ISO 45001 certification: what it is and how Canadian employers get it

What ISO 45001 actually is

ISO 45001 is the international standard for occupational health and safety management systems. Its object is preventing work-related injury and ill health: hazard identification, risk control, legal compliance, worker participation and consultation, incident investigation, and continual improvement, organised as a management system rather than a pile of policies.

The current edition is ISO 45001:2018, and it remains the first edition of the standard. A revision has been in progress, but until a new edition is actually published, ISO 45001:2018 is what certification is assessed against.

Who can certify you, and why accreditation matters

ISO writes standards; it does not certify anyone. Certification comes from an independent certification body, and the question worth asking any of them is who accredits them.

In Canada that is the Standards Council of Canada, which states it is the only internationally recognised accreditation body in Canada offering occupational health and safety management systems accreditation. The SCC is a signatory to the International Accreditation Forum multilateral arrangement, which is the mechanism that makes a Canadian certificate mean something to a customer in another country.

An unaccredited certificate is not illegal and it is usually cheaper. It is also worth considerably less to the customer who asked you for it, which is normally the entire reason for getting certified.

ISO 45001 and COR are not the same thing

Both are safety management frameworks and employers regularly confuse them, but they answer to different audiences. COR is a Canadian construction-sector programme granted provincially — by the IHSA in Ontario — and its value is largely in qualifying for work with owners who ask for it. ISO 45001 is an international standard certified by accredited bodies, and it travels: it is what a customer or a parent company outside Canada is likely to recognise.

Holding one does not give you the other. They do, however, share most of the underlying substance — hazard identification, documented procedures, competence, incident management, internal audit — so an employer who has built one has done much of the work for the other.

Running it alongside ISO 9001

ISO 45001 is built on the ISO Harmonized Structure — the common clause framework that ISO renamed from "Annex SL" in 2021. So is ISO 9001. Clauses 4 to 10 cover the same ground in the same order in both: context of the organization, leadership, planning, support, operation, performance evaluation and improvement.

The practical consequence is that an organization holding both does not need two management systems. Document control, internal audit, management review, competence records and corrective action can run once and serve both standards. Building them separately and reconciling them later is the expensive way round.