ISO 45001 internal audit checklist

Has the organisation identified the internal and external issues that affect its ability to achieve the intended outcomes of its OH&S management system, and are these reviewed?

Evidence: Context analysis with review date, covering workforce, contractors, climate, technology and regulation

Has the organisation decided whether climate change is a relevant issue for its OH&S management system (for example heat stress, extreme weather), and recorded the reasoning?

Evidence: Context analysis naming climate change and the conclusion; link to hazard identification such as working in heat

Are workers and other relevant interested parties identified, with their needs and expectations, including climate-related requirements, and is it clear which have become legal or other requirements?

Evidence: Interested parties register including workers, contractors, regulators and neighbours; link to legal register

Is the scope documented, covering all activities, products and services under the organisation's control or influence that can affect OH&S performance?

Evidence: Scope statement; site list; certificate scope

Is the OH&S management system established with its processes and their interactions, and does it run in practice as described?

Evidence: Process map or manual; sample of records from each process

Can top management show overall responsibility and accountability for preventing work-related injury and ill health and for providing safe and healthy workplaces and activities?

Evidence: Interview with top management; safety leadership tours; decisions recorded in board or management minutes

Does top management make sure OH&S requirements are integrated into business processes and that the resources needed are available?

Evidence: Budget for OH&S; capex approvals with safety review; staffing of the HSE function

Does top management develop and promote a culture that supports the system, and protect workers from reprisals when they report incidents, hazards, risks and opportunities?

Evidence: Near-miss reporting rates; no-blame policy; worker interviews on whether they feel safe to report

Where health and safety committees exist, are they established and do they function, with top management support?

Evidence: Committee terms of reference; minutes; attendance; actions closed

Does the policy commit to safe and healthy working conditions, fulfilling legal and other requirements, eliminating hazards and reducing risks, continual improvement, and consultation and participation of workers and their representatives?

Evidence: Signed, dated policy checked against each required commitment

Is the policy documented, communicated within the organisation, available to interested parties, relevant and appropriate?

Evidence: Policy on notice boards in languages workers read; induction material

Are responsibilities and authorities for relevant roles assigned and communicated at all levels, and do workers at each level take responsibility for the aspects of the system they control?

Evidence: Organisation chart; job descriptions with OH&S duties; appointment letters

Are processes in place for consultation and participation of workers at all levels, with the time, training and resources needed, and timely access to clear information about the system?

Evidence: Consultation procedure; committee meetings held in working time; worker representative training

Has the organisation identified and removed or minimised barriers to participation, such as language and literacy, fear of reprisal, and failure to respond to worker input?

Evidence: Communications in workers' languages; feedback loop on raised concerns; worker interviews

Are non-managerial workers consulted on the needs of interested parties, the policy, roles, legal requirements, objectives, controls for outsourcing, procurement and contractors, monitoring, the audit programme and continual improvement?

Evidence: Committee minutes covering each topic; consultation records for the audit programme

Do non-managerial workers participate in hazard identification and risk assessment, actions to eliminate hazards, competence and training needs, communication, control measures, and incident investigation and corrective action?

Evidence: Risk assessment sign-off sheets with worker names; incident investigation team lists

When planning, does the organisation consider its context, interested parties, scope, hazards, legal requirements and risks to the system itself, and assess risks and opportunities before planned changes are made?

Evidence: Risk and opportunity register; pre-change risk assessments

Is there an ongoing, proactive process for hazard identification covering routine and non-routine activities and situations, how work is organised, social factors, workload and working hours, leadership and culture?

Evidence: Hazard identification procedure; risk assessments for non-routine tasks such as shutdowns; psychosocial risk assessment

Does hazard identification cover infrastructure, equipment, materials, the physical environment, human factors, past incidents, emergencies, and people including visitors, contractors and those near the workplace, as well as situations outside the organisation's direct control?

Evidence: Risk assessments for visitors, contractors and remote or lone work; incident data used as input

Is hazard identification repeated for actual or proposed changes in organisation, operations, processes and activities, and when knowledge about hazards changes?

Evidence: Reviewed risk assessments after changes; management of change records

Are OH&S risks assessed with a method defined for its scope, nature and timing so that it is proactive rather than reactive, taking account of the effectiveness of existing controls?

Evidence: Risk assessment methodology; completed assessments with residual risk ratings

Are OH&S opportunities identified, including adapting work, organisation and the work environment to workers, and eliminating hazards, along with other opportunities to improve the system?

Evidence: Opportunity register; ergonomic improvements; elimination projects

Has the organisation identified and got access to up-to-date legal and other requirements that apply to its hazards, risks and system, and determined how they apply and what needs to be communicated?

Evidence: Legal register with applicability; update mechanism; licences, permits and inspection certificates

Are actions planned to address risks and opportunities, legal requirements and emergency situations, integrated into the system and evaluated, considering the hierarchy of controls and outputs from the system?

Evidence: Action plans traceable to the risk register and legal register

Are OH&S objectives set at relevant functions and levels, consistent with the policy, measurable or capable of performance evaluation, monitored, communicated and updated, taking account of worker consultation?

Evidence: Objectives register with targets, leading and lagging indicators

For each objective, is it defined what will be done, with what resources, who is responsible, by when, how results are evaluated and how the actions fit into business processes?

Evidence: OH&S programmes; progress reports

Are the resources needed to establish, implement, maintain and improve the system determined and provided?

Evidence: Budget; HSE staffing; PPE and safety equipment availability

Are competence needs defined for workers whose work affects OH&S performance, including the ability to identify hazards, and are workers competent and trained, with training effectiveness evaluated?

Evidence: Competence matrix; training records for high-risk tasks (working at height, confined space, lifting); authorisation cards

Are workers aware of the policy and objectives, their contribution, the consequences of not conforming, incidents and investigation outcomes relevant to them, the hazards and risks of their work, and their ability to remove themselves from imminent and serious danger without undue consequences?

Evidence: Worker interviews on the right to stop work; toolbox talk records; incident lessons shared

Are internal and external communications planned (what, when, with whom, how), considering diversity such as gender, language, culture, literacy and disability, and the views of external interested parties?

Evidence: Communication matrix; signage and briefings in several languages

Is OH&S information communicated across levels and functions, including changes to the system, and do communications enable workers to contribute to improvement?

Evidence: Toolbox talks; safety alerts; notice boards; suggestion records

Is relevant OH&S information communicated externally as established and as legal requirements demand, for example to authorities, contractors and visitors?

Evidence: Incident notifications to authorities; contractor briefings; visitor induction

Does the system include the documented information required by the standard and the documented information the organisation has decided it needs?

Evidence: Master list of documents and records

Are documents identified, in a suitable format and media, and reviewed and approved before issue?

Evidence: Document control procedure; approval history

Is documented information available where needed, protected, and controlled for distribution, access, storage, changes and retention, including external documents?

Evidence: Spot checks of procedures at the workplace; retention schedule; health surveillance records secured

Are processes planned and controlled with operating criteria, implemented in line with those criteria, and adapted to workers? At multi-employer workplaces, is the system coordinated with the other organisations?

Evidence: Safe systems of work; permit-to-work records; site observation; coordination meetings with other employers

Are hazards eliminated and risks reduced using the hierarchy of controls: elimination, substitution, engineering controls and reorganisation of work, administrative controls including training, then personal protective equipment?

Evidence: Risk assessments showing higher-order controls considered first; machine guarding; PPE as last resort

Is there a process for planned temporary and permanent changes (new products, processes, equipment, work locations, workforce, legal requirements, knowledge of hazards), and are the consequences of unintended changes reviewed?

Evidence: Management of change register; pre-change risk assessments; post-change reviews

Are procurement processes controlled so that purchased products and services, such as chemicals, equipment and services, conform to the OH&S management system?

Evidence: Purchasing specifications with OH&S criteria; safety data sheets obtained before purchase; equipment pre-use checks

Are hazards from contractors' activities, and from the organisation's activities to contractors' workers, identified and controlled, with OH&S criteria used to select contractors and contractors' compliance monitored?

Evidence: Contractor prequalification; contract OH&S clauses; contractor induction; site inspections of contractor work

Are outsourced functions and processes controlled, consistent with legal requirements and the intended outcomes of the system, with the type and degree of control defined?

Evidence: Outsourcing contracts; monitoring of outsourced services such as security or transport

Has the organisation planned its response to emergencies, including first aid, and provided training on the planned response?

Evidence: Emergency response plan; trained first aiders and fire wardens; emergency equipment inspection records

Is the response capability tested and exercised periodically, evaluated and revised, including after drills and real events, and is relevant information communicated to workers, contractors, visitors, emergency services and authorities?

Evidence: Drill records and debriefs; revised plans; communication with civil defence and neighbours

Has the organisation decided what to monitor and measure, including the extent to which legal requirements, hazards, objectives and operational controls are met, the methods, criteria and timing, and does it retain the results?

Evidence: Monitoring plan; inspection records; workplace exposure monitoring; health surveillance; KPI reports

Is monitoring and measuring equipment calibrated or verified and used and maintained as appropriate?

Evidence: Calibration records for gas detectors, noise meters and lifting equipment test instruments

Is compliance with legal and other requirements evaluated at set frequencies, with action taken where needed, and does the organisation keep knowledge of its compliance status?

Evidence: Compliance evaluation records; third-party inspection certificates; actions on gaps

Are internal audits carried out at planned intervals to check that the system conforms to the organisation's own requirements and the standard and is effectively implemented and maintained?

Evidence: Audit reports covering the full scope over the cycle

Does the audit programme consider the importance of processes and previous results; are auditors objective and impartial; and are relevant results reported to workers and their representatives as well as to management?

Evidence: Audit programme with worker consultation; auditor independence; communication of results to the safety committee

Does top management review the system at planned intervals, considering previous actions, changes in context, legal requirements and risks, the extent objectives were met, incidents and corrective actions, monitoring and compliance results, audits, consultation and participation, risks and opportunities, and resources?

Evidence: Management review minutes checked against each required input

Do the outputs include decisions on the system's suitability, improvement, changes, resources and integration with business processes, and are the outputs communicated to workers and their representatives?

Evidence: Minutes with decisions and owners; evidence of communication to the workforce

Does the organisation determine opportunities for improvement and act on them to achieve the intended outcomes of the system?

Evidence: Improvement projects; trends in leading and lagging indicators

Are incidents and nonconformities reported, investigated in a timely way with the participation of workers, and are root causes determined?

Evidence: Incident register including near misses; investigation reports with root cause; worker involvement

Are corrective actions decided using the hierarchy of controls, risks reassessed before action, effectiveness reviewed, and the system changed where needed, with records retained?

Evidence: Corrective action log; effectiveness checks; updated risk assessments

Does the organisation continually improve the system by enhancing OH&S performance, promoting a supportive culture, encouraging worker participation and communicating the results to workers?

Evidence: Year-on-year performance trends; culture survey results; results shared with the workforce