Why CFOs Can No Longer Treat Safety as Someone Else's Problem
ISO 45001 is the international standard for occupational health and safety management systems. Most CFOs know it exists. Fewer understand what it actually demands from them personally, and even fewer have taken real ownership of their responsibilities under it.
On this page
That needs to change. ISO 45001 is not just a certificate that sits on the wall of the WHS manager's office. It has direct financial, legal, and governance implications that land squarely in the CFO's domain. If you are signing off on budgets, managing risk, reporting to a board, or dealing with insurers, then ISO 45001 is your problem too.
This guide is written specifically for CFOs and senior finance leaders who want a clear, no-nonsense picture of what ISO 45001 requires, what it costs, what it saves, and what they personally need to own in the process.
What ISO 45001 Actually Is (and Is Not)
ISO 45001 is the global standard for occupational health and safety management systems, published by the International Organisation for Standardisation. It replaced OHSAS 18001 and is now the benchmark that most large clients, government bodies, and insurers look to when assessing a supplier's safety credentials.
If you want a fuller picture of the standard's structure and requirements, the ISO 45001 beginner's guide on CertBetter covers the fundamentals well. For now, here is what matters from a CFO's perspective.
The standard is not a compliance checklist. It is a management system framework that requires your organisation to identify hazards, assess risks, implement controls, and continually improve. Certification means an independent, accredited auditor has verified that your system meets the standard's requirements. It does not mean your workplace is perfectly safe, but it does mean you have a credible, auditable framework in place.
What ISO 45001 is not: a one-time project, a box-ticking exercise, or something that can be delegated entirely to an operations team and forgotten about. The standard explicitly requires top management involvement, and that includes finance leadership.
The Financial Case for ISO 45001 Certification
Before we get into what you need to own, let's talk numbers. Because if you are a CFO, you need a business case, not just a compliance argument.
Workers Compensation and Insurance Premiums
Workplace injuries are expensive. In Australia, workers compensation claims run into the billions of dollars each year across the economy. A single serious incident can generate costs that dwarf the entire annual budget for a safety management system. Direct costs include medical expenses, compensation payments, and legal fees. Indirect costs, which are often two to five times higher, include lost productivity, recruitment and retraining, investigation time, and reputational damage.
Insurers are increasingly using ISO 45001 certification as a risk indicator. Certified organisations often attract lower premiums or more favourable policy terms because they can demonstrate systematic hazard management. If your insurer has not asked about your safety management system yet, they probably will.
Tender and Contract Requirements
Government contracts, major infrastructure projects, and large corporate supply chains are increasingly requiring ISO 45001 certification as a minimum condition of participation. If your business is not certified, you are simply excluded from those opportunities. That is a revenue risk that belongs on the CFO's radar, not just the business development team's.
For businesses in construction, mining, manufacturing, utilities, and logistics, the question is no longer whether ISO 45001 helps you win work. It is whether you can afford not to have it. You might also want to read about which ISO certifications are required for government tenders to understand the broader picture.
Regulatory Fines and Legal Liability
Work health and safety legislation in Australia carries serious penalties. Under the model WHS Act, individuals, including officers, can face fines of up to $600,000 and five years imprisonment for category one offences. Corporations can face fines in the millions. ISO 45001 certification does not provide legal immunity, but it is strong evidence of due diligence. In the event of an incident, a documented and audited safety management system is one of the most powerful defences available.
As a CFO, you are likely already classified as an officer under the Corporations Act. Under WHS legislation, officers have a positive duty to exercise due diligence. That duty includes ensuring the business has appropriate resources and processes to eliminate or minimise risks. ISO 45001 is a credible way to demonstrate that duty is being met.
What ISO 45001 Requires from Top Management
This is where many CFOs are caught off guard. ISO 45001 Clause 5 deals with leadership and worker participation, and it places specific obligations on top management. This is not optional, and it is not something you can fully delegate.
Demonstrating Leadership and Commitment
The standard requires top management to take overall accountability for preventing work-related injury and ill health. That means actively promoting the safety management system, not just approving a budget line for it. Auditors will look for evidence that leadership is engaged, not just that a policy document exists.
In practice, this means CFOs should be visible in safety conversations at the board and executive level. It means safety performance should be a standing agenda item in management reviews, and it means resource allocation decisions should reflect genuine commitment to safety outcomes.
Providing Resources
Clause 7 of ISO 45001 requires the organisation to determine and provide the resources needed to establish, implement, maintain, and continually improve the OH&S management system. That is a finance function. If the safety team cannot get budget for training, equipment, or system improvements, the standard is not being met. The CFO's signature on the budget is, in effect, a declaration of commitment to the system.
This does not mean unlimited spending. It means that resource allocation for safety needs to be based on risk, not just on what is left over after everything else is funded.
Policy and Objectives
The OH&S policy must be appropriate to the nature and scale of the organisation's risks. Safety objectives must be measurable, monitored, and resourced. As CFO, you should be reviewing these objectives in the same way you review financial KPIs. If an objective cannot be funded, it cannot be achieved, and that is a systemic failure, not just a safety team problem.
The Costs CFOs Need to Plan For
Let's be direct about what ISO 45001 certification actually costs, because vague answers from consultants are one of the biggest frustrations businesses face.
Implementation Costs
If you are starting from scratch, you will need to develop or update your OH&S management system to meet the standard's requirements. This typically involves a gap analysis, documentation development, staff training, and internal audits before the certification audit. Depending on your organisation's size and existing systems, consultant fees for this work can range from a few thousand dollars for a small business to well over $50,000 for a large, complex organisation.
For a detailed breakdown of what certification actually costs in the Australian market, the ISO 45001 certification cost guide for Australia is worth reviewing before you approve any budget.
Certification Body Fees
The certification audit itself is conducted by an accredited certification body. Fees vary based on the number of audit days required, which is determined by your organisation's size, complexity, and number of sites. Initial certification audits are typically more expensive than the annual surveillance audits that follow. You should also factor in the cost of recertification every three years.
Ongoing Maintenance Costs
Certification is not a one-time cost. You need to budget for annual surveillance audits, internal audits, management reviews, corrective action processes, and staff training. These are not optional. If you stop maintaining the system, you lose the certificate. Many organisations underestimate ongoing costs and then struggle to justify the budget in year two and three when the initial enthusiasm has faded.
Hidden Costs
There are costs that rarely appear in initial quotes. These include staff time for system maintenance, the cost of corrective actions identified during audits, potential system upgrades, and the management overhead of running a compliant system. The hidden ISO certification costs guide covers these in detail and is worth reading before you finalise your budget assumptions.
What CFOs Should Be Monitoring
Once your organisation is certified, your job is not done. As CFO, there are specific metrics and indicators you should be tracking as part of your governance responsibilities.
Leading and Lagging Indicators
Most finance leaders are comfortable with lagging indicators: lost time injury frequency rates, workers compensation claims, days lost. These are important, but they tell you what has already gone wrong. ISO 45001 encourages a focus on leading indicators, the things that predict future performance. These include near-miss reporting rates, hazard identification activity, safety training completion, and corrective action close-out rates.
A healthy safety management system will show strong leading indicator performance. If near-miss reporting suddenly drops, that is not a sign that safety has improved. It is usually a sign that the reporting culture has broken down. That should concern you as much as a spike in claims.
Audit Findings and Nonconformities
Every internal and external audit will generate findings. Nonconformities, whether major or minor, require corrective action. As CFO, you should be receiving a summary of audit outcomes and monitoring whether corrective actions are being closed out on time and with adequate resources. An audit that identifies ten nonconformities and closes nine of them within the required timeframe is a healthy system. An audit that identifies five nonconformities and closes none of them is a governance failure.
The ISO 45001 standard requires documented evidence of corrective action, and auditors will check this at every surveillance visit.
Management Review Participation
ISO 45001 requires top management to conduct periodic management reviews of the OH&S management system. These reviews must cover performance against objectives, audit results, incidents and near-misses, legal compliance, and resource adequacy. CFO participation in these reviews is not just good practice. It is evidence of the leadership commitment the standard requires. If you are consistently absent from these reviews, that is a finding waiting to happen.
Integrating ISO 45001 with Other Management Systems
Most organisations that pursue ISO 45001 already have or are considering other ISO certifications. ISO 9001 for quality, ISO 14001 for environment, and ISO 45001 for safety share a common structure called the High Level Structure. This means they can be integrated into a single management system, sharing common documentation, audit processes, and management reviews.
From a CFO's perspective, integration is almost always more cost-effective than running three separate systems. A single integrated audit is cheaper than three separate audits. A single management review covers all three standards. Documentation is shared rather than duplicated. If your organisation is considering multiple certifications, the business case for an integrated approach is strong. The integrated management systems guide explains how this works in practice.
Choosing the Right Certification Partner
One of the most consequential decisions in the ISO 45001 process is who you choose to help you get there and who audits you. These are two separate decisions, and both matter.
Your consultant helps you build and implement the system. Your certification body audits and certifies it. The two should be independent. A consultant who also offers to certify you is a conflict of interest you should avoid. ISO's official guidance on ISO 45001 makes clear that certification must be conducted by an independent, accredited body.
When choosing a consultant, look for demonstrated experience with ISO 45001 specifically, not just general ISO experience. Ask for references from similar industries. Understand what is included in their fee and what is not. And make sure they are helping you build a system that works for your business, not just one that passes an audit.
When choosing a certification body, ensure they are accredited by a recognised accreditation body such as JAS-ANZ in Australia. Accreditation is the assurance that the certification body itself meets international standards for competence and impartiality.
The CFO's Action Checklist
To bring this together practically, here is what you should be doing as a CFO in relation to ISO 45001.
- Review your current OH&S management system against ISO 45001 requirements and understand the gaps.
- Ensure safety is a standing item in board and executive reporting, with meaningful metrics, not just incident counts.
- Budget adequately for implementation, certification, and ongoing maintenance, including staff time.
- Participate in management reviews and ensure your attendance is documented.
- Monitor corrective action close-out rates as a governance indicator.
- Understand your personal obligations as an officer under WHS legislation and how ISO 45001 supports your due diligence defence.
- Evaluate the business case for integration with ISO 9001 or ISO 14001 if your organisation holds or is pursuing multiple certifications.
- Verify that your certification body is accredited and that your consultant is independent from the certification process.
If your organisation is at the beginning of this journey, or if you are reassessing your current approach, CertBetter can help you get started. Businesses submit one form and receive up to three competing quotes from vetted ISO consultants and accredited certification bodies. It is free to use, there is no obligation, and it gives you a real market comparison before you commit to anything. For a CFO who wants to make an informed decision rather than accept the first quote that lands in their inbox, that is a practical starting point.
