The two independent cases for it
There is a commercial case and an operational case, and small businesses should score them separately. The commercial case is simple arithmetic: if certified OH&S management appears in your prequalifications and tenders, one won contract typically repays the certification many times over, and one lost shortlisting costs more than the whole program. The operational case depends on your hazard profile: for trades, fabrication, logistics, and site work, a functioning system measurably reduces incidents, and a single avoided lost-time injury (direct costs, downtime, insurance, morale, and in the worst cases enforcement) can exceed years of certification fees.
What it realistically costs a small firm
Certification fees scale with headcount and risk, so a small business pays small-business prices for the audits; the dominant cost is internal time to establish hazard assessments, a legal register, consultation habits, and records. The 2018 standard was written to be scalable: no manual, no mandatory procedures, documentation only "to the extent necessary". A lean, honest system for a low-complexity small business is genuinely achievable with internal effort plus free resources like the guides on this site.
When to wait, and what to do meanwhile
- Wait if no client asks, hazards are low (office-based work), and cash is tight; the certificate would decorate a wall, not win work.
- Do anyway: a written hazard assessment for every significant task, built with the workers who do it; a one-page legal register you actually check; an incident and near-miss log that triggers action; and a monthly safety conversation with notes. That kernel is most of the standard's value, and it makes later certification a formality.
The trap to avoid
The worst outcome, which I meet regularly as an auditor, is the small firm that bought a templated system to satisfy one client, laminated it, and changed nothing. It costs the same as a real system, returns nothing, creates legal exposure (documented procedures you demonstrably ignore are evidence against you), and fails surveillance audits. If you are going to do it, run it for real; if you cannot yet, be honest with the client about your timeline. Both are respectable. The binder theater is not.