ISO 45001 Clause 9: Evaluate Performance and Compliance
ISO 45001:2018 clause 9 requires the organisation to evaluate OH&S performance and system effectiveness. Monitoring, compliance evaluation, internal audit and management review provide different kinds of information. Together they should show what is working, where obligations or controls need attention and which decisions management must make.
What clause 9 requires in practice
Clause 9 sets out how the organisation finds out whether its OH&S system is working, through four connected activities. Clause 9.1.1 requires monitoring, measurement, analysis and performance evaluation. Clause 9.1.2 requires a separate process for evaluating compliance with legal and other requirements. Clause 9.2 requires internal audits at planned intervals. Clause 9.3 requires top management to review the system at planned intervals for continuing suitability, adequacy and effectiveness.
Each activity answers a different question. Monitoring asks how performance and controls are doing; compliance evaluation asks whether duties are being met; audit asks whether the system conforms and is effectively implemented; management review asks what leadership will decide as a result. The outputs are evaluated results, audit findings and management decisions that feed clause 10, with retained information in each area.
Why clause 9 matters to the business
Without accurate evaluation, an organisation learns about weaknesses from incidents, regulators or customers. Clause 9 gives leaders an earlier and cheaper way to learn. It also protects them from misleading comfort: a quiet injury record, a completed inspection or a favourable dashboard can all hide a failing control. Reliable evaluation lets management direct resources to the places that need them, defend decisions with evidence and show customers and insurers that prevention is managed rather than assumed. For groups operating across sites, shared evaluation methods allow fair comparison while still respecting local conditions. It is also the section auditors rely on to judge whether the system has really become part of how the business is run.
How to implement clause 9
Design the four activities as one evaluation cycle, so findings in one place reach the others. A practical outline follows. Keep the cycle accurate by testing conclusions against the work itself, and by writing down what each result can and cannot show, so that management does not read more certainty into the numbers than the evidence supports.
- Decide which questions leadership needs answered about hazards, controls, duties and objectives, and choose measures that answer them.
- Set methods, criteria and timing for monitoring, and define how results are analysed and who receives them.
- Establish a separate compliance evaluation that links each significant applicable requirement to evidence and an accountable evaluator.
- Plan an audit programme that gives more attention to important processes and past weak spots, and includes worker consultation.
- Prepare management review inputs as interpreted evidence, not raw totals, and make sure top management is present for the decisions.
- Route findings into corrective action and improvement, and tell workers the relevant results.
- Keep the records each activity needs and check that definitions stay consistent across sites.
9.1.1: decide what evidence answers the question
Determine what to monitor and measure, including relevant requirements, activities linked to hazards and risks, progress towards objectives and control effectiveness. Establish methods, criteria, timing and communication of results. Evaluate OH&S performance and the effectiveness of the system, rather than simply publish the collected numbers.
Appropriate equipment needs calibration or verification as applicable, suitable use and maintenance. Retain relevant results and equipment information. The standard does not prescribe one set of indicators. Select measures that reflect the organisation's risks and intended outcomes, and understand their limitations.
Illustrative manufacturing example: few incidents, unresolved controls
A hypothetical factory reports no recent injury but has recurring overdue actions on a significant operational control. Management should not infer that the control is effective solely from the absence of recorded harm. It examines relevant observations, completion evidence, worker feedback and the reasons for delay.
The decision may require resources, a revised plan or further competent evaluation. Useful evidence connects the concern to management action and later review. This example shows why outcome statistics and information about control operation need to be interpreted together; it does not establish a universal leading-indicator formula.
9.1.2: evaluate actual compliance status
The organisation determines the frequency and methods for evaluating compliance with legal and other requirements, carries out evaluation, takes action where needed and maintains an understanding of its status. Results require retained documented information. The evaluation should address the requirements that apply to the organisation's hazards and activities.
A list of laws demonstrates identification, not necessarily fulfilment. A practical approach links a requirement to relevant evidence and an accountable evaluator with appropriate capability. Where interpretation is uncertain, obtain suitable specialist advice. Certification and external consulting do not guarantee legal compliance or replace the organisation's duties.
9.2: use internal audit to examine implementation
Internal audits at planned intervals evaluate conformity with the organisation's own requirements and ISO 45001, as well as effective implementation and maintenance. The programme addresses frequency, methods, responsibilities, consultation, planning and reporting, considering process importance and previous results.
Define criteria and scope for each audit and select auditors to support objectivity and impartiality. Report results to relevant managers and relevant results to workers, representatives where they exist and other relevant parties. Act on nonconformities and improvement needs. Preserve evidence of the programme's implementation and audit results.
Illustrative BPO example: following a concern through the system
A fictional BPO business audits its workplace-concern process. The auditor samples a concern from a remote team, checks how it was assessed and follows the decision through implementation and feedback. Interviews include people who use the route, rather than only its central administrator.
The record shows the concern was marked complete when an email was sent, although the receiving owner had not accepted responsibility. The finding identifies the requirement and objective evidence, then the organisation evaluates and corrects the weak handover. The audit is useful because it tests operation, not because it produces a predetermined number of findings.
9.3: make management review a decision process
Top management reviews the system at planned intervals for continuing suitability, adequacy and effectiveness. Inputs include previous actions, changes in context and requirements, policy and objectives, performance trends, compliance evaluations, audits, worker consultation and participation, resources, communications and improvement opportunities.
Outputs include decisions on improvement, changes, resources, necessary actions, integration with business processes and strategic implications. Relevant outputs reach workers and representatives where they exist, and results are retained. A slide deck of statistics is not enough if no one can explain the decisions and follow-up it produced.
Evidence and interpretation mistakes
An auditor may compare a performance conclusion with its source data, a compliance evaluation with the relevant requirement, or a management decision with implementation. Avoid changing definitions without explaining the effect, presenting incomplete information as certainty or measuring success through fewer reports when reporting confidence is unclear.
For international groups, keep common definitions where useful and explain meaningful differences between sites. Combining incomparable measures can obscure important local issues. Central review should enable action where the work and responsibility sit.
Explore each numbered part
9.1 · evaluate prevention and compliance with evidence
OH&S evaluation needs evidence about prevention, controls and fulfilment of requirements. Clause 9.1 combines general performance evaluation with a distinct compliance-evaluation process. This guide explains how to interpret indicators and obligation evidence together without treating a low incident count, a completed inspection or a positive audit as a universal statement that work is safe.
9.2 · test OH&S implementation through internal audit
Internal audit examines whether the OH&S system meets its requirements and operates effectively. Clause 9.2 connects that purpose with programme planning, consultation, impartiality, reporting and response. This guide explains meaningful evidence trails and worker-facing results, showing why document checks alone cannot establish implementation and why an internal audit is not a certification decision.
9.3 · make management review drive OH&S decisions
Management review brings worker experience, performance evidence and changing requirements into leadership decisions. Clause 9.3 specifies the inputs, conclusions and outputs needed to keep the OH&S system suitable, adequate and effective. This guide explains the full review cycle, including communication of relevant outputs to workers, without treating a presentation or attendance record as sufficient evidence.
Frequently asked questions
Does ISO 45001 require a lost-time injury rate?
It requires suitable monitoring and evaluation, but does not mandate that particular indicator. Choose information that supports meaningful assessment of performance and controls.
Is an internal audit the same as compliance evaluation?
No. Their purposes differ, although evidence can overlap. Ensure both requirements are addressed rather than assume one automatically fulfils the other.
Must management review be one annual meeting?
The standard requires planned review, not one prescribed meeting format. A distributed approach must still cover the required inputs, decisions and retained results.
Turn evaluation into accountable action
Discuss audit and review support with Sterling, including agreed Effivity ISO & GRC automation software and employee learning across sites. Independent bodies decide certification. Enrol in ISO 19011 Auditing for related audit learning, alongside OH&S subject competence.
Revisit clause 8 operational control, return to the requirements overview, or continue to clause 10 improvement.