Bond prepares ISO 45001 certification in Iraq and Kurdistan.
The safety management system. It covers hazards, permits to work, incidents, training and emergency response, and operators check it before your people enter their site.
ISO 45001 Occupational health and safety management systems · Health and safety
What ISO 45001 is
ISO 45001:2018 is the international standard for an occupational health and safety management system. It asks a company to find the hazards in every task, remove or control them by the hierarchy of controls, involve the workers in that decision, and record what happens when something goes wrong. It replaced OHSAS 18001. The certification body issues the certificate to the company.
What the standard requires
- Clauses 1 to 3 cover scope, normative references and terms. Clauses 4 to 10 are the requirements an auditor checks.
- Clause 4, context. List the parties that matter, state which sites and activities the system covers, and include every worker on those sites, subcontracted labour included.
- Clause 5, leadership and worker participation. Management signs the health and safety policy and sets up a route for workers to raise a hazard without being punished for it.
- Clause 6, planning. Identify the hazards in every task, assess the risk, list the legal requirements, and set objectives with numbers and dates.
- Clause 7, support. Competence and training records for every safety critical task, plus consultation records, communication and document control.
- Clause 8, operation. Control hazards by the hierarchy of controls, run a permit to work system, control contractors and procurement, and keep an emergency plan that is tested.
- Clause 9, performance evaluation. Measure incidents, near misses and leading indicators, evaluate legal compliance, run internal audits on a plan, and hold a management review.
- Clause 10, improvement. Investigate every incident and near miss, find the cause, correct it, and show the correction worked.
Who needs ISO 45001 in Iraq and Kurdistan
The buyers that ask for ISO 45001
| Buyer or list | What they ask for |
|---|---|
| Ministry of Natural Resources Approved Vendor List | mnronline.com/avl. HSE is evaluated next to finances and the quality system. A government fee applies by category, renewed each year. We confirm the current fee before you apply. |
| Kurdistan operators | DNO, Genel Energy, Gulf Keystone and HKN run their own HSE prequalification on top of the MNR list before a contractor gets a gate pass. |
| Basra operators | Basrah Gas Company, Rumaila, EBS Petroleum and AL-WAHA run no public tenders. A supplier is invited once the HSE file is accepted. |
| EPC contractors | Subcontractor files on projects in Kurdistan and Basra carry an HSE section, usually with the accident frequency rate for the last three years. |
| KRG Approved Suppliers Center | asc.gov.krd. Annual registration. Certificates must come from a recognised conformity body to clear the criteria. |
| UN agencies through UNGM | ungm.org. One free registration covers UNDP, UNICEF, WFP, UNHCR, IOM and FAO. Field and construction contracts carry safety conditions, in English. |
| Federal Ministry of Planning | Contractor classification and the federal unified electronic tendering platform. We confirm the current instruction before filing. |
| Foreign partners and lenders | Joint venture partners and lenders in the Gulf and Europe ask for a certificate from a body accredited under an IAF member before a first contract. |
Two tracks, you choose one
Certificate track
5 daysA company that needs a valid certificate to register on the MNR AVL or the KRG ASC, or to answer the HSE clause in an operator prequalification before the deadline. We prepare the compliance system in five working days. The certification body then issues the certificate, and its calendar sits outside those five days.
Steps- We read the tender or the prequalification form and confirm the standard, the scope and the body the buyer accepts.
- We agree with the owner which sites, activities and contractors the certificate covers on the first of the five working days.
- We build the hazard identification and risk assessment for every task with the supervisors who run it.
- We write the document set inside those five days: policy, objectives, permit to work system, emergency plan, procedures and forms.
- We train each supervisor in a half day session on the records that person has to keep.
- We run the first internal audit, the compliance evaluation and the management review in the same five days, then close the findings.
- We book the certification body, prepare the site, attend stage 1 and stage 2, and answer the findings with your team.
- The compliance system, prepared in five working days
- Scope statement covering the sites, activities and contractors
- Hazard identification and risk assessment for every task
- Health and safety policy and objectives with numbers and dates
- Permit to work system, emergency plan and site forms
- Worker consultation and training records
- Internal audit report, compliance evaluation and management review minutes
- Corrective action records for every finding
- A three year surveillance and renewal calendar
Implementation track
6 to 14 weeksA company whose crews work on operator sites and are inspected in the field, and that wants permits to work, toolbox talks and incident reporting running every day.
Steps- We analyse what the company does and what its buyers and tenders require, then send a proposal.
- We walk every site and workshop with the supervisors and write the risk assessments from the tasks people actually do.
- We set up the safety committee, the consultation meetings and a hazard reporting route the crews will use.
- We write the documentation in Arabic, Kurdish or English and keep it to the forms the crews will actually fill in.
- We train every crew and supervisor, then run an emergency drill and record it.
- We let the system run for three to four weeks so signed permits, toolbox talks and incident reports exist before stage 2.
- We run the internal audit programme and the management review, then prepare the site and attend stage 1 and stage 2.
- Risk assessments written on site for every task
- Register of legal requirements, licences and insurance with renewal dates
- Full documented system in the working language
- Permit to work system in daily use with signed permits
- Toolbox talk, training and worker consultation records
- Emergency plan and the record of a tested drill
- Three to four weeks of live incident, near miss and inspection records
- A three year surveillance and renewal calendar we run with you
The certification body issues the certificate.
The implementation track, week by week
| Phase | Weeks | What happens |
|---|---|---|
| Scope and buyer requirements | Weeks 1 to 2 | We confirm which sites, activities and contractors the certificate covers and which body the buyer accepts. Nothing is written before this is fixed. |
| Site walks and risk assessment | Weeks 2 to 5 | We walk every site and workshop with the supervisors, list the hazards task by task, and assess the risk with the people exposed to it. |
| Legal register and consultation | Weeks 3 to 6 | We build the register of legal requirements, licences and insurance, and set up the safety committee and the hazard reporting route. |
| Documentation | Weeks 4 to 8 | Policy, permit to work system, procedures, emergency plan and site forms, written in Arabic, Kurdish or English around what the crews already record. |
| Training and drills | Weeks 7 to 9 | A session per crew on the records that crew owns, a session for management on the review, and one emergency drill with its record. |
| Records running live | Weeks 8 to 11 | The system runs in daily operations for three to four weeks so signed permits, toolbox talks, inspections and incident reports exist for the auditor to sample. |
| Internal audit and management review | Weeks 11 to 12 | We audit every clause, evaluate legal compliance, log the findings, and hold the management review with the owner. |
| Certification audit | Weeks 12 to 14 | The accredited body runs stage 1 on the documents and stage 2 on site with the crews working. We prepare the site, attend both, and answer the findings. |
What we do, what you do
We do
- Confirm which standard, which sites and which certification body the buyer accepts, before any work starts.
- Walk every site and workshop and write the hazard identification and risk assessment with the supervisors.
- Write the register of legal requirements and check it against the licences and insurance the company holds.
- Write the whole documented system in the language the company works in, including the permit to work forms.
- Set up the safety committee and the worker consultation records the standard asks for.
- Train crews, supervisors and management, and run the first emergency drill with them.
- Run the first internal audit and the compliance evaluation, and chair the management review.
- Select certification bodies, collect their quotes, book the audit dates, prepare the site and attend stage 1 and stage 2.
- Write the corrective actions for every finding and keep the surveillance and recertification dates in a calendar.
You do
- Name one HSE or management representative who can give about five hours a week.
- Give us the accident records, licences, insurance, training certificates and any permits the company already uses.
- Release each supervisor for a half day of training and a half day for the internal audit.
- Let us walk every site, workshop and store in the scope while the work is going on.
- Send crew representatives to the consultation meetings, which take about one hour a month.
- Take part in one emergency drill, which takes about two hours on site.
- Have the owner or general manager attend the management review, about two hours, and the opening and closing meetings of the certification audit.
- Pay the certification body and any government fees directly, or through us at cost with the receipts.
What moves the price
- Number of sites in the scope and whether the auditor has to travel to Erbil, Sulaymaniyah, Baghdad or Basra.
- Effective headcount, including subcontracted labour, which sets the auditor days under the IAF MD 5 table.
- Risk level of the work, from an office to hot work, confined space entry and lifting on a live oilfield.
- Number of shifts, because an auditor who has to see a night shift adds days.
- How many licences, permits and insurance requirements the legal register has to track.
- Whether the certificate has to come from a body accredited under an IAF member or a locally accredited body is enough.
- Languages the documentation is written in, and whether the crews read Arabic, Kurdish or English.
- How much usable documentation already exists in the company.
- Which track the company takes, the five day certificate track or the 6 to 14 week implementation track.
- Whether ISO 45001 is built alone or together with ISO 9001 and ISO 14001 as one system, which lowers total auditor days.
The proposal names the scope, the deliverables and the dates before work starts.
ISO 45001 questions we are asked
We prepare the compliance system in five working days on the certificate track. The implementation track runs six to fourteen weeks. The certification body then issues the certificate on its own calendar. Bureau Veritas, SGS, TUV and KQC in Erbil each set their own audit dates.
The proposal names the scope, the deliverables and the dates before work starts.
A certificate from a body accredited by IQAS, for example KQC in Erbil, is valid in Iraq and accepted for KRG lists. IQAS is not a member of the IAF Multilateral Recognition Arrangement. Operators such as DNO, Genel Energy, Gulf Keystone and HKN, their EPC contractors and UN agencies normally require a body accredited under an IAF member, such as Bureau Veritas, SGS or TUV. We confirm which one the buyer accepts before any body is booked.
In practice yes. DNO, Genel Energy, Gulf Keystone and HKN run HSE prequalification on top of the Ministry of Natural Resources Approved Vendor List at mnronline.com/avl, where HSE is scored next to finances and the quality system. Basrah Gas Company, Rumaila, EBS Petroleum and AL-WAHA accept a supplier only once the HSE file is on record. EPC contractors ask subcontractors for the certificate and for the accident frequency rate of the last three years.
Yes. ISO 45001:2018 replaced OHSAS 18001, and the migration period for OHSAS certificates ended in 2021. A company in Iraq still holding an OHSAS 18001 certificate has to be audited against ISO 45001 by an accredited body before it can show a current safety certificate. The KRG Approved Suppliers Center at asc.gov.krd asks for current certificates at each annual renewal, and operator HSE prequalification files ask for the same.
Three years from the date of issue. The certification body runs a surveillance audit each year and a recertification audit in year three. We keep those dates in a calendar and prepare the company for each one. If a surveillance audit is missed the body can suspend the certificate, and a suspended certificate will not pass an HSE prequalification with DNO or Basrah Gas Company, or a list renewal at the MNR AVL.
Yes. We work anywhere in Iraq, in Basra, Baghdad, Kirkuk, Erbil, Sulaymaniyah and Duhok, and in the Gulf. The office is in Erbil and the team travels to the site.
Business inquiry
Select a target. Two questions follow, and the file reaches the desk on WhatsApp. A reply comes within four working hours.