ISO 45001 OHSMS Workspace: From Context to Certification Readiness in 12 Steps
A practical guide for EHS consultants and safety teams on using Rakenne's ISO 45001 OHSMS workspace template to build a complete, internally consistent OH&S management system documentation set — with tool-assisted validation at every step.
Building an ISO 45001-compliant Occupational Health and Safety Management System is documentation-heavy and domain-specific. A first-time certification for a mid-sized manufacturing or construction company typically takes 6–12 months, with over half the effort spent on hazard identification, risk assessment, legal register maintenance, and cross-referencing controls against regulations. The bottleneck is rarely writing text — it is translating messy operational realities into auditable, hierarchy-of-controls-compliant, worker-participation-evidenced documentation.
Rakenne’s ISO 45001 OHSMS workspace template provides 12 specialized skills and 24 validation tools that guide an LLM agent through the entire PDCA cycle. Each skill enforces a structured workflow, loads ISO 45001-specific references, and uses deterministic tools to check the agent’s output — catching the kinds of errors that plain LLM drafting misses: missing hierarchy of controls justification, legal register entries without review dates, emergency plans that skip contractor procedures, and cross-document gaps where a hazard register doesn’t feed back into incident investigation findings.
This guide walks through all 12 skills in sequence, shows real dialog excerpts and tool outputs, and explains what makes tool-assisted OHSMS documentation materially better than generic AI drafting.
Why plain LLMs fall short for ISO 45001
A plain LLM can draft hazard registers and OH&S policies. Where it struggles is OH&S-specific validation:
| Concern | Plain LLM | Rakenne with ISO 45001 skills |
|---|---|---|
| Hierarchy of controls | May jump straight to PPE without justification | Enforces elimination → substitution → engineering → administrative → PPE with documented rationale |
| Worker participation | Mentions “consultation” generically | Validates evidence of both consultation (5.4a) and participation (5.4b) with specific mechanisms |
| Hazard-legal traceability | Weak linkage between hazards and legal requirements | Tools verify every hazard links to applicable legal obligations and vice versa |
| Incident feedback loop | No structural enforcement | Validates that incident investigation findings feed back into hazard identification (6.1.2) |
| Self-correction | Errors persist until manual review | Validation tools return PASS/FAIL; the agent revises until checks pass |
The difference is structural: skills give the agent a spec (workflow + references + structure) and tools (deterministic checks) to verify its own output. This is what turns a draft into an auditable artifact.
The 12-step OHSMS journey
The workspace template installs 12 skills that map to the ISO 45001 PDCA cycle:
| Phase | Step | Skill | What gets validated |
|---|---|---|---|
| Plan | 1 | Organization Profile | OH&S context completeness, worker demographics, regulatory environment |
| Plan | 2 | Gap Assessment | Mandatory artifact detection, clause maturity rating, remediation prioritization |
| Plan | 3 | Hazard & Legal Author | Hazard-legal linkage, hierarchy of controls, legal register review dates, planning action completeness |
| Do | 4 | OH&S Policy & Leadership | Six mandatory policy commitments, role definitions, approval signatures |
| Do | 5 | Competence & Awareness | Competence matrix, training plan sections, communication procedure, awareness topics |
| Do | 6 | Operational Controls | Hazard linkage, MOC procedure completeness, contractor management lifecycle |
| Do | 7 | Emergency Preparedness | Scenario coverage, response procedure elements, drill schedule, external services |
| Check | 8 | Monitoring & Measurement | Leading and lagging indicators, compliance evaluation procedure |
| Check | 9 | Internal Audit | Auditor impartiality, finding completeness, severity classification |
| Act | 10 | Management Review | Mandatory input coverage (a)–(g), output decisions, action completeness |
| Act | 11 | Incident Investigation | Incident types, investigation methodology, correction vs. corrective action, hazard feedback loop |
| Act | 12 | Executive Readiness Report | Board-ready compliance summary, readiness scoring |
Each skill reads workspace files produced by earlier steps — the organization profile feeds into hazard identification, hazard identification feeds into operational controls and emergency plans, and incident investigation findings feed back into hazard identification. The entire chain is traceable.
Step 1: Organization Profile — the OH&S foundation
Every ISO 45001 engagement starts with understanding the organization’s OH&S context. The Organization Profile skill captures structured facts — industry sector, worker demographics, work activities by risk level, locations, injury history, regulatory bodies, and contractor relationships — into a reusable profile file.
You: SafeBuild Construction is a mid-sized construction company based in Melbourne, 200 employees across 3 active construction sites plus a head office. We have a mix of direct employees and subcontractors — about 80 subcontractors on any given day. Key hazards include working at heights, mobile plant, excavations, electrical work, and manual handling. Our LTIFR last year was 12.3 and TRIFR was 28.7. We’re regulated by WorkSafe Victoria under the OHS Act 2004 and OHS Regulations 2017. We also do some work in NSW so we need to comply with SafeWork NSW requirements too. Our Safety Manager is James Chen, and our CEO is Sarah Mitchell.
Agent: I’ve drafted the organization profile based on your context. Let me run the completeness checker.
Profile completeness: PASS (94%). All required sections are present — organization details, worker demographics (200 employees + 80 subcontractors), 4 locations, 8 work activities with risk levels, OH&S history (LTIFR 12.3, TRIFR 28.7), regulatory environment (OHS Act 2004, OHS Regulations 2017, SafeWork NSW). Minor gap: shift patterns not documented — construction sites likely operate day shifts and occasional night work. I recommend adding shift information as it affects fatigue-related hazards.
I’ve also produced
output/Interested-Parties-Register.mdcovering workers, subcontractors, WorkSafe Victoria, SafeWork NSW, unions (CFMEU), neighbouring businesses, and emergency services. Andoutput/OHSMS-Scope-Statement.mdcovering all 3 construction sites and head office operations.
The organization profile becomes the anchor for everything that follows — hazard identification draws from work activities, the legal register draws from the regulatory environment, and every skill tailors its output to the organization’s size and hazard profile.
Step 2: Gap Assessment — where do you stand?
Before diving into detailed documentation, the Gap Assessment skill evaluates current OH&S practices against all ISO 45001 clauses (4–10), producing a maturity-rated gap report and remediation roadmap.
You: Assess our current OH&S practices against ISO 45001 requirements. We have some safe work procedures and a basic hazard register, but nothing formal for most clauses.
Agent: I’ve scanned the workspace for OHSMS artifacts and rated each clause area. Here’s what I found.
The mandatory artifact detector found 3 of 15 expected documents: the organization profile (4.1–4.3), the interested parties register (4.2), and the scope statement (4.3). Missing: OH&S policy (5.2), hazard register (6.1.2), legal register (6.1.3), emergency plan (8.2), internal audit (9.2), management review (9.3), and others.
Clause maturity ratings: Clause 4 (Context) is at level 3 — the organization profile provides a solid foundation. Clause 5 (Leadership) is at level 1 — ad-hoc with no formal policy. Clause 6 (Planning) is at level 1 — basic hazard register exists but not structured. Clauses 7–10 are at level 0.
Remediation priority:
- Phase 1 Foundation — OH&S policy (5.2), roles and responsibilities (5.3)
- Phase 2 Core — Hazard identification (6.1.2), legal register (6.1.3), objectives (6.2)
- Phase 3 Operational — Emergency plan (8.2), operational controls (8.1), competence (7.2)
- Phase 4 Validation — Internal audit (9.2), management review (9.3), incident procedure (10.2)
Step 3: Hazard Identification & Legal Register — the technical core
This is where ISO 45001 differs most from other management system standards. The Hazard & Legal Author skill handles hazard identification, risk assessment with the severity/likelihood matrix, hierarchy of controls, the legal register, planning actions, and OH&S objectives — with tool-assisted validation that catches the most common audit findings.
You: Identify hazards for our construction operations and build the legal register. Key work activities: working at heights (scaffolding, roofing), excavation and trenching, mobile plant operation (cranes, excavators), electrical installations, manual handling and lifting, and confined space entry.
Agent: I’ve identified 24 hazards across your 6 work activities, assessed risks using a 4×5 severity/likelihood matrix, and applied the hierarchy of controls. Let me run the validation tool.
Legal register validation: ERROR — 2 issues found.
- Legal register entry “OHS Regulations 2017” has no review date. Adding annual review date.
- Legal register entry “AS/NZS 1576 Scaffolding” has no compliance status. Setting to “Compliant — verified via site inspection records.”
Hazard-legal linkage: PASS — all 24 hazards link to applicable legal requirements. For example, “Working at heights — fall from scaffolding” links to OHS Regulations 2017 Part 3.5 (Fall prevention) and AS/NZS 1576 (Scaffolding).
Hierarchy of controls: PASS — all high/critical risks have controls documented in hierarchy order. For “Fall from scaffolding” (Critical, 4×5=20): Elimination not practicable for scaffolding work → Engineering controls: guardrails, toe boards, scaffold ties → Administrative: SWMS, competency verification → PPE: harness as last resort. Residual risk after controls: Medium (2×5=10).
Planning action: PASS — all actions have owners and target dates.
Here’s a sample from the hazard register:
| ID | Hazard | Activity | L | S | Score | Controls (Hierarchy) | Residual |
|---|---|---|---|---|---|---|---|
| H-01 | Fall from scaffolding | Heights | 4 | 5 | 20 Critical | Eng: guardrails, toe boards; Admin: SWMS; PPE: harness | 10 Medium |
| H-05 | Trench collapse | Excavation | 3 | 5 | 15 Critical | Eng: shoring, benching; Admin: ground assessment, exclusion zones | 8 Medium |
| H-12 | Crane strike | Mobile plant | 3 | 5 | 15 Critical | Eng: exclusion zones, proximity alarms; Admin: spotters, SWMS | 6 Medium |
Without the validation tool, the agent could produce a hazard register that jumps to PPE without justifying why higher-level controls aren’t practicable — the most common audit finding in ISO 45001 certification.
Step 4: OH&S Policy & Leadership — the six mandatory commitments
ISO 45001 Clause 5.2 requires the OH&S policy to include six specific commitments. The OH&S Policy & Leadership skill drafts the policy and validates that all six are present — something auditors check word-by-word.
You: Draft the OH&S policy for SafeBuild Construction and define roles and responsibilities.
Agent: I’ve drafted the OH&S policy and roles matrix based on your organization profile. Let me validate.
Policy validation: PASS — all 6 mandatory commitments present: ✓ Prevention of work-related injury and ill health ✓ Provision of safe and healthy working conditions ✓ Elimination of hazards and reduction of OH&S risks ✓ Continual improvement of the OH&S management system ✓ Consultation and participation of workers ✓ Compliance with legal and other requirements
Roles defined: ✓ Top management (CEO Sarah Mitchell), ✓ OH&S Manager (James Chen), ✓ Safety Representatives (site-level), ✓ First Aiders, ✓ Emergency Coordinators. WARNING: No dedicated return-to-work coordinator identified — recommend assigning for injury management.
Step 5: Competence & Awareness — training that matches hazard exposure
The Competence & Awareness skill builds a competence matrix that maps each role to required OH&S competencies based on actual hazard exposure, then generates the training plan, awareness program, and communication procedure.
You: Build the competence matrix and training plan for our construction workforce.
Agent: I’ve mapped 12 roles to required OH&S competencies based on your hazard register. Let me validate.
Competence matrix: PASS — all roles link to required competencies. Scaffolders require: working at heights (RIIWHS204E), scaffold inspection, harness use. Crane operators require: licence verification (HR/HC), dogger/rigger awareness. All workers require: site induction, emergency procedures, hazard reporting.
Training plan: PASS — all 6 required sections present: target audiences (12 roles), training modules (18 modules), delivery schedule (quarterly cycle), effectiveness evaluation (competency assessments + site observations), induction program, specialized training (confined space, heights, electrical).
Communication procedure: PASS — covers internal (toolbox talks weekly, safety alerts, committee minutes monthly) and external (regulator notifications, contractor inductions, emergency services liaison).
Step 6: Operational Controls — MOC, contractors, and safe work procedures
The Operational Controls skill links controls directly to the hazard register and addresses the three most audited operational areas: general controls (8.1.1), management of change (8.1.3), and contractor/procurement management (8.1.4).
You: Document our operational controls, change management procedure, and contractor management approach.
Agent: I’ve drafted all three documents linked to your hazard register. Let me validate.
Operational controls: PASS — all controls reference identified hazards. Safe work method statements (SWMS) mapped to 8 high-risk construction activities. Permit-to-work system covers: hot work, confined space, excavation, electrical isolation.
MOC procedure: PASS — all 5 required sections present: types of changes (process, equipment, personnel, regulatory, site conditions), risk assessment before change, approval authority, communication of change, post-change review.
Contractor management: WARNING — pre-qualification criteria cover insurance and competency verification, but missing explicit requirement for contractor OH&S management plan review. Adding requirement for contractors on sites >5 days to submit their OH&S management plan.
Step 7: Emergency Preparedness — plans that survive contact with reality
The Emergency Preparedness skill develops emergency plans with response procedures for each identified scenario, drill schedules, and external service coordination.
You: Develop emergency plans for our construction sites. Key scenarios: structural collapse, fall from height rescue, fire, chemical spill, electrical contact, severe weather, and medical emergency.
Agent: I’ve developed response procedures for all 7 scenarios. Let me validate.
Scenario coverage: PASS — 7 scenarios documented (exceeds minimum of 3). Each has response procedure with all 6 required elements: alarm/notification chain, evacuation routes, assembly points, emergency roles, first aid response, and emergency contacts.
Drill schedule: PASS — annual full evacuation drill, quarterly desktop exercises, monthly first aid refreshers. Post-drill evaluation process defined with debrief template.
External services: PASS — coordination documented with MFB (fire), Ambulance Victoria, WorkSafe Victoria (notifiable incidents), EPA Victoria (environmental incidents). Contact numbers and notification thresholds documented.
Contractor provisions: PASS — contractor emergency induction requirements documented, including assembly point familiarization and site-specific hazard briefing.
Step 8: Monitoring & Measurement — leading indicators catch problems early
The Monitoring & Measurement skill defines both leading and lagging OH&S indicators, the monitoring program, and the compliance evaluation procedure.
You: Set up our OH&S monitoring program with both leading and lagging indicators appropriate for construction.
Agent: I’ve defined 14 indicators and the monitoring program. Let me validate.
Indicator coverage: PASS — both types present. Leading indicators: site safety inspections (weekly), near-miss reports (monthly), toolbox talk attendance (weekly), SWMS compliance audits (monthly), safety observations (daily), training completion rate. Lagging indicators: LTIFR, TRIFR, severity rate, lost workdays, workers’ compensation claims, notifiable incidents.
Compliance evaluation: PASS — systematic evaluation process against 23 legal register entries, with annual evaluation cycle, actions for non-compliance, and regulator notification thresholds.
Step 9: Internal Audit — independence and finding rigour
The Internal Audit skill plans and documents the OHSMS audit with auditor impartiality checks and structured finding validation.
You: Plan and document an internal audit covering our full OHSMS. James Chen is the Safety Manager — make sure we handle auditor independence properly.
Agent: I’ve drafted the audit plan and report. Let me validate.
Auditor impartiality: WARNING — James Chen (Safety Manager) cannot audit Clause 6 (Planning) or Clause 8 (Operation) as these fall under his direct responsibility. Recommending an external auditor or cross-functional team member for those clause areas.
Finding validation: PASS — all 5 findings have severity classification, ISO 45001 clause reference, objective evidence, and corrective action (for NCs). 1 Major NC (Clause 5.4 — worker participation records incomplete for night shift), 2 Minor NCs, 2 OFIs.
Step 10: Management Review — the PDCA capstone
The Management Review skill compiles all OHSMS artifacts into the input pack, validates coverage of all mandatory inputs per Clause 9.3.2, and ensures every decision produces trackable actions.
You: Prepare the management review. Sarah Mitchell (CEO) and James Chen (Safety Manager) will attend.
Agent: I’ve compiled the input pack from workspace artifacts. Let me validate.
Input pack compilation: Found 8 of 12 expected artifacts — organization profile, hazard register, legal register, incident reports, audit report, monitoring data, CAPA log, and OH&S objectives.
Mandatory input validation: PASS — all 7 input categories (a)–(g) substantively addressed. All 3 output categories present: continual improvement opportunities, OHSMS changes needed, resource requirements.
Action completeness: PASS — all 6 actions have owners, due dates, and expected outcomes. Example: “Update night shift consultation procedure — Owner: James Chen — Due: 2026-06-30 — Expected: Documented evidence of night shift worker participation in hazard identification.”
Step 11: Incident Investigation — closing the loop
The Incident Investigation skill establishes the investigation procedure and corrective action process, with a critical validation: that investigation findings feed back into hazard identification (6.1.2) — a mandatory ISO 45001 requirement that auditors specifically check.
You: Establish our incident investigation procedure and corrective action process. We’ve had 3 recordable incidents this year: a scaffold fall (fractured wrist), a near-miss with a crane, and a chemical splash (minor burn).
Agent: I’ve drafted the investigation procedure and corrective action register. Let me validate.
Incident types: PASS — 6 types covered: fatalities, serious injuries, occupational diseases, near-misses, property damage, environmental releases.
Investigation methodology: PASS — 5-Why analysis as primary method with Fishbone/Ishikawa for complex incidents.
Correction vs. corrective action: PASS — procedure clearly distinguishes immediate fix (correction) from systemic root cause fix (corrective action).
Hazard feedback loop: PASS — procedure requires investigation findings to update hazard register (6.1.2). The scaffold fall investigation identified “scaffold tie spacing exceeding manufacturer specifications” as a new hazard — added to hazard register as H-25 with engineering control (inspection checklist update).
CAPA register: PASS — all 8 required fields present for each entry.
This feedback loop — from incident investigation back to hazard identification — is what makes ISO 45001 a living system rather than a set of static documents. The validation tool ensures the loop is actually closed.
Step 12: Executive Readiness Report — the board summary
The Executive Readiness Report (a cross-standard skill) scans all OHSMS artifacts and generates a board-ready compliance summary with readiness scoring.
Post-certification: Annual Maintenance
After certification, the Annual Maintenance skill prepares for surveillance audits by scanning document freshness, classifying organizational changes by OH&S impact, reconciling open CAPAs, and scoring readiness across 8 dimensions.
What the dashboard tracks
Throughout the engagement, each skill updates the project dashboard:
- Certification Readiness — weighted score across 6 areas: Context & Scope, Hazard & Risk Management, Policy & Support, Performance Evaluation, Leadership & Review, and Improvement
- PDCA Phase — current implementation phase (Plan → Do → Check → Act → Maintain)
- Hazard & Risk Management — total hazards, risk distribution by level, legal requirements count, controls coverage percentage
- Findings & Corrective Actions — open/closed gap findings, incidents, CAPAs
- Clause Maturity — radar chart showing maturity (0–5) for each clause area
The dashboard gives both the implementation team and management a real-time view of certification progress — without manual spreadsheet tracking.
Effort comparison
| Activity | Traditional consulting | With Rakenne OHSMS skills |
|---|---|---|
| Organization context & scope | 2–3 days | 1–2 hours |
| Hazard identification & risk assessment | 5–10 days | 1–2 days (with validation) |
| Legal register | 3–5 days | 2–4 hours |
| OH&S policy & roles | 2–3 days | 1–2 hours |
| Emergency plans | 3–5 days | 2–4 hours |
| Internal audit | 5–8 days | 1–2 days |
| Management review | 2–3 days | 2–4 hours |
| Total documentation | 25–40 days | 4–6 days |
The time savings come from three sources: structured templates that eliminate blank-page paralysis, automated validation that catches errors before review, and cross-document consistency checks that prevent the back-and-forth of finding contradictions across dozens of files.
Senior OH&S professionals still review and approve everything. The tool handles the mechanical production and consistency checking — the parts that are tedious but critical.
Getting started
- Create a new project using the ISO 45001 OHSMS Implementation template
- Start with the Organization Profile — it feeds into every other skill
- Run the Gap Assessment early to understand your starting position
- Follow the PDCA sequence, but adapt to your organization’s priorities
- Use the dashboard to track progress and communicate with management
Each skill runs independently — you can skip ahead or revisit earlier steps as your OHSMS evolves. The validation tools will flag any cross-document inconsistencies when you do.
Try it yourself
Open a workspace with the skills described in this article and start drafting in minutes.
Get Started Free — No Sign-Up