ISO 45001 or VCA: what is the difference and which one suits your company?

What is ISO 45001?

ISO 45001 is the international standard for an occupational health and safety management system. It does not prescribe fixed measures. It asks your organisation to map hazards and risks systematically, set objectives, involve workers, investigate incidents, and review and improve the system regularly. The structure follows the common ISO layout with clauses 4 to 10, as you know it from ISO 9001 and ISO 14001.

You have yourself certified by a certification body. A certificate is usually valid for three years, with annual checks in between. The standard suits every sector and size, including offices and service providers, and can be used internationally. The current edition dates from 2018 and is being revised. Ask your certification body about the current status and any transition period. Implementation itself is covered in the guide on implementing ISO 45001.

What is VCA, and what do VCA*, VCA** and VCA petrochemical mean?

VCA stands for the Dutch safety, health and environment checklist for contractors. The scheme is managed by the foundation SSVV and is meant for companies that do risky work or work in risky places, such as construction, installation and industry. A recognised certification body assesses your safety, health and environment system. The certificate is listed in the central certificate register so that clients can check it.

There are three levels for companies. VCA* is meant for companies without subcontractors, VCA** for companies that work with subcontractors, and VCA petrochemical for companies in the petrochemical industry. The company certificate is valid for three years with an annual check. Staffing agencies have their own variant, VCU. A personal diploma, such as B-VCA or VOL-VCA, is something different from the company certificate. Read more in the guides on VCA* or VCA** and on preparing for VCA certification.

ISO 45001 or VCA: the main differences

The two differ mainly in purpose, target group and level of detail, and much less in the subjects themselves. ISO 45001 is a standard for the system of the whole organisation. VCA is a scheme with which operating companies show their way of working to clients. These are the differences you meet in practice:

• Purpose: ISO 45001 builds a management system for the whole organisation. VCA shows clients that an operating company works safely.
• Target group: ISO 45001 suits any type of organisation. VCA is meant for contractors and other companies that carry out risky work.
• Level of detail: ISO 45001 says what you must achieve and leaves the approach open. VCA uses a checklist with questions that are closer to the work itself.
• Subject: ISO 45001 covers health and safety. VCA also includes the environment, the M in the Dutch abbreviation.
• Reach: ISO 45001 is international. VCA is mainly used in the Netherlands and Belgium, with SCC as its German-language counterpart.
• People: VCA also has diplomas for employees. ISO 45001 only certifies the organisation.

Where do ISO 45001 and VCA overlap?

The overlap is large, because both start from the same basis: know which hazards you have, choose measures for them, train people and show that it works in practice. Much of the evidence you collect for one can be used for the other.

The difference often lies in the form of the evidence, not in the subject. An auditor for either scheme wants to see more than documents: they also want to talk to employees and see the work. Employees who explain how they work safely and what they do after an incident say more than a good policy document. The subjects where both schemes meet are:

• Safety policy and objectives that management sets and discusses
• Risk assessment, in the Netherlands the RI&E, and task-based analyses such as a TRA and an LMRA
• Instruction, training and proof of competence, such as diplomas and certificates
• Reporting, investigating and following up incidents and near misses
• Inspections and internal audits, with follow-up of findings
• Management review and improvement actions with an owner and a deadline
• Control of subcontractors and hired-in personnel

Who is ISO 45001 for and who is VCA for?

Look at who your clients are and what you want to achieve yourself. If some of your clients ask for VCA, you have a clear reason. Without such a request, ambition, growth and international work weigh more heavily. The profiles below are examples, not a fixed classification; your situation may sit somewhere in between.

• Contractor or installer with clients who put VCA in their requirements: start with VCA, at the level the requirements name.
• Company without clients asking for VCA, but that wants to organise safety structurally or work internationally: ISO 45001 often fits better.
• Industrial or production company that mainly works at its own site: ISO 45001 is usually the more obvious choice, unless a client asks for VCA.
• Main contractor with many subcontractors: often VCA**, sometimes supplemented with ISO 45001 if the client asks for it or you want a complete system.
• Company that works at client sites and also has ISO 9001 or ISO 14001: ISO 45001 as the basis and VCA as additional proof can fit.

What do clients usually ask for, and how do you check?

That differs per client and per assignment, so read the requirements. According to SSVV, the client decides whether you need a VCA certificate and at which level. Some clients require VCA, others accept ISO 45001 as equivalent, sometimes under conditions such as valid VCA diplomas for operating staff and supervisors. Still others ask for both.

Do not assume anything without checking. In tenders, equivalence sometimes only becomes clear from the questions and answers document, and sometimes the bidder has to substantiate it. So ask early, so that you do not discover only after bidding that your certificate does not count. This is how you check:

• Read the contract, the requirements or the admission rules of your most important clients.
• Note the requested level (VCA*, VCA** or petrochemical) and whether employee diplomas count.
• If it says equivalent certificate, ask in writing what the client means by that.
• Ask a certification body whether the scheme fits your situation.

Combining ISO 45001 and VCA: one system, two proofs

If you want both, build one management system and lay the requirements of both next to it. Take the structure of ISO 45001 as the backbone, because it is broad and fits other ISO standards. Check for each part whether the concrete questions in the VCA scheme are answered too. This avoids duplicate procedures, duplicate records and two separate audit programmes.

Ask your certification body whether audits can be combined and how planning works. There is also VCA-MAX: a VCA certificate with an additional module on safe behaviour, meant for companies that want to anchor safety in attitude and behaviour. Whether a client accepts it again depends on that client. Record the agreements you make.

Which step first? How to choose in six steps

Do not start with the standard, but with your clients' demand and your own role. A certificate nobody asks for yields little and takes a lot of time. Go through these steps with your management and your QHSE coordinator, and write down the answers so that you can justify the choice later:

• Find out what your clients ask for, at which level and which diplomas come with it.
• Determine your role: do you carry out the work yourself, or direct subcontractors and projects.
• Do a baseline on the scheme you are considering: what you already have and what is missing.
• Choose the scheme you need now and record why. Plan the other one as a follow-up if it becomes useful later.
• Build the system so that the other scheme fits in later: one RI&E, one incident register, one audit programme.
• Request quotes from certification bodies and compare their approach and planning.

Costs and lead time in broad terms

We do not mention amounts here, because they vary widely. Costs depend on the number of employees and sites, the complexity of your work, what you have already set up, and the rates and approach of the certification body. Besides the body's fees, allow for your own hours and any training.

Lead time depends mainly on your starting point. A company with a current RI&E, documented instructions and working follow-up has less to do than a company that still has to build this. Plan generously, because an auditor wants to see evidence from the past period. After the first certification, both schemes involve an annual check and a new assessment after three years.

How BrydgeOne supports this

BrydgeOne does not choose the scheme for you and does not certify; you do that with your clients and a certification body. It does help you collect evidence and make gaps visible. In Standards framework you work with one register of controls, in which ISO 45001 is a selection. You link your own evidence, see gaps and follow them up with actions. The readiness view is explicitly not a statement about certification.

With GAP analysis you do a baseline per requirement and turn a shortcoming into an action with one click. Certificate management monitors the validity of personal certificates such as VCA, inspections and system certificates, with a signal before something expires and with requirements per job function. The evidence you record this way, such as RI&Es, inspections and reports with follow-up, is also what a VCA auditor wants to see.