ISO 45001 internal audit: planning, conduct and reporting across every site and shift

What does ISO 45001 clause 9.2 require?

An ISO 45001 internal audit is your organisation's own structured check that the OH&S management system does two things: meets the standard and the arrangements you set for yourself, and actually operates and is kept up to date. Clause 9.2 splits into a general requirement (9.2.1) and the internal audit programme (9.2.2). The programme is where the real decisions sit: audit frequency, methods, responsibilities, planning and reporting, shaped by how important each process is and by what previous audits revealed.

For each audit you define the criteria and the scope. The auditors you pick, and the way the audit is run, must keep the process objective and impartial. Results go to the managers who can act on them, and they become an input to the management review in clause 9.3, which has its own guide. Anything nonconforming enters clause 10.2, incident, nonconformity and corrective action. Keep documented information that proves the programme ran and shows what it found.

What should an OH&S internal audit look at?

Safety systems fail in predictable places: a generic risk assessment, an unchecked permit, a contractor never inducted. Aim the audit there. The table maps the areas tested most often to the evidence that proves them.

Planning the programme across sites, shifts and contractors

ISO 45001 counts as a worker anyone doing work under your organisation's control, so the programme cannot stop at the payroll. A plant with night shifts, weekend agency labour and shutdown contractors has three risk pictures; an office-hours timetable sees one.

Build the programme from risk. Give more audit time to activities with high-severity hazards, areas with recent incidents or near misses, sites where the legal register changed, and any process altered under management of change. A low-hazard office may need one visit a year; a workshop with confined spaces or work at height may need two. Sites with different activities each need their own coverage.

Before initial certification, plan so that every site and every shift pattern in scope has been audited, and the findings acted on, with some weeks to spare before the certification body's Stage 2. Its auditors tour the workplaces themselves.

Who can audit: competence and independence

No named qualification is required. Internal auditors come under clause 7.2 like anyone whose work affects OH&S performance: the competence needed is determined, acquired through education, training or experience, and backed by documented evidence. For this standard that competence has two halves. One is audit technique; the other is enough OH&S knowledge to spot an unguarded machine, question an isolation and notice when the hierarchy of controls was skipped in favour of PPE.

Independence means the safety officer who wrote the permit-to-work procedure should not be the person who audits it. Trained supervisors can audit each other's areas, with an external auditor covering the safety function. Your certification body should never be that auditor: its accreditation rules treat internal audits for its own certified clients as a significant threat to impartiality.

ISO 19011, Guidelines for auditing management systems, is the reference text for method and for evaluating auditor competence. The current fourth edition, ISO 19011:2026, appeared in May 2026 and replaced the 2018 edition, adding guidance on remote auditing and digital tools. It is guidance, not a certifiable standard; its principles of independence and an evidence-based approach matter most here. Who needs which training is set out in the ISO 45001 training guide.

How to conduct the audit on the floor

Before the visit

Read the area's risk assessments, open permits, the last audit report and the recent incident log. Send the plan to the area manager with the criteria, the scope, the shifts to be covered and the records you intend to request.

Observe, then ask

Begin with the work, not the files. Watch a task under way and compare it with its method statement and risk assessment. Ask the operator about the main hazard, its control and what they would do if the job became unsafe. Clause 7.3 expects workers to know they can remove themselves from imminent and serious danger, so an answer that shows fear of doing so is a significant result.

Sample deliberately

Choose the samples yourself and spread them across shifts, crews and time: permits from day and night shifts, contractors who started this month and last quarter, inspections from each area. One traced thread, such as a near miss followed to the revised assessment and the control now on the floor, proves more than twenty ticked items.

Reporting, grading and following up findings

Each finding states the requirement, checkable evidence and the gap:

• Requirement: the permit-to-work procedure requires the issuer to verify isolation before a permit is signed for work on powered equipment.
• Evidence: of twelve electrical permits sampled across three shifts, four had no isolation verification signed, all four from the night shift.
• Gap: isolation is not verified before permits are issued on the night shift.

ISO 45001 sets no grading scale, so your audit procedure should adopt the certification body's terms: a major nonconformity affects the system's ability to achieve its intended results, a minor one does not, and an opportunity for improvement notes a better practice where nothing is wrong. An immediate danger seen during the audit is stopped and reported at once.

The report records scope, criteria, auditors, samples, findings and a conclusion, and reaches management promptly. Closure has two steps. The owner records the correction, the root cause and the corrective action; the auditor later confirms the action worked, for instance by sampling the next month's night-shift permits. How findings are graded and closed by the certification body is covered in the nonconformities guide.

In Effivity, audit schedules and findings sit beside the incident and non-conformance modules, so a finding moves straight into root cause and corrective action, with reminders when late. Effivity, used in 50+ countries, is included with the engagement, at no additional cost.

ISO 45001 internal audit: questions buyers ask