ISO 45001 Certification Body: The Essential 2026 Guide

Choosing an ISO 45001 certification body is the decision that sets the cost, the tone and the credibility of your whole three-year certification cycle, and most buyers make it on price alone. That is a mistake you only notice later: when a customer’s procurement team rejects the certificate because it carries no recognized accreditation mark, or when an auditor with no background in your hazards spends two days on paperwork and never walks the shop floor.

This guide explains what separates a credible ISO 45001 certification body (often called a registrar in the US) from a certificate mill, the rules every accredited body has to follow for occupational health and safety audits, and the questions to ask before you sign a three-year contract.

What an ISO 45001 certification body actually does

A certification body is the independent organization that audits your occupational health and safety management system against ISO 45001:2018 and, if you conform, issues the certificate. It does not help you build the system. It plans and runs the stage 1 and stage 2 audits, makes the certification decision, then audits you again in years two and three (surveillance) and before the certificate expires (recertification). If you are new to that sequence, our ISO 45001 certification process guide walks through each step.

Every accredited certification body works to ISO/IEC 17021-1:2015, the general requirements for bodies that audit and certify management systems. For occupational health and safety, two more documents sit on top of it:

• ISO/IEC TS 17021-10:2018 sets the additional competence requirements for people who audit OH&S management systems, review the reports and make certification decisions.
• Global ACI-TECH-3-016 (M), issued 10 July 2026, is the mandatory application document for OH&S certification. It is the former IAF MD 22:2023, reformatted when the International Accreditation Forum’s role passed to the Global Accreditation Cooperation Incorporated (Global ACI), with no substantive change to the text.

Those documents matter to you as a buyer because they define what a properly run ISO 45001 audit looks like. A body that does not follow them is not giving you the audit your customers assume you had.

Accredited vs unaccredited: the first filter for any ISO 45001 certification body

Nothing in ISO 45001 requires you to use an accredited body. You can legally buy a certificate from anyone. The market, however, does not treat the two the same way.

Factor	Accredited certification body	Unaccredited certification body
Who checks the auditor	A national accreditation body (for example ANAB in the US, UKAS in the UK) witnesses audits and reviews files	No one outside the company
Rules followed	ISO/IEC 17021-1, ISO/IEC TS 17021-10, Global ACI-TECH-3-016 and -004	Whatever the company decides
Audit time	Minimum audit days set by Global ACI-TECH-3-004 (formerly IAF MD 5), scaled to headcount and OH&S risk	Often a fixed one- or two-day package
Certificate mark	Carries the accreditation body’s mark for the accredited scope	Company logo only, or a look-alike “accreditation” from an unrecognized body
Recognized in tenders	Generally yes, and often required by name	Frequently rejected
Transfer to another body later	Possible under Global ACI-TECH-3-002 without starting over	Not possible; you restart with a full initial audit

Check accreditation yourself rather than trusting the sales deck. Ask for the accreditation certificate and the scope schedule, then confirm both on the accreditation body’s own website. The IAF CertSearch database (iafcertsearch.org) also lets you look up accredited certificates and the bodies that issued them. Be wary of “accreditation” from bodies with official-sounding names that are not members of a recognized regional or global arrangement; buying such a certificate is the most common way companies end up paying twice.

Check the scope sectors, not just the logo

Accreditation is not a blanket permission. An ISO 45001 certification body is accredited for specific economic sectors. Appendix B of Global ACI-TECH-3-016 lists 39 OH&S sectors, mapped to NACE Rev. 2 codes, from agriculture and mining through construction, chemicals and health care to education and public administration. The same appendix lists typical hazards for each sector, such as confined spaces and silica dust in mining, or biological exposure in health and social work.

A body accredited for office-based services may not be accredited for your manufacturing or construction work. If your activities fall outside its accredited scope, it can still issue a certificate, but that certificate will not carry the accreditation mark for your sector, and a procurement team that checks will treat it as unaccredited. Ask the body which sector number it will place you under, and check that number on the accreditation schedule.

Auditor competence: what ISO/IEC TS 17021-10 adds

ISO/IEC TS 17021-10:2018 defines competence for three groups: auditors, the people who review audit reports and make certification decisions, and other personnel. For OH&S, the “technical area” in ISO/IEC 17021-1 is tied to the processes and services and the hazards that can expose workers to risk. In plain terms, the auditor assigned to your site should understand the hazards your workers actually face, not only the clauses of the standard.

Ask for the proposed lead auditor’s sector experience before you contract. A good ISO 45001 registrar will tell you which technical area it has assigned to you and why the named auditor is qualified for it. A vague answer here is a strong signal about the audit you will get.

What Global ACI-TECH-3-016 requires of an ISO 45001 certification body

The OH&S application document contains several rules that change how your audit runs. Knowing them helps you judge a quote and prepare your people.

• Your application must disclose hazards. The information you give the body must include your key hazards and OH&S risks, the main hazardous materials used, and relevant legal obligations from applicable OH&S legislation. It must also cover personnel working away from your premises.
• Off-site and temporary work is in scope. If your people work at a client’s premises, the body must verify your system covers those activities and consider auditing such sites periodically. Temporary sites, for example construction sites, are covered by the system of the organization that controls them and are audited on a sample basis.
• Multi-site sampling is limited. Where sites do not share the same activities, processes and OH&S risks, sampling is not appropriate, and every site must be visited.
• Interviews are mandatory. The audit team must interview the management with legal responsibility for OH&S, the employees’ representatives with OH&S responsibility, personnel who monitor employee health (such as doctors and nurses), and managers plus permanent and temporary employees. Contractors’ management and employees should also be considered.
• The closing meeting has a guest list. You will be asked to invite the legally responsible management, health-monitoring personnel and employee OH&S representatives, and the body records why if any of them are absent.
• Serious incidents must be reported. Your contract must require you to tell the body, without delay, about a serious incident or regulatory breach that involves the competent regulator. The body may then run a special audit and can suspend or withdraw the certificate if the system seriously failed.
• Consultancy limits are wider than you might expect. Acting as your OH&S coordinator, doing safety reporting, performing risk assessments, talking to regulators on your behalf, and investigating accidents all count as management system consultancy, which an accredited certification body must not offer.

Legal compliance is a certification condition

Appendix A of TECH-3-016 makes legal compliance central to the certification decision. An organization that cannot show its initial or ongoing commitment to legal compliance shall not be certified, and deliberate or consistent non-compliance precludes certification or causes suspension or withdrawal. Where you are not yet fully compliant, you must show an implementation plan with a declared completion date, and show that hazards to workers are addressed in the meantime.

The certification body does not issue statements of legal compliance. It verifies your own evaluation of compliance, which is why clause 9.1.2 of ISO 45001 gets so much attention at audit. Our guide to ISO 45001 evaluation of compliance covers what that record should contain.

How to compare ISO 45001 certification body quotes

Quotes differ more in what they include than in the day rate. Normalize them before you compare.

Question to ask	Why it matters
How many audit days for stage 1, stage 2, each surveillance and the recertification?	Audit time must follow Global ACI-TECH-3-004; a quote far below a competitor’s may not be compliant
Which accredited sector will my certificate fall under?	Confirms the accreditation mark will cover your activities
Who is the lead auditor, and what is their sector background?	Tests competence under ISO/IEC TS 17021-10
Are travel, report fees, certificate fees and annual administration charges included?	These extras often close the gap between “cheap” and “expensive” quotes
Is the price fixed for all three years?	Surveillance and recertification pricing can rise mid-cycle
How will you sample my sites and any temporary work locations?	Sampling rules for OH&S are stricter than for quality audits
Can you audit ISO 9001 and ISO 14001 at the same time?	Integrated audits can reduce total audit days and disruption

For typical budget ranges and what drives them, see our ISO 45001 certification cost breakdown.

Changing your ISO 45001 certification body

You are not locked in for life. Under Global ACI-TECH-3-002 (M), formerly IAF MD 2, a valid accredited certificate can be transferred to another accredited body. Only valid certification can move; a certificate known to be suspended cannot be accepted. The new body performs a pre-transfer review, a document review that may include a pre-transfer visit where it finds a need, for example outstanding major nonconformities. If no problems are found, your existing certification cycle continues and the new body sets the audit program for the rest of it. If problems are found, you may be treated as a new client and the cycle restarts from the certification decision.

Practical advice: switch between audits, not during one, and make sure any open major nonconformities are closed first. The timing of your next ISO 45001 surveillance audit is usually the deciding factor.

The 2027 revision and your choice of body

ISO 45001:2018 is under revision. ISO lists it as “to be revised,” and its own page says the new edition is expected to replace the current one, with publication planned as ISO 45001:2027. As of November 2026 no transition arrangements have been published, so no deadline applies yet. When you sign a multi-year contract, ask how the body will handle the transition audit, whether it can be combined with a scheduled surveillance or recertification visit, and whether that work is priced into your contract.

Frequently asked questions

Is an ISO 45001 registrar the same as a certification body?

Yes. “Registrar” is the common US term; “certification body” is the term used in ISO/IEC 17021-1 and by accreditation bodies. Both mean the independent organization that audits you and issues the certificate.

Does an ISO 45001 certification body have to be accredited?

No law or clause of ISO 45001 requires it, but most customers and tenders expect an accredited certificate. Unaccredited certificates are often rejected and cannot be transferred to another body without a full new initial audit.

How long is an ISO 45001 certificate valid?

Accredited certificates run on a three-year cycle under ISO/IEC 17021-1, with surveillance audits in years two and three and a recertification audit before expiry.

Can my consultant’s firm also certify us?

An accredited certification body must not offer management system consultancy, and Global ACI-TECH-3-016 counts OH&S services such as risk assessments, safety reporting and accident investigation as consultancy. Keep the people who help you build the system separate from the body that certifies it.

What happens if we have a serious accident while certified?

You must inform the certification body without delay where the regulator is involved. The body may run a special audit and, if the system is shown to have seriously failed, suspend or withdraw the certificate.

Get audit-ready before you call a certification body

A certification body will judge the system you have, not the one you plan to build. If your policy, hazard register, legal register, evaluation of compliance and incident records are not yet in place, the ISO 45001 Toolkit gives you editable templates for the documents auditors ask for first, so the stage 1 audit finds a working system rather than a project plan.