Service area: Available in California, Nevada, Arizona, Oregon, Washington, Idaho, Montana, Utah, Wyoming, Colorado, New Mexico, North Dakota and South Dakota.
ISO 45001 is the international standard for occupational health and safety management systems. It replaced OHSAS 18001, which is now withdrawn — organizations certified to the old standard were required to migrate by March 2021. McNeil Safety Consulting helps California employers build management systems that satisfy ISO 45001 while remaining compliant with Cal/OSHA, which is a distinction that matters more than most consultants admit.
ISO 45001 and OHSAS 18001
ISO 45001:2018, Occupational health and safety management systems — Requirements with guidance for use, was published on 12 March 2018. Certified organizations were given three years to migrate, and that window closed on 12 March 2021. If your documentation still references OHSAS 18001, it references a standard that no longer exists.
The substantive change was structural. ISO 45001 uses the same high-level structure as ISO 9001 and ISO 14001, so it integrates with quality and environmental systems. More significantly, it moves accountability upward: leadership cannot delegate the management system to a safety officer, and worker consultation and participation became explicit requirements rather than good practice.
What We Do
- Gap analysis — your current system measured against each clause of ISO 45001, with findings written plainly rather than in audit shorthand
- Context and interested parties — Clause 4 work that most organizations do badly, because it requires honest scoping rather than boilerplate
- Hazard identification and risk assessment — a documented methodology that satisfies Clause 6 and survives scrutiny
- Legal and other requirements — the compliance obligations register, which for California employers means Title 8 mapped into the system rather than sitting beside it
- Documented information — procedures, records, and control of documents, sized to your operation instead of a template
- Internal audit and management review — building the cycle that keeps certification rather than achieving it once
- Migration from OHSAS 18001 — for organizations still operating a legacy system
ISO 45001 Does Not Replace Cal/OSHA Compliance
This is the point worth being blunt about. ISO 45001 is a voluntary management standard. Cal/OSHA Title 8 is law. A certified management system does not satisfy your obligation under 8 CCR §3203 to maintain an Injury and Illness Prevention Program, and certification is not a defense to a citation.
Built well, the two reinforce each other — the ISO system becomes the mechanism that keeps your Title 8 obligations current instead of a parallel set of binders. Built poorly, you pay for two systems and get the benefit of neither.
ISO 14001 — and the 2026 Revision That Just Reset Every Certified EMS
ISO 14001:2026 was published on 15 April 2026, replacing ISO 14001:2015. Certified organizations have a three-year transition: certificates must move to the new edition before April 2029 to stay valid. If your environmental management system was built to the 2015 edition and nobody has looked at it since, the clock is already running.
Be skeptical of anyone selling this as a crisis. It is a moderate revision, and an organization with a functioning 2015 system is not starting over. What actually changed:
- The environmental conditions an organization must consider are broader than climate change alone — pollution, biodiversity and the availability of natural resources are now explicitly in scope
- The risk and opportunity requirements have been restructured and clarified
- The life cycle perspective in the determination of environmental aspects is strengthened
- New requirements address the planning and management of change
- Operational control widened from “outsourced processes” to externally provided processes, products and services — which pulls contractors, waste vendors and logistics providers into the system in a way many existing manuals do not cover
The clause that decides whether a California EMS survives its audit is compliance obligations. A register that lists “applicable environmental laws” and stops there is not a register. A real one names the air district permit conditions and the AER and AB 2588 reporting that attach to them, the HMBP inventory in CERS and the CUPA that receives it, the construction or industrial stormwater permit and the SWPPP under it, and the DTSC generator obligations under 22 CCR Division 4.5 — each with the responsible person, the frequency and the evidence. Building that register is most of the work, and it is the part generic ISO consultants skip because it requires knowing the underlying regulations rather than the standard.
Integrated EHS Management Systems
ISO 9001, ISO 14001, ISO 45001 and ISO 50001 share a harmonized structure — the same clause skeleton, the same vocabulary, the same management cycle. That is a design decision by ISO, and it means running three parallel systems with three manuals, three audit programmes and three management reviews is a self-inflicted cost. Organizations do it anyway, usually because each system was bought separately from a different consultant.
An integrated EHS management system runs one context and interested-parties analysis, one combined compliance obligations register covering health, safety and environmental duties together, one document control scheme, one internal audit programme, one corrective and preventive action process, and one management review that puts safety performance and environmental performance in front of leadership at the same meeting. Where energy management matters — refrigerated warehousing, process heat, large fleets — ISO 50001 folds into the same structure.
Said plainly: we do not certify anyone. Certification is issued by an accredited certification body after its own audit, and no consultant who builds your system can also certify it. What we do is build the system, run the internal audits, and prepare you so that the Stage 1 and Stage 2 audits are uneventful. Any firm that implies it can hand you a certificate is describing something that does not exist.
How ISO Program Development Actually Runs
The work is sequential and the sequence matters. Systems fail their certification audit almost always for the same two reasons: the compliance obligations register was never built from the organization’s real regulatory position, and worker consultation was documented rather than done.
- Gap analysis against the clause set of the applicable standard, producing a findings list tied to clause numbers rather than a generic score
- Context, interested parties and scope — including an honest scope boundary, since an inflated scope is a promise you have to audit against forever
- Compliance obligations register built from the actual Cal/OSHA Title 8 sections, air district permit conditions, water board permit terms, DTSC and CUPA obligations, and federal OSHA and EPA requirements that apply at each site
- Hazard identification and risk assessment under ISO 45001 clause 6.1.2, and environmental aspects and impacts with the life cycle perspective under ISO 14001 — done from observation of the work, not from a spreadsheet of job titles
- Worker consultation and participation, ISO 45001 clause 5.4. This is the clause that fails audits. It requires non-managerial workers to be genuinely consulted on hazard identification, controls, investigation and the system itself, and auditors ask them directly
- Documented information, operational planning and control, including contractor and procurement controls and the externally provided processes now emphasized in ISO 14001:2026
- Emergency preparedness and response, reconciled with the Emergency Action Plan under 8 CCR §3220, any HASP, the RCRA contingency plan and the RMP — so the documents agree with each other
- Internal audit programme and auditor competence, with the first cycle run before the certification body arrives
- Management review with the required inputs actually present, and corrective action that reaches root cause instead of restating the finding
- Stage 1 and Stage 2 audit support, and closing nonconformities afterward
For employers operating outside California, the same system has to hold up under federal OSHA and the Oregon, New Mexico and Wyoming state plans, which do not share California’s requirements. A management system written entirely around Title 8 travels badly. See federal and multi-state qualifications.
Call (626) 546-9384 to talk through where your system actually stands.
Common Questions
Do we need ISO 45001 certification?
Not as a matter of law. Organizations usually pursue it because a customer, general contractor, or parent company requires it, because they operate internationally, or because they want a management system with an external check on it. If none of those apply, a well-built Title 8 program may serve you better for less.
Can you certify us?
No, and no consultant can. Certification is issued by an accredited certification body, which must be independent of the party that built the system. We prepare you for that audit and support you through it.
We are still on OHSAS 18001. How bad is that?
Any OHSAS 18001 certificate expired at migration. The underlying system is not worthless — much of it maps across — but the gap analysis has to be done honestly, because ISO 45001 asks for things OHSAS 18001 never did, particularly around leadership and worker participation.
Discuss Your Management System
Serving employers throughout California. Call (626) 546-9384.
Every engagement is handled personally — nothing is farmed out. Michael Karl McNeil performs the site work, the sampling, the program writing and the citation defense himself; Zennin Sedacey-McNeil, LVN handles the occupational health and medical surveillance side. Work is never subcontracted, brokered to a partner firm, or assigned to a contract inspector hired locally for the assignment. See the service area page for what we do in each of the eleven states.
States We Serve
McNeil Safety Consulting provides this service to clients in the following states:
- California
- Nevada
- Arizona
- Oregon
- Washington
- Idaho
- Montana
- Utah
- Wyoming
- Colorado
- New Mexico
- North Dakota
- South Dakota
To confirm coverage for your site, call (626) 546-9384.