Your team has put the bunting away, the auditor has left, and the certificate is on the wall. Now comes the question I hear most after that first success: how do we keep this going without drowning in paperwork?
If you’ve just achieved ISO 45001:2018 certification, the focus shifts from building a system to living with it. The good news is the work is mostly routine. The challenge is consistency. Here’s what that looks like in real organisations, without turning safety into a box-ticking exercise.
What actually changes after certification?
Certification isn’t the finish line. It’s the start of a cycle. Typically, you’ll have annual surveillance audits and a recertification audit every three years. Surveillance days are shorter than the first audit, but they’re sharper: auditors spend more time on performance, not promises.
Expect us to ask: what’s improved, what went wrong, and what you did about it. We’ll sample risk assessments, training records, contractor control, incident investigations and legal compliance. We’ll walk the floor. We’ll talk to people at the point of risk.
The organisations that sail through surveillance are those that keep the simple routines alive. They don’t wait for audit month to tidy the files. They use the system to run the business, not the other way round.
Keep the system alive day to day
The controls that keep people safe are usually simple. Keeping them visible and used is where many systems slip. A few practical habits make the difference.
- Make leadership visible: short, regular walkabouts with one or two focused questions.
- Keep worker participation real: rotate safety representatives and invite ideas, not just signatures.
- Treat near-miss reporting as gold dust: one-minute capture, same-day review, quick feedback.
- Use dynamic risk assessments for non-routine jobs: a laminated prompt card can prevent a hospital visit.
- Control contractors like your own staff: induction, permits to work, and supervision on the job.
- Keep legal checks on a calendar: lifting gear, LEV, emergency lighting, forklift training refreshers.
A real example: a distribution client had three near-misses with forklifts in a month. None reached the accident book because no one was hurt. We helped them add a simple rule: any pallet strike equals a near miss. Reporting jumped, they re-marked walkways and changed picking routes. Their incident rate dropped, and when the surveillance audit came, they had a clear story of risk, action and results.
Build a risk-based internal audit programme
Audit isn’t a one-week sprint before the external auditor arrives. It’s your early warning system. A good programme is light, regular and risk-based.
- Map your processes: list activities where harm could occur or control could fail.
- Prioritise by risk: audit high-risk areas more often; low-risk areas annually.
- Plan the calendar: spread audits through the year so findings can be fixed calmly.
- Equip your auditors: give them time, simple checklists, and the brief to follow the evidence.
- Close the loop: track actions, verify effectiveness, and share what’s been learned.
Keep audits practical. On one site, a junior engineer led the machine-guarding audit with a tape measure and a photo checklist. He picked up three interlocks bypassed for maintenance that had never been reinstated. No drama, just facts and fixes. That’s the spirit you want.
Treat incidents and changes as opportunities to learn
Things will go wrong. ISO 45001 expects it and cares most about your response. The difference between a minor cut and a serious injury is often luck. Don’t rely on luck twice.
- Investigate proportionately, but always ask why and then the next why.
- Fix the cause, not just the symptom: replace a missing guard and remove the incentive to remove it.
- Verify effectiveness: go back a month later and check the fix is still in place and being used.
- Update risk assessments when you learn something new, and tell the people who need to know.
Change is another common trip point. New line, new chemical, new contractor, new site — all good business signs, all risk multipliers. Build a simple management of change step into project planning: what’s changing, who’s affected, training needed, controls required, legal checks, and who signs off. We saw a food manufacturer bring in a new pallet wrapper and forget about emergency stop access. A 10-minute pre-start check would have caught it.
On legal compliance, keep a living register. In the UK that usually means a mix of Health and Safety at Work Act duties and regulations like RIDDOR, COSHH, PUWER, LOLER and Working at Height. You don’t need to memorise acronyms; you do need clarity on what applies, how you comply, and where the evidence sits.
Measure what matters and review it properly
Dashboards don’t keep people safe. Actions do. That said, a few thoughtful measures keep you honest and focused.
- Use a mix of leading indicators (near-miss reports, action closure time, completed inductions).
- Track lagging indicators (RIDDOR events, lost-time injuries, restricted work days).
- Measure competence, not just attendance: short checks after training help.
- Watch health risks too: noise, dust, vibration, and any ongoing health surveillance.
Then make your management review count. Quarterly is ideal in higher-risk operations; twice a year can work elsewhere. Keep it short and useful:
- Start with significant risks and changes since the last review.
- Look at objectives: are they realistic, resourced and moving?
- Review incidents and corrective actions for patterns, not blame.
- Check legal compliance, inspections and external feedback.
- Decide actions with owners and dates, then follow through.
One client replaced a dense 30-page review pack with a five-page briefing and a 45-minute meeting focused on three decisions. Their action closure rate improved and the meetings stopped being cancelled.
Get ready for surveillance without the scramble
You shouldn’t need a war room before your next audit. A steady drumbeat of simple tasks keeps you audit-ready and, more importantly, safe.
- Keep document control simple: latest versions accessible, old ones clearly removed.
- Maintain a tidy action log that links internal audits, incidents and improvements.
- Walk recent changes with the auditor: it shows control and confidence.
- Have traceability examples ready: show how a risk led to control, training and verification.
- Brief supervisors to answer from experience, not from a script.
Common pitfalls we see after year one include: objectives set and forgotten, training matrices not updated when people move, contractor control assumed but not evidenced, and risk assessments that don’t match what’s happening on the floor. None of these are difficult to fix. They just need time booked in and someone trusted to own them.
Keeping it sustainable
The best systems are almost boring. Clear responsibilities. Small habits done often. When something breaks, fix it properly. When something changes, think safety as part of the change. When someone raises a concern, thank them and act.
Be honest about resource. A part-time coordinator can run a lean, effective system if managers lead and staff participate. If your context is higher risk or more complex — multiple sites, heavy engineering, or many contractors — scale accordingly. What you must avoid is piling on forms that no one reads. If a control doesn’t help people do the job safely, redesign it or remove it.
If you keep that mindset, surveillance audits become a useful sense-check rather than a stress test.
If you’d like a straightforward view of where you are and what to improve next, speak with the team at UKCTL. We’re always happy to share what good looks like and discuss the practicalities of certification and surveillance for your business.