ISO 45001 Internal Audit Checklist and Question Bank

An internal audit is the one place in ISO 45001 where the organization looks at itself without an outside certification body in the room. I have come to think it is also the most wasted opportunity in the standard. Plenty of organizations run a tick-box audit once a year, file the report, and then wonder why the certification auditor finds problems they never saw. This guide gives you a working checklist and a question bank organized by clause, plus the program structure that makes the answers worth something.

What does ISO 45001 require for internal audits?

Clause 9.2.1 of ISO 45001:2018 requires the organization to conduct internal audits at planned intervals to provide information on whether the OH&S management system conforms to the organization's own requirements and to the standard, and whether it is effectively implemented and maintained. That last phrase matters. Conformity asks whether the procedure exists. Effectiveness asks whether people are actually safer because of it.

Clause 9.2.2 then lists what the audit program must include. In practice it comes down to these obligations:

a) Plan, establish, implement, and maintain an audit program, including frequency, methods, responsibilities, consultation, planning requirements, and reporting, taking into account the importance of the processes concerned and the results of previous audits.
b) Define the audit criteria and scope for each audit.
c) Select auditors and conduct audits to ensure objectivity and impartiality of the audit process.
d) Ensure results are reported to relevant managers, and that relevant results are reported to workers, worker representatives, and other relevant interested parties.
e) Take action to address nonconformities and improve OH&S performance.
f) Retain documented information as evidence of the implementation of the program and the audit results.

The standard does not set a fixed frequency. "Planned intervals" is a decision you make and defend, based on risk and past results. An annual full-system cycle is common, but a high-hazard process with a recent incident deserves more attention than a low-risk office function that has had clean results for three years.

ISO 19011:2018, Guidelines for auditing management systems, is the companion document. ISO 45001 does not make it mandatory, but its clause 5 (managing an audit program) and clause 6 (performing an audit) are the reference most certification bodies expect your program to resemble.

How should you structure the audit program?

Before you reach for any checklist, decide what the program is for. I usually ask clients one question: if this audit finds nothing, would you believe it? If the honest answer is no, the program has a design problem, not an audit problem.

Scope, criteria, and frequency

Audit criteria are the yardstick. For an ISO 45001 audit they typically include the standard itself, your own OH&S policies and procedures, and the legal and other requirements you identified under clause 6.1.3. Scope covers the sites, processes, shifts, and contractor activities included. Night shifts, weekend crews, and contractor work areas are the places gaps tend to hide, so make sure they appear in the schedule.

Auditor selection and impartiality

Clause 9.2.2 c) requires objectivity and impartiality, which means auditors should not audit their own work. A safety manager auditing the safety department's own procedures is the classic failure. Small organizations can solve this by cross-auditing between sites or departments, or by bringing in an external auditor for specific clauses. The auditor does not need to be a full-time safety professional, but they do need competence under clause 7.2, which in practice means training on the standard, on audit technique, and on the hazards of the area they are looking at.

Worker involvement

The standard expects results to reach workers and their representatives, and clause 5.4 expects genuine participation in the system. Including a frontline worker as an audit team member or observer is one of the cheapest ways to improve what the audit actually sees. For more on what participation must look like in practice, see worker participation in ISO 45001 and what clause 5.4 requires.

Audit methods at a glance

Method	What it tests	Best used for	Common weakness
Document review	Whether required documented information exists and is controlled	Clauses 5.2, 6.1, 7.5	Proves the paper exists, not that it is used
Interviews	Awareness and understanding	Clauses 5.4, 7.3, 8.2	Managers answer for workers
Observation	What people actually do	Clauses 8.1, 8.2	Behavior changes when the auditor is watching
Record sampling	Whether processes ran as described	Clauses 9.1, 10.2	Small samples hide patterns
Workplace walk-through	Physical controls and conditions	Clauses 6.1.2, 8.1.2	Done once, at the same time of day

In my own practice, a good audit uses at least three of these for every significant finding. This is a rule of thumb, not a requirement of ISO 45001 or ISO 19011. A procedure that exists on paper, is described accurately by a worker, and is visible on the floor is conforming and effective. If only the first of those is true, you have a document, not a control.

ISO 45001 internal audit checklist by clause

The checklist below follows the standard's structure from clause 4 through clause 10. Treat it as a starting point. Edit the questions to match your hazards and your own procedures, because clause 9.2.1 a) audits against your own requirements as well as the standard's.

Clause 4: Context of the organization

Has the organization determined the external and internal issues relevant to its purpose that affect the OH&S management system (4.1)?
Can you show how workers and other interested parties were identified, and which of their needs and expectations became legal or other requirements (4.2)?
Is the scope of the OH&S management system documented and available to interested parties (4.3)?
Does the scope cover activities, products, and services that can affect OH&S performance, including those at contractor and multi-employer sites (4.3)?
Are the processes needed for the management system, and their interactions, established and maintained (4.4)?

Evidence to request: context analysis, interested-party register, scope statement, process map.

Clause 5: Leadership and worker participation

Can top management describe, in their own words, how they take accountability for the prevention of work-related injury and ill health (5.1)?
Is the OH&S policy appropriate to the organization, available as documented information, and communicated within the organization (5.2)?
Does the policy include commitments to eliminate hazards and reduce OH&S risks, to consultation and participation of workers, and to continual improvement (5.2)?
Are OH&S roles, responsibilities, and authorities assigned and understood at all levels (5.3)?
In interviews with three workers, can each say who they would go to with a safety concern (5.3)?
Is there a documented process for consultation and participation of non-managerial workers, and are barriers to participation identified and removed (5.4)?
Are non-managerial workers consulted on hazard identification, control selection, training needs, and incident investigation (5.4)?
Can workers raise concerns without fear of reprisal, and is there evidence that they have (5.4)?

Evidence to request: policy, organization chart, committee minutes, consultation records, interview notes.

Clause 6: Planning

Does the hazard identification process cover routine and non-routine activities, human factors, emergencies, and past incidents (6.1.2.1)?
Does it consider the workplace design, work organization, social factors, and situations that arise outside the workplace but are under organizational control (6.1.2.1)?
Are OH&S risks assessed with defined methodology and criteria, and are the results current (6.1.2.2)?
Are OH&S opportunities considered, such as adapting work to workers or eliminating hazards (6.1.2.3)?
Is there a process to identify and access legal and other requirements, and to keep them current (6.1.3)?
Can the organization show a recent regulatory change and what it did about it (6.1.3)?
Are OH&S objectives measurable where practicable, monitored, and linked to the policy and to the risk assessment (6.2.1)?
For each objective, are the resources, responsible person, timeline, and evaluation method defined (6.2.2)?

Evidence to request: hazard register, risk assessment records, legal register, objectives plan. For hands-on methods, the article on workplace hazard identification methods such as JSA, HAZOP, and checklists pairs well with this section.

Clause 7: Support

Are the resources needed for the OH&S management system identified and provided (7.1)?
Is competence defined for roles that affect OH&S performance, and are training records available (7.2)?
Does competence include the ability to identify hazards, and is there evidence it was assessed rather than just delivered (7.2)?
Are workers aware of the policy, the objectives, their contribution to effectiveness, the implications of not conforming, incidents relevant to them, and their right to remove themselves from dangerous situations (7.3)?
Is there a documented communication process covering what, when, with whom, and how, including contractors and visitors (7.4)?
Is documented information controlled for identification, format, review, approval, distribution, retention, and disposal (7.5.3)?

Evidence to request: training matrix, competence assessments, communication plan, document control log. See the complete list of required ISO 45001 documents for what an auditor should expect to find.

Clause 8: Operation

Are operational controls in place for the activities associated with identified hazards, and do they follow the hierarchy of controls in clause 8.1.2 (eliminate, substitute, engineering controls and work reorganization, administrative controls, then PPE)?
During observation of a high-risk task, does the control actually in use match the documented control (8.1.2)?
Is there a process for planned changes to products, processes, equipment, and work organization, and does it assess OH&S risk before the change goes live (8.1.3)?
Does the change process also cover unplanned changes, with action to mitigate adverse effects (8.1.3)?
Are OH&S requirements built into procurement of products, equipment, and services (8.1.4.1)?
How does the organization coordinate with contractors on hazards and controls, and how does it check that contractor workers are covered (8.1.4.2)?
Are outsourced functions that affect the OH&S management system controlled, and is the control type and degree defined (8.1.4.3)?
Are emergency scenarios identified, and are response plans established, including first aid (8.2)?
Have emergency response plans been tested, with drills at planned intervals, and were lessons from drills recorded (8.2)?
In worker interviews, can each worker say what to do when the alarm sounds and where to go (8.2)?

Evidence to request: operating procedures, permit-to-work records, change records, contractor files, emergency plans, drill reports. The article on management of change under ISO 45001 goes deeper on questions 30 and 31.

Clause 9: Performance evaluation

Has the organization determined what needs to be monitored and measured, the methods, and when results are analyzed (9.1.1)?
Does monitoring include the extent to which legal requirements are met, hazard and risk controls, and progress on objectives (9.1.1)?
Is monitoring equipment calibrated or verified where applicable (9.1.1)?
Is there a process to evaluate compliance with legal and other requirements, with records of the results (9.1.2)?
Has the previous audit program been completed as planned (9.2)?
Did management review consider all required inputs, including the status of actions from previous reviews, audit results, consultation outcomes, incidents, and opportunities for improvement (9.3)?
Do management review outputs include decisions on resources and on the system's suitability, adequacy, and effectiveness?

Additional audit-program questions for clause 9.2 (supplementary to the numbered list):

Are auditors selected so they do not audit their own work, and are impartiality decisions recorded (9.2.2 c)?
Are there records of auditor competence, such as training on the standard and audit technique (7.2, 9.2.2 c)?
Do the audit criteria, scope, and frequency reflect the importance of the processes and previous audit results (9.2.2 a), b))?
Were audit results reported to relevant managers, and to workers, worker representatives, and other interested parties (9.2.2 d))?
Is documented information retained as evidence of the audit program and its results (9.2.2 f))?

Evidence to request: monitoring data, compliance evaluation, audit program and schedule, auditor competence and impartiality records, audit reports, evidence of reporting to workers, management review minutes.

Clause 10: Improvement

Is there a process to report, investigate, and take action on incidents and nonconformities (10.2)?
Do investigations involve workers and look for root causes, not just the immediate unsafe act (10.2)?
Is the effectiveness of corrective actions reviewed, and are risk assessments updated when needed (10.2)?
In a trace of three recent incidents, does each run from report to closed action (10.2)?
Is there evidence of continual improvement of suitability, adequacy, and effectiveness, including promoting a culture that supports the system (10.3)?
Are results of improvement actions communicated to workers (10.3)?

Evidence to request: incident log, investigation reports, corrective action register, trend data.

What questions expose real gaps, not just missing paperwork?

The checklist above is the floor. The questions below are the ones I have found produce the most useful findings, and none of them can be answered by pointing at a document.

When was the last time a worker stopped a job because it was unsafe, and what happened next?
Which hazard on your register has the highest residual risk, and what did you do about it this quarter?
What changed in the last six months, and who assessed the safety impact before it happened?
Show me a contractor who started work last month. How did they learn your site's hazards?
Which legal requirement changed last year, and where did that show up in a procedure?
What did your last three near-miss reports have in common?

The trouble with a near-miss question is that a low number of reports often signals a reporting problem, not a safety record. If your organization reports almost nothing, I would audit the reporting culture before I would congratulate anyone.

Questions about the dull middle of the system are where I find the most. Training records exist but were never tested for competence. Corrective actions are closed on the date the email was sent, not the date the fix was verified. Management review lists the audit results as an input but records no decision. None of these breaks a clause in an obvious way, and all of them weaken the system.

How do you write and grade audit findings?

A finding is only as useful as the evidence behind it. A solid finding states the requirement (clause or internal procedure), the objective evidence (what you saw, who you spoke with, which record, with identifiers), and the gap. Avoid writing opinions such as "training is inadequate." Write "3 of 8 forklift operators sampled had no refresher record since 2022, against procedure SOP-14, section 4.2," and the reader knows exactly what to fix.

Most programs grade findings into three categories:

Category	Meaning	Typical response
Major nonconformity	Absence or total breakdown of a required process, or a situation that creates a significant risk of injury	Immediate containment, root cause analysis, corrective action with verification
Minor nonconformity	A lapse or isolated failure in an otherwise functioning process	Correction and corrective action within a defined period
Opportunity for improvement	Conforming, but could work better	Considered at management review, no mandatory action

The categories are a convention drawn from ISO 19011 practice and certification body habits, not a requirement of ISO 45001 itself, so define them in your own procedure. One more point that gets missed: an imminent safety hazard seen during an audit is not a finding to write up later. Stop the work or escalate immediately, and document it afterward.

Clause 10.2 governs what happens next. Nonconformities require reacting to the issue, evaluating the need for action to eliminate root causes, implementing the action, reviewing its effectiveness, and updating risks and opportunities where necessary. Retain documented information on the nature of the nonconformity and the results of any action taken.

How does the audit feed management review and improvement?

Clause 9.3 lists the inputs top management must consider, and audit results are among them. The audit's real value shows up when leadership reads the report and changes something. In my view, the best sign of a healthy program is a management review where audit trends lead to a resourcing decision, not just a nod.

A few habits make the connection stronger:

Trend findings by clause and by site over several cycles, so recurring problems stand out.
Report positive practices as well, since they are often transferable.
Track closure time for corrective actions, and escalate the overdue ones.
Feed audit insights back into the risk assessment, because a finding on a procedure often points to a hazard that was underrated.

If you also run OSHA-regulated operations, an ISO 45001 audit does not replace compliance checks against specific rules, but it should surface them. The overview of how ISO 45001 and OSHA work together explains where the two overlap.

Common internal audit mistakes

The patterns I see most often are predictable. Audits are scheduled in a single burst before certification, so the system is only checked when it is polished. Corrective actions fix the instance rather than the cause, so the same finding returns the next year. And results are reported to managers but never reach workers, which clause 9.2.2 d) specifically requires.

An internal audit that finds nothing is not evidence of a perfect system. More often it is evidence of a shallow audit.

Building your own question bank

Start with the questions above, then adapt. Add questions drawn from your own incident history, from your legal register, and from the hazards specific to your sites. Retire questions that never produce a finding, and rotate in new ones so auditors do not fall into a script. Keep the bank under document control, because it is part of the evidence that the audit program is planned and maintained.

If you are still building the system the audit will test, the ISO 45001 implementation guide covers the full path. And if you would like a second set of eyes on your audit program, you can reach Certify Consulting at certify.consulting.

What would your last audit report look like if every finding had to be backed by something you watched a worker do, not something you read in a binder?

Last updated: 2026-11-05

Frequently Asked Questions

How often should ISO 45001 internal audits be conducted?

ISO 45001:2018 clause 9.2.1 requires audits at planned intervals but sets no fixed frequency. Many organizations audit the full system annually, with higher-risk processes or areas with recent incidents audited more often. Clause 9.2.2 b) requires the program to take into account the importance of the processes concerned and the results of previous audits.

Who can perform an ISO 45001 internal audit?

Anyone competent and impartial. Clause 9.2.2 e) requires auditors to be selected so the audit process is objective and impartial, which in practice means people should not audit their own work. Auditors need competence under clause 7.2, typically through training on the standard and on audit technique, and ISO 19011:2018 provides guidance on auditor competence.

What documented information is required for an internal audit?

Clause 9.2.2 g) requires documented information as evidence of the implementation of the audit program and the audit results. Typically that means the audit program or schedule, audit plans, checklists or notes, audit reports, and records of corrective actions arising from findings.

Is ISO 19011 required for ISO 45001 internal audits?

No. ISO 45001 does not make ISO 19011:2018 mandatory, but it is the standard guidance for auditing management systems. Clause 5 covers managing an audit program and clause 6 covers performing an audit, and certification bodies generally expect internal audit programs to follow similar principles.

What is the difference between a major and minor nonconformity?

ISO 45001 does not define these grades. They are a convention from ISO 19011 practice and certification bodies. A major nonconformity usually means a required process is absent or has broken down, or that a significant risk of injury exists. A minor one is an isolated lapse in an otherwise functioning process. Define the categories in your own audit procedure.