ISO 45001 common mistakes: the ten that fail audits, where auditors find them on site, and the fix for each

How ISO 45001 audits fail in practice

An OH&S certification audit rarely ends with a verdict of failure. Either the certification body's Stage 1 readiness review finds the system not yet operating and Stage 2 moves back, or Stage 2 raises major nonconformities and no certificate is issued until each is verified as resolved. A major still open six months after Stage 2 means Stage 2 is repeated.

What sets ISO 45001 apart is where the evidence sits: the rules for OH&S audits require the auditor to see the system during operational activities, including a tour of the workplaces.

In our experience, the ten mistakes below cause most delayed certificates. The nonconformities guide covers grading and closure; the Stage 1 and Stage 2 guide the audit days.

Mistakes 1 to 3: hazards, leadership and workers

1. Risk assessments that describe a generic workplace

• Why: the register was bought, copied from a sister site or written in an office, so it lists typical hazards, not your tasks, and misses non-routine work such as maintenance.
• In the audit: on the tour the auditor stops at a task, asks the operator what could hurt them, then looks for it in the register. A missing activity, or controls that differ from those in use, puts hazard identification in question.
• Fix: assess each activity with the people who do it, and revisit the assessment when the work changes. The hazard identification guide sets out the method.

2. Safety belongs to the safety officer

• Why: certification is delegated to the HSE function, and line managers treat safety as its job.
• In the audit: the standard makes top management accountable for preventing injury and ill health. When a production manager cannot state the objectives, or a supervisor defers every question to the safety officer, leadership evidence is thin.
• Fix: top management sets and reviews the objectives; each supervisor can explain the hazards and controls in their own area.

3. Worker participation that exists only in minutes

• Why: a committee was formed for the certificate and is attended mainly by managers.
• In the audit: clause 5.4 expects non-managerial workers to be consulted and to take part. Auditors ask workers how they report a hazard and what happened last time. "Nothing happened" is the finding.
• Fix: hazard reports and committee actions that reach a visible outcome, with workers involved in risk assessment and investigation.

Mistakes 4 to 6: controls, legal duties and contractors

4. Reaching for PPE before anything else

• Why: gloves and signs are quick; elimination and engineering controls need budget and design.
• In the audit: clause 8.1.2 sets an order: eliminate, substitute, engineer or reorganise, administrative controls including training, then adequate PPE. An assessment offering only PPE and procedures for a significant risk invites the question of why nothing higher was considered.
• Fix: record, for each significant risk, which levels were examined and why the chosen control was selected.

5. A legal register nobody has evaluated

• Why: the register was compiled once as a list of laws and never assigned or checked against practice.
• In the audit: the auditor picks an obligation that applies to you, such as a statutory inspection, and asks for the last evaluation of compliance under 9.1.2. An out-of-date register, or none, is a frequent OH&S finding.
• Fix: a register by jurisdiction, each obligation with an owner and a dated evaluation. The legal register guide covers the method.

6. Contractors and agency workers left outside

• Why: they are on someone else's payroll, so their safety is treated as someone else's problem.
• In the audit: the standard counts anyone working under your control as a worker. Auditors ask contractors on site about their induction, their permit and who supervises them (8.1.4).
• Fix: prequalification, induction, permits and inspections applied to every contractor and agency worker. See the contractor management guide.

Mistakes 7 and 8: emergencies and incidents

7. Emergency plans that have never been tested

• Why: the plan was written for the document set, and drills disrupt production.
• In the audit: under 8.2 the auditor asks when the last drill ran, on which shift, what went wrong and what changed. A plan with no drill record, or lessons never applied, is a weak point.
• Fix: drills across areas and shifts, reviewed with those involved, and the plan updated when a gap shows.

8. Investigations that stop at "human error"

• Why: retraining the individual is the quickest close-out, and near misses go unreported.
• In the audit: the auditor reads a closed investigation and asks for the cause, whether workers took part and whether the risk assessment was revisited (10.2). The standard's incident definition includes events that could have caused harm, so an empty near-miss log raises questions.
• Fix: investigate with worker participation, reach the cause, change the control, and close the action only once it is shown to work.

Mistakes 9 and 10: internal checks and timing

9. An internal audit and review that miss half the operation

• Why: the internal audit covers head office on day shift, and the review is a deck of injury statistics with nothing decided.
• In the audit: the certification body checks that the programme reached every site and shift in scope, that nobody audited their own work and that findings were closed (9.2); sites with different activities and risks are not sampled. It then reads the review record for decisions (9.3).
• Fix: a programme covering every site and shift, and a review that records decisions with owners and dates. See the internal audit and management review guides.

10. Booking Stage 2 before the system has a history

• Why: a client's prequalification deadline sets the date, not the state of the system.
• In the audit: Stage 1 looks for internal audits and a management review already performed. With only weeks of inspections, drills and incident records, the process stops there, or Stage 2 finds too little to sample.
• Fix: plan backwards from the evidence: records from every activity, drills run, internal audit and review complete, findings closed. The timeline guide covers the operating period.

Shortcuts that leave the hazards in place

The pressure is real: a principal contractor wants the certificate before you start, and someone offers it in days. Each offer moves the ten mistakes rather than fixing them.

• The bought register. A generic set of risk assessments is mistake 1 delivered in a folder. The auditor tours your site, not the template's.
• The certificate without a site visit. An OH&S audit that never walked the workplace does not meet the rules for accredited certification. Our guides show how to verify a certificate and choose a certification body.
• The guaranteed date on the first call. Nobody can promise one before seeing your sites and records.

Our practice: a realistic range in the proposal, then a firm audit date once the gap analysis shows what has to change.

ISO 45001 common mistakes: questions buyers ask