ISO 45001 certification isn’t one audit—it’s two. Stage 1 is a documentation review. Stage 2 is your full operational assessment. Understanding the difference matters because they require different preparation approaches and assess different aspects of your system.

This guide walks through both stages: what auditors assess, what they’re looking for, what the gaps are, and how to prepare for each.

Stage 1: The Documentation Review and Readiness Assessment

Stage 1 is diagnostic. The auditor is asking: “Does this organisation have a credible system framework on paper?” They’re not yet testing whether it works in reality.

What Happens During Stage 1: Timeline and Activities

Stage 1 is typically 1-3 days on-site (depending on organisation size). The auditor will:

• Review your documentation: Policies, procedures, forms, records, evidence
• Interview management: Understanding of the system, leadership commitment, evidence of resource allocation
• Interview a sample of workers: Understanding of safety procedures, communication channels, how concerns are raised
• Walk the site: Understanding of actual hazards and whether documented controls exist
• Verify IT systems: Document management, records storage, accessibility

The auditor isn’t deeply assessing control effectiveness yet. They’re checking: Do you understand ISO 45001? Have you documented a system that addresses each clause? Do people understand the basics?

What the Auditor Reviews During Stage 1

Stage 1 assessment focuses on system framework completeness:

• Clause 4 (Context): Have you identified relevant external and internal issues affecting safety?
• Clause 5 (Leadership): Is there a documented safety policy? Does leadership demonstrate commitment?
• Clause 6 (Planning): Have you identified hazards and assessed risks? Do controls exist on paper?
• Clause 7 (Support): Is there evidence of competence assessment? Is communication documented?
• Clause 8 (Operation): Are operational procedures documented? Do emergency procedures exist?
• Clause 9 (Performance Evaluation): Do you have an internal audit procedure? Is a management review scheduled?
• Clause 10 (Improvement): Is a nonconformity and corrective action procedure documented?

The auditor will ask: “Where is this addressed in your documented system?” They want page references, evidence they can review during Stage 2.

Stage 1 Findings: What’s Expected

Most organisations receive some findings at Stage 1. This is normal. Typical findings might be:

• Hazard register incomplete or not covering all areas
• Risk control verification missing (you’ve written down controls but haven’t verified they’re implemented)
• Competence assessment incomplete for key roles
• Management review procedure documented but no actual review conducted yet
• Worker consultation procedure exists but no evidence of actual consultation

These are usually addressable in 4-8 weeks, allowing you to proceed to Stage 2. Major findings at Stage 1 (indicating fundamental gaps in system design) are rarer and suggest more substantive work is needed.

How to Prepare for Stage 1

The most common Stage 1 mistake is incomplete documentation. Don’t attempt Stage 1 if your procedures aren’t written and your evidence isn’t gathered. The auditor will identify gaps and delay Stage 2.

Stage 1 Report and the Gap Between Stages

After Stage 1, the auditor will provide a report with findings. These typically fall into nonconformities (gaps requiring closure) and observations (advisories). You’ll have a specified timeline (usually 4-8 weeks) to address findings.

This gap is your opportunity to strengthen your system. Don’t rush it. For each finding, understand the root cause, design a fix, implement it, gather evidence that it works, and document your response.

Common remediation activities include:

• Completing hazard identification across all areas not yet covered
• Implementing and verifying control measures
• Conducting competence assessments and recording results
• Conducting worker consultation and documenting feedback
• Conducting your first internal audit (if required)

Once you’ve addressed findings, you’ll communicate this to the certification body, typically with supporting documentation. They may review and accept your response, or they may require a pre-Stage 2 follow-up visit.

Stage 2: Full Operational Assessment and Certification Audit

Stage 2 is the comprehensive audit. The auditor is now testing whether your system actually works. They’re asking: “In practice, does this organisation manage health and safety effectively?”

What Happens During Stage 2: Timeline and Activities

Stage 2 is typically 2-5 days on-site (depending on organisation size, complexity, and multi-site scope). The auditor will:

• Review operational evidence: Incident investigations, corrective actions, training records, competence assessments
• Conduct detailed interviews: With workers at all levels to verify understanding and system embedding
• Observe work processes: Verify controls are actually used and understood
• Trace processes: Follow a hazard from identification through risk assessment to control implementation
• Review management systems: Verify the system actually functions (communication, decision-making, improvement)
• Assess internal audit: Verify your internal audit programme is operational and findings are acted upon

Key Stage 2 Assessment Areas

Stage 2 auditors focus intensively on six areas. Understanding these is crucial to preparation:

1. Hazard Identification and Risk Assessment (Clause 6.1)

This is the #1 audit focus. The auditor asks: “Does your organisation actually identify hazards?” They’ll trace a specific hazard through your process:

• Is it in your hazard register?
• Was it risk-assessed? What’s the risk level?
• What control measures did you select?
• Are those controls implemented?
• Do people working with that hazard understand it and the controls?

Auditors will interview workers: “Can you identify hazards in your job?” A worker who can’t—or who identifies hazards not in your register—is a red flag.

Before Stage 2, ensure your hazard register is comprehensive and current. Brief workers on how to identify hazards in their roles.

2. Control Verification and Effectiveness (Clause 8.1)

You’ve identified a hazard and selected controls. But are the controls actually implemented and effective? The auditor observes. They check:

• Are PPE controls provided and used?
• Are engineering controls installed and functioning?
• Are administrative controls (checklists, procedures) followed?
• What’s the control maintenance schedule? Evidence of maintenance?

Before Stage 2, verify all documented controls are actually implemented. If a control isn’t yet in place, either implement it or update your risk assessment to reflect current controls and residual risk.

3. Competence and Competence Assessment (Clause 7.2)

The auditor asks: “How do you know people are competent for their roles?” They’ll review:

• Competence assessment records for critical roles
• Training records for workers assigned to hazardous tasks
• Evidence that competence was assessed (not just training attended)
• Plans for workers who aren’t yet competent

Before Stage 2, ensure you have documented evidence of competence assessment. This isn’t just training records—it’s assessment evidence showing someone has the knowledge and skills for their role.

4. Internal Audit Programme and Findings (Clause 9.2)

The auditor reviews your internal audit programme: Is it risk-based? Is it actually happening? Are findings tracked to closure?

They’ll check:

• Do you have a documented audit plan?
• Have audits been conducted as planned?
• Are findings documented and classified?
• Is there evidence of corrective actions and closure?

Before Stage 2, conduct at least one (ideally two or more) internal audits. Have findings documented and some corrective actions implemented. This demonstrates your system self-regulates.

5. Management Review (Clause 9.3)

The auditor wants to see evidence that management reviews the system. They’ll look for:

• Management review meeting minutes
• What topics were discussed (audit findings, incidents, performance data, improvements)?
• What decisions were made and implemented?
• Evidence of resource allocation decisions

Before Stage 2, conduct a management review if you haven’t already. Document discussions and decisions. This shows leadership commitment.

6. Incident Investigation and Corrective Action (Clause 10.2)

If you’ve had incidents or near-misses, the auditor will review investigation files. They want to see:

• Was the incident properly investigated?
• Was root cause identified?
• Were corrective actions appropriate to the root cause?
• Is there evidence the corrective action was implemented?
• Was closure verified?

Before Stage 2, ensure your incident investigation files are complete. If you have any incidents, use them as teaching examples of how your system responds.

How to Prepare for Stage 2

Understanding Stage 2 Findings

Stage 2 findings are classified the same as Stage 1: major NC, minor NC, observation, OFI. However, Stage 2 findings are often more serious because they reflect operational failures, not just documentation gaps.

Major Nonconformity at Stage 2 Examples:

• Hazard identification programme not actually conducted
• No internal audit programme in operation
• Critical staff not competent for their role and no assessment conducted
• No management review conducted
• Safety policy not communicated or understood

Minor Nonconformity at Stage 2 Examples:

• One area’s hazard register not updated recently
• One training record missing a signature
• One internal audit not completed as planned
• One incident investigation incomplete

A major NC at Stage 2 blocks certification. You must close it (usually within 3 months) before certification is granted. Minor NCs don’t block certification but must be addressed.

The Closing Meeting and Next Steps

At the end of Stage 2, the auditor conducts a closing meeting. They’ll outline findings, though not in complete detail (the report comes later). They’ll indicate whether certification looks likely or whether major issues need addressing.

If major NCs exist, you’ll receive a timeline for closure (typically 3 months). You’ll write corrective action responses, the certification body will review them, and you’ll either provide additional evidence or undergo a follow-up audit.

If only minor NCs exist, you may be conditionally certified while minor NCs are addressed, or you may close them before the certification decision is made.

From Stage 2 to Certification Decision

After Stage 2, the auditor drafts a detailed report. This report will include:

• Audit summary and scope
• Detailed findings (with evidence and clause references)
• Closing timeline for major NCs (typically 3 months)
• Recommended next steps

You’ll receive the report and have an opportunity to respond to findings you disagree with. Most bodies have an appeals process for disputed findings.

Once major NCs are closed, the certification body issues the certification decision. If you have only minor NCs, these can often be closed within 6-12 months without blocking certification, though your certificate may be issued conditionally.

The certification decision includes your three-year certificate specifying:

• Your organisation’s name and location
• Scope of certification (which parts of your organisation and which activities are covered)
• Certificate validity dates (3 years)
• Accreditation body logo

You can now display this certificate, reference it in tenders, and claim compliance with ISO 45001.

Common Stage 1 and Stage 2 Mistakes

After observing hundreds of audits, patterns emerge. Here are the most frequent mistakes:

Mistake 1: Attempting Stage 1 Before Ready

Organisations schedule Stage 1 before documentation is complete. The auditor identifies major gaps, Stage 2 is delayed, and momentum is lost. Don’t apply for Stage 1 until your documented system is 90% complete.

Mistake 2: Not Addressing Stage 1 Findings Properly

You receive Stage 1 findings and do minimal remediation. At Stage 2, the auditor finds the same gaps. This damages credibility. Take Stage 1 findings seriously and address them thoroughly.

Mistake 3: Insufficient Evidence Gathering

You have procedures and people understand them, but you haven’t documented evidence. When the auditor asks “Can you show me evidence of competence assessment?” you can’t. Have records ready.

Mistake 4: Workers Aren’t Briefed

The auditor interviews workers and they struggle to answer basic questions. Workers don’t know their organisation’s safety policy or how to report hazards. This signals the system isn’t embedded. Brief your workforce before Stage 2.

Mistake 5: Skipping Internal Audit Before Stage 2

You haven’t conducted internal audits. The auditor asks for your internal audit programme and finds nothing. Internal audit is critical evidence that your system self-regulates. Conduct audits before Stage 2.

Mistake 6: Controls Don’t Match Documentation

Your procedures say “PPE is required” but the auditor visits the site and PPE isn’t in use. Your documentation says “controls are checked monthly” but there’s no evidence of checking. Align your practice with your documentation.

Key Takeaways

Stage 1 is a documentary framework review. Stage 2 is a comprehensive operational assessment. Understanding what each stage assesses helps you prepare effectively.

For Stage 1: Complete your documentation, gather basic evidence, and brief key people. For Stage 2: Conduct internal audits, gather operational evidence, verify controls are implemented, and brief your workforce.

Don’t rush between stages. Use the gap wisely to strengthen your system. A well-prepared Stage 2 minimises findings and accelerates certification.

Conclusion: Preparation Is Everything

Stage 1 and Stage 2 are sequential audits designed to progressively verify your system. Stage 1 checks the framework. Stage 2 checks the operation. Success at both depends on thorough preparation.

Don’t rush between stages. Use the gap to strengthen your system. Conduct internal audits, gather operational evidence, verify controls are working, and brief your workforce. A well-prepared Stage 2 audit leads to rapid certification with minimal findings.

Related Articles

• ISO 45001 Certification: The Complete Pathway Guide
• ISO 45001 Internal Audit: How to Plan, Conduct and Report Effectively
• ISO 45001 Audit Nonconformities: Common Findings and How to Close Them Fast
• Choosing the Right ISO 45001 Certification Body: What to Look For