ISO 45001 Audit Checklist

An ISO 45001 audit checklist is a structured tool used to verify whether an occupational health and safety management system meets applicable ISO 45001 requirements. It typically covers organizational context, leadership, worker consultation, hazard identification, risk assessment, legal obligations, operational controls, competence, incident response, performance evaluation, internal audits, management review, and corrective action. A strong checklist also identifies the objective evidence needed for each item.

Include questions and evidence prompts for Clauses 4 through 10: context of the organization, leadership and worker participation, planning, support, operation, performance evaluation, and improvement. Review the OH&S policy, hazard and risk registers, legal and other requirements, competence records, emergency plans, inspections, incident investigations, audit reports, management-review outputs, corrective actions, and effectiveness verification. Assign an owner and follow-up date for every gap.

Start by defining the audit scope, criteria, locations, processes, and responsible personnel. Review prior findings, OH&S objectives, risk assessments, legal requirements, incident trends, training records, and corrective-action status. Build an audit plan that samples records and observes work where controls are implemented. Brief auditees on the purpose and schedule, then compile evidence that shows controls are operating effectively rather than merely documented.

ISO 45001 requires internal audits at planned intervals, but it does not prescribe one fixed frequency. Establish an audit program based on process risk, legal and OH&S obligations, incident history, changes, previous findings, and organizational performance. Higher-risk activities or areas with recurring nonconformities may need more frequent audits. Ensure the schedule, scope, results, corrective actions, and follow-up are documented.

Useful evidence includes the OH&S policy and objectives, risk assessments, hazard-identification methods, compliance evaluations, training and competency records, consultation records, operational procedures, contractor controls, inspection results, emergency-drill records, incident investigations, monitoring data, internal-audit reports, management-review minutes, and corrective-action verification. Auditors also use interviews and observations to confirm documented arrangements are implemented in daily operations.

An audit finding is any result of evaluating evidence against audit criteria. Findings can confirm conformity, identify an opportunity for improvement, or identify a nonconformity. A nonconformity occurs when evidence shows a requirement has not been met, such as a missing required process, an unimplemented control, or ineffective corrective action. Record the requirement, objective evidence, and severity clearly so the organization can investigate and correct it.

First contain or correct the immediate issue where needed. Then determine the root cause, evaluate whether similar issues exist elsewhere, define corrective actions, assign owners and due dates, and implement the changes. Closure should include objective evidence that actions were completed and an effectiveness review showing the nonconformity is not recurring. Simply marking an action complete without verification is not a defensible closure.

Yes. QMS Learning’s ISO 45001 Internal Auditor Course covers hazard identification, OH&S risk assessment, incident investigation, and management review. The platform also provides role-profile onboarding, AI Workbench access, Manager Dashboard visibility, and Audit-Evidence Package export. These tools help teams understand what to check, select an appropriate method for gaps, and assemble records that support audit readiness. The ISO 45001 course pilot cohort opens in Q3 2026.