ISO 45001 systems that hold up on site, not just in the office.
Occupational health and safety management systems for Abu Dhabi contractors, operators and service providers: designed to satisfy both your certification body and the ADOSH-SF v4.0 regulatory framework at the same time.
The short version
- ISO 45001 replaced OHSAS 18001. Any 18001 certificate is expired and will be rejected in pre-qualification.
- Two requirements catch people out: evidenced worker consultation (clause 5.4) and applying the hierarchy of controls in order, not defaulting to PPE.
- Certification does not make you ADOSH-SF compliant. Build both as one system or maintain two that will contradict each other.
- Expect site visits. Office-only preparation fails, because the evidence trail is physical.
What ISO 45001 actually is
ISO 45001:2018 is the international standard for occupational health and safety management. It replaced OHSAS 18001 and shifted the emphasis decisively: from procedural compliance to leadership accountability, worker participation and genuine hazard control.
Two changes catch experienced organisations out. First, clause 5.4 requires demonstrable worker consultation and participation: not a suggestion box, but evidence that non-managerial workers were involved in hazard identification, incident investigation and control selection. Second, the standard requires you to address the hierarchy of controls in that order: elimination, substitution, engineering controls, administrative controls, then PPE. Systems that default to PPE and toolbox talks are marked down.
| Requirement | What it means in practice | Common failure |
|---|---|---|
| Hazard identification (6.1.2) | Proactive, ongoing, covering routine and non-routine activities | A risk register written once and never revisited |
| Legal & other requirements (6.1.3) | A maintained register of applicable UAE and Abu Dhabi legislation | Generic register with no ADOSH-SF references |
| Worker consultation (5.4) | Evidence that workers shaped controls and procedures | Consultation claimed but not recorded |
| Hierarchy of controls (8.1.2) | Controls selected in the prescribed order, with justification | PPE presented as the primary control |
| Contractor control (8.1.4) | Procurement and coordination of OH&S with contractors | Subcontractors outside the system entirely |
| Incident investigation (10.2) | Root cause analysis and corrective action effectiveness review | Root cause recorded as “operator carelessness” |
| Emergency preparedness (8.2) | Tested plans with drill records and review | Plans exist; drills were never run |
ISO 45001 and ADOSH-SF v4.0: the Abu Dhabi overlap
If you operate in Abu Dhabi, you are almost certainly subject to the Abu Dhabi Occupational Safety and Health Framework as well as any certification you choose to pursue. These are two different obligations with substantial overlap:
- ADOSH-SF v4.0 is regulatory. It applies to entities operating in the Emirate through their sector regulator. Compliance is not optional and is enforced through inspection.
- ISO 45001 is voluntary certification. You pursue it because clients, tenders or group policy require independent assurance.
Built separately, they generate duplicate paperwork, contradictory procedures and two sets of audits. Built together (which is how we build them) a single OH&S management system satisfies both, with the ADOSH Codes of Practice mapped as legal requirements inside the ISO 45001 framework. Read more on ADOSH-SF v4.0 compliance.
We map every applicable ADOSH-SF Code of Practice into your legal register and design your procedures to discharge both obligations simultaneously. One system, one document set, one internal audit programme: assessed by two different audiences.
Who needs ISO 45001
- Contractors and subcontractors bidding for work with ADNOC group companies, Aldar, Modon, main contractors or government entities, where 45001 is a standing pre-qualification requirement.
- Operators of higher-hazard facilities: manufacturing, warehousing, workshops, plant and equipment yards.
- Facilities management providers managing multi-trade workforces across client sites.
- Organisations after a serious incident, where demonstrating systemic control has become urgent, commercially and legally.
- Businesses with rising insurance premiums or an insurer requesting evidence of OH&S management.
What we do for you
What you receive
- Gap analysis report covering ISO 45001 and ADOSH-SF status side by side.
- OH&S manual and procedure set, editable and branded to your organisation.
- Hazard register and risk assessments for every activity in scope.
- Legal register mapped to applicable ADOSH Codes of Practice and federal law.
- Permit-to-work forms and control documents ready for site use.
- Emergency response plans and a twelve-month drill schedule.
- Internal audit programme, checklists and completed reports for the first cycle.
- Management review pack with signed minutes.
- Audit-day attendance at both certification stages.
The certification process
- Free consultation: thirty minutes to establish scope, drivers and deadline.
- Gap analysis: document review plus site walkdown, because OH&S gaps are visible on site and invisible in folders.
- Risk assessment programme: the foundation everything else is built on.
- System design and build: developed in working sessions with your supervisors and workforce representatives.
- Implementation: permits issued, inspections run, drills conducted, records accumulated.
- Internal audit and management review: both mandatory before certification.
- Stage 1 audit: readiness and documentation review by the certification body.
- Stage 2 audit: full implementation assessment, typically including site visits.
- Certification: three-year cycle with annual surveillance.
Timeline and investment
ISO 45001 generally takes longer than ISO 9001 because the evidence trail is physical. Auditors need to see permits issued, inspections closed out and drills completed, and those records accumulate in real time.
| Situation | Typical duration | Main variable |
|---|---|---|
| Office-based, low hazard, under 25 staff | 10–12 weeks | Speed of document approval |
| Single site with workshop or yard operations | 12–16 weeks | Depth of risk assessment required |
| Multi-site contractor with active projects | 16–24 weeks | Site coverage and sampling |
| Adding 45001 to an existing certified system | 6–10 weeks | Maturity of existing risk processes |
As with all certifications, you pay certification body fees directly to the auditor and consultancy fees to us. We take no commission from certification bodies. Our fee is fixed against a scope agreed after the gap analysis. Full breakdown in our UAE certification cost guide.
Questions clients ask first
Not automatically. They are separate obligations with heavy overlap. ISO 45001 is voluntary certification by a certification body; ADOSH-SF v4.0 is a regulatory framework enforced by your sector regulator. A system built to address only ISO 45001 will usually miss ADOSH-specific requirements. We build both into a single system so you satisfy each without duplicating effort.
No. OHSAS 18001 was withdrawn and the migration period to ISO 45001 closed in September 2021. Any OHSAS 18001 certificate is now expired and will not be accepted in pre-qualification. If you built a system under 18001, much of it is reusable, but it needs restructuring for context, leadership, worker participation and the hierarchy of controls.
More than most organisations expect, and it must be evidenced. Auditors look for records showing non-managerial workers contributed to hazard identification, incident investigation, control selection and procedure development. In practice this means minuted safety committee meetings with worker representatives present, and risk assessments signed by the people who do the task.
For any organisation with site operations, almost certainly. Certification bodies apply sampling rules based on the number and type of sites. This is why office-only preparation fails: the system has to work where the hazards are. Our gap analysis always includes a site walkdown for this reason.
Yes, and it is usually cheaper and faster. A combined audit shares the common clauses, reducing certification body audit days, and you maintain one document set instead of two. See integrated management systems.
Let’s make your next audit a non-event.
Book a free 30-minute consultation. We will tell you honestly whether you need a consultant, and if you do, exactly what it will take.