If you've filled in a tender or a prequalification portal lately, you've probably hit a line like: "Does your organisation have an audited WHS management system?", and paused. You have safety policies. You run inductions. You have SWMS on every job. So the honest answer feels like it should be yes. But that box is asking something more specific than "do you take safety seriously", and getting it wrong can quietly cost you the work.
Here's the part most explanations skip: "audited WHS management system" isn't one thing. Depending on who's asking, it's one of three quite different checks, different in cost, in time and in what you walk away with.
The short answer
An audited WHS management system is a safety management system that has been checked by someone independent, not just written down. In practice, that check is one of three things:
- Certification to ISO 45001. A JAS-ANZ-accredited certification body audits your system and issues a certificate. The strongest and most portable version.
- An audit against the NSW Government WHS Management Systems and Auditing Guidelines. An independent audit against the NSW Government's criteria, common for NSW government construction work.
- A prequalification review. Your system is reviewed and verified inside a scheme such as Cm3 or Avetta, or a head contractor's own portal.
Which one you need depends entirely on who's asking. Get it wrong in one direction and you lose the tender waiting for a certificate you didn't have time to get. Get it wrong in the other and you buy certification the gate never asked for, which is real money and months of effort the buyer didn't require.
First, "management system" is more than documents
A WHS management system is the whole way your business identifies hazards, controls them, checks that the controls are working and improves when they're not. Policies, inductions and SWMS are part of it, but on their own they're inputs, not a system. The internationally recognised benchmark is ISO 45001, but you can run a genuine, defensible safety system without ever certifying it. Plenty of businesses do exactly that. What turns "we have policies" into "audited" is the independent check. That's where the three pathways part ways.
Pathway 1: certified to ISO 45001
The strongest and most portable version. A JAS-ANZ-accredited certification body audits your system on site in two stages, issues a certificate, then returns for annual surveillance audits to keep it live. Who asks for it: head contractors and government panels at the bigger end of town, tenders that specifically say "certified" or "third-party certified", and in four states, the licence itself. In New South Wales, Tasmania, Victoria and Western Australia, a certified safety management system is a condition of holding a Class A (friable) asbestos removal licence: the current NSW and Tasmanian forms name ISO 45001, Tasmania adding "or equivalent", the WA form names the Australian adoption AS/NZS ISO 45001:2018, and Victoria names no standard at all, requiring a JAS-ANZ-accredited OHS management system certificate, which in practice means ISO 45001. What you walk away with: a certificate almost every buyer recognises, one build that satisfies many gates. The catch is time: certification realistically takes 6 to 12 months for a small business, because the system has to run long enough to generate real records before a certifier can audit it.
Pathway 2: audited against the NSW Government WHS guidelines
On NSW government construction work, agencies commonly require a contractor's WHS management system to be audited against the NSW Government WHS Management Systems and Auditing Guidelines. It's a genuine independent audit. An auditor assesses your system against the guidelines' criteria and you close out any corrective actions, but the output is an audit report accepted by the agency, not a certificate. It doesn't make you "ISO 45001 certified", and it isn't meant to: it's the entry requirement for that stream of work. If NSW government construction is the market you're chasing, this, not certification, is often the exact thing the tender is asking for, and it's usually faster to arrange than a full certification build.
Pathway 3: verified inside a prequalification scheme
Schemes like Cm3 and Avetta, and many head contractors' own portals, sit between "self-declared" and "certified". Their assessors review and verify your WHS documentation and evidence against the scheme's criteria, and if you meet them you're prequalified: visible to that scheme's member clients as a contractor whose safety system has been independently checked. It's typically the fastest of the three pathways, and it's exactly what many builders mean when they tick "audited WHS system required". Two honest limits: the review is generally of your documentation and records rather than an on-site audit, and the status lives inside that scheme. A client on a different portal may ask you to prequalify all over again.
The three pathways side by side
| Pathway | Who typically asks for it | What the assessment covers | What you walk away with | When it's the right answer |
|---|---|---|---|---|
| ISO 45001 certification | Head contractors, government panels and larger tenders; a Class A asbestos licence condition in NSW, TAS, VIC and WA (details above) | A certification body audits the whole system in use, on site: Stage 1, Stage 2, then annual surveillance | A certificate from a JAS-ANZ-accredited body, portable and recognised by almost every buyer | Certification is named across several of your gates, or a licence requires it |
| NSW Government WHS guidelines audit | NSW government agencies on construction work | An independent audit of your WHS system against the guidelines' criteria, with corrective actions closed out | An audit report accepted by the agency for that stream of work | The gate is NSW government construction work and the tender names the guidelines |
| Prequalification review (Cm3, Avetta, portals) | Head contractors and clients who run their supply chain through a scheme | Review and verification of your WHS documentation and evidence against the scheme's criteria | Prequalified status inside that scheme, visible to its member clients | The buyer names the scheme and you need to be in the running quickly |
How to work out which one you actually need
Start with the wording, not the solution. Read the tender or licence clause closely. It usually names the pathway ("certified by a JAS-ANZ accredited body", "audited against the NSW Government guidelines", "Cm3 prequalified"). If it's ambiguous, ask the buyer; evaluators answer that question all the time. Then work backwards from the deadline: certification realistically takes 6 to 12 months, while guidelines audits and prequalification reviews are usually much faster. That arithmetic often decides the pathway for you.
And buy only what the gate requires. If one builder's portal is the gate, prequalification gets you tendering; certification can come later if bigger gates appear. If certification keeps turning up across your tenders, or a licence names it, build once, properly, and let one certificate satisfy many gates. Whichever pathway you land on, the system underneath has to be real: all three checks are designed to catch a paper system, and a certificate sitting on top of a system nobody uses doesn't survive the first surveillance visit.
If a tender or a licence has put "audited WHS management system" in front of you and you can't tell which of the three it's asking for, send the wording to info@cdmcg.com.au or book a 20-minute call, with no pitch and no obligation. Twenty minutes usually settles it, and it's better settled before the deadline forces the timing.
Book a 20-minute call
Exemplar Global-certified ISO 9001, 14001 and 45001 Lead Auditor and Managing Director of CDMCG. CDMCG builds management systems to be certification-ready. The certificate itself is always issued by an independent certification body, and CDMCG never consults for organisations it audits on behalf of certification bodies.