An ISO 45001 gap assessment is the diagnostic step that happens before implementation begins. It tells you exactly where your current health and safety practices stand against the requirements of ISO 45001:2018 — so you enter the certification process informed, not blindsided.
The stakes are real. The U.S. Bureau of Labor Statistics reported 5,070 fatal work injuries in 2024, and the National Safety Council estimated total U.S. work injury costs at $181.4 billion that same year — including $54.9 billion in wage and productivity losses alone. A structured OHSMS isn't optional infrastructure. It's risk control.
This guide covers what an ISO 45001 gap assessment is, why it matters, how to conduct one step by step, and what the process looks like in practice.
TL;DR
- A gap assessment benchmarks your current OH&S practices against ISO 45001:2018 to pinpoint what's missing before certification
- Skipping it means rework, wasted resources, and corrective actions raised during the certification audit
- Clauses most commonly assessed: leadership commitment (5), hazard identification (6), operational controls (8), and incident investigation (10)
- The deliverable is a prioritized action plan from current state to full conformance
- Teams that close gaps early enter Stage 1 and Stage 2 audits with fewer nonconformities and faster resolution times
What Is an ISO 45001 Gap Assessment?
An ISO 45001 gap assessment is a structured, clause-by-clause review of your existing occupational health and safety practices measured against the requirements of ISO 45001:2018 — the international standard for Occupational Health and Safety Management Systems (OHSMS).
It maps where you are, where the standard requires you to be, and what needs to change before you pursue certification.
How It Fits the ISO 45001 Journey
The gap assessment is a pre-implementation tool. It sits at the beginning of the certification process — before you build or restructure your OHSMS — and distinguishing it from a formal audit matters:
| Activity | Purpose | When It Happens |
|---|---|---|
| Gap assessment | Identifies what needs to change | Before implementation begins |
| Internal audit | Tests whether your implemented system conforms | After implementation, before certification |
| Stage 1 audit | Registrar document/readiness review | Initial certification |
| Stage 2 audit | Full conformity assessment in practice | After Stage 1 clearance |
Registrars including NQA and LRQA consistently position the gap assessment as step one of any implementation or transition — specifically because it surfaces nonconformities before a formal auditor does.
Who Needs a Gap Assessment?
The assessment applies across three scenarios:
- Starting from scratch with no formal OHSMS in place
- Transitioning from OHSAS 18001 to ISO 45001:2018 (the migration deadline passed in September 2021, but the structural differences between the two standards are substantial enough to justify a fresh clause-by-clause review)
- Strengthening an existing OHSMS before a surveillance or recertification audit
Why an ISO 45001 Gap Assessment Is Critical for Workplace Safety
Without a gap assessment, organizations begin implementation without a clear picture of where they actually stand. Teams invest time in areas that may already be compliant while overlooking high-risk gaps in hazard identification or emergency preparedness. By the time those gaps surface during a certification audit, fixing them is significantly more costly — in time, resources, and schedule.
The data backs this up. According to Smithers' analysis of ISO 45001 certification audit nonconformities, the five most common failure areas are:
- Lack of documentation
- Poor risk management
- Lack of training
- Poor compliance monitoring
- Inadequate internal audits
Every one of these is identifiable — and fixable — during a gap assessment, long before a registrar flags them as formal nonconformities.
Five Concrete Benefits
Documented baseline over assumptions. The assessment replaces internal guesswork with evidence. Leadership gets a factual picture of current safety performance — not an optimistic one.
Early exposure of compliance risks. Documentation failures, outdated risk assessments, and missing records cost far less to fix during implementation than when cited as nonconformities mid-audit. NQA requires containment, root cause analysis, and corrective action evidence in response — a process that can push certification back by weeks.
Focused resource allocation. The assessment prioritizes findings by severity and impact, so effort and budget go where they matter most rather than spread evenly across low-risk and high-risk areas alike.
Fewer certification delays. NQA requires the OHSMS to be operational for at least three months — with a full internal audit cycle and management review — before a certification assessment can proceed. The earlier gaps are resolved, the sooner that clock starts. ISOQAR notes Stage 1 and Stage 2 audits should be no more than six months apart, so late gap discovery compresses that window significantly.
Stronger safety culture from day one. Interviews with workers, document reviews, and site observations signal organizational commitment to safety at every level — generating the worker buy-in that makes new procedures stick.
How to Conduct an ISO 45001 Gap Assessment: Step by Step
A gap assessment is most effective when conducted systematically against the actual clauses of ISO 45001:2018 — not as a general safety review. Organizations with no prior ISO experience often benefit from working with a consultant who understands how registrars interpret specific clauses during certification audits.
Step 1 — Understand the ISO 45001:2018 Standard
Before assessing anything, your team needs a working understanding of what the standard actually requires — with or without outside support. The clauses that receive the most scrutiny during certification audits are:
- Clause 4 — Organizational context and interested parties
- Clause 5 — Leadership and worker participation
- Clause 6 — Planning, hazard identification, and risk assessment
- Clause 8 — Operational controls and emergency preparedness
- Clause 10 — Incident investigation and continual improvement
BSI's ISO 45001 self-assessment framework covers all clauses (4 through 10) and uses a maturity scoring model — a useful reference for establishing your baseline before formal assessment begins.
Step 2 — Document Your Current Safety Practices
Collect and review every piece of existing OHS documentation: policies, procedures, risk assessments, training records, incident logs, emergency response plans, and operational controls.
Then go beyond the documents. Conduct site observations and brief interviews with workers and supervisors. There's often a gap between what's written and what actually happens on the floor — and that gap matters to auditors.
Step 3 — Compare Current Practices Against ISO 45001 Requirements
Map each element of your current system to the corresponding ISO 45001 clause. Assign a status to each element:
- Fully compliant — meets the clause requirement with evidence
- Partially compliant — some elements present but incomplete
- Not yet in place — clause requirement not addressed
Use a consistent format — a structured spreadsheet or assessment template — so findings are reviewable by management and traceable when you move into remediation.
Step 4 — Identify Gaps and Prioritize by Risk
Not all gaps are equal. Categorize findings by their potential impact on worker safety and certification readiness.
High-priority gaps (address first) typically include:
- Absent or informal hazard identification processes
- Missing or outdated risk assessments
- No documented emergency response procedures
- Incident investigation records that don't include root cause analysis
- Lack of documented leadership involvement in safety
Medium and low-priority gaps can be scheduled into a broader remediation timeline. Address them after high-priority items are resolved — they won't jeopardize certification readiness if sequenced properly.
Step 5 — Develop a Targeted Action Plan
Each prioritized gap becomes a corrective action with:
- A specific owner — a named person, not just a department
- A completion timeline, with 30/60/90-day milestones working well in practice
- A success criterion that can be verified
- A clause reference for traceability during the eventual audit
SMART goal structure keeps action items concrete and auditable. Vague commitments like "improve hazard identification" don't hold up under registrar review.
Step 6 — Monitor Progress and Reassess
Completing actions on paper isn't the same as resolving gaps in practice. Build a review cadence to verify that corrective actions are actually working — not just checked off a list.
The gap assessment is not a one-time exercise. Revisit it when:
- Processes or operations change significantly
- An incident or near-miss occurs
- A surveillance or recertification audit is approaching
- New regulatory requirements affect your OHS obligations
ISO 45001 Gap Assessment in Action: A Real-World Walkthrough
Consider a mid-sized manufacturing company with approximately 150 employees pursuing ISO 45001 certification for the first time. They have some safety procedures in place but no formal OHSMS. Here's how the gap assessment unfolds.
Steps 1 and 2 — Understanding and documenting: The team reviews the standard and collects existing documentation. During floor interviews, the assessor discovers that hazard identification is done informally by supervisors — no standardized process, no records. Workers also report they're rarely consulted on safety decisions. That's a Clause 6.1 gap and a Clause 5.4 gap identified in the first day.
Steps 3 and 4 — Comparing and prioritizing: The clause-by-clause review surfaces 14 gaps total. After risk prioritization, five are marked high-priority:
- Hazard identification process (Clause 6.1)
- Risk assessment documentation (Clause 6.1)
- Emergency response procedures (Clause 8.2)
- Incident investigation records (Clause 10.2)
- Leadership commitment documentation (Clause 5.1)
The remaining nine are categorized medium or low and scheduled accordingly.
Steps 5 and 6 — Action planning and follow-up: An action plan assigns each gap a responsible owner with 30/60/90-day milestones. After 90 days of remediation, a follow-up review confirms four of five high-priority gaps are resolved. The remaining gap — emergency drill documentation — is scheduled to be completed before the Stage 1 audit.
The outcome: the company proceeds to certification with confidence. No major nonconformities during the audit.
Independent data supports this approach. The ASSP documented a manufacturing case study in which an aluminum manufacturer — after conducting a gap analysis of its existing programs and implementing ISO 45001 — achieved a 50% reduction in injuries by systematically addressing high-risk hazards.
How Synergistic Systems Can Help
Synergistic Systems is an ISO management systems consulting firm with over 25 years of experience and a hands-on approach built on modular documentation and training systems. Their consultants have worked alongside all major accredited registrars — including DNV, Bureau Veritas, BSI, Lloyd's Register, NQA, SGS, and others — which means they know exactly what auditors examine during ISO 45001 certification.
Their ISO 45001 gap assessments cover every clause, not just documentation. Consultants work directly with personnel at every level — from top management to hourly workers — to document existing processes accurately, identify gaps, and translate findings into a step-by-step implementation roadmap.
A few things that make their approach practically useful:
- Ready-to-adapt templates for hazard identification, risk assessment, emergency response, and incident investigation — so gap resolution starts immediately after the assessment
- A cloud-based intranet hosts hazard logs, risk registers, incident records, corrective actions, internal audits, and management reviews in one place; no hardware or software purchase required, and well-suited for multi-site organizations
- For organizations already on ISO 9001, ISO 45001 is added as a module within the existing system rather than built in parallel — eliminating duplicate documentation and reducing implementation cost
- Full-cycle support from the initial gap assessment through Stage 1 and Stage 2 registration audits
To start with a complimentary discovery meeting, contact Synergistic Systems at their Dallas Metroplex ISO Center at (972) 415-9217, Gulf Coast ISO Center at (225) 924-0099, or Northwest Arkansas ISO Center at (225) 306-5182.
Frequently Asked Questions
What is the gap analysis in ISO 45001:2018?
An ISO 45001:2018 gap analysis is a structured assessment that compares your current occupational health and safety practices against the specific requirements of the standard. It identifies what must be improved, documented, or built before certification can be achieved. The findings serve as the foundation for your implementation plan.
What are the 4 steps of gap analysis?
The core sequence is: (1) document your current state, (2) compare it against the standard's requirements, (3) identify and prioritize the gaps, and (4) develop an action plan to close them. In practice, ISO 45001 gap assessments typically add steps for site observation, worker interviews, and ongoing progress monitoring.
How long does an ISO 45001 gap assessment take?
Timeline depends on organization size, complexity, and documentation readiness. A small to mid-sized company may complete the assessment in one to three days; larger or multi-site organizations may require a week or more of document review, site observations, and analysis.
What is the difference between an ISO 45001 gap assessment and an audit?
A gap assessment is a diagnostic tool used before or during implementation to find and fix weaknesses. A formal audit — whether internal or by a registrar — verifies that your system already meets ISO 45001 requirements. Gap assessments inform improvement; audits confirm compliance.
Which ISO 45001 clauses most commonly have gaps?
The most frequently underdeveloped areas are Clause 6.1 (hazard identification and risk assessment), Clause 5 (leadership involvement and worker participation), Clause 8 (operational controls and emergency preparedness), and Clause 10 (incident investigation and corrective actions), consistent with top nonconformities commonly reported across the industry.
Can an organization conduct an ISO 45001 gap assessment internally?
Internal assessments are possible, but familiarity bias and limited knowledge of registrar interpretations frequently cause real gaps to go undetected. An experienced ISO 45001 consultant — such as Synergistic Systems, with 25+ years of gap assessment work across hundreds of projects — delivers more objective findings and an action plan that holds up at audit.
