ISO 45001 Consultancy in Johor Bahru
Occupational health and safety management systems that satisfy your customers' audit requirements and your duties under OSHA 1994 — built once, not twice.
Why ISO 45001 is cheaper than it looks
Since 1 June 2024, when the Occupational Safety and Health (Amendment) Act 2022 came into force, OSHA 1994 applies to every place of work in Malaysia. The old First Schedule limits are gone. Every employer now carries a statutory duty to assess and manage the safety and health risks its work creates, and the maximum fine for breaching employer general duties rose from RM50,000 to RM500,000.
That changes the arithmetic. Hazard identification, risk assessment, a written safety and health policy, legal compliance registers, incident investigation, emergency arrangements, worker consultation — these appear in both the standard and the statute. If you are building an OSH system to meet DOSH expectations anyway, building it to ISO 45001 costs marginally more and gives you a certificate your customers recognise.
We work with manufacturers and industrial operations across Johor Bahru, Pasir Gudang, Senai, Kulai and Iskandar Puteri.
Gap Analysis
Existing HIRARC records, permits, incident files and legal registers reviewed against both the standard and your statutory duties.
Risk Assessment & Legal Register
The two foundations. Everything else is built on them, and they are where most existing systems are weakest.
System Design
Documented information proportionate to your operation — a 60-person fabrication shop does not need a 600-person plant's manual.
Internal Audit & Certification Support
We run the first audit cycle with your team, then stand beside you through Stage 1 and Stage 2.
Where ISO 45001 and Malaysian law meet
Hazard identification & risk assessment
Clause 6.1.2 mirrors the statutory duty to assess risks to anyone affected by your undertaking. HIRARC is the methodology DOSH expects.
OH&S policy
Clause 5.2 asks for a documented policy. Section 16 of OSHA 1994 already requires a written safety and health policy.
Worker consultation
Clause 5.4 requires consultation and participation. Section 29A requires an OSH Coordinator at five or more employees; Section 30 a safety and health committee at forty.
Legal & other requirements
Clause 6.1.3 forces a maintained legal register — OSHA 1994 as amended, USECHH 2000, NADOPOD 2004, and the machinery provisions consolidated into OSHA.
Contractors & procurement
Clause 8.1.4 covers outsourcing and contractors. Section 18A places a duty on principals toward contractors and their employees.
Incident & corrective action
Clause 10.2 requires investigation and corrective action. NADOPOD 2004 requires notification of accidents and dangerous occurrences to DOSH.
The overlap is not total. ISO 45001 asks for things the law does not — objectives and planning, documented management review, a defined internal audit programme. And certification is not a defence to a prosecution. But the duplicated effort is real, and most factories are paying for it twice.
Is ISO 45001 right for you?
- A customer or group head officehas made ISO 45001 a condition of supply.
- You migrated from OHSAS 18001and the system has not been meaningfully maintained since.
- Recertification is dueand you know the documentation has drifted from practice.
- You have had an improvement notice or a notifiable incidentand want a system rather than a patch.
- You have appointed an OSH Coordinatorunder Section 29A and need a defined system for them to run.
- You already hold ISO 9001and want to add 45001 to the same management system.
Built from your floor, not a hazard library
Most ISO 45001 systems fail at Stage 2 for the same reason: the risk assessments were written at a desk. Generic hazard lists produce generic controls, and an auditor who walks your line will find the gap in twenty minutes.
We write risk assessments from what we observe on your processes, with the people who operate them. That takes longer up front and it is the reason the system still works after the certificate arrives.
Being based in Johor Bahru means getting to your site is a short drive rather than a scheduling exercise — so the site work actually happens.
Your route to ISO 45001
Gap Analysis
We walk the floor and review existing HIRARC records, permits, incident files and legal registers against both the standard and your statutory duties.
Risk Assessment & Legal Register
The two foundations, built properly. Everything documented afterwards depends on getting these right.
System Build & Consultation
Documentation developed with your process owners, rolled out through your OSH Coordinator or committee so Clause 5.4 is satisfied by practice.
Internal Audit & Certification
First audit cycle with your team, management review inputs prepared, then on site for Stage 1 and Stage 2 and the nonconformity responses.
ISO 45001 — common questions
Is ISO 45001 mandatory in Malaysia?
No. ISO 45001 is a voluntary certification. What is mandatory is compliance with OSHA 1994, as amended by the Occupational Safety and Health (Amendment) Act 2022, which has applied to every place of work in Malaysia since 1 June 2024. Most factories pursue ISO 45001 because a customer or group head office requires it, not because the law does.
If we are certified to ISO 45001, does that mean we comply with OSHA 1994?
Not automatically, and it matters not to assume otherwise. ISO 45001 requires you to identify and comply with applicable legal requirements, so a well-built system will surface most gaps. But certification is an audit against the standard, not a legal compliance determination, and it is not a defence in a prosecution. The two need to be maintained deliberately alongside each other.
We already hold ISO 9001. How much extra work is ISO 45001?
Less than you would expect. Both standards share the same high-level structure, so the clauses covering context, leadership, planning, support, performance evaluation and improvement are largely common and can be documented once. The genuinely new work is hazard identification and risk assessment, the legal register, worker consultation arrangements, operational controls and emergency preparedness.
What happened to OHSAS 18001?
OHSAS 18001 was formally withdrawn in September 2021. The migration period ran three years from ISO 45001's publication in March 2018, and was extended by six months to 30 September 2021 because of COVID-19. If your last full system build was against OHSAS 18001 and you migrated on paper without reworking the underlying system, expect the gap analysis to find that hazard identification, worker consultation and management of change need substantive work rather than renaming.
Do you provide ISO 45001 training?
Yes — we arrange and manage training as part of the engagement, including in-house sessions delivered at your premises and scheduled around shift patterns. The consultancy work itself — gap analysis, risk assessment, system design, internal audit and certification audit support — is delivered by ProSafe directly.
How long does ISO 45001 certification take?
For a manufacturing site of 50 to 200 people with no existing OH&S management system, six to nine months from gap analysis to certification audit is realistic. Sites already certified to ISO 9001 usually move faster because the management-system scaffolding exists. The rate-limiting step is almost always completing risk assessments across all work activities.
Not sure if you need certification or just a compliant system?
That is the right question to ask first, and the gap analysis answers it. One site visit tells you which one you actually need.