ISO 45001 clause 9.2.1: define the purpose of an OH&S internal audit
ISO 45001:2018 clause 9.2.1 requires internal audits at planned intervals to determine whether the OH&S management system conforms to the organisation’s own requirements, including its policy and objectives, and to ISO 45001. Audits also provide information on effective implementation and maintenance. These questions define the work before a checklist is selected.
What clause 9.2.1 requires in practice
Clause 9.2.1 sets the purpose and rhythm of internal audit. The organisation runs audits on a planned schedule to find out about two matters. The first is conformity: with its own internal requirements for the OH&S system, among them the policy and objectives, and also with the requirements set out in ISO 45001. The second is effectiveness: whether the system is actually implemented and maintained.
The clause deliberately names the organisation's own commitments as audit criteria, so an arrangement the business has set for itself can be audited even if the standard does not demand it. It does not set an interval, leaving that to the programme addressed in clause 9.2.2. The output is audit information that supports a judgement about the system, based on evidence of use and upkeep, not only on whether documents exist.
Use the right requirements as criteria
The organisation’s own arrangements matter. If it has established a particular control, consultation process or review requirement, the audit can examine whether that requirement is fulfilled. Policy and objectives also provide relevant organisational direction and commitments.
Internal rules cannot replace the standard with a weaker expectation. Auditors need to understand both sets of requirements and distinguish them from optional methods. A preferred form, software feature or meeting format is not an ISO requirement simply because an auditor has used it elsewhere.
Examine operation and maintenance
A procedure can be well written yet poorly implemented. An arrangement that worked initially can deteriorate after staffing, equipment or service changes. The audit therefore needs evidence about actual use and continuing effectiveness, not only current approval dates.
Follow the relationship between intention, work and result. Ask what was planned, what happened, what evidence is available and how deviations were addressed. Worker accounts can reveal conditions missing from records. Sampling should be suitable for the audit’s purpose, with limitations understood.
Why clause 9.2.1 matters to the business
The difference between a system that conforms on paper and one that works at the workplace is where most harm hides. Clearly stating the audit purpose keeps the exercise accurate: it prompts auditors to ask whether commitments are kept, whether controls survived staffing or equipment changes, and whether results match the intention. For management it clarifies what an audit can and cannot prove, which prevents the false comfort of a clean report. For workers it signals that their own commitments from the policy and objectives will be tested. Audit information of this kind also strengthens management review, because decisions rest on observed operation. Customers value audit results that examine real practice.
How to implement clause 9.2.1
Start by agreeing what each audit is meant to conclude, then collect evidence that can support it. A practical route follows. Be clear in the audit plan about limitations of sampling and timing, so that conclusions are stated at the level the evidence supports, and so that no single clean result is taken as proof about the whole system.
- Gather the organisation's own requirements, including policy commitments and objectives, alongside the standard's requirements.
- Turn each into an audit question about intention, operation and result, so that evidence can be judged against criteria.
- Choose samples that suit the purpose, such as a recent task, a change or a concern, and state their limits.
- Plan to collect three kinds of evidence together: records, interviews with the people who do the work, and observation.
- Where little has yet happened, label the audit as a readiness check and plan a later one to examine real operation.
- Write findings that name the criterion and the evidence, without blame or speculation.
- Record how deviations were addressed and use them to adjust the planned intervals.
Two illustrative audit questions
A construction company requires coordination before trades begin overlapping activities. An audit examines a recent work period, the decisions made and workers’ understanding of the arrangement. If records were completed retrospectively without influencing the work, the auditor explores implementation rather than treating a signature as conclusive evidence.
A software business commits to a usable route for work-related concerns. The audit examines whether workers know the route, whether relevant reports receive competent assessment and whether outcomes are communicated. The existence of a policy statement alone does not establish that the commitment operates in practice.
Plan intervals that provide useful information
The requirement is for planned intervals, with the detailed programme addressed in clause 9.2.2. The standard does not impose an identical annual audit frequency on every process. Importance and previous results inform the programme, and practical access to meaningful evidence matters.
An audit conducted before any relevant work occurs may assess readiness but cannot establish all implementation outcomes. Define the objective accurately and plan later coverage where needed. Avoid presenting limited evidence as a conclusion about the entire system.
Evidence and common mistakes
Audit evidence and conclusions should be traceable to criteria. Programme implementation and results are retained under the following subclause. Findings should be clear enough for the organisation to understand the issue without speculation or unnecessary blame.
Common weaknesses include checking only document titles, using personal preferences as criteria and assuming no reported injury means effective prevention. Another is treating a clean audit as an absolute assurance. An internal audit is one evaluation process within the system, with its own scope and sampling limits.
Frequently asked questions
Are policy and objectives relevant audit criteria?
Yes. The clause expressly includes the organisation’s own requirements, including policy and objectives.
Can a document review prove all implementation?
No. Documents contribute evidence, but the audit needs suitable information about actual operation and maintenance.
Does every audit cover the whole system?
Individual audits can have defined scopes within a programme that provides the necessary information and coverage.
Improve the audit question before collecting evidence
Ask Sterling to review an OH&S audit approach against the actual processes and requirements. The ISO 19011 Auditing Management Systems course supports evidence-based practice. Effivity ISO & GRC automation software can be scoped to agreed audit needs. Continue through internal audit and the guide.