An ISO 45001 gap analysis compares your occupational health and safety management system with the applicable requirements and identifies what needs to change. Start by agreeing on the locations, activities, workers, and organizational boundaries covered by the review. Consider the work the organization controls or influences so the assessment reflects how the business actually operates.

ISO 45001:2018 remains the published standard, with Amendment 1:2024 addressing climate considerations. A draft revision is not a replacement for the published requirements. Confirm the applicable edition and amendment when defining the assessment criteria.

Involve leadership, workers, and worker representatives early in the review. Discuss recurring hazards, recent changes, current responsibilities, and the resources available to address findings. Identify who can authorize changes to purchasing, maintenance, staffing, and work methods. The safety manager may coordinate the work, but operational managers and leadership need to make and support the decisions within their authority.

Set clear responsibilities and ways for workers to contribute

Before the review begins, agree on these practical arrangements:

• Ask leadership to approve the scope, priorities, accountable action owners, and review schedule.
• Give workers a way to raise concerns and take part in decisions affecting their work.
• Check participation across shifts, including people who may have less access to meetings or written procedures.

Certification is optional under ISO 45001 itself. A customer or contract may separately require it. Establish whether the organization seeks certification, better internal management, or both, so the assessment has a clear purpose.

Use the applicable licensed standard as the assessment criteria. Compare three sources of evidence: what the organization has documented, what workers understand, and what happens during the work. A procedure may be current while the equipment or supervision it depends on is missing from a night shift or temporary work area.

Select tasks that show how the system works under different conditions. Speak with supervisors and workers, review supporting records, and observe the controls being used. Include maintenance, shutdowns, contractor activities, and changes to routine work where relevant. Record the limits of the sample so a brief visit is not presented as evidence about every task or location.

Write each finding so the responsible person can understand and act on it. State the requirement or expectation, evidence reviewed, gap identified, and work affected. “Training needs improvement” does not explain what to fix. A finding that identifies a changed cleaning task, outdated briefing material, and workers unable to explain the isolation steps gives the team a clear issue to investigate.

Address hazards before organizing the remaining actions

Respond to immediate hazards through the organization’s work-control and emergency arrangements. Do not wait for the implementation timetable to address an unsafe condition. Then prioritize the remaining findings by potential harm, applicable obligations, and effects on other controls. Improvements to filing or document format can be planned alongside that work without delaying measures needed to protect workers.

For each finding, record who is responsible, what action is needed, the target date, and the evidence that will show whether the action worked. Name who will verify the result. Uploading a new document may complete one task, but it does not establish that the underlying issue has been resolved.

The official ISO technical committee FAQ explains that OH&S risk assessment methods and criteria need defined scope, nature, and timing, with a proactive and systematic approach. Nonroutine work also needs attention; infrequent activity can introduce unfamiliar tasks and competence concerns.

Review hazard information with the people who perform the tasks. Ask what has changed in equipment, substances, layout, staffing, or working hours. Compare the risk assessment with the controls actually available and used. Check how the organization responds when a control fails and whether that response includes reassessing the affected work.

Maintain a record of applicable legal requirements and other commitments. For each item, identify its source, the operations it applies to, who keeps it current, and how compliance is evaluated. Distinguish legal duties from voluntary standards and contract terms. Certification to ISO 45001 does not replace the organization’s duty to meet applicable occupational safety laws.

Consider climate where it affects the OH&S system

The ISO–IAF joint communiqué explains the 2024 changes: organizations determine whether climate change is a relevant issue, and interested parties may have climate-related requirements. Assess that relevance within the management system’s context.

For example, local heat, smoke, flooding, or storm conditions may affect exposure, site access, or emergency arrangements. These are possible assessment topics, not a universal list of new ISO controls. Record the reasoning and revisit it when conditions or relevant expectations change.

For each operational finding, decide what needs to change in the task. Involve the people responsible for the equipment, process, and supervision. Consider whether the hazard can be removed or reduced through changes to equipment or work methods before relying on instructions and personal protective equipment. Confirm that the proposed action addresses the conditions that led to the finding.

Check what the chosen control needs in order to work. This may involve purchasing, maintenance, contractor coordination, training, or approval of a changed work method. Confirm that supervisors have the authority, equipment, and staffing needed to apply it. Resolve missing resources before expecting crews to follow instructions that depend on them.

Example: a changed maintenance procedure misses one shift

Identify the gap guidance is shown.

Review emergency arrangements against the activities and foreseeable conditions. Test whether people can access the equipment, contacts, and response instructions they are expected to use. Address weaknesses found during exercises or actual events.

Put the revised processes into use and review what happens. Depending on the task, useful evidence may include worker feedback, inspections, maintenance records, competence checks, contractor briefings, incident investigations, or emergency exercises. Select evidence that shows whether the relevant controls are working. Collecting large numbers of unrelated records can make important gaps harder to see.

Plan the implementation period around the organization’s starting point, operating cycles, and changes needed. Some actions can be checked quickly, while others require repeated use or observation during a later activity. If certification is being sought, discuss evidence expectations with the certification body. Keep an accurate record of what occurred; do not manufacture evidence or backdate activities to fill an audit file.

Read safety indicators alongside worker feedback

A low injury count does not establish that every control is working or that workers feel able to report concerns. Review the figures alongside working hours, changes in exposure, recurring observations, open actions, and access to reporting. Ask workers whether the measures reflect their experience. Investigate discrepancies rather than treating a favorable number as the end of the review.

Use a manageable set of records with clear ownership and revision control. ISO’s practical guide for small organizations notes opportunities to integrate common management-system elements while retaining OH&S-specific requirements. Existing ISO 9001 or ISO 14001 processes can help, but their presence does not prove the occupational safety requirements have been addressed.

Plan the internal audit around the system’s scope, significant risks, recent changes, and previous findings. Agree on the criteria, locations, methods, and reporting arrangements. Select auditors with the competence to assess the work and arrangements that support objective judgment. Avoid treating a person’s approval of their own work as an independent check.

Follow selected records through to the work they describe. If a contractor briefing is recorded, check what was communicated and observe the related controls. If an action is marked complete, examine the supporting evidence and look for recurrence. Record what was sampled, what could not be checked, and which questions remain unresolved.

Separate the immediate correction from prevention of recurrence

Replacing missing equipment corrects the immediate condition. Investigating why purchasing, storage, or shift handover failed helps identify what needs to change to prevent recurrence. Keep those decisions distinct. Choose corrective actions that address the established cause and agree on how their effectiveness will be checked.

Assign a reviewer and a suitable verification date for each action. An equipment replacement may be checked immediately, while a changed process may need another operating cycle or repeated observation. If the evidence does not show that the action worked, keep the finding open or revise the action. The tracker should reflect verified results rather than planned completion dates alone.

These audit practices are implementation recommendations. Use the licensed standard and any agreed certification criteria to establish the requirements for your organization.

Give leadership the information needed to evaluate the system, including performance, worker input, audit results, compliance evaluations, relevant changes, and progress on significant actions. Explain unresolved risks and the decisions needed to address them. Identify where equipment, staffing, time, or changes to priorities are necessary so the review leads to specific decisions.

Record the decisions, responsible people, and follow-up dates. Include agreed changes to priorities, resources, or objectives, and communicate decisions to those affected. At the next review, check whether the agreed actions were carried out. An attendance sheet records who met, but it does not show the decisions made or their results.

Review readiness with the certification body

• Agree the audit arrangements

  If seeking certification, agree the scope, schedule, and evidence expectations with the certification body.

• Check the operating evidence

  Check that applicable requirements have been assessed, controls are operating, internal audits and management review have been carried out, and findings have credible follow-up.

• Keep unresolved items visible

  Disclose unresolved items through the agreed process rather than hiding them from the audit team.

ISO 45001 describes a management system, not a guarantee that every activity is safe. Continue responding to actual hazards before, during, and after an audit. Keep improvement work connected to the field once the certificate has been issued.

Through Renew Safety’s ISO 45001 occupational health and safety service, you can discuss the assessment scope, implementation work, and unresolved findings. Share the locations in scope, existing processes, and known gaps so the discussion starts with your organization’s actual needs.