ISO 45001 clause 9.2: test OH&S implementation through internal audit
ISO 45001:2018 clause 9.2 requires internal audits at planned intervals to provide information about system conformity and effective implementation and maintenance. Audits examine the organisation’s own requirements, including its policy and objectives, and the standard’s requirements. The purpose is to test the system through evidence, not merely confirm that documents exist.
What clause 9.2 requires in practice
Clause 9.2 requires internal audits at planned intervals. Clause 9.2.1 gives the purpose: to show whether the OH&S management system meets the organisation's own requirements, including its policy and objectives, and the requirements of the standard, and whether it has been put into effect and kept up effectively.
Clause 9.2.2 turns this into a programme. The organisation plans, establishes, implements and maintains one or more audit programmes covering frequency, methods, responsibilities, consultation, planning needs and reporting, taking account of how important the processes are and what earlier audits found. Each audit has defined criteria and scope. Auditors are chosen and audits conducted so that the process is objective and impartial. Results go to relevant managers, and relevant results to workers, representatives where they exist and other interested parties. Action follows on nonconformities, and evidence of the programme and results is retained.
Connect purpose and programme
Clause 9.2.1 establishes the audit’s general purpose. Clause 9.2.2 addresses the programme, including frequency, methods, responsibilities, consultation, planning and reporting. It also addresses criteria, scope, impartiality, communication of relevant results and action on nonconformities and improvement.
The programme considers process importance and previous audit results. A schedule is useful, but it is not the whole programme. Suitable methods and access to relevant workers and activities are needed to answer the audit questions.
Why clause 9.2 matters to the business
Internal audit is the organisation's own independent look at whether the system works, carried out while there is still time to fix problems quietly. A good programme finds control gaps, weak handovers and ignored actions before an incident or an outside assessor does. It also gives top management information that managers closest to the work may be reluctant to raise. When results reach workers, audits strengthen trust that concerns lead to action. Businesses that treat audit as a paperwork exercise miss this value and tend to receive surprises at independent assessment. Impartial, evidence-based audit also helps compare sites fairly and shows customers that the system is checked by more than its owners.
How to implement clause 9.2
Build the programme around risk and learning, not a calendar alone. A sensible sequence follows. Make sure the programme can reach evidence about real work as well as records, and avoid treating a favourite checklist or template as the requirement, since the standard requires results, not a particular format.
- Define what the audits must tell you, using the purposes in clause 9.2.1, and set the criteria from both your own requirements and the standard.
- List processes and interfaces, rank them by importance and past findings, and plan coverage accordingly.
- Consult workers when planning, since they know which shifts, tasks and interfaces deserve attention.
- Choose auditors who are competent in the system and the activity, with no stake in the work being examined.
- Plan each audit so that records, interviews and observation of real work are all possible.
- Report to managers and communicate relevant findings to workers and their representatives in usable form.
- Route nonconformities into corrective action, check closure for effectiveness and use results in the next programme.
Follow evidence through actual work
An audit can trace a reported hazard into assessment, control selection, worker involvement, implementation and evaluation. Another sample may examine a contractor interface or management decision. Interviews, records and observation can provide complementary evidence.
Distinguish a requirement from an auditor’s preferred method. A finding should explain the relevant criterion and the evidence supporting the conclusion. A missing favourite template is not automatically a nonconformity if the organisation fulfils the requirement through another suitable arrangement.
Two illustrative audit trails
A manufacturer’s audit follows a recent maintenance task involving contractor workers. It examines how hazards and interfaces were assessed, what requirements were communicated and whether the planned coordination occurred. Workers’ accounts help test the records. The auditor does not accept a contractor approval certificate as proof that the actual task was controlled.
A BPO business audits its response to work-related concern reports. The sample follows a report through assessment, decision, communication and follow-up. The audit checks whether workers can use the process and whether the reported issue was addressed. A helpdesk status marked closed is not sufficient without understanding what closure meant.
Preserve impartiality and communicate results
Select auditors and conduct the work to support objectivity and impartiality. Competence needs to match the system and the activities examined. Internal or external personnel can perform the organisation’s internal audit, provided the arrangement meets those needs.
Results go to relevant management, and relevant findings are communicated to workers, representatives where they exist and other relevant parties. This worker-facing communication is important: an audit report stored only in a management folder may not provide the information needed for participation and improvement.
Evidence and common mistakes
Retain documented evidence of programme implementation and audit results. Records should show what was examined and concluded, with appropriate follow-up through the system. A checklist is a tool, not proof that an effective audit occurred.
Common weaknesses include auditing only the safety coordinator, omitting worker consultation from programme arrangements and reporting findings without a route for action. Another is presenting a successful internal audit as proof of legal compliance or guaranteed certification. The independent certification body makes its own decision, and compliance evaluation remains a distinct process.
Explore each numbered part
9.2.1 · define the purpose of an OH&S internal audit
The general internal-audit requirement examines whether the system meets both organisational and ISO requirements and works effectively. This guide explains how policy, objectives and actual work contribute to that judgement. It distinguishes evidence-based conclusions from personal preferences and shows why a document-only review or absence of reported incidents cannot answer every audit question.
9.2.2 · plan and deliver an impartial audit programme
An OH&S audit programme needs more than dates. Clause 9.2.2 covers methods, responsibilities, consultation, planning, reporting and appropriate attention to process importance and past results. This guide explains individual audit boundaries, impartiality, communication with workers and follow-up, showing how the programme can provide useful information rather than simply generate completed checklists.
Frequently asked questions
Can an external person perform an internal audit?
Yes, on the organisation’s behalf, with suitable competence, objectivity and scope.
Should workers receive audit information?
Relevant findings are communicated to workers and representatives where they exist, as well as other relevant parties.
Does an internal audit replace compliance evaluation?
No. It may contribute evidence, but the purposes and required conclusions are distinct.
Build an audit trail that tests prevention
Discuss OH&S internal-audit support with Sterling, including programme design and evidence preparation. The ISO 19011 Auditing Management Systems course develops relevant auditing principles. Effivity ISO & GRC automation software can be scoped to agreed audit processes. See evaluation and the directory.