ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
An ISO 45001 surveillance audit is the shorter annual audit that keeps your certificate alive between the initial three-day-plus assessment and the recertification audit in year three. It is not a formality. Your certification body can suspend a certificate for refusing one, and because of a rule unique to occupational health and safety, it is the one management-system surveillance audit that can never be run entirely from a laptop.
This guide works through the mechanics from the two documents that actually govern them: ISO/IEC 17021-1:2015, which sets what a certification body must audit and when, and IAF MD 5:2023 Issue 4 Version 3, which sets how many days it gets. Both are free to read, and both say things about OH&S audits that general “ISO surveillance” advice leaves out.
Free gap assessment
Could you prove workers take part in safety decisions?
Score every clause of ISO 45001, free, including the consultation and participation evidence that fails more audits than any other requirement.
Run the free ISO 45001 gap assessment → or View premium report sample
Clause 9.6.2.2 of ISO/IEC 17021-1 is blunt about scope: surveillance audits are on-site audits, but they are not necessarily full system audits. Your auditor is not re-auditing all of clauses 4 to 10. They are sampling, and eight areas are mandatory in every single surveillance.
| The eight mandatory review areas (clause 9.6.2.2) | What to have ready |
|---|---|
| a) Internal audits and management review | Audit programme, reports for the period, management review minutes with all clause 9.3 inputs and outputs |
| b) Actions taken on nonconformities from the previous audit | Corrective action records with root cause, action, verification of effectiveness — not just “closed” |
| c) Complaints handling | Worker and external complaints log, including OH&S concerns raised and how they were resolved |
| d) Effectiveness against your objectives and intended results | OH&S objectives with measured progress, incident and ill-health trends, leading indicators |
| e) Progress of planned continual improvement activities | Improvement plans with dates, evidence of what moved and what slipped |
| f) Continuing operational control | Clause 8 evidence: permits, safe systems of work, contractor control, emergency drills |
| g) Review of any changes | New sites, processes, substances, shift patterns, headcount, legal changes, and the hazard reassessment each triggered |
| h) Use of marks and references to certification | Website, tenders, email footers, vehicle livery — anything carrying the certification mark |
Item (g) is where most ISO 45001 surveillance audit findings start. OH&S systems drift faster than quality systems because the hazards move: a new machine, a new contractor, a new building, a new night shift. If the change register and the hazard identification records do not line up, the auditor has a nonconformity without having to look very hard.
Clause 9.6.2.1.2 also makes clear that on-site auditing is only part of surveillance. The certification body may send enquiries between visits, review your website and promotional material against your certified scope, ask for documented information, and monitor your performance by other means. An ISO 45001 surveillance audit is the on-site part of a year-round relationship, not a single date in the diary.
The programme your ISO 45001 surveillance audit sits inside is fixed by clause 9.1.3.2. A three-year cycle begins at the certification decision — not the audit, not the certificate print date. You get a two-stage initial audit, surveillance audits in the first and second years following that decision, and a recertification audit in year three before the certificate expires. Later cycles start at the recertification decision.
Two timing rules in clause 9.1.3.3 catch people out, and both bite on the first ISO 45001 surveillance audit. Surveillance audits happen at least once per calendar year, except in recertification years. And the first surveillance audit after initial certification must be no more than 12 months from the certification decision date.
| Cycle year | Audit | Clock it runs against |
|---|---|---|
| Year 0 | Stage 1 + stage 2 initial audit, then the certification decision | Cycle starts at the decision |
| Year 1 | First ISO 45001 surveillance audit | Within 12 months of the certification decision date |
| Year 2 | Second surveillance audit | At least once in the calendar year |
| Year 3 | Recertification audit | Completed in time for renewal before expiry |
That 12-month rule is measured from a date you may not have written down. If your decision was made six weeks after your stage 2 closing meeting, your first surveillance deadline moved six weeks later too — and if you diary it off the stage 2 date instead, you will book late. Ask your certification body for the certification decision date in writing and put that, not the audit date, in the calendar.
Clause 9.1.3.3 carries a note allowing frequency to be adjusted for things like seasons or systems of limited duration, such as a temporary construction site. If your highest-risk work only happens in one quarter, say so during audit planning. An auditor who visits the quiet month has sampled nothing useful, and both of you have wasted the days.
The length of an ISO 45001 surveillance audit comes from IAF MD 5:2023, now republished by Global ACI as TECH-3-004. Clause 5 sets the proportion: annual surveillance time should be about one third of the audit time spent on the initial certification audit, stage 1 and stage 2 combined. The clause adds a note that a surveillance audit is unlikely to run less than one audit day.
The initial figure comes from Table OH&SMS 1, which is indexed on the effective number of personnel and on the complexity category of your OH&S risk. Working clause 5’s one third against that table, and rounding to the nearest half day as clause 2.2.3 requires, gives the realistic shape of an ISO 45001 surveillance audit:
| Effective personnel | Initial audit (high / med / low) | Indicative annual surveillance (high / med / low) |
|---|---|---|
| 1–5 | 3 / 2.5 / 2.5 days | 1 / 1 / 1 day |
| 6–10 | 3.5 / 3 / 3 | 1 / 1 / 1 |
| 11–15 | 4.5 / 3.5 / 3 | 1.5 / 1 / 1 |
| 16–25 | 5.5 / 4.5 / 3.5 | 2 / 1.5 / 1 |
| 26–45 | 7 / 5.5 / 4 | 2.5 / 2 / 1.5 |
| 46–65 | 8 / 6 / 4.5 | 2.5 / 2 / 1.5 |
| 66–85 | 9 / 7 / 5 | 3 / 2.5 / 1.5 |
| 86–125 | 11 / 8 / 5.5 | 3.5 / 2.5 / 2 |
| 126–175 | 12 / 9 / 6 | 4 / 3 / 2 |
| 176–275 | 13 / 10 / 7 | 4.5 / 3.5 / 2.5 |
| 276–425 | 15 / 11 / 8 | 5 / 3.5 / 2.5 |
Treat the right-hand column as the shape of the answer, not a quote. Your certification body does the calculation, and clause 5 requires it to review the planned surveillance time at every surveillance and recertification audit to reflect changes in the organization and the maturity of the system, recording the review and any adjustment. Audit time also includes off-site planning, document review and report writing under clause 2.1.1, while travel and breaks are excluded by clause 2.1.3.
One number you cannot negotiate away: clause 2.2.2 forbids cutting audit days at the planning stage by programming longer working days. If someone offers to compress your ISO 45001 surveillance audit into one very long day, that is not a saving your certification body is allowed to make.
Clause 1.12 is OH&S-specific: audit time rests on three complexity categories, based on the nature and severity of your OH&S risks. Table OH&SMS 2 maps sectors onto them.
| Category | Typical sectors | Consequence of control failure |
|---|---|---|
| High | Construction, heavy manufacturing and processing, mining, offshore fishing, commercial effluent treatment | Could put life at risk or cause serious injury or illness |
| Medium | Food and beverage processing, textiles, metal products, electrical and electronic assembly, passenger transport, hotels and leisure, technical testing and laboratories, education | Could result in injury or illness |
| Low | Corporate HQ and holding companies, general business services, telecommunications and postal services, restaurants, estate agency, public administration, financial institutions | May result in minor injury or illness |
For an ISO 45001 surveillance audit, Table OH&SMS 2 is a starting point, not a verdict. The guidance says plainly that not all organizations in a sector fall in the same category, and the certification body should keep flexibility in contract review to look at your actual activities. Its own example: shipbuilding is normally high risk, but a firm building small carbon-fibre boats could sit at medium. Where a certification body lowers your category it must document the case — so if you believe you have been priced as high risk for office-based work, that is a reviewable decision with a paper trail behind it.
Several adjustment factors increase OH&S audit time specifically, and they feed into every ISO 45001 surveillance audit as well as the initial one: an accident and occupational disease rate above the sector average, members of the public present on site (hospitals, schools, airports, ports, stations, public transport), live legal proceedings related to OH&S, the temporary presence of many subcontractors during a shutdown or turnaround, and dangerous substances held in quantities that bring major-accident regulations into play.
Two reductions available to quality and environmental systems are closed off for OH&S. The temporary-unskilled-personnel reduction in clause 2.3.6 is in principle not applicable, because employing temporary unskilled staff is itself a source of OH&S risk. High levels of automation and low-risk activity reductions are also marked not applicable. Headcount reductions for genuinely identical exposure are allowed, but they must be documented with the risk reasoning, and groups doing repetitive work that lowers attention need the risk assessed rather than discounted.
This is the rule that distinguishes OH&S from every other management system, and most generic surveillance advice misses it. IAF MD 5’s remote-audit provisions limit OH&S remote activity to reviewing documents and records and interviewing staff and workers — and then state directly that process control and OH&S risk control cannot be audited using remote audit techniques.
Read alongside clause 9.6.2.1.2 of ISO/IEC 17021-1, which requires surveillance activities to include on-site auditing, the conclusion is firm. Your document review and your interviews can run over video. Whether the guard is actually fitted, whether the permit-to-work system is actually being followed on the floor, whether the chemical store is actually locked — none of that can be signed off remotely. An ISO 45001 surveillance audit will always include someone walking your workplace.
There is a second OH&S-only exclusion worth knowing if you are in cycle two or later. Clause 7 of IAF MD 5 lets certification bodies design individualized surveillance and recertification programmes for second and subsequent cycles, with accreditation body approval, under the advanced surveillance and recertification procedures. The clause ends with one sentence: for OH&S management systems these requirements are not applicable. So the flexible, risk-tuned surveillance programme a mature ISO 9001 or ISO 14001 holder can apply for is not on the table for ISO 45001. An ISO 45001 surveillance audit stays on the annual cycle, every cycle.
There is a widely repeated claim that major nonconformities in surveillance must be closed within 90 days. ISO/IEC 17021-1 does not say that. The standard sets a deadline for correcting majors before expiry in the recertification clause; there is no surveillance-specific closure window in the standard itself. What exists instead is your certification body’s own documented procedure, which clause 9.6.5.1 requires it to have, and which typically does set a 30, 60 or 90-day window. Ask for that procedure rather than assuming a number applies to your ISO 45001 surveillance audit.
What the standard does set out is what happens when things are not resolved. Clause 9.6.5.2 requires a certification body to suspend certification where, for example, the client has failed to meet certification requirements, has voluntarily asked for suspension, or — the one that matters here — does not allow surveillance or recertification audits to be conducted at the required frequencies. Skipping an ISO 45001 surveillance audit is not a quiet administrative lapse; it is a listed suspension trigger.
| State | What it means | Clause |
|---|---|---|
| Suspended | Certification is temporarily invalid. You may not present yourself as certified while it lasts. | 9.6.5.3 |
| Restored | Reinstated once the issue causing suspension is resolved. The accompanying note says suspension would not, in most cases, exceed six months. | 9.6.5.4 |
| Withdrawn or reduced | Failure to resolve leads to withdrawal, or to reducing the scope so the non-conforming parts are excluded. | 9.6.5.4, 9.6.5.5 |
A reduced scope is the outcome people forget to plan for. If one site or one activity cannot demonstrate control, the certificate can survive with that part carved out — which protects the contract that needs a certificate, but changes what you are allowed to claim in tenders. Check the scope statement on the reissued certificate before you quote it.
ISO 45001:2018 currently sits at stage 90.92, “International Standard to be revised”, with ISO’s own page saying it is expected to be replaced by ISO/DIS 45001 within the coming months. ISO’s FAQ on the standard names the coming edition ISO 45001:2027. The draft is published and purchasable; the final text is not.
For your next ISO 45001 surveillance audit, three things follow, and the third is the one to act on.
First, you are audited against ISO 45001:2018. A draft is not a requirement, and no auditor may raise a nonconformity against unpublished text.
Second, Amendment 1:2024 — the climate action changes — already applies and is free of charge from ISO. It added a requirement to determine whether climate change is a relevant issue in your context work, and a note that interested parties can have climate-related requirements. If your clause 4.1 and 4.2 records predate 2024 and say nothing about climate, that is a live finding at your next surveillance, not a future one.
Third — and this is where ISO 45001 differs sharply from its sister standards — there is no published transition schedule. ISO 9001:2026 and ISO 14001:2026 both have dated transition requirements from Global ACI, with accreditation milestones and hard expiry dates for the old editions, and both documents allow the transition audit to be bundled into a surveillance or recertification audit. Nothing equivalent exists for ISO 45001, because the standard is not published yet. Anyone quoting you a 45001 transition deadline, or selling you extra surveillance days to cover a transition audit, is extrapolating. The honest planning assumption is a three-year transition starting from publication, and no change to your surveillance programme until the clock actually starts.
Preparing for an ISO 45001 surveillance audit is a narrower job than preparing for certification, which is why it is so often left too late. Work the eight review areas, not the whole standard.
Four weeks before the ISO 45001 surveillance audit, close the loop on last year’s findings. Clause 9.6.2.2(b) makes previous nonconformities a mandatory review item, and an action recorded as complete with no evidence that it worked is the easiest finding an auditor will write all day. Each one needs root cause, the action taken, and verification of effectiveness.
Then complete the internal audit and management review before the auditor arrives, not after. Both are mandatory review items. A management review held three weeks after surveillance proves nothing about the year being audited.
Build the change list yourself. New or modified plant, new substances, new contractors, a new site, a shift-pattern change, a headcount change big enough to move your effective personnel band, and any change in applicable OH&S legislation. For each, show the hazard identification and risk assessment that followed. Then check the thing your auditor will test in five minutes: worker participation and consultation records under clause 5.4, which remain the most commonly weak evidence in OH&S systems because they are the hardest to fake.
Last, walk your own floor the week before with the eight review areas in hand. Your auditor is coming on site whether you like it or not, and on an OH&S audit the floor is the evidence.
If your document set is the part that is behind — the OH&S policy, hazard identification and risk assessment records, legal register, objectives, consultation records, incident investigation forms and management review template — our ISO 45001 Toolkit gives you the full set of editable templates mapped to clauses 4 to 10, so surveillance preparation is a review exercise rather than a writing one.
At least once per calendar year, except in recertification years, under clause 9.1.3.3 of ISO/IEC 17021-1. The first one must fall within 12 months of the certification decision date. In a standard three-year cycle that means surveillance in years one and two, and recertification in year three.
About one third of the initial stage 1 plus stage 2 audit time, per clause 5 of IAF MD 5:2023, and unlikely to be less than one audit day. In practice that is one day for a small low-risk organization, two to three days for a mid-sized medium-risk site, and more where the complexity category is high or adjustment factors apply.
Not completely. Document and record review and interviews with staff and workers may be conducted remotely, but IAF MD 5 states that process control and OH&S risk control cannot be audited using remote techniques, and ISO/IEC 17021-1 requires surveillance to include on-site auditing. Expect a site visit every year.
Not allowing surveillance audits at the required frequencies is one of the examples clause 9.6.5.2 gives of when a certification body shall suspend certification. Under suspension the certificate is temporarily invalid; if the cause is not resolved it leads to withdrawal or a reduction of scope, and the standard notes suspension would not usually exceed six months.
No. ISO 45001:2018 is still the standard you are certified to, and no transition requirements have been published. The exception is Amendment 1:2024 on climate action, which already applies — make sure your clause 4.1 and 4.2 records show you determined whether climate change is a relevant issue.
No. Your internal audit is your own clause 9.2 activity, and it is one of the things the external auditor reviews. An ISO 45001 surveillance audit is a third-party audit by your certification body, and it samples rather than covering the whole system.
An ISO 45001 surveillance audit happens once a calendar year in years one and two of the cycle, within 12 months of your certification decision the first time, for roughly a third of your initial audit days and never less than one. An ISO 45001 surveillance audit samples eight mandatory areas rather than the whole standard, it always includes time on site because OH&S risk control cannot be audited remotely, and declining it is a listed ground for suspension. Until ISO 45001:2027 is published and a transition schedule exists, nothing about that programme changes — except that Amendment 1:2024 on climate is already in scope.
Further reading on the site: ISO 45001: A Guide to Occupational Health & Safety for the standard itself, how ISO 45001 certification actually works for the initial audit that sets your surveillance time, the ISO 45001 revision and the 2027 edition for where the new standard stands, and the ISO 14001 surveillance audit if you run an integrated system and need to see where the two diverge. Primary sources: ISO 45001:2018 on iso.org and IAF MD 5:2023 Issue 4 Version 3.
November 4, 2026
November 3, 2026
November 2, 2026
November 1, 2026
October 31, 2026