ISO 45001 certification consultant in Malaysia
Occupational health and safetyISO 45001:2018
Turn DOSH compliance into a system that prevents incidents, not just a file for when the inspector calls.
What it is
ISO 45001:2018 is the international standard for an occupational health and safety management system, replacing the earlier OHSAS 18001. It requires an organisation to identify hazards, assess risk, involve workers in decisions that affect their safety, and control the causes of injury and ill health rather than reacting after an incident. Certification follows a two-stage audit by an accredited body. In Malaysia it works alongside the Occupational Safety and Health Act 1994, amended in 2022 to widen its coverage, giving DOSH inspectors and customers evidence that safety is systematically managed on top of statutory compliance.
Who needs it in Malaysia
- Manufacturers and construction firms with physical risk
- Factories, workshops, and construction sites with machinery, height work, or chemical exposure use ISO 45001 to formalise the hazard identification and risk assessment that OSHA 1994 already requires, and to reduce lost-time incidents.
- Contractors bidding tenders that score safety systems
- CIDB and many corporate tenders now score bidders on documented safety management, not just a safety officer's presence. ISO 45001 gives contractors a certificate that answers that section of the tender directly.
- Companies after a reportable incident or DOSH audit finding
- A lost-time injury, a DOSH inspection with findings, or an insurer's request for a stronger safety system pushes many companies toward ISO 45001 to show a structured response rather than a one-off fix.
- Groups integrating safety with ISO 9001 or ISO 14001
- Companies already certified to ISO 9001 or ISO 14001 add ISO 45001 on the same audit cycle, since the clause structure matches and worker safety data often overlaps with quality and environmental records.
Our process
Hazard identification and risk assessment baseline
We review every work activity for hazards, from machinery and chemicals to ergonomics and psychosocial risk, and build the risk assessment register clause 6.1.2.1 requires before anything is documented.
Legal register mapped to OSHA 1994
We build the compliance obligations register against the Occupational Safety and Health Act 1994 and its 2022 amendments, plus any sector-specific regulations, so legal compliance evidence exists before the auditor asks for it.
Worker consultation and documentation
Procedures, safe work instructions, and emergency plans are drafted with input from the workers actually exposed to the risk, satisfying clause 5.4's requirement for consultation and participation, not management alone.
Internal audit and management review
A full rehearsal covering clause 9.2 and clause 9.3, closing findings and compiling incident data, near-miss reports, and corrective action status for the management review the standard requires.
Certification audit support
We accompany you through Stage 1 and Stage 2, including a site walk-through of machine guarding, PPE use, and permit-to-work records, and help close findings before they threaten the certificate.
Timeline
A single site with an existing safety officer and OSHA 1994 compliance history typically reaches certification in three to six months from gap analysis. Higher-risk sites, such as construction or chemical handling, or companies without a documented incident and near-miss process, can take up to eight months since evidence needs to accumulate across a full internal audit cycle. Pairing ISO 45001 with ISO 9001 or ISO 14001 usually adds one to two months rather than doubling the project.
What affects the cost
- Number of sites and the physical risk profile of the work performed
- Existing safety officer capacity and OSHA 1994 compliance history
- Certification body fees, which scale with site count and risk classification
- Scope of worker training on hazard identification and emergency response
- Whether incident and near-miss reporting is already documented
- Whether ISO 9001 or ISO 14001 are implemented in the same project
How BUKTI helps
- BUKTI keeps your hazard and risk assessment register current against clause 6.1.2.1, so it reflects real work activity rather than a document frozen at the last audit.
- Incidents, near misses, and corrective actions run through BUKTI's CAPA workflow mapped to clause 10.2, with root cause and closure evidence tracked automatically.
- Management review inputs required by clause 9.3, including incident trends and worker consultation records, are compiled in BUKTI so the meeting starts with data.
FAQ
How is ISO 45001 different from OSHA 1994 compliance?
OSHA 1994, amended in 2022, is Malaysian law that every employer must follow regardless of certification. ISO 45001 is a voluntary management system standard that gives you a documented, auditable way to meet and exceed those legal duties, with worker consultation and continual improvement built in, rather than compliance existing only on paper.
Does ISO 45001 replace OHSAS 18001?
Yes. ISO 45001 fully replaced OHSAS 18001, which was withdrawn in March 2021. Companies still holding an OHSAS 18001 certificate no longer hold a valid safety management system certification and need to migrate to ISO 45001.
How much does ISO 45001 certification cost in Malaysia?
Cost depends on the number of sites, the risk profile of the work, and how much safety documentation already exists. Certification body fees are quoted separately from consulting fees, and we provide a written, fixed-scope quote after reviewing your operation.
How long does ISO 45001 implementation take?
Three to six months is typical for a single site with an existing safety officer. Higher-risk operations or sites without documented incident records need longer, since auditors expect to see a full internal audit cycle of evidence before certification.
Can ISO 45001 be combined with ISO 9001 or ISO 14001?
Yes, and most manufacturing and construction clients do exactly that. The clause structures align closely, so documentation, internal audits, and management review meetings are shared across all three standards, which usually costs less overall than pursuing three separate certification projects.
What happens after a workplace incident once we are certified?
ISO 45001 requires investigation, root cause analysis, and corrective action through clause 10.2, on top of any OSHA 1994 reporting duty. BUKTI's CAPA workflow keeps that investigation on record, which certification bodies and DOSH inspectors both expect to see.
Related standards
Where we work
Perlis, Kedah, Penang, Perak, Selangor, Kuala Lumpur, Putrajaya, Negeri Sembilan, Melaka, Johor, Pahang, Terengganu, Kelantan, Sabah, Sarawak, Labuan. ISO consultants in every Malaysian state.
Ask about this standard
Had a DOSH finding or a tender scoring safety systems?
Tell us what triggered the search for ISO 45001. We will show you the fastest realistic path to certification.