ISO 45001 Toolkit: What a Complete One Contains (2026)

An ISO 45001 toolkit is only worth buying if it covers every piece of documented information the standard requires, plus the records an auditor will sample even though no clause names them. Most packs on the market are a manual, a policy and a stack of procedures that restate the standard. That looks complete in a file listing and falls apart at stage 1, when the auditor asks to see your hazard assessments, your legal register and the evidence that workers were consulted.

This guide sets out what a complete toolkit for ISO 45001:2018 has to contain, clause by clause, the registers thin packs leave out, the gaps that turn into findings, and how to check a pack before you pay for it.

What an ISO 45001 toolkit has to cover

ISO 45001:2018 is the international requirements standard for occupational health and safety (OH&S) management systems. It was published in March 2018, runs to 41 pages, and was reviewed and confirmed by ISO in 2024. It carries one amendment: ISO 45001:2018/Amd 1:2024, which adds climate change to the context clauses (4.1 and 4.2). ISO publishes the amendment free of charge and it already applies to current certificates.

The standard follows the same ten-clause structure as ISO 9001 and ISO 14001, with requirements in clauses 4 to 10. A toolkit has to give you three things across those clauses:

• The documented information the standard says you must maintain — scope, policy, roles, risk methodology, legal requirements, objectives, operational controls, emergency plans.
• The records it says you must retain — competence, communication, monitoring results, compliance evaluation, audits, management review, incidents and corrective actions.
• The working tools that produce those records — registers, forms and checklists, so the system generates evidence as a by-product of running it.

An ISO 45001 toolkit that delivers the first group without the third leaves you writing your own forms in the month before the audit, which is exactly the work a toolkit is meant to save.

The mandatory documents inside a complete ISO 45001 toolkit

ISO 45001 uses the term “documented information” rather than documents and records, but the split still matters. Documents describe how the system works; records prove it ran. The full clause-by-clause list is in our guide to ISO 45001 mandatory documents. The table below maps each requirement to what a complete pack should hand you.

Clause	Requirement	What the toolkit should provide
4.3	Scope of the OH&S management system	Scope statement, usually inside the manual or context procedure
4.1, 4.2	Context and interested parties (now including climate change)	Context procedure, interested-parties log, SWOT template
5.2	OH&S policy	Editable policy with the commitments 5.2 lists
5.3	Roles, responsibilities and authorities	Responsibility section in the manual or a role matrix
6.1.1–6.1.2	Risks and opportunities; hazard identification and risk assessment method	Hazard, risk and opportunity procedure plus a working register
6.1.3	Legal and other requirements	Legal requirements procedure and legal register
6.2.2	OH&S objectives and plans to achieve them	Objectives procedure and an objectives and targets sheet
7.2, 7.4	Evidence of competence and of communication	Training matrix, needs analysis, training register, communication procedure
8.1	Operational planning and control, change, procurement and contractors	Control of operations and management of change procedures, change register
8.2	Emergency preparedness and response	Emergency procedure and emergency team structure
9.1.1, 9.1.2	Monitoring results, calibration, evaluation of compliance	Monitoring and compliance procedure, calibration register
9.2, 9.3	Internal audit programme and results; management review	Audit procedure, schedule, report, checklist; review minutes
10.2	Incidents, nonconformities and corrective action	Incident report and investigation forms, CAR, NC register

Note what is not on the list. ISO 45001 does not require an OH&S manual. Most toolkits include one, and it is a convenient place to hold the scope, roles and process map, but an auditor gives no credit for a long manual that restates the standard. What earns credit is evidence of activity.

Why a hazard procedure is not a hazard assessment

Clause 6.1.2 requires you to document the methodology and criteria for assessing OH&S risks. Many buyers stop there: the procedure is written, so the box is ticked. It is not. An auditor will ask for the assessments themselves — the completed register showing hazards by task or area, who is exposed, the risk rating, and the controls chosen.

Those controls have to follow the hierarchy in clause 8.1.2: eliminate the hazard, substitute less hazardous processes or materials, use engineering controls, then administrative controls, and only then personal protective equipment. A register that jumps straight to PPE and training for every hazard is a common finding. A good ISO 45001 toolkit builds the hierarchy into the register’s columns, so whoever fills it in has to say why the higher-order controls were not practicable.

The same logic applies to the other methods the standard asks for. A legal requirements procedure with an empty legal register does not satisfy 6.1.3, and an emergency procedure with no drill records does not show that 8.2 is working. For the full assessment method, see ISO 45001 risk assessment.

The registers a thin ISO 45001 toolkit leaves out

Registers are where cheap packs cut corners, because they take the most work to design well. A complete set includes:

• Risk and opportunity register — hazards, risk ratings and controls, plus OH&S opportunities, which 6.1.2.3 treats separately.
• Legal register — each applicable law and other requirement, how it applies, and the date compliance was last evaluated under 9.1.2.
• Training register and training matrix — who needs which competence, and evidence they have it.
• Document master register and external document register — the control of documented information under 7.5.
• Calibration register — for monitoring equipment such as gas detectors and noise meters, required by 9.1.1 where applicable.
• Change management register — planned changes assessed under 8.1.3, where a surprising number of incidents begin.
• Nonconformity and corrective action register — open findings, root causes, actions and effectiveness checks under 10.2.

If an ISO 45001 toolkit lists fifty files and none of them is a register, the count is padding.

Six gaps that make an ISO 45001 toolkit fail an audit

These are the problems certification auditors raise most often against systems built from templates:

1. Placeholder text left in place. “[Organization name]” in a signed policy tells the auditor nobody read the document.
2. A generic legal register. A list copied from another country, or one that names laws without saying how they apply to your sites, fails 6.1.3.
3. No evidence of worker consultation. Clause 5.4 requires consultation and participation of workers, with specific emphasis on non-managerial workers. A procedure is not evidence; minutes, safety committee records and toolbox-talk sign-offs are.
4. Contractors missing from the system. Clause 8.1.4 covers procurement, contractors and outsourcing. If contractor selection, induction and monitoring are not visible, expect a finding on any site that uses them.
5. Climate change ignored. Since Amd 1:2024, 4.1 requires you to decide whether climate change is a relevant issue, and 4.2 notes that interested parties can have climate-related requirements. Packs written before 2024 often say nothing about it.
6. OHSAS 18001 residue. Procedures that still cite OHSAS 18001 clause numbers, or no distinct controls for management of change and procurement (clauses 8.1.3 and 8.1.4, which ISO 45001 made explicit), signal a pack that was relabelled rather than rebuilt when ISO 45001 replaced OHSAS 18001.

Most of these are fixed by the people using an ISO 45001 toolkit, not by the toolkit itself. A template can prompt for the right evidence; it cannot hold the safety committee meeting for you.

Toolkit, consultant or software platform

A toolkit is not the only route, and it suits some organizations better than others.

Route	Best for	Main trade-off
Document toolkit	Organizations with an in-house safety lead who can adapt templates	You supply the time and the site knowledge
Consultant	High-hazard sites, tight deadlines or no internal OH&S expertise	Highest cost; knowledge can leave with the consultant
Software platform	Multi-site organizations that want workflows and dashboards	Recurring subscription; you still need the content
Toolkit plus targeted help	Most small and mid-sized firms	Needs a clear split of who writes what

Many organizations combine a toolkit with a few consultant days for the risk workshop or a pre-audit review. For budgeting, see our breakdown of ISO 45001 certification cost.

Does the ISO 45001 revision change what to buy?

ISO 45001 is being revised. The Draft International Standard (ISO/DIS 45001) went to ballot on 17 June 2026, and voting closed on 9 August 2026. ISO’s own standard page says the 2018 edition is expected to be replaced by the new version within the coming months, and ISO expects publication in the first half of 2027. No transition arrangements have been published yet, so there is no deadline to plan against.

Until the new edition is published, certification audits run against ISO 45001:2018 with Amd 1:2024. A toolkit aligned to that edition is the right purchase today. When the new edition lands, expect the transition work to focus on the changed clauses rather than a full rebuild. Our ISO 45001 revision guide tracks what is reported about the draft.

How to check an ISO 45001 toolkit before you buy

Ask the seller, or read the listing, for answers to these:

• Is there a full file list, not just a document count?
• Does every mandatory clause in the table above have a document or record behind it?
• Are the registers working spreadsheets, or Word tables you will rebuild?
• Does the hazard register follow the hierarchy of controls?
• Does the context procedure address climate change under Amd 1:2024?
• Are the files editable Word and Excel, with placeholders clearly marked?
• Is there an internal audit checklist that walks clauses 4 to 10?
• Does the licence cover your use, for example one organization versus several clients?

Our own ISO 45001 Toolkit is built to pass that list: 50 editable templates, almost all in Word and Excel, including the OHSMS manual and policy, 16 procedures from context to management of change, the risk and opportunity, legal, training, calibration and change registers, incident and corrective action forms, and a clause-by-clause audit checklist. It is a one-time $99 download. If you want to see where you stand first, the ISO 45001 gap analysis guide shows how to score your current system.

Frequently asked questions

Is an ISO 45001 toolkit enough to get certified?

No toolkit gets you certified on its own. Certification depends on an accredited certification body confirming that your system is implemented and effective, which means records of real activity: assessments, consultation, training, audits and management review. A toolkit removes the drafting work so your time goes into running the system. The full sequence is in our guide to ISO 45001 certification.

How many documents should an ISO 45001 toolkit contain?

There is no correct number. The standard sets out roughly a dozen areas of documented information to maintain and a similar number of record types to retain. A complete ISO 45001 toolkit typically lands between 40 and 60 files once procedures, registers and forms are counted. Judge it on clause coverage and registers, not on the total.

Will an auditor reject template documents?

Not because they started as templates. Auditors reject documents that do not match how the organization works — unfilled placeholders, processes nobody follows, or hazards that do not exist on your sites. Adapt every document to your operations and the origin does not matter.

Do I need a new toolkit when ISO 45001:2027 is published?

Not a new one, but you will need to update your documents to the new edition within whatever transition period is set. That period has not been announced. Buy for the 2018 edition now and plan an update once the final text and transition rules are published.

The short version

A complete ISO 45001 toolkit maps every clause 4–10 requirement to a document or record, includes working registers rather than empty procedures, builds the hierarchy of controls into the risk register, covers contractors and change, and reflects the 2024 climate amendment. Check the file list against the clause table, then spend your effort where auditors look hardest: the hazard register, the legal register and the evidence that workers took part. For the standard itself, see ISO 45001:2018 on iso.org, and for the wider context read our overview of ISO 45001 and workplace safety.