ISO 9001 vs ISO 45001: which certificate goes on this RFQ

This page is a buying comparison. It is for operations, quality, and EHS leads at mid-market manufacturers, warehouses, and field-service firms who are about to send a registrar RFQ and cannot agree whether ISO 9001 or ISO 45001 belongs on it.

Those standards are not interchangeable operations logos. 9001 is a quality management system. 45001 is an occupational health and safety management system. Customers ask for both. Salespeople will offer to quote both. The useful question is a procurement question: which certificate does this cycle have to produce, and can you staff the system behind it.

Quality versus environment, when occupational health and safety is not this cycle, is the ISO 9001 vs ISO 14001 comparison. Environment versus occupational health and safety, when quality is not the argument, is the ISO 14001 vs ISO 45001 comparison. The three-standard plant stack, when ISO 14001 belongs beside both, is the IMS buying guide. Whether the system is real enough to book Stage 1 is first ISO certification. After you pick the standard, you still write one outbound pack, choose a registrar, read the quote, and verify accreditation for the legal entity and the edition you will claim. This page does not invent prices, day-rate totals, or accreditation identifiers. Confirm the live schedule in the quarter you would book.

The decision here is narrower: 9001 on this RFQ, 45001 on this RFQ, or neither until the system exists. Then one pack.

1. What each standard is for, in plain terms

Skip the clause lists. Buyers do not award a certificate because they memorized a table of contents.

ISO 9001 is how a customer checks that you can repeat the work and correct it when it fails. A certification body samples that quality system: how an order becomes a product or a service, how nonconforming work is caught, and who owns the process. The certificate is not a promise that every unit, every pick, or every service visit is perfect.

On a plant the interviews sit in receiving, production, inspection, and with the people who run them. In a warehouse they sit in how an order is received, stored, picked, and shipped, and what happens when the wrong part leaves the dock. In a field-service firm they sit in how a work order is taken, staffed, closed, and how a callback or a complaint is handled. The owner is the person who already runs that work and can speak without a script. A safety lead holding a copied quality manual is not that person.

ISO 45001 asks whether you control the occupational health and safety risks of a defined scope and can prove it. A certification body samples that OH&S management system: how you identify hazards, how workers participate, and whether incidents change the way the work is done. Buyers meet this as a hazard register someone maintains, a way workers are consulted before the procedure is frozen, and an incident record someone opens after a near miss. Machine guarding, chemical exposure, racking and forklifts, working at height, confined space, lone working, driving, contractors on the floor, and the night shift are the usual objects. A binder of toolbox talks, a poster by the clock, or last year's injury rate on a slide is not that system.

The certificate records the management system. It does not replace a statutory safety duty, and it does not mean the site had no injuries. The auditor will want the control that runs when the EHS manager is not in the room, and what a worker says about the job the procedure describes. A portal that still says OHSAS 18001 is asking for a certified OH&S system. Confirm they will accept ISO 45001 before you substitute it. Do not answer that row with a quality certificate.

The OHSMS lives where people can be harmed. On a plant that is the floor, maintenance, and the contractors who do that work. In a warehouse it is racking, pedestrian aisles, powered industrial trucks, temporary labour, and the shift that actually picks. In field service it is the van, the customer roof or plant room, lone working, and the subcontractor who shows up in your shirt. That map is not the quality map with a new title. A design office can sit inside 9001 and outside 45001 if you will defend that boundary. A customer site or a vehicle can be central to 45001 and missing from a factory quality list that says "the plant." An inspection bench can be central to 9001 and a thin OH&S story if the significant hazards sit on the line next door. The owner is whoever can walk the hazards and sit with a worker who was not briefed for the visit. A quality lead holding a copied hazard list is not that person.

You can hold both certificates eventually. This page is about which one this RFQ is for.

2. When 9001 is the forced gate this cycle

Start with 9001 when the pressure in front of you is quality, and an occupational health and safety mark will not lose a bid, a site pass, or a renewal this quarter.

That is still the usual manufacturer case. Portals, primes, and export paperwork treat 9001 as table stakes, and the plant already half-runs the work an auditor will sample. It is also the rational gate for a warehouse whose customer scores accuracy and on-time shipment, and for a field-service firm whose contract scores first-time fix and complaint handling, when nobody has named a certified OH&S system on a date you can point at.

Put 9001 on this RFQ when most of these are true:

• The customer, portal, bid, or supplier approval in front of you names 9001, or names "an ISO certificate" and means quality.
• You can name the legal entity, the sites that do the certified work, and a quality or operations owner who will be in the room.
• Documented processes roughly match Tuesday. Internal audit and management review can touch this system before you invite a body. That test is first-certificate readiness.
• 45001 pressure is a forecast: a safety slide, an insurer conversation you expect, a private-equity note that OH&S might come up, or a toolbox-talk habit you already run that does not name a certified OHSMS. A forecast is not a date that kills a contract this cycle.
• You are not offering a quality certificate as a stand-in for an OH&S promise already in the contract, the tender, the insurer condition, or the contractor prequalification. If the exhibit names ISO 45001, OHSAS 18001, or a certified OH&S management system, 9001 will not clear it. Confirm whether a portal that still says OHSAS 18001 will accept ISO 45001. Do not guess, and do not send quality in its place.

A later 45001 add is a normal plan. One line on the pack is enough. Leave 45001 off this RFQ while the hazard register is still a wish, including at a job shop or a depot whose bid forms name only 9001. If ISO 14001 is also a living system and belongs on the same programme, that argument is the IMS buying guide. If the live fork is quality versus environment, and 45001 is not part of this cycle, the buying comparison is ISO 9001 vs ISO 14001. If the live fork is quality versus information security, the comparison is ISO 9001 vs ISO 27001.

If the portal requires 9001 and the quality system does not exist, build the system, then send the pack. An RFQ sent so the quote creates a deadline is how Stage 1 writes findings you already knew. Readiness still has the first-certificate shape. The content is the QMS. Who writes the system versus who certifies it is consultant vs certification body.

Leave 45001 off this cycle only when it is not the gate and you cannot staff both. Read the portal, the site-access rule, and the insurance exhibit before you do that. Many manufacturing and contractor rows still name safety beside quality. A 9001 certificate you already hold does not put hazards into scope, and it does not appoint an OH&S owner.

3. When 45001 is the forced gate this cycle

Start with 45001 when a customer, an insurer, a tender, or a contractor prequalification will not let you through without an occupational health and safety certificate this cycle, and you can show an OHSMS. That is the usual case for plants, warehouses, and field crews whose buyers score injuries, participation, and contractor control, or who will not let a crew on a site without the mark. A light-footprint office is in this section only when the work is physical. A desk and a fire drill are not a gate.

The certificate does not replace the legal duty to keep people safe. Quoting 45001 does not close an investigation, and it does not authorize a task the procedure forbids. A loss-control visit from an insurer is not this certificate. Neither is a statutory inspection.

Put 45001 on this RFQ when most of these are true:

• A named customer, portal, tender, insurer, or contractor prequalification requires 45001, or an accredited OH&S certificate, on a date you can point at. If the words are still OHSAS 18001, confirm they will accept ISO 45001 before you write that edition on the pack.
• You can describe the hazards in scope: the work, the people exposed, the contractors, and which legal entity operates that work.
• Someone other than a hopeful quality manager owns hazard identification, worker participation and consultation, operational controls, and incident learning, and can be interviewed with a worker who does the job.
• The hazard register matches Tuesday. Significant hazards have controls and records. Workers were consulted in a way you can show, not only signed onto a slide. Boundaries you will defend have a reason you can explain at Stage 1. A supervisor, a picker, or a field technician would recognise the list.
• You can name where those hazards occur, including the shift that runs them. That address may be a warehouse aisle, a maintenance shop, a customer site, or a vehicle. It may not be every office already listed on a quality certificate, and it may not stop at the factory fence.
• 9001 pressure is a forecast: a supplier portal you expect to open, a customer roadmap, a note that quality might come up. A forecast is not a date that kills a contract this cycle. If you already hold 9001, say so. This RFQ is an add, not a restart, and the existing certificate does not put hazards into scope.
• You are not offering an OH&S certificate as a stand-in for a quality promise already in the contract or the supplier approval. If the exhibit names ISO 9001 or a certified quality management system, 45001 will not clear it.

If the prequalification requires 45001 and the OHSMS does not exist, build the system, then send the pack. A downloaded procedure and a month of toolbox talks will not survive Stage 1, and they will not survive a worker interview. Readiness still has the first-certificate shape. The content is the OHSMS. Worker evidence is floor time, warehouse time, or time on the job with the crew. How to write that on the pack is remote vs on-site ISO audits.

A later 9001 add is a normal plan when quality is not the gate. One line on the pack is enough. Leave 9001 off this RFQ while the process map is still a wish. Many warehouses and field firms discover the reverse a quarter later: the site pass needed 45001, and the next OEM portal still names 9001. Write that as a later add. Do not pretend this pack covers it.

4. What buyers get wrong

Three patterns show up in mid-market rooms. Each one produces unlike quotes, or a Stage 1 whose job is to discover fiction.

Treating either certificate as a badge. The certificate is the output of an independent audit, not a logo rented to clear a questionnaire. For 9001, a quality manual nobody opens, a procedure that does not match the pick path or the service visit, and a complaint log that stops at the inbox are a project. For 45001, a binder of toolbox talks and an injury-rate slide are a project. The certification body samples. It does not write the process map, the hazard register, or the rule for how workers are consulted. Finish the system, or hire implementation help that will not also be the certifier, then send the RFQ. Who writes the system versus who certifies it is consultant vs certification body.

Shopping both at once with hollow systems. "Quote 9001 and 45001, we're integrated" is a sentence, not a programme. Integration is real when shared processes already run (document control, internal audit, management review, corrective action) and both technical systems exist: processes a supervisor would recognise, and hazards a worker would recognise, with participation you can show. A quality manual copied from a similar plant, and a hazard list copied from the same file, marked complete everywhere, with no owner, is hollow. Pairing two PDFs asks for days on two systems you do not operate. If you want both certificates eventually, name which one is this cycle. "Both" is a claim about systems you run.

Skipping the standard customers still gate on. A plant, a warehouse, or a field firm drops 9001 because 45001 sounds more urgent, then fails the supplier approval that still names quality. The same firm drops 45001 because the quality meeting is the one on the calendar, then fails the insurer, the site-access rule, or the contractor portal that still names OH&S. Read the portal, the contract exhibit, the insurance condition, and the tender scoring sheet before you treat the other mark as old news. The same miss shows up one step sideways: adding ISO 14001 because "EHS" sounded like one word, then asking bodies to quote an aspects register nobody owns. An OH&S certificate does not clear a quality field. A quality certificate does not clear a safety field. Neither clears an environmental field.

"Quote whichever is easier" means the bodies are not quoting the same object. Adding ISO 14001, or ISO/IEC 27001, because someone mentioned a stack belongs on the IMS buying guide or the 9001 vs 27001 comparison, and only when that system exists. If the argument is which of 14001 or 45001 goes on this RFQ, and quality is not the choice, use ISO 14001 vs ISO 45001. Confirm competence for the edition on the pack when you choose a registrar and verify accreditation. A strong quality auditor is not automatically the person who can sample worker participation on a night shift or a customer roof. A strong OH&S auditor is not automatically the person who can sample how a nonconforming shipment is stopped.

5. How the RFQ, the scope, the sites, and the people differ

A quote is a designed audit programme. It starts from your facts. 9001 facts and 45001 facts are not the same list with a different title.

Scope. For 9001, name the legal entity, the products or services, the processes, and the exclusions you will defend. For 45001, name the work where people can be harmed, including contractors, and what sits outside the boundary. "The whole company" sweeps a sales office into an OHSMS it should not share, or drops a customer site because it was not on the quality tour. A warehouse that only stores and picks is still a scope, if that is the work. A field-service firm that only maintains equipment at customer sites is still a scope, if that is the work. More than one location is multi-site certification scope. Write that map before anyone counts days.

Sites. 9001 follows the work: plants, warehouses, labs, depots, and the offices where the certified service is run, including the second shift. 45001 follows hazards: the floor, the aisle, maintenance, field crews, vehicles, customer sites you will claim, and the shift that does the work. A design office can be in the quality system and out of the OHSMS. A fleet, a yard, or a roof at a customer address can be central to 45001 and missing from a quality site list that says "the factory" or "head office." A temporary labour agency's people on your floor still count if you will claim control of that work. This cycle names one standard's sites. If you are honestly quoting both, the pack carries a site-by-standard matrix. The later add stays off the pack, with one line that says so.

People. 9001 interviews a quality or operations owner, process owners, and someone who does the work: an operator, a picker, a dispatcher, a technician who closes the job. 45001 interviews an OH&S owner who can show the hazard register, how workers were consulted, and what changed after the last incident, plus workers and contractors who do the job. "We'll bring the safety lead in at Stage 2" means the pack is early. "The quality manager will cover safety" means the hazard list has no owner. "The EHS manager will cover quality" usually means the process map has no owner. If one person owns both, say so only when that person can walk both systems, including a worker conversation that was not scripted and a nonconforming-work example that was not rehearsed.

One page, the same pack to every body. The full checklist is how to build a registrar RFQ / scope pack. For this decision, these rows have to be explicit:

Fact	If 9001 is this cycle	If 45001 is this cycle
Standard and edition	The 9001 edition you will claim	The 45001 edition you will claim
What is in scope	Products, services, processes, exclusions you will defend	Work where people can be harmed, including contractors, and the boundary
Document the owner can show	Processes that match the work, plus internal audit and management review of this system	A hazard register people use, plus worker participation and incident learning
Sites	Where that work happens, with headcount bands and shifts	Where those hazards occur, including the shift, the warehouse, field work, vehicles, and contractors
Owner	Named quality or operations owner	Named OH&S owner who can walk hazards and sit with a worker
The other standard	Later add, or not this cycle	Later add, or not this cycle
Who implemented	Internal, named consultant, or none	The same disclosure. The implementer is not the certifier

Headcount is a band per site, not the about-page total. A night shift still counts when the certified work or the hazard runs at night. Temporary crews and subcontractors count when you will claim that work. A thinner story for one logo ends the comparison. What comes back (programme structure, travel, exclusions, quality competence, OH&S competence, and how worker interviews are staffed) is what CB quotes include. If 45001 is the standard, say that worker interviews are on site. Do not let a remote day count erase the floor, the aisle, or the customer job. That split is remote vs on-site ISO audits.

6. One CB programme this cycle, a sequential add, or the full IMS

Sometimes one certification body should quote 9001 and 45001 together. Often that request is the plant-stack habit applied before the OHSMS exists, or before anyone has decided whether ISO 14001 belongs in the same buy.

One programme this cycle is honest when both systems already run under one legal entity, shared processes are real, both owners can sit the audit, and each standard has its own site story or an honest site-by-standard matrix. You may still receive two certificates. Say which processes are shared and which work is standard-specific. Process control, nonconforming work, and customer complaints are quality work. Hazards, worker participation, and incident learning are OH&S work. They are not one register with two covers. A corrective action on a wrong shipment is not an incident investigation, and a near-miss review is not a customer complaint, unless you already run them as shared processes you can show. Let the certification body restate the method. Do not ask them to invent integration you do not operate. A lead who has never stood where the nonconforming work is stopped is not a quality lead for this scope. A lead who will not interview a worker is not an OHSMS lead. Ask how they staff both.

If you already hold one of the two, say so on the pack: the legal entity, who issued the certificate, and whether this RFQ is an add or a request to sample the existing system again. An existing quality certificate does not put hazards into scope. An existing OH&S certificate does not put the process map into scope. It tells a body whether they are extending a programme they already run or quoting a stranger. If that body cannot cover the standard you are adding, the honest options are a second certification body or a transfer. Write that choice before you compare replies.

A sequential add is the better buy when only one system is real. Certify the gate this cycle. Add the other standard when its owner, its sites, and its documented information exist. A later add is still an RFQ, and the new scheme still gets Stage 1. Tell the shortlist which standard comes later. If the body you award now cannot cover it, the honest options are wait, add a second certification body, or plan a transfer.

The full IMS with 14001 is a different decision. When environment is also a system you run, and a customer, permit or consent condition, insurer, or tender requires that mark this cycle, the honest product is often one operations-stack programme: 9001, 14001, and 45001 together. How to write that three-standard matrix, and when not to, is the IMS buying guide. This page stops at quality versus occupational health and safety. Do not add 14001 on this pack to look thorough. If the argument is which of 9001 or 14001 goes on this RFQ, and 45001 is not the choice, use ISO 9001 vs ISO 14001. If the argument is which of 14001 or 45001 goes on this RFQ, and quality is not the choice, use ISO 14001 vs ISO 45001. If 14001 is the third real system beside quality and occupational health and safety, switch to the IMS guide before you send.

Keep ISO/IEC 27001 off this pack unless information security is the gate this cycle. That comparison is ISO 9001 vs ISO 27001. The sequence lives on the path guide. One body for the operations standards and another for information security is a legitimate design when you write it on purpose. Confirm the legal entity in how to choose a registrar and how to verify accreditation.

7. Choose what goes on this RFQ, then send one pack

Make the call in one sitting. The output is a sentence at the top of the scope pack.

1. Write the actual requirement. Portal, contract, tender, insurer, contractor prequalification, site-access rule. Use their words. If one field says quality and another says a certified OH&S system, note which revenue, which site, or which renewal is blocked this cycle. If a field still says environment, or still says OHSAS 18001, note that too, and confirm what they will accept.
2. Match it to a system you can show. 9001 needs processes that match the work. 45001 needs hazards, worker participation, and incident learning you can walk, including a worker who was not rehearsed. If that system does not exist, do not send. Build it, or hire an implementer who will not certify you, and disclose them on the pack.
3. Name one primary standard. Mark the other "later add" or "not this cycle," unless both systems and both owners are real enough to defend at Stage 1. If 14001 is a third system you can staff and a customer requires it now, stop and use the IMS buying guide before this pack goes out. If the argument is quality versus environment and 45001 is not this cycle, use the ISO 9001 vs ISO 14001 comparison instead. If the argument is environment versus occupational health and safety and 9001 is not this cycle, use the ISO 14001 vs ISO 45001 comparison instead.
4. Name the owner and the sites for that standard. Quality owner and the locations where the work happens, or OH&S owner and the locations where people can be harmed, including the shift, the contractors, the warehouse aisle, and the field job. If one person owns both, say that only when they can walk both.
5. Write one pack and send it to every body you might award. How to choose them is how to choose a registrar. Confirm the legal entity's accreditation for this edition, on the live schedule, in how to verify accreditation before you invite a body you cannot award. If you already hold the other certificate, name it on the pack so the add is comparable.

If the room is still split after step 3, you have two procurements. Run the one that unblocks revenue and park the other until its system exists.

When that sentence is true, send one registrar RFQ / scope pack. Submit the same page with the Get quotes button below, including to the logo you already like. The standard on the page has to be the standard you can staff.