ISO 9001 and ISO 45001 for Construction Under CDM 2015

By Ersin Çetin, General Manager, Lead Auditor & TrainerPublished

A site manager in a hi-vis vest and hard hat briefs a small construction crew beside scaffolding on a UK building site in morning light.

An ISO 45001 system turns routine site briefings and inspections into audit evidence. Source: UniCert

UK construction clients and principal contractors often expect their supply chain to hold ISO 9001, ISO 45001, or both, before a bid is considered. The certificates tell a buyer that quality and health and safety run through a documented, audited system rather than depending on the knowledge of a few experienced staff. They do not prove legal compliance. ISO 45001 certification is not the same as complying with the Construction (Design and Management) Regulations 2015 [1], and holding it does not discharge any CDM duty [2].

This guide is written for the quality or SHEQ manager at a building contractor, civil engineering firm or specialist subcontractor pursuing certification mainly to win work. It explains why clients ask for the standards, how an ISO 45001 system supports each CDM 2015 duty-holder role, what an integrated ISO 9001 and ISO 45001 system looks like on site, and the route a contractor takes to certification. It sits within a wider integrated management system certification programme and complements our overview of ISO certification for the construction sector.

Why construction clients ask for ISO 9001 and ISO 45001

Clients ask for these standards because procurement rules and principal contractors use them as an early filter on risk. ISO 9001 is a common requirement in UK construction and public-sector procurement, and where a tender uses the Common Assessment Standard for pre-qualification, the quality-management certificate must come from an accredited certification body [7]. For a UK building contractor, not holding ISO 9001 can remove you from a tender list before your price is read. Our page on ISO 9001 certification in the UK sets out the scope and audit stages.

ISO 45001 carries similar weight on the health and safety side. It replaced OHSAS 18001, and the migration to it closed in 2021 under ISO/IAF migration guidance [9]. The standard is deliberately proactive: it requires hazards, risks and opportunities to be identified and addressed before incidents occur, and it requires worker consultation and participation rather than treating safety as a management-only activity [3]. Because it follows the ISO harmonised structure, it integrates with ISO 9001 and ISO 14001, which matters when a contractor wants one system rather than three. The ISO 45001 certification in the UK page explains the certification route in detail.

How the requirements flex by sector

ISO 9001 and ISO 45001 set the same requirements for every organisation, but the way they apply depends on the work. In a manufacturing setting the emphasis falls on calibration, production control and traceability, which we cover in our guide to how ISO 9001 applies in a manufacturing setting. For a professional or field-based service, process consistency and competence records carry more of the load, as covered in a companion guide, ISO 9001 for service businesses. Construction sits at the demanding end: the workplace changes daily, the workforce is transient, much of the labour is subcontracted, and every project also carries statutory duties under CDM 2015 [1].

Contractors that fabricate structural steelwork also need EN 1090 certification for UKCA or CE marking, which runs alongside the management-system standards rather than replacing them.

How ISO 45001 maps to CDM 2015 duty-holder roles

ISO 45001 does not map one to one onto CDM 2015, but its clauses support the planning, managing and monitoring that every CDM role has to do. CDM 2015 places duties on defined roles, the client, principal designer, principal contractor, designers and contractors, covering how health and safety is planned, managed and monitored, the competence and capability of anyone appointed, and the flow of pre-construction and construction-phase information [1][2]. An ISO 45001 management system gives you the mechanisms to deliver and evidence those duties consistently across projects.

A diagram linking each CDM 2015 duty-holder role to the ISO 45001 clauses that support planning, managing and monitoring construction health and safety.

How ISO 45001 clauses support, but do not replace, each CDM 2015 duty. Source: UniCert

CDM 2015 duty-holder Core duty under CDM 2015 (summary) Supporting ISO 45001 elements
Client Make suitable arrangements for managing the project, appoint duty-holders, provide pre-construction information, check management arrangements are maintained Clause 5 leadership and commitment; Clause 4 context and interested parties; Clause 7.4 communication; Clause 9 monitoring and review
Principal designer Plan, manage and monitor the pre-construction phase, coordinate health and safety in design, identify and eliminate or control foreseeable risks Clause 6.1.2 hazard identification; Clause 8.1.2 eliminating hazards and reducing risks; Clause 8.1.3 management of change
Principal contractor Plan, manage and monitor the construction phase, prepare the construction phase plan, organise cooperation between contractors, ensure induction, site rules and worker consultation Clause 8.1 operational planning and control; Clause 8.1.4 procurement and contractors; Clause 5.4 consultation and participation of workers; Clause 8.2 emergency preparedness
Contractor Plan, manage and monitor their own work and workers under their control, follow the principal contractor's directions, ensure worker competence Clause 7.2 competence; Clause 7.3 awareness; Clause 8.1 operational control; Clause 10.2 incident investigation and corrective action
Designer (including in-house) Eliminate, reduce or control foreseeable risks through design, provide information about remaining risks Clause 6.1.2 hazard identification; Clause 8.1.2 hierarchy of controls; Clause 7.5 documented information

Read the table as showing support, not equivalence. An auditor assessing your ISO 45001 system checks that it works as designed. They do not sign off your CDM compliance, your construction phase plan or your notification to the HSE. A contractor can hold a valid certificate and still fall short of a CDM duty on a particular project, and an enforcing authority will judge the duty, not the certificate [2]. Used well, the system makes the CDM paperwork a by-product of normal operation rather than a separate exercise.

What an integrated ISO 9001 and ISO 45001 system looks like on a construction project

On a live project an integrated system shows up as one set of controls that serve quality and safety together. Because ISO 9001 and ISO 45001 share the same high-level structure, clauses on leadership, competence, documented information, internal audit and management review are written and audited once, not twice [3][4].

Document control. Drawings, specifications, method statements and inspection records all run through one register with version control, so the crew on site is working to the current revision. Superseded documents are removed from the site office and site tablets.

Competence. ISO 45001 clause 7.2 and ISO 9001 clause 7.2 both require competence to be defined, met and recorded. In practice that means a skills matrix linking each role to the CSCS cards, plant tickets, SMSTS or SSSTS certificates and trade qualifications it needs, with renewal dates tracked.

Risk assessments and method statements. RAMS are the core operational control on site. The system defines who writes them, who reviews them, how they are briefed to the workforce, and how they are revised when the sequence or site conditions change.

Site inspections. Scheduled inspections, covering both workmanship and safety, generate records with photographs, actions and closure dates. Trends feed the management review.

Incident reporting. One route captures accidents, near misses, quality defects and environmental events, with investigation proportionate to potential severity and corrective action tracked to completion under clause 10.2.

Subcontractor control. ISO 45001 clause 8.1.4 covers procurement and contractors. The system sets how subcontractors are approved, what evidence of competence and insurance they provide, how they are inducted, and how their performance is monitored and recorded.

A common site-level finding on construction audits is a method statement that no longer matches the work being done on site, or one that has not been briefed to and signed by the gang doing the task. Keeping RAMS current is the highest-value habit for passing a site audit.

Route to certification for a contractor

How quickly a contractor certifies depends on the state of its existing CDM arrangements. A firm that already documents its construction phase plans, runs internal audits and holds management reviews can often be audit-ready within a few months. One relying on informal, person-dependent arrangements should plan for longer, because the auditor needs a trail of real records to sample. The steps below assume you already run projects under CDM 2015 [1] and have health and safety arrangements in place.

  1. Commission a gap analysis. Compare your current arrangements against ISO 9001 and ISO 45001 using a structured gap analysis. The output is a prioritised action list, usually weighted towards documented information, internal audit and worker consultation.
  2. Fix the certification scope. State the activities and sites the certificate covers, for example "principal contractor and works contractor for commercial fit-out and refurbishment". Include design in scope if you carry design responsibility.
  3. Align the system with your CDM arrangements. Map existing construction phase plans, RAMS processes and inspection regimes to the clauses. Do not build a parallel system.
  4. Confirm competence and training records. Close gaps in the skills matrix and in card and ticket renewals before the audit.
  5. Run the system on live projects. Generate real records over a period of weeks: inspections, briefings, incident logs, subcontractor approvals.
  6. Complete an internal audit and management review. Both standards require at least one full internal audit cycle and a management review before certification.
  7. Stage 1 audit. The certification body checks readiness, scope, and whether your documented system addresses the clauses. Findings here are usually about the maturity of records.
  8. Stage 2 audit. The auditor tests implementation, including at least one visit to an active site, interviews with operatives, and sampling of records.
  9. Certification decision and the three-year cycle. After any nonconformities are cleared, the certificate is issued. Surveillance audits follow annually, with recertification every three years.

Accredited bodies size audit duration using IAF MD 5, based on your headcount and the complexity of your work [5]. An integrated audit of ISO 9001 and ISO 45001 assesses the shared clauses once, which keeps the combined duration below the sum of two separate audits [6].

In our audit experience with SME contractors, integrated Stage 1 and Stage 2 assessments are completed in a small number of auditor days, with at least one of those days on an operational site. The exact figure comes from the IAF MD 5 calculation for your organisation [5], so treat any range you are quoted as a planning guide until scoping is done. If you want that calculation for your headcount and scope, request a quote.

Tenders and pre-qualification: the Common Assessment Standard, SSIP and CHAS

Most UK construction pre-qualification either asks for accredited certification or accepts it as evidence against quality and safety questions. UK construction pre-qualification is now handled mainly through the Common Assessment Standard, operated via Build UK, CHAS and Constructionline, which replaced BSI's PAS 91 after it was withdrawn in April 2023. Under Procurement Policy Note PPN 03/24, the Common Assessment Standard is the recommended construction pre-qualification route for UK public-sector procurement, though buyers may still use the old PAS 91 forms informally. Like PAS 91 before it, the Common Assessment Standard expects quality-management certification held with a UKAS-accredited certification body [7]. That point matters when you choose a certification body: check its accreditation scope and the accreditation body behind it, and confirm it covers the standards your buyers name.

Alongside the Common Assessment Standard, Safety Schemes in Procurement (SSIP) member schemes and construction assessment schemes such as CHAS and Constructionline sit next to ISO certification. An accredited ISO 45001 certificate is frequently accepted as supporting evidence towards the health and safety module in those assessments, which can reduce duplicate questionnaires [8]. For a fuller picture of what procurement teams require for tenders, review the buyer's specific wording, because requirements vary between frameworks.

ISO 9001 and ISO 45001 for Construction Under CDM 2015

Practical summary of the key steps covered in this guide. Source: UniCert

Frequently asked questions

Does ISO 45001 certification make us CDM 2015 compliant?

No. ISO 45001 certification and CDM 2015 compliance are separate. The certificate shows an accredited auditor found your health and safety management system working as designed. It does not discharge any CDM duty, sign off a construction phase plan, or replace HSE notification [2]. What it does is give you the systematic risk management that CDM duty-holders and pre-qualification assessors expect to see.

Do we need both ISO 9001 and ISO 45001, or just one?

It depends on your buyers. Many UK construction clients score quality and safety separately, so contractors often need both. If budget forces a sequence, check which one appears more often as mandatory in your target tenders. ISO 9001 is the more common baseline for public-sector bidding, while ISO 45001 tends to be decisive where site safety risk is high.

Does our certification body have to be accredited?

For tenders that use the Common Assessment Standard, which replaced PAS 91 after it was withdrawn in April 2023, the questionnaire calls for quality-management certification held with an accredited certification body, so an unaccredited certificate may not be accepted [7]. Read each buyer's requirement and confirm your certification body's accreditation scope covers the standards you need. If in doubt, ask the buyer before you commit.

How long does certification take for a contractor?

It depends on how much of your CDM practice is already written down and audited. A contractor that has completed a full internal audit cycle and a management review, and can show real project records, is close to audit-ready. One documenting arrangements for the first time needs longer to generate that evidence. A gap analysis gives you a dated action list and a realistic schedule.

Can a small specialist subcontractor get certified?

Yes. Audit duration and system size scale with headcount and complexity under IAF MD 5, so a small subcontractor has a proportionate system and a shorter audit [5]. The requirements are the same, but the evidence is lighter: a compact skills matrix, a clear RAMS process, inspection records, and controlled documents.

Fitting ISO 9001 and ISO 45001 into your next tender

For a UK building contractor, ISO 9001 and ISO 45001 are mainly commercial tools. They keep you on tender lists and give clients and principal contractors evidence that quality and safety decisions are recorded, reviewed and improved rather than left to individual recall. Keep the accuracy point in view: ISO 45001 supports your CDM 2015 duties and pre-qualification, but it does not discharge them, and an enforcing authority will judge the duty rather than the certificate [1][2]. Build one integrated system, run it on live projects, keep your RAMS current, and choose a certification body whose accreditation scope matches what your buyers ask for. From here, plan how construction certification fits your wider integrated management system certification roadmap.

Editorial note. UniCert is UAF-accredited for ISO 9001, ISO 14001 and ISO 45001, and is an IAF MLA signatory through that accreditation. See /accreditation.

References

  1. legislation.gov.uk. The Construction (Design and Management) Regulations 2015 (SI 2015/51). Retrieved 28 August 2026.
  2. Health and Safety Executive (hse.gov.uk). Managing health and safety in construction: Construction (Design and Management) Regulations 2015, Guidance on Regulations (L153). Duty-holder roles and duties for the client, principal designer, principal contractor, designers and contractors. Retrieved 28 August 2026.
  3. International Organization for Standardization (iso.org). ISO 45001:2018, Occupational health and safety management systems, Requirements with guidance for use. Cited for the harmonised structure, proactive hazard and risk management, and worker consultation and participation. Retrieved 28 August 2026.
  4. International Organization for Standardization (iso.org). ISO 9001:2015, Quality management systems, Requirements. Cited for shared clauses on leadership, competence, documented information and internal audit. Retrieved 28 August 2026.
  5. International Accreditation Forum (iaf.nu). IAF MD 5, Determination of Audit Time of Quality, Environmental, and Occupational Health and Safety Management Systems. Cited for audit-duration sizing by headcount and complexity. Retrieved 28 August 2026.
  6. International Accreditation Forum (iaf.nu). IAF MD 11, Application of ISO/IEC 17021-1 for Audits of Integrated Management Systems. Cited for combined-audit duration when shared clauses are assessed once. Retrieved 28 August 2026.
  7. The Common Assessment Standard (Build UK / CHAS / Constructionline), which replaced BSI PAS 91:2013+A1:2017 (withdrawn April 2023); Procurement Policy Note PPN 03/24. Cited for UK construction pre-qualification expectations on accredited certification. (secondary) Retrieved 28 August 2026.
  8. Safety Schemes in Procurement (SSIP), and construction assessment schemes including CHAS and Constructionline (secondary). Cited for acceptance of accredited ISO 45001 certification as supporting evidence in health and safety pre-qualification modules. Retrieved 28 August 2026.
  9. International Accreditation Forum (iaf.nu) and ISO. ISO/IAF migration guidance for the transition from OHSAS 18001 to ISO 45001 (secondary). Cited for the migration deadline in 2021. Retrieved 28 August 2026.