ISO 45001 Recertification Audit: The Complete 2026 Guide

An ISO 45001 recertification audit is the on-site audit in year 3 of your certification cycle that decides whether your occupational health and safety certificate gets renewed. It covers the whole scope, runs at about two thirds of a fresh initial audit, and has a hard stop: every major nonconformity has to be corrected before the certificate expires.

Three things make this audit different from its quality and environmental cousins. Part of it can never be done remotely. The flexible audit programs other standards can use in later cycles are closed to OH&S. And the 2027 edition of the standard is close, with no transition schedule to plan against yet.

This guide covers what the audit checks, how many days to expect, what happens if you miss the date, and how to plan your renewal while the new edition is pending. If you are still working toward your first certificate, start with how ISO 45001 certification works.

What an ISO 45001 recertification audit actually checks

The rules come from ISO/IEC 17021-1:2015, the standard every accredited certification body (your registrar) works to. Clause 9.1.3.2 sets the three-year program: a two-stage initial audit, surveillance in years 1 and 2, and recertification in year 3. Clause 9.6.3.2.1 says the ISO 45001 recertification audit shall include an on-site audit, and it must address three things:

• The effectiveness of the management system across the whole certified scope.
• Your demonstrated commitment to keep it effective and keep improving it.
• Whether the system is achieving your objectives and intended results.

Notice the word running through all three. A surveillance audit samples the system. A recertification audit asks whether it works, and it asks across the full three years. Under clause 9.6.3.1.2, the audit team also reviews your previous surveillance reports, so a finding raised in year 1 and quietly dropped will come back.

A stage 1 is not automatic for an ISO 45001 recertification audit. Clause 9.6.3.1.3 says one may be needed where there have been significant changes to the management system or changes to legislation. A new site, a new high-risk process or an OH&S regulation that reshaped your controls can all trigger that conversation, so raise them early.

Point of comparison	Surveillance audit	ISO 45001 recertification audit
When	Years 1 and 2	Year 3, before expiry
Coverage	A sample, not necessarily the full system	Whole certified scope
Audit time	About 1/3 of the initial audit	About 2/3 of a fresh initial audit
Major nonconformity deadline	Set by the certification body’s procedure	Corrected before the certificate expires
Result	Certificate maintained	A new three-year certificate

For the annual visits themselves, see our ISO 45001 surveillance audit guide.

When the ISO 45001 recertification audit has to happen

Clause 9.6.3.1.1 requires the ISO 45001 recertification audit to be planned and conducted in time for renewal before the expiry date. The standard does not set a fixed number of months. In practice, the date that matters is not the audit but the certification decision, which comes after the audit and after any majors are closed.

So plan backward from the expiry date printed on your certificate. The timings below are typical planning practice, not requirements, and your certification body may ask for something different.

Before expiry	What should happen
9–12 months	Confirm audit dates, send updated headcount and site data, flag significant changes
6–9 months	Finish the internal audit cycle and a management review covering the three years
3–6 months	ISO 45001 recertification audit takes place
1–3 months	Correct any majors, submit evidence, certification decision
Expiry date	The new certificate should already be in hand

An ISO 45001 recertification audit in the last few weeks leaves no room for a major finding. That is the most common self-inflicted problem in this process, and it is avoidable with one early phone call.

How long an ISO 45001 recertification audit takes

Audit time comes from IAF MD 5:2023, now republished by Global ACI as TECH-3-004. Clause 6 says ISO 45001 recertification audit time is normally about two thirds of the time an initial audit (stage 1 plus stage 2) would need if it were carried out today. The clause says outright that this is not two thirds of the original time.

That is the detail to check in your quote. Your days are calculated on your current effective personnel and your current risk profile, so growth since the first audit raises the figure.

The starting figures come from Table OH&SMS 1, indexed on effective personnel and OH&S risk complexity. Applying two thirds and rounding to the nearest half day, as clause 2.2.3 requires, gives this shape:

Effective personnel	Fresh initial audit, days (high / med / low)	Indicative recertification, days (high / med / low)
1–5	3 / 2.5 / 2.5	2 / 1.5 / 1.5
6–10	3.5 / 3 / 3	2.5 / 2 / 2
11–15	4.5 / 3.5 / 3	3 / 2.5 / 2
16–25	5.5 / 4.5 / 3.5	3.5 / 3 / 2.5
26–45	7 / 5.5 / 4	4.5 / 3.5 / 2.5
46–65	8 / 6 / 4.5	5.5 / 4 / 3
66–85	9 / 7 / 5	6 / 4.5 / 3.5
86–125	11 / 8 / 5.5	7.5 / 5.5 / 3.5
126–175	12 / 9 / 6	8 / 6 / 4
176–275	13 / 10 / 7	8.5 / 6.5 / 4.5
276–425	15 / 11 / 8	10 / 7.5 / 5.5

The right-hand column is our arithmetic, not a table in the document. Treat it as a way to sanity-check an ISO 45001 recertification audit quote, because clause 8 lets your certification body adjust up or down, and clause 3.9 caps reductions from the table at 30%.

A worked example: a high-complexity manufacturer had 40 effective personnel at its initial audit, so 7 days. It now has 60. The ISO 45001 recertification audit is based on 8 days, not 7, which gives about 5.5 days rather than 4.5.

Count people carefully. For OH&S, clause 1.9 extends effective personnel to contractors and subcontractors whose work can affect your OH&S performance. Sending a headcount with only your payroll number invites a recalculation later. For what those days cost, see ISO 45001 certification cost.

Four OH&S rules that shape an ISO 45001 recertification audit

Most recertification advice is written generically across ISO standards. These four rules from TECH-3-004 apply specifically to OH&S, and each one changes how you plan.

It can never be fully remote

Clause 4 limits remote activity for OH&S to reviewing documents and records and interviewing staff and workers. It also says process control and OH&S risk control cannot be audited remotely. Someone has to walk the floor.

No individualized program in later cycles

Clause 7 lets certification bodies design individualized surveillance and recertification programs for second and later cycles, with accreditation body approval. Then it adds a short sentence: for OH&SMS these requirements are not applicable. A mature OH&S system does not earn a lighter ISO 45001 recertification audit this way, so any such offer deserves a question.

Some sites get more time

Clause 8 lists increases that apply to OH&S only. They include accident and occupational disease rates above the sector average, members of the public on site, OH&S legal proceedings, large temporary contractor presence during shutdowns, dangerous substances at major-accident quantities, and sites abroad where the legislation and language are not well known.

Temporary workers rarely reduce the count

Clause 2.3.6 says the headcount reduction for temporary unskilled personnel is in principle not applicable to OH&S, because those workers can be a source of OH&S risk. If your seasonal workforce is large, expect them to count.

What auditors press at an ISO 45001 recertification audit

An ISO 45001 recertification audit looks for three years of evidence that the system works. These are the areas where a thin record shows up fastest.

ISO 45001 clause	What they want to see
4.1, 4.2	Context and interested-party records that address climate change, per Amendment 1:2024
5.4	Consultation and participation of non-managerial workers, with records across the cycle
6.1.2	Hazard identification and risk assessments that changed when the work changed
6.1.3, 9.1.2	A current legal register and evaluations of compliance for the full period
8.1.3, 8.1.4	Management of change, plus control of contractors and outsourced work
8.2	Emergency drills tested and reviewed, not only planned
9.2, 9.3	A completed internal audit program and management reviews with real decisions
10.2	Incidents investigated with root cause, and actions shown to be effective

Compliance evaluation trips up many sites, because a register can look complete while the evaluation behind it stopped in year 1. Our guide to ISO 45001 evaluation of compliance covers what a defensible record looks like.

ISO 45001 recertification audit findings and the expiry date

Clause 9.6.3.2.2 is the rule that sets your schedule: for any major nonconformity, correction and corrective action must be completed before the certificate expires. You may see 90 days quoted as a universal limit for closing findings. ISO/IEC 17021-1 does not say that. Deadlines like that come from your certification body’s own procedure, so read that document rather than a blog post, this one included.

The date mechanics are worth knowing too:

• Finish early, and clause 9.6.3.2.3 allows the new expiry date to be based on the old one, so an early audit does not have to cost you months.
• Do not finish, and clause 9.6.3.2.4 says recertification shall not be recommended and the certificate not extended.
• Miss expiry, and clause 9.6.3.2.5 lets the certification body restore certification within 6 months if the outstanding activities are completed. After that, at least a stage 2 is required.

Restoration keeps the old cycle, but it does not erase the gap. The new certificate’s effective date falls on or after the recertification decision, so you can have a period with no valid certificate. If a contract or tender requires continuous ISO 45001 certification, that gap is the real cost. Check your contracts before you treat the 6-month window as a safety net.

Your ISO 45001 recertification audit and the 2027 edition

ISO 45001:2018 is at stage 90.92, International Standard to be revised, and ISO’s page says it is expected to be replaced within the coming months. DNV says the date has not been communicated and that Global ACI’s transition requirements for ISO 45001:2027 are not yet available. Our ISO 45001 revision guide tracks the draft itself.

For an ISO 45001 recertification audit today, the position is simple. You are audited against ISO 45001:2018 with Amendment 1:2024. No auditor can raise a nonconformity against an unpublished draft.

Planning further out takes more care, because nobody can give you a real 45001 transition deadline. The closest guide is ISO 14001:2026, published on 15 April 2026. Its Global ACI transition document gave a three-year transition ending 30 April 2029, with accreditation decisions due about a year after publication. It also allowed the transition audit to run alongside a surveillance or recertification audit, or as a separate special audit.

If ISO 45001 follows that pattern, which is an assumption and not a rule, your expiry date points to a rough plan:

Your certificate expires	Planning assumption
Before the new edition publishes	Renew against ISO 45001:2018. Your next cycle will carry the transition.
Within about a year after it publishes	Probably still a 2018 renewal, since your certification body may not yet be accredited to the new edition. Ask them.
Later in the transition window	Your renewal may be the natural transition moment, if the final rules allow it. Budget for possible extra time.

Ask your certification body one question in writing: how would a renewal issued now interact with a future transition end date? Under the ISO 14001 rules, a client that declines to transition may not keep certification beyond the end of the transition period. Do not delay a renewal in the hope of avoiding a later audit, because the certificate’s expiry date will not wait for the standard.

How to prepare for an ISO 45001 recertification audit

Most ISO 45001 recertification audit preparation is confirming the record is complete. Work through this list in order, starting at least six months out.

1. Find the expiry date on your certificate and write down the date you want the certification decision made by.
2. Send your certification body updated headcount, contractor numbers, sites, shifts and activities, then check the audit days against the table above.
3. Pull every surveillance report from the cycle and confirm that each finding is closed, with evidence that the action worked.
4. Complete the internal audit program across all clauses and all sites in scope. Our ISO 45001 internal audit checklist runs from clause 4 to clause 10.
5. Hold a management review that looks at the three-year trend in incidents, objectives and worker consultation rather than the last quarter alone.
6. Refresh your hazard identification and legal register for any change since the initial audit, and record climate in your context work if it is missing.
7. Choose the people and areas for the floor walk, including contractors, and tell them what the auditor will ask.
8. Hold time in the following weeks for corrective action, so a major finding does not meet a closed calendar.

If your documents have drifted over three years, our ISO 45001 Toolkit provides 50 editable templates for ISO 45001:2018, including the OH&S manual and policy, hazard and risk assessment, the legal register, incident investigation, internal audit and management review. It is $99, delivered instantly, and useful for filling gaps before your ISO 45001 recertification audit. The templates still need your own content and evidence behind them.

Frequently asked questions

How often is an ISO 45001 recertification audit required?

Every three years. ISO/IEC 17021-1 clause 9.1.3.2 places recertification in the third year of the cycle, which starts at the certification decision. Later cycles start at the recertification decision.

Can an ISO 45001 recertification audit be done remotely?

Not in full. Clause 9.6.3.2.1 of ISO/IEC 17021-1 requires an on-site audit, and TECH-3-004 clause 4 says OH&S process control and risk control cannot be audited remotely. Document review and interviews can be remote where your certification body allows it.

Is an ISO 45001 recertification audit shorter than the initial audit?

Usually, at about two thirds of the time a fresh initial audit would take on your current numbers. If you have grown or your risk profile has increased, it can approach or exceed what you remember from the original visit.

What happens if the certificate expires before the audit is finished?

The certificate lapses. The certification body may restore it within 6 months once the outstanding activities are complete, and after that at least a stage 2 is required. Either way, you can have a gap with no valid certificate.

Should I wait for ISO 45001:2027 before recertifying?

No. Your expiry date is fixed and the new edition has no confirmed publication date or transition schedule. Renew on time against the current edition and ask your certification body how they expect to handle the transition.

The short version

An ISO 45001 recertification audit is an on-site, whole-scope audit in year 3, at about two thirds of a fresh initial audit on today’s numbers. Majors must be closed before expiry, process and risk control cannot be audited remotely, and the 2027 edition has no transition schedule yet. Start with the date on your certificate and work backward.

For the wider picture, read our guide to ISO 45001 workplace safety. If you run an integrated system, our ISO 14001 recertification audit guide covers the environmental side, which already has a dated transition.

Primary sources: ISO 45001:2018 on iso.org, Global ACI-TECH-3-004 (M), Determination of Audit Time (formerly IAF MD 5), and an IAS summary of ISO/IEC 17021-1:2015 Section 9.