ISO 45001 tells principal contractors and tender panels you run a proper health and safety management system, not a folder of risk assessments pulled together the week before an audit. This guide covers what UKAS-accredited auditors check on a construction site, the certification routes on offer in 2026, and which one fits a contractor your size.
Why this matters
Construction sits high on the risk register for any principal contractor framework, and PQQ scoring reflects that. Framework agreements and public sector tenders increasingly list ISO 45001 as a scored or mandatory criterion for 2026 submissions, alongside CDM 2015 duties that ISO 45001 does not replace.
A certificate without UKAS accreditation gets flagged or rejected by procurement teams who know the difference. Getting the certification route right the first time saves a repeat audit cycle.
Who this is for
This guide is for the operations director or SHEQ manager at a contractor running 20 to 250 staff, bidding on principal contractor frameworks or public sector lots, and likely already holding Cyber Essentials or working toward it. If your firm subcontracts across multiple live sites, the scope question in ISO 45001 matters more than the standard itself.
What to look for in ISO 45001 for construction firms
UKAS accreditation status
A certification body without UKAS accreditation issues a certificate procurement teams won't recognise. Check the certification body's UKAS scope before signing anything - construction-specific scope matters, not just a general ISO 45001 listing.
Auditor site experience
An auditor who has never walked a live construction site will miss the difference between a paper-based risk assessment and one that actually reflects working at height, plant movement, and subcontractor turnover. Ask for the auditor's sector background before the Stage 1 visit.
Integration with existing management systems
If you already run ISO 9001 for manufacturing and engineering firms style processes, or hold ISO 9001 already, ISO 45001 shares enough structure (Annex SL) to combine into one integrated management system. Combined audits cut total site-visit days versus running each standard separately.
Audit scheduling around live sites
Construction audits can't happen the way an office audit does - subcontractors rotate, sites open and close, and the auditor needs to see live operations. Confirm the certification body will schedule Stage 2 around an active site, not a quiet week in the yard.
Multi-site and subcontractor scope
If your PQQ submissions cover multiple active sites, the certificate scope needs to say so explicitly. A certificate scoped to head office only doesn't satisfy a framework that wants site-level assurance.
Cost structure across the three-year cycle
ISO 45001 runs on a three-year certification cycle with an annual surveillance audit in years two and three. Budget for all three years up front, not just the initial certification cost - the surveillance audits are where certification bodies vary most on price.
Certification routes for ISO 45001
Full-service UKAS-accredited certification body - the standard route. One certification body runs the full Stage 1 and Stage 2 audit and issues the certificate directly. Buy this route if you're bidding on public sector frameworks where auditor credibility is scored.
Consultant-led gap analysis then certification - the guided route. A consultant builds your management system documentation and preps you for the same two-stage audit, then a separate UKAS-accredited body certifies. Consider this if you have no in-house SHEQ resource and need someone to build the system from scratch.
Integrated management system covering ISO 45001, ISO 9001, and ISO 14001 - the efficient route. One combined audit covers all three standards in fewer total site-visit days than running them separately. Buy this if you already hold one of the three - the incremental audit effort for the other two is smaller than starting fresh.
DIY implementation with no external support - the wildcard. You still need a UKAS-accredited certification body to issue the actual certificate; going fully DIY only removes consultant cost, not audit cost. Skip this if you're tendering on frameworks where a shaky Stage 1 result delays your bid window.
Cyber compliance sorted while you handle H&S
OneClickComply automates ISO 27001, Cyber Essentials and SOC 2 certification end-to-end.
What to avoid
- Certificates without UKAS accreditation. They look identical to a real one on a PowerPoint slide and mean nothing to a procurement team who checks the register.
- Software platforms with no construction sector track record. A tool built for office-based compliance doesn't handle multi-site, subcontractor-heavy evidence the way a construction audit needs.
- Treating ISO 45001 as a CDM 2015 substitute. The management system certificate and your principal contractor duties under CDM 2015 are separate obligations - one doesn't discharge the other.
For help deciding which certification to prioritise first when you're weighing more than one standard, choosing the right compliance framework walks through the decision.
Verdict comparison
| Route | UKAS accreditation | Best for | Cycle | Verdict |
|---|---|---|---|---|
| Full-service certification body | Direct | Public sector bidders | 3 years, annual surveillance | Buy |
| Consultant-led then certify | Via separate body | No in-house SHEQ resource | 3 years, annual surveillance | Consider |
| Integrated with ISO 9001/14001 | Direct | Firms already ISO-certified | 3 years, annual surveillance | Buy |
| DIY implementation | Still required for certificate | Very small, low-tender-volume firms | 3 years, annual surveillance | Skip |
Frequently asked questions
One last thing
Many frameworks bundle a health and safety requirement and a cyber security requirement into the same PQQ, so ISO 45001 and Cyber Essentials often need to land together rather than one after the other. Contractors who plan both certifications on the same timeline avoid a second scramble six months later.