ISO 45001 Certification

HIRA: The Document Everything Else Rests On

Hazard Identification and Risk Assessment is the foundation of the whole system. Done properly, it covers every hazard type — physical, chemical, ergonomic, biological, and psychosocial — across every activity, including routine work, maintenance, non-routine tasks, and emergency scenarios.

Each hazard gets rated by likelihood and severity, and controls get applied in the hierarchy of controls order: eliminate the hazard, substitute it, apply engineering controls, apply administrative controls, and only then rely on PPE.

That order matters more than it sounds. A HIRA that lists "provide helmets and safety shoes" as the control for most hazards will get flagged, because PPE is the last line of defence, not the first. Auditors specifically look for whether you considered elimination and engineering controls before defaulting to PPE.

How ISO 45001 Maps to Indian Law

This is where the standard earns its keep for Indian businesses, and it's worth being specific rather than vague:

• Factories Act, 1948 — safety provisions, hazardous process requirements, and welfare obligations align closely with ISO 45001's operational controls and legal compliance clauses.
• Building and Other Construction Workers (BOCW) Act, 1996 — directly relevant for construction contractors, where ISO 45001's contractor management requirements overlap substantially.
• Occupational Safety, Health and Working Conditions Code, 2020 — consolidates multiple safety laws and extends liability to directors and designated officers. Your documented HIRA, training records, and incident investigations become your primary evidence of due diligence.
• Employees' Compensation Act, 1923 — a functioning OH&SMS reduces both incident frequency and the disputes that follow them.

ISO 45001 doesn't replace any of these legal obligations. What it does is give you a system that satisfies them systematically instead of reactively, with the paper trail to prove it.

Who Needs ISO 45001

The standard is sector-neutral, but it matters most where physical risk is highest:

• Manufacturing and factories regulated under the Factories Act
• Construction contractors, especially those bidding on government or infrastructure projects
• Mining, oil and gas, and chemical operations
• Logistics, warehousing, and transport businesses
• Pharmaceutical and healthcare facilities
• Engineering and EPC contractors working on client sites with their own safety requirements
• IT/ITES and service companies — lower physical risk, but increasingly asked for it by enterprise clients as part of vendor ESG assessments

Documents You'll Need

• OH&S policy signed by top management
• Defined OH&SMS scope covering sites, activities, and workers including contractors
• Hazard Identification and Risk Assessment (HIRA) records
• Register of legal and other requirements, with compliance evaluation records
• OH&S objectives and targets with measurable indicators
• Roles, responsibilities, and authorities documentation
• Evidence of worker consultation and participation — safety committee minutes, toolbox talk records, suggestion and near-miss logs
• Competence and training records covering permanent, contract, and agency workers
• Operational control procedures, including work permits for high-risk activities
• Emergency preparedness and response plans, with mock drill records
• Incident investigation reports and corrective action records
• Internal audit programme and reports
• Management review minutes
• OH&S performance monitoring data

The Certification Process

1. Gap analysis. Assess current safety practices, documentation, and physical conditions against ISO 45001 requirements. This tells you honestly whether you're facing a documentation project or a capital-expenditure one.
2. Define scope and appoint the team. Decide which sites, activities, and worker categories the OH&SMS covers. Contract workers need to be inside the scope, not outside it.
3. Conduct the HIRA. Walk the site with the people who actually do the work. Identify hazards across routine, non-routine, and emergency conditions, rate the risks, and apply the hierarchy of controls.
4. Build the legal register. Identify every applicable statutory requirement — Factories Act, BOCW, state rules, OSH Code provisions — and set up a process to evaluate compliance periodically.
5. Establish worker participation mechanisms. Safety committees, near-miss reporting, toolbox talks, consultation on HIRA. This can't be retrofitted the week before the audit; auditors ask workers directly.
6. Document and implement. Write the procedures, roll them out on the floor, and train everyone — including contractors and agency staff.
7. Internal audit and management review. Both mandatory. The internal audit is also your best chance to find problems while they're cheap to fix.
8. Stage 1 audit. The certification body reviews documentation and readiness. Gaps identified here must be closed before Stage 2.
9. Stage 2 audit. On-site assessment of whether the OH&SMS is genuinely implemented. Expect auditors to interview shop-floor workers, not just managers.
10. Certification and surveillance. Certificate valid for three years, with surveillance audits typically annual and a recertification audit at the end of the cycle.

Realistic Timeline

For an organisation with existing safety practices and reasonable statutory compliance, 3 to 6 months is realistic. Multi-site operations, construction contractors with large contract workforces, or businesses starting from minimal documentation should plan for longer.

The constraint is usually evidence. Worker participation records, training completion, mock drills, and incident investigations need to exist over a period — you can't generate three months of safety committee minutes in a week, and auditors can tell when someone has tried.

What It Costs

Certification body fees — priced on audit man-days, driven by headcount, number of sites, and risk profile. A single-site small to mid-sized Indian organisation typically lands in the ₹70,000 to ₹2.5 lakh range across the three-year cycle including surveillance audits. High-risk sectors and multi-site operations cost more.

Implementation costs — consulting, documentation, training, and any physical safety improvements the gap analysis identifies. For older facilities, the engineering controls portion is often the larger number.

Worth framing against what incidents actually cost. A single permanent total disability case at a mid-sized unit runs into tens of lakhs in direct and indirect costs, before accounting for production disruption, regulatory scrutiny, and litigation.

On accreditation: certificates are issued by certification bodies, and those bodies are accredited — in India, by NABCB under ISO/IEC 17021, or internationally by another IAF member. Confirm your certifier's accreditation status before engaging them. An unaccredited certificate costs less and is worth exactly nothing in a tender evaluation.

Why Work With LegalDev

The failures we see most often aren't dramatic. A HIRA written in an office rather than on the floor. Contract workers left out of training records. A safety committee that exists on paper but has never met. Worker consultation that amounts to a notice board.

LegalDev's approach starts with a gap analysis covering documentation and physical conditions together, so you know upfront what the project actually involves. We run the HIRA on-site with your supervisors and operators, build the legal register against the Factories Act, BOCW, and OSH Code provisions that apply to you specifically, set up worker participation mechanisms that will hold up under auditor questioning, and prepare your floor staff for the interviews that happen during Stage 2. If you're also pursuing ISO 9001 or ISO 14001, we'll structure it as an integrated management system rather than three separate projects.

Frequently Asked Questions