If you are searching for an ISO 45001 consultant, you are probably in one of three places. Your leadership has decided to certify and nobody in the building has done it before. Or a customer has put ISO 45001 in a tender requirement. Or you have a safety program that works reasonably well in practice but doesn't look anything like what a certification auditor expects to see on paper. In each case the real question is the same: what exactly will this person do, what will I have in my hands when they are done, and how do I tell a good one from a bad one?
I'm Jared Clark, Principal Consultant at Certify Consulting, and I have come to think that most disappointing consulting engagements fail at the scoping stage, long before anyone writes a procedure. This guide lays out what the work actually involves, clause by clause, so you can write a scope that holds up and ask the right questions before you sign anything.
What Does an ISO 45001 Consultant Actually Do?
An ISO 45001 consultant helps an organization design, implement, and prove an occupational health and safety (OH&S) management system that conforms to ISO 45001:2018. Most of the time the end goal is third-party certification, though some clients only want conformity without the certificate.
The work falls into five broad activities:
- Assessing where you are against the requirements of clauses 4 through 10.
- Designing the system so it fits how your operation really runs, rather than dropping a generic template on top of it.
- Building the documented information the standard requires.
- Training and coaching leaders, workers, and internal auditors.
- Preparing you for the certification audit and supporting you through nonconformities.
What a consultant should not do is run your safety program for you. ISO 45001:2018 clause 5.1 places specific accountability on top management for the effectiveness of the system, and clause 5.4 requires consultation and participation of workers. A consultant who writes everything alone in a back office produces a system that your people don't recognize, and auditors notice that quickly. If you want to understand what workers' participation looks like in practice, I wrote about it in worker participation in ISO 45001: what clause 5.4 requires.
Consultant, Certification Body, or Internal Auditor: Who Does What?
People confuse these roles often, and the confusion costs money. ISO/IEC 17021-1 requires certification bodies to be impartial, and it restricts them from offering consultancy to a client they certify. That is why the organization that audits you cannot also be the one who built your system.
| Role | What they do | Can they certify you? | Typical timing |
|---|---|---|---|
| ISO 45001 consultant | Designs, builds, and coaches your OH&S system; prepares you for audit | No | Before and during implementation |
| Certification body (CB) | Conducts Stage 1 and Stage 2 audits and issues the certificate | Yes, if accredited | At the end of implementation, then annual surveillance |
| Internal auditor | Audits your own system under clause 9.2 and reports to management | No | Throughout, at planned intervals |
| Accreditation body | Accredits the CB (not you) | No | Not part of your project |
One practical consequence: a consultant should never promise you a certificate. They can prepare you well, but the decision belongs to the certification body, and anyone who guarantees an outcome is telling you something about their honesty.
Typical Scope of an ISO 45001 Engagement, Clause by Clause
The best way to understand scope is to walk through the standard. Here is where a consultant normally spends time, and what you should expect to see produced.
Clause 4: Context of the Organization
This is where most organizations underestimate the work. Clause 4.1 requires you to determine the external and internal issues that affect your OH&S outcomes. Clause 4.2 asks you to identify workers and other interested parties and their relevant needs and expectations. Clause 4.3 requires you to define the scope of the management system, and clause 4.4 requires the system itself.
A consultant typically runs a facilitated session with leadership and produces a context register, an interested parties register, and a written scope statement. The scope statement matters more than people expect, because it determines which sites, activities, and contractors the certificate covers. Scope it too narrowly and a customer may reject the certificate; scope it too broadly and you are auditing things you cannot yet control.
Clause 5: Leadership and Worker Participation
Under clause 5.2 top management must establish an OH&S policy. Clause 5.3 requires assigned roles, responsibilities, and authorities, and clause 5.4 requires processes for consultation and participation of workers. Expect the consultant to draft the policy with your executives (not for them), build a roles matrix, and design a participation mechanism, such as a safety committee charter or a hazard reporting channel.
Clause 6: Planning
This is the technical center of the standard and the place where a consultant's competence shows most clearly.
- Clause 6.1.2.1 requires processes for ongoing and proactive hazard identification, and it names the factors to consider, including work organization, routine and non-routine activities, past incidents, and potential emergency situations.
- Clause 6.1.2.2 requires assessment of OH&S risks, and 6.1.2.3 requires assessment of OH&S opportunities.
- Clause 6.1.3 requires you to determine legal and other requirements.
- Clause 6.1.4 requires planning actions to address risks and opportunities.
- Clause 6.2 requires measurable OH&S objectives and plans to achieve them.
Deliverables here usually include a hazard identification procedure, a risk assessment methodology with a defined scoring approach, a populated hazard and risk register, a legal requirements register, and an objectives plan. If you want to see how these pieces are built, see ISO 45001 risk assessment matrix: build it from scratch and workplace hazard identification methods.
A good consultant will walk your floor with your supervisors while building the hazard register. A weak one will send you a spreadsheet pre-filled with hazards from other companies.
Clause 7: Support
Clause 7.2 requires competence, 7.3 awareness, 7.4 communication, and 7.5 documented information. The consultant develops a competence matrix, training plan, communication plan, and the document control process. Some of the training they deliver themselves, such as management awareness sessions and internal auditor training.
Clause 8: Operation
Clause 8.1.2 sets out the hierarchy of controls: eliminate hazards first, then substitute, then engineering controls and administrative controls, and finally personal protective equipment. Clause 8.1.3 requires management of change, 8.1.4 covers procurement, contractors, and outsourcing, and clause 8.2 requires emergency preparedness and response.
Here the consultant works on operational controls that already exist and tests whether they meet the standard. Common deliverables include a management of change procedure, contractor selection and oversight criteria, and an emergency response plan with drill records. See ISO 45001 management of change for the detail on clause 8.1.3.
Clause 9: Performance Evaluation
Clause 9.1 requires monitoring, measurement, analysis, and evaluation. Clause 9.1.2 requires evaluation of compliance. Clause 9.2 requires an internal audit program, and clause 9.3 requires management review at planned intervals, with specific inputs listed in the standard.
Expect the consultant to set up a performance indicator set (leading and lagging), an internal audit schedule, and a management review template. Most will also conduct the first internal audit or train your people to do it. Certification bodies generally want to see a completed internal audit and a management review before the Stage 2 audit, which is why these two elements often become the critical path.
Clause 10: Improvement
Clause 10.2 requires processes for incident and nonconformity management, including investigation and corrective action, and 10.3 requires continual improvement. The consultant builds the incident investigation procedure, the corrective action log, and often coaches your team through a first real investigation.
What Deliverables Should You Expect?
Write the deliverables into the contract. If they are vague in the proposal, they will be vague at handover. Here is a checklist you can adapt.
Diagnostic phase
- Gap analysis report mapped to clauses 4 to 10
- Written implementation plan with milestones and named owners
Design and documentation phase
- Scope statement (clause 4.3)
- OH&S policy and objectives (clauses 5.2, 6.2)
- Roles, responsibilities, and authorities (clause 5.3)
- Hazard identification and risk assessment procedures and registers (clause 6.1.2)
- Legal and other requirements register (clause 6.1.3)
- Competence matrix, communication plan, document control (clause 7)
- Operational control procedures, management of change, contractor controls, emergency plans (clause 8)
Verification phase
- Internal audit program and completed first internal audit (clause 9.2)
- Management review record (clause 9.3)
- Corrective action log (clause 10.2)
Certification phase
- Pre-audit readiness review
- Support during Stage 1 and Stage 2 (typically as an observer or coach, not as the auditee)
- Help closing out nonconformities
For a fuller list of what the standard explicitly requires you to document and retain, use ISO 45001 required documents: the complete list. Note that ISO 45001 requires far fewer procedures than most people assume. A consultant who hands you a 200-page manual for a 40-person company has probably confused thoroughness with conformity.
How Long Does an Engagement Take and What Does It Cost?
Timelines depend on size, complexity, and how much of a system you already have. In my experience, a small single-site organization with a functioning safety program can move faster than a multi-site manufacturer starting from scratch, and the gap is usually many months, not weeks. I'd be cautious about anyone quoting a fixed duration before they've seen your operation.
On cost, the honest answer is that it varies widely with scope, number of sites, headcount, and how much you want the consultant to do versus coach. Be careful about published price figures from anyone who hasn't scoped your situation. What you should compare are the pricing structures:
| Pricing model | How it works | Best for | Watch out for |
|---|---|---|---|
| Fixed fee by phase | Set price per defined deliverable group | Organizations that want budget certainty | Scope creep disputes if deliverables are vague |
| Time and materials | Hourly or daily rate, with an estimate | Uncertain or evolving scope | Open-ended spend without a cap |
| Retainer | Monthly fee for a set number of hours | Ongoing support after certification | Paying for hours you don't use |
| Coaching-only | Consultant guides, your team writes | Organizations with in-house safety staff | Needs real internal capacity |
Remember that the consultant fee is only one part of the budget. Certification body fees (Stage 1, Stage 2, and annual surveillance audits), internal staff time, training, and any physical control improvements all add up. Ask each certification body for a written quote based on your headcount and sites. Our implementation page describes how we sequence the work.
How Do You Hire the Right ISO 45001 Consultant?
Here is the screening process I would use if I were on your side of the table.
1. Check for real safety and auditing competence
Ask what auditing qualifications they hold. Lead auditor training under ISO 45001 (usually a five-day course) is common among qualified consultants, but it isn't a substitute for operational experience in your sector. A manufacturing plant, a hospital, and a construction firm have different hazards, and a consultant who has only worked in offices will struggle with the first two. Ask for sector-specific references, and read about how the standard applies in your industry, for example construction or oil and gas.
2. Ask how they handle worker participation
If the answer is "I'll write the procedures and send them over," keep looking. Clause 5.4 is not satisfied by a document; it is satisfied by workers being consulted on hazard identification, incident investigation, and control selection. The right answer involves time on the floor.
3. Ask to see a sample deliverable
A redacted hazard register, a sample gap analysis, or a sample internal audit report tells you more than any sales call. Look for specificity: named tasks, named controls, clause references, and evidence of judgment rather than boilerplate.
4. Ask about their relationship with certification bodies
A consultant should be independent, familiar with how several certification bodies audit, and honest about not influencing the audit result. Be wary of anyone who claims a special relationship with a specific auditor. ISO/IEC 17021-1 exists precisely to prevent that kind of influence.
5. Clarify who does the work
In some firms the person who sells the engagement is not the person who shows up. Ask who will be on your site, how often, and what their qualifications are.
6. Insist on knowledge transfer
By the end, your people should be able to run the system without the consultant. Ask what training, handover, and internal auditor development are included. A system that can only be maintained by the person who built it will start decaying the week they leave.
7. Check the contract
Look for defined deliverables, defined milestones, a clear statement of what you are responsible for (access, staff time, decisions), IP ownership of documents created for you, and exit terms.
Red Flags When Evaluating Consultants
- Guarantees of certification or a fixed certification date before they have seen your site
- Template-only systems with your logo pasted on
- No site visit in the proposal
- No mention of worker consultation
- Pressure to buy a specific certification body or software
- Documents that exceed what the standard requires with no rationale
- Unwillingness to name the person who will do the work
Do You Even Need a Consultant?
Not always, and I'd rather say so than sell you something you don't need. If you have a competent safety manager with management system experience, support from leadership, and time to dedicate, you may only need targeted help: a gap analysis, internal auditor training, or a pre-certification readiness review. Smaller organizations often find a scaled approach works well; see ISO 45001 for small and medium enterprises.
Organizations that benefit most from full engagement tend to be those with no prior management system experience, multiple sites, high-hazard operations, or a hard customer deadline. And if you're transitioning from OHSAS 18001, the work is narrower; the standard was withdrawn and replaced, and the changes are laid out in OHSAS 18001 to ISO 45001: what changed.
How Does a Consultant Fit Into the Certification Process?
The certification path normally runs: gap analysis, system design and implementation, internal audit, management review, Stage 1 audit (documentation and readiness review), Stage 2 audit (implementation and effectiveness on site), certificate issue, and then surveillance audits. The certificate cycle is three years, with surveillance audits during that period and recertification at the end.
The consultant's role shifts across those stages. Early on they lead; in the middle they coach; at the audit they step back. If they are answering the auditor's questions for you, something has gone wrong.
A Practical Starting Point
Before you request proposals, write down four things: the sites and activities you want certified, the customer or regulatory deadline if there is one, who inside the company will own the system, and what you already have (policies, risk assessments, incident records). Handing that to three consultants and comparing what each one asks you back is one of the most revealing exercises I know. The good ones ask about your hazards and your people before they talk about price.
If you'd like to talk through scope for your own organization, you can reach us through the contact page, or learn more about the standard itself at certify.consulting.
Last updated: 2026-11-12
Frequently Asked Questions
What does an ISO 45001 consultant do?
An ISO 45001 consultant helps an organization design, document, implement, and verify an OH&S management system that conforms to ISO 45001:2018. Typical work includes a gap analysis, hazard and risk assessment setup, drafting required documented information, training, internal audit support, and certification audit preparation.
Can my ISO 45001 consultant also certify my company?
No. ISO/IEC 17021-1 requires certification bodies to remain impartial and restricts them from providing consultancy to clients they certify. The consultant prepares you, and an accredited certification body independently audits you and issues the certificate.
What deliverables should an ISO 45001 consultant provide?
Expect a gap analysis, implementation plan, scope statement (clause 4.3), OH&S policy and objectives, hazard and risk registers (clause 6.1.2), legal requirements register (clause 6.1.3), operational control procedures (clause 8), an internal audit (clause 9.2), a management review record (clause 9.3), and pre-audit readiness support.
How do I choose an ISO 45001 consultant?
Check auditing qualifications and sector experience, ask for a sample deliverable, confirm how they involve workers under clause 5.4, clarify who will actually do the work, and make sure the contract defines deliverables and includes knowledge transfer. Avoid anyone who guarantees certification.
Do I need a consultant to get ISO 45001 certified?
Not necessarily. Organizations with an experienced safety manager, leadership support, and time may only need targeted help such as a gap analysis or internal auditor training. Full engagements suit organizations with no management system experience, multiple sites, high-hazard operations, or firm customer deadlines.
Jared Clark
Principal Consultant, Certify Consulting
Jared Clark is the founder of Certify Consulting, helping organizations achieve and maintain compliance with international standards and regulatory requirements.