Exemplar Global OHSMS Lead Auditor cheat sheet

ISO 45001 follows the Harmonized Structure: clauses 4 Context, 5 Leadership and worker participation, 6 Planning, 7 Support, 8 Operation, 9 Performance evaluation, 10 Improvement.

Clause 5.4 requires consultation and participation of workers at all levels; participation means involvement in decision-making, consultation means seeking views before decisions.

Clause 6.1.2 requires a hazard identification process covering routine and non-routine activities, emergency situations, human factors, past incidents, and changes; 6.1.2.2 separately addresses assessment of OH&S opportunities.

Hierarchy of controls per 8.1.2: eliminate the hazard, substitute, engineering controls and work reorganization, administrative controls including training, then PPE; PPE is the last resort.

Clause 6.1.3 requires determination of legal and other requirements and how they apply; compliance is evaluated under 9.1.2 and the results retained as documented information.

Documented information (clause 7.5) is created and updated with identification, format, review and approval; control covers distribution, access, retrieval, retention and disposition.

ISO 45001 has no requirement for an OH&S manual and no prescribed list of mandatory procedures; required documented information is specified clause by clause.

Risk is defined as the combination of likelihood of occurrence of a hazardous event and its severity of injury or ill health; opportunity is not the same as risk and is assessed separately.

The standard requires workers to be able to report hazardous situations without fear of reprisal (clause 5.1 and 7.4), and requires the organization to protect workers from reprisal.

ISO 19011 principles of auditing: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach, risk-based approach.

Audit types by subject: system, compliance/regulatory, supplier, surveillance, recertification, internal (first party), customer (second party), certification body (third party).

Audit programme (clause 5 of ISO 19011) is a set of one or more audits planned for a specific time frame and directed at a specific purpose; each individual audit has its own objectives, scope and criteria.

Programme risk considerations include the significance of the process, results of previous audits, maturity of the management system, changes, complaints, and legal/regulatory exposure.

An audit is a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively against audit criteria; consulting is not auditing.

Independence means auditors do not audit their own work; for internal audits, auditors should not audit activity for which they have responsibility.

The audit programme manager establishes, implements, monitors, reviews and improves the programme, including resourcing and auditor competence needs.

Surveillance audits are conducted at least once a year, except in justified cases; recertification audit is required before certificate expiry, typically every three years.

ISO 19011 clause 7 competence includes: knowledge of audit principles, procedures and methods; knowledge of management systems and reference documents; knowledge of the organization's context and sector; generic skills of an auditor; discipline-specific knowledge.

Generic auditor skills include communication, interviewing, note-taking, report writing, risk awareness, decision-making, teamwork, and the ability to remain fair, objective and diplomatic.

Lead auditor competence additionally requires the ability to plan and manage an audit, represent the audit team, lead the team to reach conclusions, and prevent and resolve conflicts.

Competence is evaluated through education, training, experience, and auditor evaluation methods such as record review, feedback, interviews, observation, and testing.

Auditor ethical conduct includes honesty, confidentiality, discretion, independence, impartiality, and not accepting gifts or benefits that could influence judgment.

Audit team roles: lead auditor (manages audit, finalizes report), auditors (carry out assigned tasks), technical experts (provide specialized knowledge, do not audit as auditors), observers and guides.

A technical expert does not act as an auditor and must be accompanied by an auditor when auditing; the auditor remains responsible for the audit findings.

Auditor evaluation should be ongoing, with competence reviewed against the programme's needs and development needs identified.

ISO 19011 clause 6.2: initiating an audit involves establishing initial contact with the auditee, confirming feasibility, and determining the audit objectives, scope and criteria.

Audit criteria are the set of requirements used as a reference against which objective evidence is compared; for an OH&S audit these include ISO 45001, legal requirements, and organizational requirements.

Documentation review is performed in preparation to determine conformity of the documented information with audit criteria and to gather information for planning; it should not replace on-site evidence gathering.

The audit plan (ISO 19011 6.3.2) includes objectives, scope, criteria, dates, locations, expected time and duration, roles, and allocation of resources; it is communicated to auditees.

Sampling in planning should be risk-based, considering process importance, past performance, changes, and legal/regulatory significance.

When the audit scope is changed during the audit (e.g., a process is unavailable), the change and its justification should be recorded and communicated.

Audit objectives state what the audit is intended to accomplish; scope defines boundaries (functions, activities, sites, time period); criteria are the requirements.

The audit plan should be sufficiently flexible to allow for changes based on information gathered during the audit.

Objective evidence is verifiable information, records, statements of fact or other information relevant to the audit criteria; evidence must be traceable and recorded.

Opening meeting (ISO 19011 6.4.2) confirms the audit plan, scope, criteria, communication arrangements, and the availability of resources; the auditee should be reminded of sampling limitations.

Evidence gathering methods include interviews, observation of activities and conditions, review of documents and records, and sampling; triangulation of sources strengthens findings.

Interview technique: ask open questions, listen actively, avoid leading questions, sample across shifts and levels, and verify statements against records and observation.

Sampling risk: the audit uses samples, so absence of a finding does not prove absence of nonconformity; this limitation should be stated in the report.

Observation of the workplace should cover physical conditions, housekeeping, use of PPE, signage, emergency equipment, and worker behavior against procedures.

Audit evidence should be recorded during the audit (checklists, notes, copies of records) to support findings and conclusions.

Communication during the audit includes periodic exchanges with the auditee, escalation of significant risks or immediate hazards, and agreement on findings before the closing meeting.

Hazard identification should cover routine and non-routine activities, emergency situations, human factors, changes, and past incidents; risk assessment determines likelihood and severity.

Auditors verify that risk assessment outputs feed into controls (8.1.2 hierarchy of controls) and that controls are implemented, maintained and effective.

Legal and other requirements (6.1.3) include legislation, regulations, collective agreements, and voluntary commitments; auditors verify the register is current and applicable.

Compliance evaluation (9.1.2) requires the organization to evaluate compliance with legal and other requirements at planned intervals and retain evidence of the results.

Legal compliance audits require the auditor to know the applicable jurisdiction and verify that obligations are identified, communicated, and met.

Contractor and outsourced process controls (8.1.4) must ensure that contractors meet the organization's OH&S requirements; auditors verify procurement and contractor management.

Emergency preparedness (8.2) requires planned responses, testing at planned intervals, and review of the response, including with workers and relevant interested parties.

Incident investigation (10.2) requires determining root causes, addressing consequences, reviewing risk assessments, and communicating results to workers and relevant parties.

A finding is the result of evaluating collected audit evidence against audit criteria; findings can indicate conformity or nonconformity.

Nonconformity is the non-fulfillment of a requirement; classify by severity (major/minor) and by type (systemic, implementation, effectiveness).

Major nonconformity typically indicates a systemic failure, absence of a required process or control, or a situation that creates significant OH&S risk or legal noncompliance; minor indicates an isolated lapse not indicating system failure.

An observation or opportunity for improvement is not a nonconformity; it should be clearly distinguished in the report and not used to inflate findings.

Each nonconformity should state the requirement (criterion), the objective evidence (what was found, where, when), and the significance; avoid opinion and unsupported statements.

The audit report (ISO 19011 6.6) includes objectives, scope, criteria, dates, sites, findings, conclusions, and any limitations or sampling caveats.

The closing meeting (6.5) presents findings and conclusions, confirms the audit is complete, and agrees on follow-up timelines; disagreements should be recorded.

Findings should be agreed with the auditee before the closing meeting where practicable, but the auditor retains responsibility for the conclusion.

Corrective action (ISO 45001 10.2) requires reacting to the nonconformity, evaluating the need for action to eliminate root causes, implementing action, reviewing effectiveness, and updating risks.

Verification of corrective action checks whether the action was implemented and whether it is effective in preventing recurrence; evidence may be records, re-audit, or observation.

Follow-up timelines should be agreed at the closing meeting; the auditor verifies closure against the agreed date and records the result.

A finding is closed only when objective evidence demonstrates the corrective action has been implemented and is effective; implementation alone is not sufficient.

The audit is complete when all planned audit activities have been carried out or otherwise justified; the audit report is distributed per the audit programme.

Records of the audit (plan, checklist, notes, report, corrective action evidence) are retained as documented information per the programme's requirements.

If the auditee does not respond or the action is ineffective, the finding remains open and should be escalated per the programme's rules.

The audit programme should be reviewed after audits to identify improvement opportunities and adjust future audit frequency and scope.

Effective auditor communication is clear, concise, factual and respectful; it distinguishes evidence from opinion and avoids blame language.

Conflict management: address disagreements with evidence, focus on criteria and facts, escalate unresolved issues to the lead auditor, and record unresolved disagreements.

The lead auditor is responsible for team cohesion, task allocation, and resolving differences between team members and auditees.

Active listening and questioning techniques reduce defensiveness; open questions encourage description, closed questions confirm facts.

Confidentiality and impartiality apply to all communications; sensitive information should be handled per the audit programme's rules.

Communication with the auditee should be planned: opening meeting, periodic updates, immediate escalation of significant risks, and closing meeting.

Teamwork requires clear role assignment, shared understanding of the audit plan, and coordination of sampling to avoid duplication and gaps.

Cultural and language differences should be managed with interpreters or technical experts; the auditor remains responsible for conclusions.