas where worker views should feed into the organisation's Health & Safety decisions.
People affected by the decision get a genuine opportunity to influence it before the organisation settles the approach.
Participate in
Activities where workers need practical involvement in how the system identifies, controls and learns from risk.
The workforce becomes part of identifying the problem, shaping the control and learning from what happens afterwards.
People doing the work contribute to hazard identification and control selection.
Issues raised have owners, decisions and visible follow-through.
Workers closest to the event contribute to understanding what happened and why.
People affected by new processes, machinery or controls have input before implementation.
This is a practical summary of the consultation and participation themes within clause 5.4, not a reproduction of the standard. The full clause contains additional requirements around establishing, implementing and maintaining consultation and participation processes, particularly for non-managerial workers.
Don't start with PPE if the hazard can be designed out.
ISO 45001 expects risk reduction to follow a hierarchy. Start by asking whether the hazard can be removed, then work down through progressively more dependent forms of control.
Eliminate
Remove the hazard entirely. Redesign the process, task, equipment or layout so the exposure no longer exists rather than trying to manage contact with it.
Substitute
Replace the hazard with something presenting a lower risk. A less hazardous substance, lighter component, quieter process or safer method can reduce the inherent risk before additional controls are needed.
Engineering
Separate people from the hazard through physical or engineered means. Guards, enclosure, extraction, interlocks, barriers and automation can continue providing protection without relying entirely on somebody remembering a procedure.
Administrative
Procedures, permits, supervision, signage, job rotation and training can reduce exposure or influence how work is performed. These controls depend much more heavily on consistent human behaviour.
PPE
Personal protective equipment protects the individual when exposure still remains. It is an important control, but generally the last level in the hierarchy rather than the first answer to a hazard.
A safety system can run the hierarchy upside down.
A risk assessment may finish with gloves, glasses, a procedure and refresher training without showing whether elimination, substitution or engineering controls were genuinely considered first.
The better question is not simply “what control do we have?” It is “why did we stop at this level of the hierarchy?”
Question whether the hazardous task, substance or exposure needs to exist at all.
Look for a less hazardous material, method, component or process.
Prefer controls that physically separate people from the hazard.
Use procedures, permits, training and supervision for the residual risk.
Protect against exposure that remains after stronger controls have been considered.
Sometimes elimination or substitution genuinely is not reasonably achievable. The important point is that the risk assessment shows those stronger options were considered before defaulting to administrative controls or PPE. That gives supervisors, workers and auditors a much clearer view of why the final control strategy looks the way it does.
The strongest control is usually the one that asks the least of the person exposed to the hazard. Eliminate or engineer risk where practical, then use systems of work, supervision and PPE to manage what genuinely remains.
The hazards most systems stop looking for too early.
Machinery, vehicles, chemicals and manual handling are usually visible. A stronger ISO 45001 system also looks at how work is organised, who may be exposed, the social factors around work and what previous events have already told the organisation.
The hazard is not always a machine, substance or moving vehicle.
Hours, workload, supervision, staffing, shift design, working alone, contractor interfaces and previous incidents can all reveal hazards or increase exposure that a traditional task-only risk register misses.
Workload, hours and pace
Look at workload, working hours, shift arrangements, staffing and the degree of control workers have over the pace and organisation of their work.
Behaviour and workplace relationships
Consider factors including bullying, harassment, victimisation and other behaviours or management practices that can create or intensify workplace risk.
When tired people meet hazardous work
Long hours, overtime, rotating shifts, night work and insufficient recovery can affect attention, judgement and the ability to perform tasks safely.
What changes when nobody else is nearby?
Consider access to assistance, communication, emergency response, supervision and whether the task remains suitable when performed alone or outside normal operating hours.
Contractors, visitors and others exposed
Hazard identification should not stop with direct employees. Contractor activity, shared workplaces, visitors, delivery drivers and others can create hazards or be exposed to existing ones.
What have previous events already told you?
Incidents, near misses, complaints, observations and previous investigations can reveal hazards or weaknesses that a fresh risk assessment might otherwise overlook.
How work is organised changes the conditions in which hazards are encountered. A technically adequate process can become less reliable when people are fatigued, overloaded, under time pressure, poorly supervised or reluctant to raise concerns. The risk assessment needs to recognise those conditions where they are relevant rather than assuming perfect behaviour every time.
Look beyond the person normally assigned to the task.
Consider pressure, absence, breakdowns, overtime and unusual operating conditions.
Use observations and workforce experience rather than relying solely on management assumptions.
Repeated near misses and similar incidents often point to a hazard or control weakness still unresolved.
A complete hazard register needs to describe the work as it really happens, not only the equipment involved. Look at the task, the people, the working environment, how the work is organised and what previous events have already revealed.
Four stages. Typically 12 to 20 weeks.
ISO 45001 can use the same overall implementation programme as the other management-system standards, but genuine worker consultation and participation has to develop as the system is built and operated.
Gap analysis
One day on site, a written report and a fixed quote before you commit to implementation. The review compares the existing Health & Safety arrangements with ISO 45001, including leadership, worker participation, hazard and risk management, operational controls, audit and review. The gap analysis costs £900 and is credited in full against implementation if you proceed.
Build
Hazard identification and risk assessment, worker consultation and participation, legal requirements, objectives, operational controls and the documented information the system genuinely needs. These are built around the real operation to ISO 45001:2018 with Amendment 1:2024.
Embed, audit and review
The system runs for real and workers take part in it. Risk controls, consultation routes, reporting and management routines begin creating genuine evidence. DBIM runs the first internal audit alongside you, facilitates the first management review and works through the actions they generate.
Stage 1 and Stage 2
DBIM helps you choose a UKAS-accredited certification body and prepare for both audits. The certification body's auditors conduct Stage 1 and Stage 2, and DBIM does not attend. Any resulting findings are closed out within the agreed implementation fee.
Worker participation cannot be compressed into audit week.
Workers need opportunities to contribute to risk assessment, controls, communication, reporting and improvement. If genuine participation has to be built from nothing, allow enough implementation time for people to experience those arrangements before external certification.
The implementation programme and certification-body timetable are related but separate. If a client or tender has imposed a fixed certification deadline, appoint the certification body early rather than waiting until the Health & Safety management system is finished.
Holding a working ISO 9001 or ISO 14001 system can shorten the management-system build because much of the structure is shared.
A business starting with little consultation infrastructure may need more time for participation to become credible.
Stage 1 and Stage 2 availability can become the final constraint even when the system itself is ready.
Working towards a tender or contractor deadline? Start with the required certification date and work backwards to establish whether the system has enough time to be built, operated and independently assessed properly.
More questions? →Understand the safety gap. Then fix the project fee.
DBIM prices the implementation after seeing the existing Health & Safety arrangements. That avoids charging for controls the business already has and avoids pretending every ISO 45001 implementation starts from the same place.
Build around the operation, the workforce and the risks.
The final cost depends on the starting position, complexity of the operation, workforce, sites and how much suitable Health & Safety structure is already in place.
Where the business already runs ISO 9001 or ISO 14001, shared management-system processes can reduce the amount of new structure required.
ISO 45001 as a standalone management system.
Combined assessment across two management-system standards.
Integrated ISO 9001, ISO 14001 and ISO 45001 review.
Added for each additional site included within scope.
The gap-analysis fee is credited in full against implementation if you proceed with the DBIM implementation project within six months of the report.
If ISO 9001 or ISO 14001 is already operating effectively, context, leadership, documented information, audit, corrective action and management review can often be shared. The ISO 45001 project can then concentrate on the genuinely OH&S-specific requirements, including worker participation, hazard identification and risk control.
Building ISO 45001 does not automatically make DBIM your ongoing competent person.
If the business also needs continuing external Health & Safety support, competent-person provision, advice and ongoing compliance input, that can sit alongside the ISO 45001 project as an outsourced Health & Safety service.
One firm supporting both the management-system implementation and the ongoing Health & Safety requirement.
Travel beyond 40 miles is charged separately and agreed as part of the project scope before work begins.
Buy the implementation the business needs, then decide separately whether ongoing external Health & Safety support adds value. The ISO 45001 build should leave the organisation with a system it can own, rather than quietly turning certification into an indefinite consultancy dependency.
Before you decide what the business actually needs.
Certification, an old OHSAS 18001 system, worker participation and the future revision all raise slightly different questions. The important thing is identifying which problem you are actually trying to solve.
01 What's the difference between ISO 45001 and OHSAS 18001?
ISO 45001 replaced OHSAS 18001 as the international occupational Health & Safety management-system standard.
The shift is broader than simply changing the certificate. ISO 45001 places stronger emphasis on leadership, organisational context, worker consultation and participation, proactive hazard identification and integration of Health & Safety into normal business processes.
ISO 45001 also aligns structurally with the other ISO management-system standards, making integration with ISO 9001 and ISO 14001 considerably easier.
02 Our OHSAS 18001 certificate lapsed and we never migrated. Where do we start?
Usually with a gap analysis, not a blank sheet of paper.
The old system may still contain useful risk assessments, operational controls, responsibilities, incident processes, audit history and management arrangements.
The gap analysis identifies what is still usable and where ISO 45001 requires stronger arrangements, particularly around worker consultation and participation, leadership, hazard identification and application of the hierarchy of controls.
03 What does worker participation actually mean for an auditor?
It means looking for evidence that workers, particularly non-managerial workers, genuinely influence the Health & Safety management system rather than simply receiving instructions from it.
That evidence can appear in risk assessments, incident investigations, workplace-change discussions, safety meetings, hazard reporting and decisions around controls.
What workers themselves can explain about those arrangements matters. A consultation procedure is much less convincing if the people doing the work cannot recognise the process it describes.
04 Do we need ISO 45001 if we already have decent Health & Safety?
Not necessarily.
A business can have effective Health & Safety arrangements without holding ISO 45001 certification. If there is no customer, tender, corporate or strategic requirement for third-party certification, strengthening the existing system may be the more proportionate route.
If a client or main contractor has made ISO 45001 certification a condition of supply, however, good arrangements alone do not replace the certificate they have specifically asked for.
05 Can ISO 45001 be integrated with ISO 9001 and ISO 14001?
Yes, and where more than one standard is being maintained it is usually the cleaner way to run them.
Context, leadership, competence, documented information, audit, corrective action and management review can often operate through one management framework.
ISO 45001-specific controls then sit inside that framework, particularly worker consultation and participation, hazard identification, OH&S risk control and the hierarchy of controls.
As a planning guide, adding ISO 45001 to a suitable existing ISO management system can cost substantially less than a completely standalone implementation.
06 Should we wait for the next edition of ISO 45001?
No, not if the business needs certification now.
Build against the current published requirements rather than delaying a commercial or operational need for a future revision.
A well-built management system should also make future transition easier because the underlying arrangements for leadership, worker participation, hazard identification, operational control, audit and improvement are already operating.
When a revised edition is published, the sensible route is to review the working system against the changed requirements and address the genuine gaps rather than assume another complete implementation is required.
Establish what already works before fixing the implementation scope.
Standalone ISO 45001 project, fixed after the gap analysis.
Build, participation, operation, internal audit, review and certification readiness.
Certification only makes sense when it solves the problem the business actually has. If the customer needs the certificate, build towards it. If the real need is simply stronger Health & Safety management, that may be a different and less expensive project.
Building, rescuing or reviving a lapsed 18001?
Twenty minutes on the phone should be enough to establish which position the business is actually in and roughly what it will cost.
You might need a complete ISO 45001 implementation, a targeted repair of an existing Health & Safety management system, or a gap analysis to establish how much of an old OHSAS 18001 framework is still worth keeping.
Tender, customer requirement, business growth, incident, first certification or a certificate the organisation once held and now needs again.
Get in contact →Create ISO 45001 around the current operation, risks and workforce.
Fix a Health & Safety management system that exists but is no longer controlling the operation consistently.
Recover the useful foundations of an old OHSAS 18001 system and build the ISO 45001 requirements around them.
Establish the real starting position before fixing the project scope.
Standalone ISO 45001 project, fixed after the gap analysis.
Build, participation, operation, internal audit, review and certification readiness.
If you don't actually need ISO 45001 certification, we'll say so. A business can have effective Health & Safety arrangements without certification. Where a customer or main contractor specifically requires ISO 45001, the certificate matters. Where nobody does, improving the underlying system may be the more proportionate investment.
DBIM supports businesses across Manchester, Bolton, Bury, Stockport, Rochdale, Oldham, Preston, Blackburn, Warrington and Trafford , with appointments elsewhere in the UK where the required site work and travel arrangement make sense for both sides.