ISO 45001 Gap Analysis: A Step-by-Step Guide for Construction Companies

Introduction: What a Gap Analysis Actually Is (and What It Is Not)

Most construction companies pursuing ISO 45001 certification approach it the same way.

They read the standard. They hold a meeting. They assume their existing health and safety procedures cover most of it. Then they book an auditor and find out they were wrong.

A gap analysis exists to prevent exactly that.

It is not a self-assessment of how well your safety culture is performing. It is not a checklist you hand to the site manager and collect back signed. It is a clause-by-clause comparison between what ISO 45001:2018 requires and what your organization actually has in place right now. Every gap it surfaces is a finding you can fix before certification. Every gap it misses becomes a non-conformance the auditor documents on your behalf.

The distinction matters. A gap analysis done properly is a controlled process. An audit without one is a surprise.

For construction companies specifically, the stakes are higher than most industries. Subcontractors on site, shifting work environments, plant and equipment risks, fall hazards, excavations — construction throws more variables at a safety management system than almost any other sector. ISO 45001 was built to handle that complexity. But it will only certify you if you can prove it.

When to conduct a gap analysis

Three situations call for one. First, before initial certification, to understand how far you are from meeting the standard before committing resources to a certification programme. Second, after a significant incident, to identify which clause or process broke down and why. Third, annually as part of your management review cycle, to verify that your system has kept pace with changes in your operations, workforce, or legal environment.

---

The ISO 45001:2018 Clause Structure: What You Are Measuring Against

ISO 45001 is built on the Plan-Do-Check-Act cycle. The auditable requirements live in Clauses 4 through 10.

---

How to Run a Gap Analysis: The 5-Step Process

1. Assign ownership and form a small review team.A gap analysis cannot be a solo exercise. You need at least one person with knowledge of ISO 45001 requirements and at least one person with direct knowledge of how the site actually operates. For construction companies, that often means pairing the EHS officer with a site supervisor or project manager.
2. Work through each clause and rate your current compliance.For every requirement in Clauses 4 through 10, assign one of three ratings. Fully compliant means the requirement is met, documented, and there is objective evidence of it being followed. Partially compliant means something exists but it is incomplete, inconsistent, or undocumented. Non-compliant means nothing is in place. Rate each clause honestly. The purpose is not to look good. It is to know where you are.
3. Collect evidence for each rating.A rating without evidence is an opinion. For each clause you assess, record what document, record, or observable practice supports your rating. If you cannot find evidence, the rating defaults to non-compliant regardless of what you believe is happening on site.
4. Record every gap in a structured register.Each gap needs four things: the clause reference, a description of what is missing or incomplete, a severity rating (major or minor), and the person responsible for closing it. An ISO 45001 gap analysis template built to the standard's structure makes this significantly faster. You can download the one I use in client engagements at hemiqplus.com/templates rather than building the register from scratch.
5. Prioritise gaps by certification risk.Not all gaps carry equal weight. A missing OH&S policy under Clause 5.2 will block certification outright. An incomplete training record under Clause 7.2 may result in a minor nonconformity. Sort your gap register by severity and address the major gaps first.

---

How to Document Findings and Create a Corrective Action Plan

Once your gap register is complete, it becomes the input for your corrective action plan.

Each gap becomes an action item. Each action item needs a clear description of what needs to be built, updated, or implemented; a responsible person; a target completion date; and a verification method — how you will confirm the gap has been closed.

For construction companies, the corrective action plan should be realistic about timescales. Building a hazard identification procedure from scratch takes time. Training a workforce spread across multiple sites takes longer. If you are working toward a certification date, map your corrective action plan backwards from that date and identify which gaps create the most risk to your timeline.

Document everything. ISO 45001 requires documented information as evidence of compliance. A corrective action plan that exists in a spreadsheet is usable. One that exists only in email threads is not.

---

What to Do With the Results

The gap analysis output serves three audiences.

For top management, it is a resourcing decision. The results should be presented in a format that makes clear which gaps require people, time, or budget to close. Leadership that understands the gap picture makes better decisions about certification readiness.

For the EHS team, it is a work plan. The corrective action register becomes the daily task list between now and certification. Progress should be tracked and reviewed monthly.

For the certification body, it demonstrates intent. When an external auditor sees that a gap analysis was conducted, findings were documented, and corrective actions were implemented with evidence, the narrative changes from "this company is trying to pass an audit" to "this system is being actively managed."

After your initial certification, repeat the gap analysis annually. Update it when operations change significantly, when an incident occurs, or when new legal requirements come into effect. The ISO 45001 system is designed to improve over time. The gap analysis is how you measure whether it actually is.

---

Conclusion

A gap analysis is not the boring administrative step before the real work begins.

It is the real work.

Construction companies that treat it as a box-ticking exercise before calling the auditor consistently find themselves unprepared. Companies that treat it as a diagnostic — something that tells them the truth about their system before anyone external does — use it to certify faster, with fewer nonconformities, and with a system that actually holds up after the auditor leaves.

You cannot improve what you have not measured. A gap analysis is how you measure.

---