An ISO 45001 internal audit checklist that only asks "do you have a document for this?" tells you almost nothing about whether the occupational health and safety management system actually works on the shop floor. A process-based ISO 45001 internal audit checklist instead traces how leadership commitment, hazard identification, risk control, competence, emergency preparedness and corrective action connect in practice, and it tells the auditor exactly what evidence to sample at each step. This guide organizes the audit by OHSMS process area, gives interview questions, evidence-sampling guidance and typical nonconformity wording for each, and closes with a consolidated checklist you can adapt for your own audit programme.
A process-based ISO 45001 audit follows a hazard or a work activity end to end — from how it was identified, through the controls applied, to the monitoring and corrective action that follows — rather than checking each management-system clause in isolation. This exposes gaps between what a procedure says and what actually happens at the point of work.
Plan a process-based ISO 45001 audit
Start audit planning from the organization's own risk register and its highest-consequence activities, not from a generic clause-by-clause template. Identify which processes will be sampled this cycle, which sites or shifts will be covered, and which roles will be interviewed. A process-based plan groups audit questions around how work actually flows — planning, execution, monitoring, review — so a single audit trail can surface a gap that a document check alone would miss. Build the audit programme so that, across a full cycle, every OHSMS process area gets audited at a frequency that reflects its risk level and its history of findings, and record that risk-based rationale in the audit programme itself.
Two inputs improve a process-based plan more than any checklist template: last cycle's finding history and current incident/near-miss trends. If lifting operations produced three findings last year and a recent near miss, the current audit should deliberately trace a lifting activity end to end rather than treating every process area as equally due for attention. Assign each planned audit a defined scope statement (site, process, shift, time window) before the audit starts, and share it with the process owner in advance so the right records and personnel are available on the day. A sampling plan drafted at this stage — which records, how many, from which period — keeps the audit efficient and gives the auditor a documented basis for the conclusions reached.
| Planning element | What to decide before the audit |
|---|---|
| Scope | Site, process area, shift and time window to be covered |
| Sampling basis | Number of records/activities to sample and the period they are drawn from |
| Interview list | Roles to interview, including workers independent of their supervisor |
| Trigger inputs | Prior findings, incident trends, changes since the last audit |
| Evidence access | Records, systems and areas the auditor needs access to on the day |
Audit context, leadership and worker participation
This process area tests whether top management's stated commitment to the OHSMS is visible in resourcing, decision-making and day-to-day behaviour, and whether workers are genuinely consulted rather than just informed. Sample evidence should include management review minutes, safety committee records, worker consultation logs, and records of how worker feedback changed a procedure, a risk assessment or a budget decision.
Context is also where the audit checks that the organization has correctly scoped its OHSMS — which sites, activities and workers (including contractors and temporary staff) are covered, and whether interested-party requirements such as client contractual clauses or landlord obligations have been identified. A scope statement that excludes a category of workers or an activity without a documented rationale is worth probing, since it can quietly remove real hazards from the management system's coverage.
Interview questions for leadership and workers
Ask leaders how they know the OHSMS is working, what safety information reaches them and how often, and what they last changed because of worker input. Ask workers separately — away from their supervisor — whether they know how to report a hazard, whether they have seen action taken on something they raised, and whether they were consulted before a recent process or equipment change. A typical nonconformity here reads: "Worker participation arrangements exist on paper, but sampled workers on [shift/area] could not describe how to raise a hazard or cite an example of resulting action."
Audit hazard identification and OH&S risks
This process area verifies that hazard identification is systematic, current and covers routine, non-routine and emergency situations, and that risk assessments genuinely drive control selection rather than being completed after the fact to justify an existing control. Evidence to sample includes hazard registers, risk assessment records, change records that triggered a reassessment, and evidence that the hierarchy of controls was actually considered rather than defaulting straight to PPE.
Trace a hazard through controls and monitoring
Pick two or three significant hazards from the register and trace each one forward: was the risk assessment reviewed at the stated frequency, does the control described in the assessment match what is physically installed or practiced at the workplace, and does monitoring data (inspections, permits, incident records) confirm the control is functioning as intended? This forward trace is usually where the gap between documented intent and operational reality shows up. A typical nonconformity: "The risk assessment for [activity] specifies [control], but the control observed at the workplace during the audit did not match the documented control, and no interim reassessment was recorded."
Audit legal and other requirements
This process area checks that the organization has a working method for identifying which OSH legal and other requirements apply to it, that those requirements have been translated into workplace obligations, and that compliance is periodically evaluated rather than assumed. For India-based sites, sample the applicable OSH central/state obligations separately from the ISO 45001 process check itself; for GCC operations, sample local legal and client requirements including, where applicable, ADOSH-SF compliance obligations.
Compliance evaluation
Ask for the record of the last compliance evaluation, who performed it, what method was used, and what happened to any gaps it found. A legal register alone is not evidence of compliance evaluation — the auditor needs to see that someone actually checked current practice against each obligation and closed the gaps found. A typical nonconformity: "A legal register exists and is current, but no record of periodic compliance evaluation against the register was available for sampled obligations."
Audit objectives, competence and communication
Sample OH&S objectives against SMART criteria in practice — are they measurable, is progress tracked, and does anyone act when an objective is off track? For competence, sample training records against actual job risk exposure: does a confined-space entrant have current confined-space competence evidence, does a forklift operator have a current authorization record? For communication, check that safety-critical information flows both up (worker to management) and down (management to worker) and that records exist for both directions, including for contractors and visitors where relevant.
Objectives, competence and communication are frequently audited superficially because the records look complete at a glance; the process-based test is whether they change behaviour. Ask to see one objective that was missed and what happened next — a target that is quietly rolled over every year without consequence is a weak process, even if the tracking spreadsheet itself looks tidy. For competence, cross-check a sample of high-risk roles (confined space, work at height, hot work, crane operations) against training and authorization records rather than sampling low-risk roles where gaps are less consequential. For communication, verify that a recent safety alert or lesson-learned bulletin actually reached the shift it was intended for, using toolbox-talk attendance records or read-and-understood acknowledgements as evidence, not just proof that the bulletin was issued centrally.
Audit operational planning and control
This is usually the largest process area in a manufacturing or construction audit. Sample permit-to-work records, lockout-tagout records, management-of-change records, and evidence that operational controls specified in risk assessments are actually the controls in use. Check that change management was triggered for recent process, equipment or organizational changes and that the resulting risk assessment updates are traceable.
Contractors, procurement and outsourced work
Sample contractor prequalification records, site induction records, and evidence that contractor-specific hazards were assessed and controlled before work started, not retrospectively. For outsourced processes and purchased equipment, check that OH&S requirements were communicated to the supplier or contractor and that acceptance evidence — inspection, commissioning, handover records — confirms the requirement was actually met. A typical nonconformity: "Contractor X commenced work on [date] before the sampled induction and permit records show completion of the required site-specific hazard briefing."
Audit emergency preparedness
Sample the emergency response plan against the hazards actually present on site, drill records against the plan's stated frequency, and evidence that lessons from drills or real emergencies were fed back into the plan. Interview a sample of workers, including night-shift and contractor personnel, on whether they know the emergency assembly point and their role in an emergency. A typical nonconformity: "The emergency drill record for [date] shows a drill was conducted, but no post-drill review or corrective action record exists for the gaps observed during the drill."
Pay particular attention to scenarios that are rarely drilled but plausible for the site — a chemical release rather than only fire, a confined-space rescue, or an emergency during a shutdown when normal staffing levels are reduced. A drill programme that only ever exercises the same fire-evacuation scenario each year gives limited assurance that the organization can respond to its actual highest-consequence hazards, and this gap is worth raising even where the drill records themselves are technically complete.
Audit monitoring, incidents and corrective action
Sample incident and near-miss records against the site's actual operational activity to test under-reporting, then trace a sample of investigations through root-cause analysis to corrective action closure and effectiveness review. Sample monitoring and measurement records — inspections, exposure monitoring, equipment checks — against the frequency the organization itself has committed to. A typical nonconformity: "Corrective action CAR-[number] was closed on [date] based on completion of the stated action, but no evidence of effectiveness verification was recorded before closure."
Under-reporting is one of the harder gaps to evidence directly, but it usually leaves indirect traces: a site with active production and no near-miss reports for several months, first-aid records that do not appear anywhere in the formal incident log, or a marked mismatch between verbal accounts from workers during interviews and what the records show. Where the audit trail suggests under-reporting, document the indirect evidence carefully and raise it as a finding on the reporting culture and process, rather than trying to reconstruct individual unreported events.
Audit management review and continual improvement
Sample management review minutes against the inputs the organization is expected to consider — audit results, incident trends, compliance evaluation outcomes, worker feedback and objective performance — and check that outputs (decisions, resource commitments, changes to objectives) are recorded and subsequently tracked to completion. A management review that only records attendance and a generic "safety is good" summary, without evidence that the stated inputs were actually discussed, is a common and legitimate finding.
Continual improvement is easiest to audit by tracing a specific example forward: pick one improvement opportunity raised in the previous management review or a previous internal audit, and follow it through to a resourced action, a completion date and a measurable change in performance. If the organization cannot produce at least one such example across a full audit cycle, that itself is worth raising as a finding on the effectiveness of the improvement process, independent of whether individual corrective actions were closed on time.
Sampling, findings and report quality
Audit quality depends as much on how the audit was sampled and how findings were written as on which processes were covered. A defensible internal audit programme documents its sampling rationale, grades findings consistently, and tracks every finding to verified closure.
Finding grading and objective evidence
Grade findings consistently — major nonconformity, minor nonconformity and observation are common gradings — based on defined criteria such as whether a systemic failure exists, whether a legal or client requirement is breached, or whether the gap is an isolated lapse. Every finding must be written against objective evidence: what was seen, heard or read, where, when and against which requirement, not an auditor's general impression. "Housekeeping needs improvement" is not a finding; "Combustible waste was observed accumulated against the electrical panel in Bay 3 at the time of audit, contrary to the site's own housekeeping procedure" is.
Follow-up and effectiveness
Track every finding through a corrective action, a target closure date, an owner, and — critically — an effectiveness check that confirms the root cause was actually addressed, not just that an action was completed. Findings that are closed on paper but recur at the next audit cycle usually indicate that the effectiveness check step was skipped.
Maintain a running follow-up register across audit cycles rather than treating each audit's findings as a separate list. A register that shows the same or a similar finding recurring in the same area across two or three cycles is itself diagnostic — it points to a systemic weakness in root-cause analysis or in how corrective actions are resourced, and should be escalated to management review as a pattern rather than closed quietly as three unrelated minor findings.
| Finding grade | Typical basis | Follow-up expectation |
|---|---|---|
| Major nonconformity | Systemic failure, or breach of a legal/client requirement | Immediate containment plus root-cause action with verified effectiveness |
| Minor nonconformity | Isolated lapse in an otherwise working process | Corrective action with a defined closure date and verification |
| Observation | Improvement opportunity, no current nonconformity | Tracked for consideration, no mandatory closure date |
| Process area | Primary evidence to sample | Typical interviewee |
|---|---|---|
| Leadership & worker participation | Management review minutes, consultation records | Site head, safety committee members, workers |
| Hazard identification & risk | Hazard register, risk assessments, change records | HSE officer, area supervisor, operators |
| Legal & other requirements | Legal register, compliance evaluation records | Compliance owner, HSE manager |
| Operational planning & control | Permits, LOTO records, MOC records | Shift supervisor, permit issuer, contractors |
| Emergency preparedness | Emergency plan, drill records, post-drill reviews | Emergency response team, workers |
| Monitoring & corrective action | Incident records, CAPA register, inspection records | Investigators, action owners |
| Management review | Review minutes, tracked decisions | Top management |
Before the full checklist below, if your last certification or gap assessment is more than a year old, or your internal audit findings keep repeating across cycles, it is worth having an external reviewer benchmark your programme; book an ISO 45001 gap assessment with Himaya Prevention, whose ISO 45001 & ISO 14001 consultation team runs both certification-readiness and internal-audit-quality reviews. Organizations that also want a structured second opinion on documented evidence can pair this with Himaya's broader safety audit service, and sites preparing for third-party audits under IS 14489 third-party safety audit can use the same process trace method described above.
ISO 45001 checklist
Use this consolidated, editable checklist as the working document for a process-based internal audit. Mark each item as conformant, minor nonconformity, major nonconformity, or not applicable, and attach the sampled evidence reference.
- Leadership commitment is visible in resourcing and decisions, not only in policy wording
- Worker consultation and participation arrangements produce traceable outcomes
- Hazard identification covers routine, non-routine and emergency situations
- Risk assessments are current, reviewed on trigger events, and drive the controls actually in place
- Legal and other requirements are identified, translated into obligations, and periodically evaluated
- OH&S objectives are measurable and tracked, with corrective action when off track
- Competence records match actual job risk exposure
- Operational controls (permits, LOTO, MOC) match what risk assessments specify
- Contractor and outsourced-work controls are applied before work starts, not retrospectively
- Emergency plans, drills and post-drill reviews are current and linked to actual site hazards
- Incident and near-miss reporting reflects actual operational activity, not under-reporting
- Corrective actions are tracked to verified effectiveness, not just task completion
- Management review covers all required inputs and its outputs are tracked to completion
- Findings are graded consistently and written against objective evidence
Frequently asked questions
How often are ISO 45001 internal audits required?
The organization sets its own internal audit programme and frequency based on the importance of the processes involved and the results of previous audits, rather than a single fixed interval applying to every process. Higher-risk processes and areas with recurring findings are typically audited more often than stable, low-risk ones.
Must every clause be audited annually?
No single clause needs to be audited every year as long as the full audit programme covers the entire OHSMS within a planned cycle, commonly across a certification cycle. What matters is that the programme's coverage and frequency decisions are documented and risk-based, not that every topic recurs annually.
Who can be an internal auditor?
An internal auditor needs to be competent in audit method and sufficiently independent of the process being audited to give an objective result — auditors should not audit their own work. Competence is usually built through recognized internal-auditor training combined with practical audit experience and, ideally, calibration alongside more experienced auditors.
What counts as objective evidence?
Objective evidence is verifiable information — records, observations, interview statements corroborated by other evidence, or measurement data — that supports a finding. An auditor's opinion or a general impression is not objective evidence; the finding must be traceable to something specific that was seen, read or heard during the audit.
How are findings graded?
Most organizations grade findings as major nonconformity, minor nonconformity or observation, based on criteria such as whether the gap is systemic, whether it breaches a legal or client requirement, and whether it represents an isolated lapse versus a pattern. Grading criteria should be defined in the audit procedure and applied consistently across auditors.
If the constraint is not knowing what to ask but keeping audit programmes, findings and CAPA traceable across sites and cycles, HSEFQ.com runs audit planning, digital checklists, findings and CAPA in one place — request an audit-management demo, or write to info@himpre.com to discuss an ISO 45001 internal-audit programme review.
0 Comments