ISO 45001 clause 9.2.2: plan and deliver an impartial audit programme
ISO 45001:2018 clause 9.2.2 requires an audit programme covering frequency, methods, responsibilities, consultation, planning requirements and reporting. The programme considers process importance and previous audit results. It also establishes criteria and scope for each audit, objective and impartial conduct, reporting, communication of relevant findings and action on nonconformities and improvement.
What clause 9.2.2 requires in practice
Clause 9.2.2 describes the audit programme in six parts. The organisation plans, establishes, implements and maintains a programme that covers how often audits take place, the methods, responsibilities, consultation, planning requirements and reporting, and that takes account of process importance and the results of previous audits. For each audit it defines criteria and scope.
It selects auditors and conducts audits so that the process is objective and impartial. Results are reported to relevant managers, and relevant results to workers, workers' representatives where they exist and other relevant interested parties. The organisation acts to address nonconformities and continually improve OH&S performance, with reference to clause 10, and retains documented information as evidence of the programme and the results. A note points readers to ISO 19011 for guidance on auditing and auditor competence.
Plan coverage that reflects the system
Identify processes and interfaces that need examination to provide information on conformity and effectiveness. Consider which activities are important to OH&S outcomes and where earlier findings suggest weaknesses. An identical checklist applied to every department may miss the interactions that determine control reliability.
Include consultation in programme arrangements and connect with the wider worker-involvement requirements. Workers can help identify relevant conditions, shifts or interfaces that deserve attention. Consultation should inform planning rather than occur only after the audit dates and methods are fixed.
Why clause 9.2.2 matters to the business
A programme gives audit continuity and purpose. Without one, audits cluster around easy areas, important interfaces are missed and repeated findings go unexamined. Careful planning directs scarce audit time to the processes where failure would hurt most. Impartial auditors give management findings it can trust, and consulting workers when planning surfaces issues that managers may not see. Reporting results back to workers shows them that participation matters. The programme also lets the business demonstrate to customers and insurers that its checks are systematic, not occasional. When audit work is postponed repeatedly, the organisation loses information it needs for review, so a well-owned schedule is itself a safeguard.
How to implement clause 9.2.2
Treat the programme as a management tool that responds to risk and results. A workable approach follows. Where an audit has to be deferred, note the information gap that creates and decide how it will be covered, since silent postponement of important audits weakens the evidence available to management.
- Record the processes, sites and interfaces in scope, and rank them by importance and earlier findings.
- Set frequency and depth for each, and add focused audits where problems keep recurring.
- Include worker consultation in programme design and note how their input shaped coverage.
- Define criteria and scope for each audit, and decide which methods will reach records, people and the actual work.
- Appoint auditors who are competent and free of conflicts, using cross-functional or outside support where the organisation is small.
- Agree reporting routes to managers and to workers and their representatives, tailoring the information without removing findings.
- Track corrective actions to closure, review postponed audits for the information they leave missing, and keep programme and audit records.
Define scope, criteria and auditor arrangements
For each audit, define the boundaries and the requirements against which evidence will be evaluated. Make sure the methods can obtain relevant information from records, people and work. Access to the actual activity matters; a quiet office interview may not answer a question about a changing site interface.
Select auditors and conduct audits to ensure objectivity and impartiality. Consider competence and conflicts of interest. Small organisations may use cross-functional or external support, but no single staffing model is prescribed. The arrangement should permit an accurate evaluation of the evidence.
Two illustrative programme decisions
A manufacturer has repeated findings in maintenance coordination. Its programme gives the interface focused attention, including relevant shifts and contractor-worker information. The audit examines whether earlier actions changed the work. Another general interview with the safety coordinator would not provide the same evidence.
A BPO business introduces a revised concern-reporting process. The programme schedules an audit after enough experience exists to examine actual cases and worker understanding. Criteria include the organisation’s own arrangements and relevant standard requirements. The audit distinguishes whether the process was launched from whether it is functioning effectively.
Report, communicate and respond
Report audit results to relevant management. Communicate relevant findings to workers, representatives where they exist and other relevant interested parties. Tailor the information appropriately without losing the findings needed for participation and action.
Take action to address nonconformities and continually improve OH&S performance. Connect findings with the appropriate response process and evaluate action where required. A report that reaches management but produces no response to a clear unmet requirement leaves the programme’s practical value incomplete.
Required evidence and common mistakes
Retain documented information as evidence of programme implementation and audit results. A schedule, audit records and reports can work together, but the standard does not prescribe a particular software platform or checklist design. Evidence should show what was planned, performed and concluded.
Common weaknesses include omitting consultation, unclear audit criteria, auditors evaluating work without sufficient impartiality and findings kept only in a management folder. Another is repeatedly postponing important audits without considering the information gap created by the delay.
Frequently asked questions
Is consultation part of the programme?
Yes. It is expressly included in programme arrangements and connects with the broader worker-involvement requirements.
Must relevant findings reach workers?
Yes, including representatives where they exist and other relevant parties, as appropriate to the findings.
Can audits be combined with other systems?
Yes, if OH&S criteria, scope, competence, consultation and evidence remain adequately addressed.
Make the next programme useful to workers and management
Discuss OH&S audit-programme design with Sterling, including impartial delivery and evidence. The ISO 19011 Auditing Management Systems course provides relevant learning. Effivity ISO & GRC automation software can be scoped to agreed audit processes. See the audit overview and the directory.