Exemplar Global OHSMS Lead Auditor common mistakes
Exemplar Global OHSMS Lead Auditor · Understand the traps and how to avoid them.
Citing a clause number (e.g., 'clause 8.1.2') to justify a finding without stating what the standard actually requires, so the reasoning collapses if the clause number is misremembered.
Candidates memorise a clause map under time pressure and treat the number as the answer, when exam items test whether you can apply the requirement to a described situation.
What to do instead
For every finding or judgement, write the requirement in your own words first ('the organisation must eliminate hazards and reduce risks using a hierarchy of controls'), then attach the clause number only as a label. Practise this on 20 scenario items until the paraphrase comes automatically.
Treating ISO 45001 as a hazard-by-hazard checklist and missing the system-level intent, e.g., accepting a risk assessment because hazards were listed, without asking whether the process is planned, implemented, maintained and evaluated.
Candidates with a technical safety background default to hazard-spotting and overlook the Plan-Do-Check-Act structure that the standard is built on.
What to do instead
For each clause, ask the four PDCA questions: how is it planned, how is it done, how is performance checked, and how are results fed back into improvement? Apply this grid to consultation and participation, contractor control, and management review before answering.
Confusing audit types and mislabelling the scenario: calling a supplier audit a 'third-party audit', or treating a certification audit as an 'internal audit' because it is performed on site.
The terms first-party, second-party and third-party describe the relationship between auditor and auditee, not the location or the formality, and candidates conflate relationship with purpose.
What to do instead
Classify by two axes before answering: who is the auditor relative to the auditee (internal / interested party such as a customer / independent certification body), and what is the purpose (conformity, supplier evaluation, certification, surveillance). State both axes explicitly in your reasoning.
Judging auditor competence by qualifications on a CV, e.g., accepting an auditor as competent for a high-hazard process because they hold a general OHS diploma, without checking sector knowledge, audit experience or the specific technical competence the process demands.
Certificates are visible and easy to count; competence is demonstrated through application, and items often hide a gap such as an auditor assigned to audit a process they have never worked with.
What to do instead
Evaluate competence against four elements: education/training, work experience in the relevant sector, audit experience, and demonstrated personal attributes. When a scenario shows a mismatch, identify the missing element and the action (additional technical expert, reassignment, training) rather than rejecting the auditor outright.
Ignoring the ethical dimension in a scenario, e.g., accepting a gift from the auditee, continuing an audit after realising you previously consulted for the client, or letting the client edit findings before issue, and answering only on technical grounds.
Candidates focus on the audit process and treat conduct as background, so they miss that the question is testing independence, objectivity, confidentiality or integrity.
What to do instead
Scan every scenario for a conduct trigger before analysing the technical content: gifts/hospitality, prior relationship, pressure to soften a finding, confidentiality of worker health data, or undisclosed conflict. Name the principle (independence, objectivity, integrity, confidentiality) and the required action, including declining or escalating.
Writing an audit plan that lists clauses to cover but omits sampling approach, audit criteria, audit team roles, logistics, or the requirement to review documentation before the on-site phase.
Candidates reproduce a generic plan template and forget that the plan must be risk-based and tailored to the organisation's hazards and previous audit results.
What to do instead
Build plans from a fixed skeleton: objectives, scope, criteria, dates and sites, team roles and responsibilities, sampling strategy and rationale, allocation of time to higher-risk processes, document review stage, and communication arrangements. Practise condensing this into a plan for a described organisation in under ten minutes.
Accepting verbal assurances as audit evidence, e.g., recording 'the manager confirmed workers are trained' as a finding of conformity, or conversely writing a nonconformity from a single interview without corroboration.
Interviews are the easiest evidence to obtain and candidates treat a confident answer as proof, forgetting that evidence must be verifiable and triangulated.
What to do instead
Classify evidence as record, observation or interview, and require at least two independent sources before concluding. Where only an interview exists, phrase the finding as a potential issue requiring verification, and describe the follow-up evidence you would seek.
Auditing the documented procedure instead of the actual hazard controls, e.g., checking that a risk assessment form is signed and dated while never asking whether the identified controls exist in the workplace or whether residual risk is acceptable.
Documents are convenient and unambiguous; the workplace is messy, so candidates stay in the document review comfort zone.
What to do instead
For every risk assessment reviewed, trace one or two significant hazards down to the physical control (guard, ventilation, permit, PPE) and to worker awareness of it. Structure answers as: hazard identified? risk evaluated against criteria? control implemented? control effective? workers consulted?
Misclassifying findings: raising a minor observation as a major nonconformity, or downgrading a systemic failure (e.g., no legal register at all, no incident investigation process) to a minor because only one department was sampled.
Candidates grade by how serious the individual incident sounds rather than by whether the management system requirement failed systematically, and they lack a consistent decision rule.
What to do instead
Apply an explicit test: does the requirement fail, and if uncorrected would the system fail to achieve its intended outcome? Check whether the failure is isolated (minor) or systemic/repeated across the audited scope (major). Write the classification rationale in one sentence alongside each finding.
Closing out corrective action on the basis of a submitted action plan or a revised procedure, without verifying that the root cause was addressed and that the correction was implemented and effective.
Candidates confuse a promise to act with evidence of action, and they accept documents because verification visits are not described in the scenario.
What to do instead
Separate three verification steps: correction (is the immediate problem fixed?), root cause analysis (does the stated cause explain the finding?), and effectiveness (has evidence shown recurrence is prevented?). Require objective evidence for each step and state what evidence would justify closure.
Handling conflict by avoidance or escalation: in a scenario where an auditee disputes a finding or becomes hostile, the candidate either withdraws the finding to keep the peace or refers immediately to the client without attempting resolution.
Candidates read conflict as a personal failure rather than a normal audit event, and they have no rehearsed process for it.
What to do instead
Use a fixed sequence: hear the objection fully, restate the evidence and the criterion, distinguish disagreement about facts from disagreement about interpretation, agree next steps (additional sampling, escalation to audit team leader), and record the unresolved point in the report. Practise applying it to two or three conflict scenarios.