Key takeaways
- ISO certification means an accredited certification body has audited your management system against ISO 45001 (WHS), ISO 9001 (quality) or ISO 14001 (environment); it is not a licence to do traffic control.
- In Australia and New Zealand, JAS-ANZ accredits certification bodies, so check that your certifier is accredited for the standard and scope you need.
- Certification usually follows a Stage 1 and Stage 2 audit, then surveillance audits during a three-year cycle and a recertification audit.
- Many principal contractors and some prequalification schemes ask for certified or equivalent systems, but requirements vary, so read the actual tender or scheme criteria.
- ISO 9001 and ISO 14001 have been revised, and a 2024 amendment added climate change to the context clauses, so ask your certifier which editions apply and when the transition ends.
ISO certification for a traffic control company means an accredited certification body has audited your management system against ISO 45001 for work health and safety, ISO 9001 for quality or ISO 14001 for environment, and found it working. It is not a licence to do traffic control, but many principal contractors and prequalification processes ask for it or an equivalent system.
Traffic control businesses usually start thinking about ISO when a tender asks for it, or when a principal contractor's prequalification form has a box they cannot tick. That is a reasonable trigger, but the businesses that get the most from certification treat it as a way to run the company better, not a badge for tenders. This guide explains what each standard covers, how certification works and how to make the system real in the field.
This is general information. Standards and scheme requirements change, so check the current versions with Standards Australia, your certification body and the tender or scheme documents.
What each standard covers for a TC business
All three standards share a common high-level structure, so one integrated management system can cover them together. What auditors look for in a traffic control company:
| Standard | Focus | What auditors often look at in a TC business |
|---|---|---|
| ISO 45001 | Occupational health and safety | SWMS, TGS implementation, fatigue management, incident investigation, consultation, competency |
| ISO 9001 | Quality management | Quote-to-docket process, TGS revision control, customer complaints, inspection records, supplier control |
| ISO 14001 | Environmental management | Fuel and oil spills, vehicle emissions, waste from damaged devices, night noise, wash-down water |
ISO 45001 in traffic control terms
Work on or next to a road used by traffic is high-risk construction work, so the business already needs SWMS, risk assessments and incident processes under WHS laws. ISO 45001 asks you to show those processes form a system: hazards identified and controlled following the hierarchy of controls, workers consulted, incidents investigated and corrective actions closed, and leadership involved. The recurring traffic control hazards, such as errant vehicles, reversing plant, fatigue, heat and abuse from the public, should all be visible in the system. Safe Work Australia explains the underlying WHS duties.
ISO 9001 in traffic control terms
Quality in traffic control means the right crew, with the right tickets, at the right site, with the right TGS revision and equipment, and accurate dockets afterwards. ISO 9001 asks you to define and control those processes, measure them and improve them. Customer complaints, no-shows and docket disputes are quality data.
ISO 14001 in traffic control terms
Environmental aspects for a TC company include fuel and oil from vehicles and generators, waste from damaged cones and signs, night noise from equipment and vehicles, and wash-down water at depots. On larger projects, clients may ask how you manage these.
Who certifies, and why accreditation matters
Certification bodies audit and certify businesses. Accreditation bodies check that certification bodies are competent. In Australia and New Zealand, JAS-ANZ is the accreditation body, and it maintains a register you can use to check whether a certification body is accredited for a particular standard.
Why it matters:
- Clients check. A certificate from a body that is not accredited for that standard may not satisfy a tender requirement.
- Scope matters. The certificate should describe your actual activities, for example traffic management services, and the sites covered.
- Expiry and status matter. Certificates are suspended or withdrawn if surveillance audits lapse.
Questions to ask a certification body
- Are you accredited by JAS-ANZ for each standard we want, and for our industry scope?
- How many audit days will Stage 1, Stage 2 and surveillance audits take, and why?
- Will you visit live sites, including night shifts, or only the office?
- Can you audit ISO 45001, 9001 and 14001 together as an integrated system?
- How do you handle multiple depots?
- What does your proposal include, and what is charged separately?
Be wary of offers of quick certification without a real audit. A certificate that does not reflect a working system tends to fall apart at the first serious tender assessment or incident investigation.
How the certification process works
Most certifications follow a similar path.
- Gap analysis. Compare current practice with the standard. Many TC businesses already have most of the field processes; the gaps are usually in documentation, internal audits, management review and objectives.
- Build the system. Define processes, responsibilities, records and objectives. Keep it proportionate to the size of the business.
- Run it. Operate the system for long enough to generate records: inspections, incidents, corrective actions, training and customer feedback.
- Internal audit and management review. Audit your own system and hold a management review before the certification audit.
- Stage 1 audit. The certification body reviews documentation and readiness. Findings need addressing before Stage 2.
- Stage 2 audit. The certification body tests implementation and effectiveness, including site visits and interviews.
- Certification. Once any major nonconformities are closed, the certificate is issued.
- Surveillance. Surveillance audits typically occur during each year of the three-year cycle, then a recertification audit.
Costs depend on the size of the business, the number of sites, the number of standards and whether audits are integrated. Consultant support, internal time and any software are additional cost drivers. Ask certification bodies for written proposals that state audit days, sites and standards.
Where certification matters commercially
Requirements differ between clients and schemes, so read the actual criteria rather than assuming.
- Principal contractors. Many tier one and tier two contractors ask for certified management systems, or for evidence of equivalent systems, during subcontractor prequalification.
- Government and council work. Some road authority and council prequalification processes ask for certified or equivalent quality, safety and environmental systems. In NSW, see our guide to traffic control prequalification.
- State traffic management accreditation. Schemes such as Victoria's traffic management company accreditation have their own criteria. Certification may help with evidence, but it does not replace the scheme's requirements. Check each scheme directly.
- Tenders. Certification can be a pass or fail criterion or just one factor. Our guide to traffic control tenders covers how to answer capability questions with evidence.
Do not overstate certification in marketing or tenders. State the standards, the certification body and the scope exactly as they appear on the certificate.
The 2024 amendment and 2026 revisions
Two sets of changes are worth knowing.
- Climate change amendment. In February 2024, ISO and the IAF published an amendment to management system standards, including ISO 9001, ISO 14001 and ISO 45001, adding climate change to the clauses on the organisation's context and interested parties. Businesses are asked to consider whether climate change is a relevant issue. For an outdoor workforce, heat stress is an obvious example.
- ISO 9001 and ISO 14001 revisions. A revised edition of ISO 9001 has been published, and certification bodies have reported a multi-year transition period for existing ISO 9001:2015 certificates. ISO 14001 has also been revised, with its own transition arrangements. Dates and transition periods are set by ISO and the accreditation bodies, so ask your certification body for the current timeline and what it means for your next audit.
ISO 45001 is also under revision, with certification bodies expecting a new edition around 2027 and a transition period after publication. Until then, ISO 45001:2018 with the 2024 amendment applies. Psychosocial hazards, such as abuse from the public and isolated night work, are worth building into your system now regardless of the timing.
Making the system real in the field
The biggest gap in traffic control management systems is usually between the manual and the ute. Auditors know this, and they test it by sampling jobs. A typical audit trail might be: pick a docket, then check the booking, the TGS revision used, the crew's tickets and inductions, the pre-start and SWMS sign-on, the inspection records, any incident or variation, and the invoice.
Records that already exist in a well-run TC business become evidence:
| Field process | ISO evidence it provides |
|---|---|
| Pre-start checklists | Hazard identification, equipment checks |
| SWMS sign-on | Consultation, competency, risk control |
| Inspection records | Monitoring and measurement |
| Dockets | Service delivery, customer acceptance |
| Near miss and incident reports | Incident management, corrective action |
| Fatigue and roster checks | Risk control for a key hazard |
| Equipment inspections | Maintenance and control of resources |
| Complaints | Customer satisfaction, improvement |
Our guides to traffic control dockets and near miss reporting cover two of the most useful record sets. If you already run temporary traffic management audits on sites, those results feed directly into your internal audit programme.
Common nonconformities in TC businesses
- SWMS that do not match the actual work method.
- Superseded TGS revisions used on site.
- Expired tickets or inductions not picked up before rostering.
- Incident corrective actions raised but never closed.
- Internal audits not done, or done only on paperwork.
- Management review held without real data.
- Equipment inspection records missing for some depots.
- Customer complaints handled by phone and never recorded.
Next steps
Start with a gap analysis against ISO 45001, build one integrated system and choose a JAS-ANZ accredited certification body. TrafWise can help by capturing pre-starts, SWMS sign-off, inspections and dockets on every shift, so the records auditors sample are already there.
Frequently asked questions
Does a traffic control company need ISO certification?
Not by law. ISO certification is voluntary, and traffic control work is governed by WHS laws, state traffic management requirements and licensing or accreditation schemes. But many principal contractors, councils and prequalification processes ask for certified or equivalent management systems, so certification can affect which work you can win.
What is the difference between ISO certified and ISO compliant?
Certified means an independent certification body has audited your system and issued a certificate, ideally under accreditation from a body such as JAS-ANZ. Compliant or aligned usually means the business says its system follows the standard without independent certification. Some clients accept alignment for smaller contracts; many tenders ask for certification.
How long does ISO certification take for a traffic control company?
It depends on how developed your current system is. A business with working SWMS, inspections, dockets and incident processes may need months to formalise and run the system before audits. You usually need records showing the system has operated, plus an internal audit and management review, before the Stage 2 audit.
Which ISO standard should a traffic control company get first?
Most start with ISO 45001 because WHS is the biggest risk and the most common tender question in traffic control. ISO 9001 often follows because clients care about consistent service and records. ISO 14001 matters for larger projects and government clients. Many businesses build one integrated system and certify the standards together.
How do I check if an ISO certificate is genuine?
Check the certificate's issuing certification body, standard, scope, sites and expiry date, then confirm that the body is accredited for that standard. In Australia and New Zealand, JAS-ANZ maintains a register of accredited bodies. The international IAF CertSearch database can also help, though not every certificate appears there.