ISO 45001 Stage 1 and Stage 2 audit: what auditors check on site, day by day

What Stage 1 and Stage 2 check in an ISO 45001 audit

Stage 1 asks whether your occupational health and safety management system is ready to be audited in full. Stage 2 asks whether the system control the hazards your workers actually face, across every site, shift and activity in the scope.

The two-stage pattern comes from ISO/IEC 17021-1, the requirements standard that accreditation bodies use to assess certification bodies. IAF MD 22, the mandatory document for OH&S certification, adds rules specific to health and safety, including the expectation that implementation is evaluated while work is under way.

Picking the body is covered in choosing an ISO 45001 certification body, and the full route from decision to certificate in the certification process guide.

Stage 1: the readiness review for an OH&S system

ISO/IEC 17021-1 fixes the objectives of Stage 1; in OH&S terms they become this list.

Expect part of Stage 1 at your premises: the certification body must tell you in advance which activities will be on site, and the condition of a workshop or a yard cannot be judged from a document list.

Stage 1 closes with documented conclusions on readiness and a list of concerns that could become nonconformities at Stage 2. It is not a gap analysis, which is the first stage of Sterling's engagement: the auditor names the concern and leaves the remedy to you.

The interval before Stage 2

The certification body sets the gap between the stages with your need to resolve those concerns in mind, and it may change its Stage 2 arrangements because of what it found. You receive the audit plan and the audit team's names in advance; a justified objection to a team member requires the body to change the team.

Stage 2: the system at the point of work

Stage 2 evaluates implementation, including effectiveness, at your sites. Under ISO/IEC 17021-1 it must cover at least conformity with all ISO 45001 requirements in scope, performance monitoring against your objectives, legal and contractual compliance, operational control, internal audit and management review, and management responsibility for the policy.

What makes an OH&S Stage 2 different is where the evidence lives. IAF MD 22 expects evaluation during operational activities, with a tour of facilities and work sites given as the example. In practice the auditor will:

• Watch a task and compare it with its risk assessment, method statement and permit, and ask the operator what the hazards are.
• Test the hierarchy of controls: was elimination or substitution considered before personal protective equipment became the answer?
• Follow an incident from report to investigation, to the revised risk assessment, to whether the control changed on the floor (10.2).
• Check contractors against prequalification, induction and supervision records (8.1.4).
• Ask non-managerial workers how they raise a concern and whether they know they may remove themselves from imminent and serious danger.

Effectiveness is judged by consequence. A drill record shows the drill happened; a drill report whose lessons altered the emergency plan (8.2) shows the system learns.

A typical ISO 45001 Stage 2, day by day

The certification body sets audit time under IAF MD 5 from effective personnel, contractors included, and the OH&S risk category of your activities; the cost guide explains those drivers. The table illustrates three days at one manufacturing site and one auditor.

How auditors sample sites, shifts and contractors

ISO/IEC 17021-1 requires evidence to be gathered by appropriate sampling and verified through interviews, observation and review of documents and records. For OH&S, the rules narrow what can be sampled:

• Different risks, no sampling: IAF MD 22 states that sampling is not appropriate where several sites do not share the same activities, processes and OH&S risks. A depot and a fabrication shop are not interchangeable.
• Temporary sites such as project locations are selected for visits on an evaluation of risk.
• Remote methods may replace only the parts of an on-site audit that do not involve witnessing process control and other OH&S risk control.

A clean Stage 2 does not prove every task is safe, and one finding does not condemn a whole site. The questions auditors typically ask on the floor are gathered in our audit questions guide.

Findings, the closing meeting and the certification decision

Every nonconformity is recorded against a specific ISO 45001 requirement, with a plain statement of what is wrong and the objective evidence. It is discussed with you; that is the moment to produce a record the auditor missed. The auditor may not suggest the cause or the fix, which protects the impartiality of the certificate.

• Major nonconformity: affects the capability of the system to achieve its intended results, for example no evaluation of compliance with OH&S law at all.
• Minor nonconformity: does not affect that capability, for example one overdue inspection in an otherwise working programme.
• Opportunity for improvement: recorded where the scheme permits; it is not a nonconformity.

At the closing meeting you are told the conclusions and the recommendation, that the evidence came from a sample, how findings are graded, the deadline for corrections and corrective action plans, what the certification body does next, and how complaints and appeals work.

Competent people at the certification body who did not take part in the audit then decide, once corrections and corrective actions for every major nonconformity have been reviewed, accepted and verified, and plans for minor ones accepted. If a major is not verified within six months of the last day of Stage 2, another Stage 2 is needed. Closing findings is covered in our nonconformities guide, and the three-year cycle that follows in our surveillance and recertification guide.

ISO 45001 Stage 1 and Stage 2 audits: questions buyers ask