ISO 45001 in Construction: The Most Common Audit Failures

The Six Most Common Construction ISO 45001 Failures

1. CDM 2015 integration not reflected in the OHSMS. CDM 2015 imposes specific H&S management obligations on Principal Contractors that go beyond ISO 45001 baseline requirements — including the Construction Phase Plan, welfare provisions and site safety coordination requirements. ISO 45001 systems that do not explicitly address CDM 2015 obligations are incomplete for UK construction organisations.
2. Subcontractor H&S management inadequate. ISO 45001 Clause 8.1.4.2 and CDM 2015 both require the organisation to manage the health and safety of subcontractor workers on its sites. Pre-qualification of subcontractor H&S capability, site induction covering site-specific hazards, and ongoing monitoring of subcontractor H&S performance are consistently inadequate in construction audits.
3. Site-specific risk assessments and method statements not reviewed before work commences. Generic risk assessments and method statements that do not reflect specific site conditions, interfaces and task-specific hazards are a consistent finding. Each task on each site requires a task-specific and site-specific RAMS — not a generic document with the site name added.
4. Working at height management inadequate. Working at height is the primary cause of construction fatalities. Collective protection measures must be prioritised over personal protection equipment, and scaffolding must be inspected at 7-day intervals with records maintained. Audit findings consistently identify: missing fall arrest systems, expired scaffolding inspections and inadequate control of roof work activities.
5. Permit-to-work not applied to all notifiable high-risk work. Permit-to-work systems for hot work, confined space entry and excavation near services are required but not consistently applied. Temporary works — falsework, scaffolding, temporary supports — require formal design and inspection sign-off that is frequently absent.
6. Incident investigation does not identify systemic causes. Construction incident investigations citing proximate causes without systemic ones do not produce improvements that prevent recurrence. ISO 45001 requires investigation to identify systemic root causes — and the corrective actions must be systemic, not individual.

The CDM 2015 Integration Gap

CDM 2015 creates specific legal obligations for Principal Contractors that are not automatically addressed by a generic ISO 45001 management system. The Construction Phase Plan — required under CDM Regulation 12 — must be developed before construction phase begins and must cover: the management of pre-construction information, the arrangements for managing the project, the specific control measures for significant site risks, and the site rules.

An ISO 45001 system that does not reference CDM 2015 obligations, does not include a Construction Phase Plan template, and does not assign responsibility for CDM Principal Contractor duties to specific roles is not a complete health and safety management system for a UK construction organisation. Auditors assess whether CDM obligations are addressed in the OHSMS — and find this gap in a significant proportion of first-time certification audits in the sector.