ISO 45001 Audit Checklist: 37 Questions Organized by Clause

ISO 45001 Audit Checklist: What Auditors Actually Ask

An ISO 45001 audit checklist fails in one of two ways: it asks whether documents exist, or it asks generic safety questions no one can act on. The questions that surface real findings are the ones that test whether the Occupational Health and Safety Management System actually works. "Is there a hazard identification procedure?" checks a box. "Show me the hazard assessment for the task your crews performed most recently, and ask the supervisor what changed since it was written" tells you whether the system is alive.

This checklist is organized by clause and built around what we have watched trip up real organizations during gap analyses, Certification Audits, and Surveillance Audits. The findings described here come from actual consulting engagements across manufacturing, field services, and industrial operations. Not every question applies to every organization; tailor it to your scope. If you are building the wider system rather than auditing it, start with our ISO 45001 certification services page for how the pieces fit together.

How to Use This Checklist

Do not try to cover every question in a single session. ISO 45001 lets you split the Internal Audit program across the year, clause by clause or process by process. A focused two-hour audit of Clause 8 will find more than a rushed full-day sweep. For each question, chase objective evidence: a record, a walked process, or an employee explaining the hazard in their own words.

One warning before the clause questions. Auditors consistently find the same meta-problem: what the manual says and what the field does are two different systems. At one plant, the safety lead could predict the finding before the external audit happened. Their external safety certification audit had scored hazard identification lowest three years running, for the same reason each time: the written procedures described a process nobody followed. Ask the floor, not the binder.

Clause 4: Context of the Organization

1. Has the organization determined the internal and external issues that affect OH&S performance?

2. Are workers, and where required their representatives, treated as interested parties with consultation requirements?

3. Is the OH&S management system scope documented, and does it reflect where work actually happens, including client sites?

4. If the system is used as a framework rather than for certification, does the documentation still satisfy every clause it claims?

What actually happens: scope decisions get reversed mid-project. At one multi-site field services company, leadership narrowed the program's scope partway through implementation, deciding to use ISO 45001 as a framework rather than chase the certificate. The scope documentation, the gap analysis, and months of work on the wider scope all needed rework. An Internal Audit should confirm the declared scope matches the current strategic intent, not the intent of eighteen months ago.

Clause 5: Leadership and Worker Participation

5. Can Top Management demonstrate OH&S leadership beyond signing the policy: participating in reviews, resourcing actions, removing obstacles?

6. Does the OH&S policy include the commitments the standard requires, and any wording local legislation mandates?

7. Are roles, responsibilities, and authorities defined, communicated, and understood?

8. Is there a functioning mechanism for worker consultation on hazard identification and incident investigations?

9. Can non-managerial workers point to how their input changed the system?

What actually happens: consultation happens at the management table and nowhere else. The same standard that requires the framework explicitly requires non-managerial workers to be part of it. At one plant, the entire documentation redesign was built by the safety lead and the consultant before anyone thought to take it to the crews; the consultant's reminder, which applies to every audit of Clause 5, was that the workers who actually do the work are the ones who can say what the framework missed. A checklist that only interviews managers will pass this clause every time and learn nothing.

The inverse failure also exists: a policy signed, posted, and completely unknown. At one plant within a larger organization, the audit found a comprehensive corporate EHS policy published on the parent company's website, written with both standards in mind, that the site's own manager had never seen. If the audit team can find the policy faster than the plant manager can, Clause 5 has a finding.

Clause 6: Planning

10. Is there a documented, repeatable process for hazard identification covering routine and non-routine activities?

11. Does hazard identification cover everyone who could be affected, including visitors, contractors, and workers at client sites?

12. Are risk assessment methods defined, and can a field worker explain how their task got its risk score?

13. Are legal and other requirements identified, and is there a realistic mechanism for staying current?

14. Are OH&S objectives measurable, and do they include at least one leading indicator rather than only lagging injury rates?

15. Do objectives have action plans with owners, resources, and timeframes?

What actually happens: risk scoring becomes subjective theater, and hazard identification documents age out of contact with the work. On the first problem: one safety lead argued the three-by-three risk matrix in use was "very subjective," because what one supervisor rates low another rates medium, and pushed for a more detailed tool that forced justification of every score. The field supervisor's compromise kept both: the simple tool for daily field use, the detailed one as the validation that shows how the number was derived. An audit question that works anywhere: pick a completed hazard assessment at random and ask the assessor to walk you through why the score is what it is. If they cannot, the tool is theater.

On the second: hazard identification scored lowest year after year in one company's external safety audits, and the safety lead's diagnosis was blunt. What the field actually did and what the manual said were disconnected, and the manual's hazard identification section was, in the safety lead's own words, something nobody followed. The audit question that catches this is not "does the process exist" but "show me the last task your crew performed and the assessment that preceded it."

On objectives: the reflexive choice is Total Recordable Incident Rate, a lagging indicator that only moves after someone is hurt. One operations lead wanted exactly that; the safety lead pushed back that the account needed proactive measures too. The system they settled on paired one lagging indicator with inspection completion rates, a leading one. A useful audit follow-up: for each objective, ask what weekly behavior changes when the number moves the wrong way.

Clause 7: Support

16. Are resources for the OH&S system adequate, and can the safety lead request more without a fight?

17. Is competence defined for safety-critical roles, and verified rather than assumed?

18. Do training records show role-specific competence, or only generic awareness completion?

19. Is there evidence that workers know the hazards of their specific tasks, not just that they attended orientation?

20. Is documented information controlled, current, and actually used by the people it is written for?

What actually happens: competence is documented and hollow. At one plant, hazard assessment documentation had drifted so far from field practice that a critical task inventory embedded in the safety manual for years had never been used by field staff; the operations lead, asked about it, confirmed he had never even seen it. Training that ends at a completed checklist proves attendance. The audit question is whether the worker can name the hazards of their current task and the control that fails first.

Terminology is part of competence, and it is a finding that hides in plain sight. Another organization had documented hazard assessments for years under a term borrowed from another country's safety legislation, one its workers had never heard anywhere else. The fix was renaming the tool "Job Hazard Analysis" so crews would actually use it. If a checklist question is unanswerable by the workforce in their own vocabulary, the documentation, not the workers, has failed.

Clause 8: Operation

21. Are operational controls defined for processes with significant OH&S risk?

22. Do the controls match the hierarchy of controls, or do they start at PPE because that was cheapest?

23. Are elimination and substitution genuinely considered before administrative controls, with the reasoning recorded?

24. Is procurement controlled so that purchased equipment and contractor work do not introduce unassessed hazards?

25. Are emergency procedures specific to the site's real hazards, and have they been drilled?

26. For field-based workers, is there a practiced plan for emergencies at client sites where the client controls the response?

27. Do corrective actions from incidents and drills actually close, with evidence, or do they stay open on paper?

What actually happens: the hierarchy of controls gets applied bottom-up, and operators defeat the controls nobody tested. At one plant, a 30-ton press went through iterations of safety controls: restricting to setup personnel, then two-button activation. Operators defeated the two-button system with a pencil, jamming one button depressed through the guard so they only had to press one. The root cause was ergonomic, not behavioral: holding run buttons for several seconds was unpleasant. The permanent fix, a robot offload that removed the human from the interaction, was only found after working up the wrong direction through the hierarchy; the team's own admission was that they had moved bottom-up when the standard expects top-down. An audit checklist should ask for the hazard assessments where elimination and substitution were evaluated and rejected with reasons, not just the PPE register.

Emergency preparedness fails in site-specific ways that generic plans cannot cover. At one high-temperature ceramics operation, the honest answer to "what is the fire response procedure for this room" was that if a fire starts there, you run, and the plan was to invite the local fire department for a walkthrough precisely because standard suppression would make it worse. That is a facility where the correct emergency plan contradicts the template. A checklist that asks "is there an emergency procedure" gets a yes; the question that gets evidence is "show me the drill record for this room's scenario."

For mobile workforces the gap is different: drills happen at client sites under the client's plan, and the employer's own procedures for employer-specific emergencies go unrehearsed. At one company whose crews rotate between client facilities, workers could spend months on client sites without ever practicing the employer's own rescue procedure for a worker stranded at height. The assessment from the safety side was that the plan exists but nobody practices it. The audit question: when did your crews last rehearse your procedure, not the client's evacuation?

The corrective action half of Clause 8 fails quietly: incidents get reported, fixes happen in the field, and nothing gets documented. One operations lead recognized the pattern from the quality side immediately: great at getting incidents reported, never great at tracking how they were fixed. His own framing was that it sounded exactly like their nonconformance process. The checklist question is to take three closed incident reports and ask for the evidence of the corrective action's completion and effectiveness check.

Clause 9: Performance Evaluation

28. Is monitoring and measurement defined for OH&S performance, with both leading and lagging indicators?

29. Are inspection and monitoring records complete, and do they capture what field supervisors already do informally?

30. Is compliance with legal requirements evaluated at planned intervals, with evidence of how each determination was made?

31. Does the Internal Audit program cover the full system scope across the year, including client-site operations?

32. Has Management Review occurred at planned intervals with Top Management present, not just the safety lead?

33. Do Management Review outputs record decisions and resource changes, or only attendance?

What actually happens: management review becomes a date change. Asked whether OH&S management reviews occurred, the safety lead at one company was refreshingly honest: sure, they just changed the date. The annual review consisted of the safety lead going through the manual personally, with no meeting, no leadership attendance, and no record beyond a calendar entry; the CEO, by the account, trusted the safety lead to run it and the two spoke perhaps twice a year. Clause 9.3 requires Top Management involvement, and a review one person conducts alone is a finding regardless of how good that person is. The audit question is to ask for the review minutes and then to ask which executives attended.

The second Clause 9 failure is undocumented good work. The same company's field supervisors spotted and fixed hazards daily, ran toolbox talks, and managed safety well by habit, and almost none of it left a record. During the audit, undocumented practice is indistinguishable from absent practice. Where the organization relies on informal vigilance, the checklist should ask what evidence would exist if the supervisor who does it were hit by a bus.

Clause 10: Improvement

34. Are Nonconformities and incidents identified, controlled, and corrected?

35. Is Root Cause analysis proportionate to the incident, or does every investigation stop at human error?

36. Are corrective actions verified for effectiveness before closure?

37. Is there evidence of continual improvement, or does the improvement log only fill before audits?

What actually happens: reporting works and close-out does not. Incident forms get filed; the corrective action happens in the field and is never documented, so the system cannot learn. One operations VP, reviewing the pattern, noted it was exactly what their quality-side nonconformance process looked like before it was fixed. The near-miss reporting layer has its own trap: quota systems. A client-mandated minimum of observation cards per worker per day produced, at one company, reports about a colleague picking up a broom. Volume targets convert a safety signal into paperwork. The audit question is whether near-miss reports describe genuine precursor events and whether any of them have produced a system change.

Red Flags That Signal Deeper Issues

Beyond clause-level findings, these patterns predict an OH&S system that will fail its next external audit:

The safety manual has become a landfill. One company's HSE manual had grown into hundreds of pages of policies, procedures, and duplicated sections with conflicting wording; the safety lead's own description was that sections of it were things the company did not do, and no one, including the safety lead, understood all of it. Documentation nobody reads is not control, it is liability.

Every question routes to one person. If only the safety coordinator can answer anything about the system, it belongs to them, not the organization. This is the one-person-show pattern, and it is the single strongest predictor that worker consultation (Clause 5.4) is a document, not a practice.

The same finding appears year after year. Hazard identification scoring lowest year after year at one company was not an audit problem; it was a system that produced the same gap on schedule. A recurring finding is not evidence of a bad auditor. It is evidence the corrective action never reached the root cause.

Stop work authority exists and has never been used. If no worker has ever stopped a job, the policy is either unneeded or unexercised. At one company, clients asking "why didn't they exercise stop work authority in this case?" after incidents became the driver for quizzing every new hire on it during orientation. The audit question: when was it last exercised, and what happened afterward?

Incentives drive volume instead of quality. Gift cards for observation cards, daily quotas, leaderboards: any of these converts genuine hazard reporting into junk reports within a month. The safety lead who shut down an incentive proposal at one company put the reasoning plainly: if you have to bribe people to work safe, they are in the wrong place. Look instead for a small target tied to genuine catches, and evidence that reports get feedback.

Making the Checklist Work for You

Customize this to your operation: add questions for your known risk areas, delete what does not apply to your scope, and let each audit cycle refine the next. The most valuable questions in any audit are the ones that end with a worker explaining a hazard in their own words, because that is the only evidence that the system reached the people it exists to protect.

If your team is building audit capability in-house, or you want an experienced outside auditor to run the Internal Audit program, we provide both. For a self-assessment before the audit, the free ISO 45001 gap analysis tool scores your starting point against the clause structure above. And when you want help turning findings into a working system, the ISO 45001 consultants at Kaizen ISO Consulting offer a free initial consultation.