A safety system that holds up when the Department of Employment and Labour walks in.
ISO 45001 doesn’t replace South Africa’s Occupational Health and Safety Act. It gives you the documented, auditable management system regulators, clients and insurers increasingly expect to see sitting behind it.
What is ISO 45001, in one honest paragraph?
ISO 45001:2018 is the international standard for an Occupational Health and Safety Management System (OHSMS). It replaced the older OHSAS 18001, and it runs on the same Plan-Do-Check-Act cycle as every other ISO management standard: identify hazards, assess risk, control it, check whether the controls actually worked, and improve. What sets it apart from a basic safety file is the emphasis on worker participation — the people doing the risky work are formally involved in identifying and controlling the hazards, not just told the rules from head office.
South Africa already has a well-established legal framework for this in the Occupational Health and Safety Act of 1993 (OHSA), enforced by the Department of Employment and Labour. ISO 45001 doesn’t sit above or replace the OHSA — it gives you a systematic way of actually running what the Act requires, rather than a set of policy documents nobody has looked at since the last audit. Recent enforcement activity, including blitz inspections run jointly with Home Affairs since mid-2024, has made the gap between ‘we have a safety file’ and ‘we have a functioning safety management system’ a lot more visible.
Related work sits under our Compliance Audits & Reviews and Risk Assessments services.
Who in South Africa actually needs an ISO 45001 certificate?
Anyone with people doing physically risky work benefits from ISO 45001, but it clusters hardest in a handful of sectors. Construction and mining sit at the top — both carry real injury risk and both increasingly expect contractors to show a proper OHS management system, not just a CIDB grading and a safety file. Manufacturing and engineering follow close behind, especially anywhere with machinery, height work or hazardous materials. In heavy fabrication for mining and construction specifically, we’re also seeing pressure from bodies like the Southern African Institute of Welding to pair OHS certification with welding-specific quality standards, because the two risks — structural integrity and worker safety — sit right next to each other on site.
What this actually looks like on the ground
Downtown Spares again gives us the clearest local example — ISO 45001 was one of three standards (alongside 9001 and 14001) they certified to as a single integrated management system, specifically because a parts and logistics operation carries real day-to-day safety exposure: forklifts, racking, loading bays, staff moving heavy stock all day. Treating worker safety as part of the same audited system as quality and environmental management, rather than a bolt-on safety file, is exactly the shift ISO 45001 is designed to force.
We see the same pattern in engineering: businesses like Quicktrans Engineering and Lekabe Engineering operate in industries — construction, multidisciplinary engineering — where a documented, audited safety system isn’t a nice-to-have for winning work, it’s baseline evidence a client’s procurement team will ask to see before a contract is even signed.
The path from ‘we should probably get certified’ to certificate in hand
The biggest difference between an ISO 45001 project and a quality-management one is who’s in the room. This standard genuinely requires input from the people on the shop floor or the site, not just management — auditors will ask workers directly whether they were involved in identifying hazards.
- 1Hazard identification & risk assessment
Walking the actual site with your people to find the real hazards, not the textbook ones — see our Risk Assessments service.
- 2OHS policy & documentation
Building the management system documentation the standard requires, matched to how your site actually operates.
- 3Worker participation & training
Formally involving the people doing the risky work — this is the clause most safety files get wrong.
- 4Internal audit & management review
Testing the system before an external auditor does.
- 5Stage 1 audit
Documentation and readiness review by a SANAS-accredited certification body.
- 6Stage 2 audit
Auditors verify the OHSMS is genuinely operating on site, including interviews with workers themselves.
- 7Certification decision
Certificate issued, valid for three years subject to surveillance audits.
Most South African businesses complete this in five to nine months. As always, confirm your certification body is SANAS-accredited before you sign anything — it’s the detail that determines whether the certificate actually counts for tender purposes.
The audit doesn’t stop once you’re certified
ISO 45001 follows the same three-year certification cycle as every other management-system standard: initial Stage 1 and Stage 2 audits, a shorter surveillance audit at the end of year one and year two, and a full recertification audit before year three ends. What’s different in practice is what auditors go looking for at surveillance — incident and near-miss records, whether corrective actions from the last audit were actually closed out, and whether worker participation is still real rather than a box that got ticked once at Stage 2 and never revisited.
If your business has had a reportable incident since your last audit, expect it to come up directly at the next surveillance visit. That’s not a bad thing — it’s the system doing exactly what it’s meant to do.
ISO 45001 — the questions we get asked before anything else
01Is ISO 45001 the same as complying with the OHS Act?+
No. The Occupational Health and Safety Act (OHSA) is South African law and applies to you regardless of certification. ISO 45001 is a voluntary, internationally recognised management-system certificate that gives you a structured, audited way of actually running what the OHSA requires — recent enforcement trends make having that structure increasingly valuable, but the certificate itself doesn’t replace your legal obligations.
02Do construction companies need ISO 45001 in South Africa?+
Not by law specifically, but it’s increasingly requested by clients and main contractors as part of prequalification, particularly on larger infrastructure and mining-related projects, alongside CIDB grading rather than instead of it.
03What’s the difference between a safety file and an ISO 45001 OHSMS?+
A safety file is typically a static set of documents compiled for a specific site or project. An ISO 45001 OHSMS is an ongoing, audited management system with worker participation, internal audits, incident investigation and continual improvement built in — it’s a live process, not a folder.
04How long does ISO 45001 certification take?+
Most South African businesses complete the process in five to nine months, depending on site complexity, number of locations, and how mature existing safety practices already are.
05How often do I need to renew ISO 45001?+
Every three years, with shorter annual surveillance audits at the end of year one and year two. The same cycle applies across ISO 9001, ISO 14001 and ISO 45001, which is why certifying them together as an integrated system is usually more efficient.
06Can a small business get ISO 45001 certified?+
Yes. The standard scales to the size and risk profile of the business — a small engineering workshop and a large manufacturing plant both certify against the same clauses, with audit scope adjusted to match.
07What happens after a workplace incident if we’re already ISO 45001 certified?+
You investigate it through your OHSMS’s incident-investigation procedure, implement corrective action, and document it. Your certification body will typically review how the incident was handled at your next surveillance audit — a well-handled incident with clear corrective action is far less damaging to your certification than an unreported or poorly investigated one.
Ready to talk about your OHS Management System?
Book an obligation-free consultation and we’ll tell you honestly what your site actually needs.