ISO 9001 vs ISO 45001. Which does my business actually need?

Berkshire Safety Consultants
May 19
5 min read

If you've ever sat down to fill in a tender response, applied for a public sector contract, or had a larger client ask for your "management system documentation," you've probably bumped into ISO 9001 and ISO 45001.

And if you're like most SME owners, you've probably also Googled some version of: do I actually need this, or is it one of those things consultants invent to sell me services?

Fair question. Here's a straight answer.

The 30-second version

ISO 9001 is about how you run your business: quality, consistency, doing what you say you'll do.
ISO 45001 is about how you keep people safe at work: staff, contractors, visitors, the public.
They're separate certifications, audited separately, and you can hold one without the other.
Most SMEs don't legally need either. But if you tender for work, want to win bigger contracts, or operate in a higher-risk industry, one or both will start mattering very quickly.

That's the gist. If you want to know which applies to you specifically, keep reading. ISO 9001 vs ISO 45001. Which does my business actually need?

What ISO 9001 actually is

ISO 9001 is the international standard for quality management systems. In plain English: it's a framework for proving that your business has documented, repeatable processes for delivering whatever it is you sell and that you actually follow them.

When a client asks if you're ISO 9001 certified, what they're really asking is:

Do you have documented procedures for how you do the work?
Do you measure whether those procedures are working?
When something goes wrong, do you have a system for fixing it and stopping it happening again?
Can you prove all of the above to an external auditor?

It's not about being good at your job. Plenty of brilliant tradespeople and consultants aren't ISO 9001 certified. It's about being able to prove, on paper, that the way you work is consistent, measured and improvable.

Who tends to need it:

Manufacturers and engineering firms - almost always expected by larger customers.
Anyone supplying the public sector, NHS, or large private clients.
Construction firms tendering for anything above a certain contract value.
Service businesses (consultants, IT, facilities management) where clients want assurance you won't drop the ball.

Who probably doesn't need it:

Sole traders and very small B2C businesses.
Pre-revenue or early-stage businesses where the cost of certification outweighs the contract value it would unlock.

What ISO 45001 actually is

ISO 45001 is the international standard for occupational health and safety management systems. It replaced the older OHSAS 18001 in 2018 and is now the recognised global benchmark.

What ISO 45001 says you need to demonstrate:

You've identified the H&S risks across your operations properly, not on a back-of-an-envelope.
You have controls in place to manage those risks, and the controls are documented.
Your workers are involved in the H&S process, not just informed about it.
You measure, monitor and review your safety performance.
When incidents or near-misses happen, you investigate, learn, and adjust.

The thing that catches a lot of SME owners off guard: ISO 45001 isn't only about the obvious physical hazards. It also covers psychological safety, fatigue, contractor management, and whether your H&S culture survives when the boss isn't in the room.

Who tends to need it:

Construction, manufacturing, logistics, healthcare, and any industry with notable physical risk.
Anyone tendering for public sector contracts, especially infrastructure, housing, or NHS work.
Businesses with employees on multiple sites or working in client environments.
Companies wanting to demonstrate that their safety management is engineering-led, not paperwork-led.

Who probably doesn't need it (yet):

Office-only businesses with low operational risk.
Very small teams where a properly executed risk assessment process is genuinely sufficient.

So which one do you need?

Honest answer: it depends on where your tenders are coming from.

Here's how it tends to play out for SMEs we work with at Berkshire Safety Consultants:

You're in a low-risk service business and most of your work comes from referrals or repeat clients. You probably don't need either. A solid set of risk assessments, a method statement template, and decent insurance will cover you for compliance. ISO certifications would be a marketing investment more than a legal one and at this stage, your money is better spent elsewhere.

You're tendering for mid-sized private sector contracts. ISO 9001 starts mattering. Procurement teams use it as a shortlisting filter, not because it tells them you'll do good work, but because the absence of it is an easy reason to cut your bid from the pile.

You're tendering for public sector, NHS, housing association or large infrastructure work. Both standards start showing up in PQQs. ISO 9001 is increasingly a baseline. ISO 45001 alongside SSIP membership (CHAS, SafeContractor, Construction line) is what gets you onto framework agreements and approved supplier lists.

You operate in a higher-risk industry. ISO 45001 In many higher-risk industries becomes effectively expected. Your clients will ask, your insurers will care, and the Building Safety Act has raised expectations around how you demonstrate safety management. Without it, you're competing for work with both hands tied behind your back.

The tender shortlisting reality

Here's the bit most SME owners don't realise until they've been through it.

When a procurement team is reviewing 30 tender responses, they're not reading every page. They're filtering. The first filter is usually a checklist of accreditations and certifications listed in the PQQ. If you don't tick the boxes, you don't get to the section where they read your proposal.

That's the actual commercial value of ISO certification for an SME, not the audit, not the process improvement (though those are real), but the fact that holding it means you make it past the first cut.

We hold both ISO 9001 and ISO 45001 at BSC, alongside SSIP, which is why we tend to pre-qualify on shortlists without a second pass. It's also why the question ISO 9001 vs ISO 45001. Which does my business actually need? is, for most growing SMEs, really the question "do I want to be eligible for the contracts I'd like to win in 18 months' time?"

What to do next

If you're early in the journey:

Look at your last 12 months of tender losses (or contracts you wanted to bid on but didn't). Were any of them blocked by missing accreditations? That's your answer.
If yes, ISO 45001 is usually the higher-leverage starting point for higher-risk businesses; ISO 9001 for service-led ones.
Before you spend anything on a certification body, get a gap analysis done. There's no point paying for an audit you're guaranteed to fail.

If you're not sure where you sit on the spectrum, that's the kind of thing we have free 20-minute calls about. No pitch, just an honest read on whether ISO certification is worth your time at this stage of your business.

You can book a call here or drop a comment below.