I85PREP
⌘ K
Exemplar Global OHSMS Lead Auditor study materials
Exemplar Global OHSMS Lead Auditor study resources

Exemplar Global OHSMS Lead Auditor practice questions

One question at a time. Build your Exemplar Global OHSMS Lead Auditor understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Occupational health and safety management system fundamentals and the ISO 45001 standard

An organization is establishing its occupational health and safety management system. According to ISO 45001, what is the primary intended outcome of the OH&S management system?

  1. Certification of the organization's products against national safety legislation
  2. Prevention of work-related injury and ill health to workers and provision of safe and healthy workplaces Correct answer.
  3. Guarantee that no worker will ever be exposed to a hazard during employment
  4. Elimination of all documented OH&S risks before any work activity begins

Explanation

ISO 45001 states the intended outcomes of the OH&S management system include continual improvement of OH&S performance, fulfilment of legal and other requirements, and achievement of OH&S objectives. Central among these is the prevention of work-related injury and ill health and the provision of safe and healthy workplaces. The standard is a management framework, not a zero-risk warranty.

Question 2Occupational health and safety management system fundamentals and the ISO 45001 standard

Under ISO 45001, the term 'worker' is defined to include which of the following?

  1. Only personnel holding a permanent employment contract with the organization
  2. Only personnel whose work is supervised directly by a line manager
  3. Only personnel working at the organization's own premises
  4. Persons performing work or work-related activities under the control of the organization Correct answer.

Explanation

ISO 45001 defines a worker broadly as a person performing work or work-related activities that are under the control of the organization. This covers employees, contractors, temporary staff and self-employed persons working under the organization's control. The breadth of the definition supports the standard's emphasis on consultation and participation.

Question 3Occupational health and safety management system fundamentals and the ISO 45001 standard

ISO 45001 requires top management to demonstrate leadership and commitment. Which action best demonstrates this requirement?

  1. Approving the OH&S budget once per financial year
  2. Delegating all OH&S decision-making to the appointed safety manager
  3. Taking accountability for the effectiveness of the OH&S management system Correct answer.
  4. Reviewing incident statistics only after a serious injury occurs

Explanation

Clause 5.1 requires top management to take accountability for the effectiveness of the OH&S management system. Accountability cannot be delegated, even though operational tasks can be assigned. Other leadership actions, such as integrating OH&S into business processes and providing resources, flow from this accountability.

Question 4Occupational health and safety management system fundamentals and the ISO 45001 standard

Which statement correctly describes the relationship between ISO 45001 and the earlier OHSAS 18001 standard?

  1. Both standards must be implemented together for certification to be valid
  2. OHSAS 18001 remains the mandatory certification standard for OH&S management
  3. ISO 45001 is a technical product standard that is unrelated to OHSAS 18001
  4. ISO 45001 replaces OHSAS 18001 and uses the High Level Structure common to other ISO management system standards Correct answer.

Explanation

ISO 45001 superseded OHSAS 18001, and organizations certified to OHSAS 18001 were given a migration period. ISO 45001 follows the High Level Structure used by ISO 9001 and ISO 14001, which supports integrated management systems. OHSAS 18001 is no longer the current reference standard.

Question 5Occupational health and safety management system fundamentals and the ISO 45001 standard

An organization is determining the scope of its OH&S management system. According to ISO 45001, which factor must be considered?

  1. The organization's financial turnover and market share
  2. The certification body's preferred audit duration
  3. The number of employees at each individual work site
  4. The external and internal issues relevant to its purpose, and the work-related activities performed by workers Correct answer.

Explanation

Clause 4.3 requires the organization to determine the boundaries and applicability of the OH&S management system by considering the external and internal issues, the requirements of interested parties, and the work-related activities performed. Scope must reflect the organization's actual OH&S context. Financial and audit-logistics factors are not scope criteria.

Question 6Occupational health and safety management system fundamentals and the ISO 45001 standard

ISO 45001 clause 4.1 requires the organization to determine external and internal issues relevant to its purpose. Which of the following is an example of an internal issue?

  1. Changes in national OH&S legislation
  2. Emerging technologies in the organization's industry
  3. The organization's culture regarding hazard reporting Correct answer.
  4. Contractual requirements imposed by a major client

Explanation

Internal issues relate to the organization's own characteristics, such as its governance, culture, knowledge, capabilities and resources. Organizational culture around hazard reporting is therefore an internal issue. Legislation, industry technology trends and client contracts are external issues.

Question 7Occupational health and safety management system fundamentals and the ISO 45001 standard

In ISO 45001, what does the term 'consultation' with workers require?

  1. Obtaining workers' written agreement to all OH&S objectives
  2. Seeking workers' views before a decision is made Correct answer.
  3. Transferring decision-making authority to worker representatives
  4. Informing workers about decisions after they have been made

Explanation

ISO 45001 distinguishes consultation from participation. Consultation means seeking views before decisions are made, whereas participation means involving workers in decision-making processes. The standard requires both mechanisms to be established and documented.

Question 8Occupational health and safety management system fundamentals and the ISO 45001 standard

Which of the following best describes the purpose of the hierarchy of controls in ISO 45001?

  1. To determine the financial cost of each proposed control measure
  2. To rank hazards according to the severity of potential injury
  3. To assign responsibility for each risk to a named individual
  4. To provide a systematic order for selecting controls that reduce OH&S risks Correct answer.

Explanation

Clause 8.1.2 requires the organization to establish a process for reducing OH&S risks using the hierarchy of controls. The hierarchy orders control options from most to least effective, starting with elimination and ending with personal protective equipment. It guides selection of controls, not hazard ranking, cost or accountability assignment.

Question 9Occupational health and safety management system fundamentals and the ISO 45001 standard

An organization is preparing for its OH&S management system to be audited against ISO 45001. Which document does the standard require as documented information describing the core elements of the management system?

  1. A documented OH&S policy and documented scope of the OH&S management system Correct answer.
  2. A register of every worker's medical history
  3. A list of all suppliers used by the organization
  4. A copy of each worker's employment contract

Explanation

ISO 45001 requires documented information for the OH&S policy and for the scope of the OH&S management system. These two items are mandatory documented information under clauses 5.2 and 4.3 respectively. Medical records, supplier lists and employment contracts are not required documented information under the standard.

Question 10Occupational health and safety management system fundamentals and the ISO 45001 standard

Under ISO 45001 clause 6.1.2, what must the organization do when identifying hazards?

  1. Identify hazards on a routine basis, including hazards arising from the organization's operations, and consider how work is organized Correct answer.
  2. Identify hazards by relying solely on incident reports from the previous year
  3. Identify hazards only at the request of a regulator
  4. Identify hazards only for activities that have previously caused an injury

Explanation

Clause 6.1.2 requires a proactive, ongoing hazard identification process that considers how work is organized, social factors, and routine and non-routine activities. Hazard identification must not depend only on historical incidents. The process must also consider emergency situations and changes in the organization.

Question 11Occupational health and safety management system fundamentals and the ISO 45001 standard

An organization has identified a legal requirement to conduct quarterly noise monitoring at a manufacturing site. Under ISO 45001, how should this requirement be treated?

  1. As an external issue that is irrelevant to the management system
  2. As an OH&S objective with a measurable target for reducing noise below the legal limit
  3. As a compliance obligation that must be considered when establishing, implementing and maintaining the OH&S management system Correct answer.
  4. As a documented information item that is retained only for the audit

Explanation

Clause 6.1.3 requires the organization to determine and have access to up-to-date legal and other requirements and to determine how they apply. Compliance obligations must be considered when establishing and maintaining the OH&S management system. The organization must also evaluate compliance with them.

Question 12Occupational health and safety management system fundamentals and the ISO 45001 standard

ISO 45001 requires the organization to establish OH&S objectives. Which characteristic must these objectives have?

  1. They must be identical to the objectives of a parent organization
  2. They must be measurable, monitored, communicated and updated as appropriate Correct answer.
  3. They must be approved by the external certification body before implementation
  4. They must be kept confidential from workers

Explanation

Clause 6.2 requires OH&S objectives to be consistent with the OH&S policy, measurable where practicable, monitored, communicated and updated. They must also be documented and supported by plans specifying what will be done, resources, responsibility, timeframe and evaluation. External approval and confidentiality are not required.

Question 13Occupational health and safety management system fundamentals and the ISO 45001 standard

A worker reports a near-miss involving a forklift. According to ISO 45001, what is the organization required to do with this information?

  1. Record it only if a person was injured
  2. Discipline the worker for reporting a non-injury event
  3. Report it to the certification body within 24 hours
  4. Investigate the incident and determine corrective actions to eliminate the cause Correct answer.

Explanation

Clause 10.2 requires the organization to react to incidents and nonconformities, evaluate the need for corrective action, investigate and determine root causes, and implement action. A near-miss is an incident under the standard even without injury. The organization must also review the effectiveness of corrective action taken.

Question 14Occupational health and safety management system fundamentals and the ISO 45001 standard

An auditor is reviewing an organization's emergency preparedness arrangements. Which element must the organization include according to ISO 45001 clause 8.2?

  1. Emergency plans developed solely by external consultants
  2. A guarantee that emergencies will not occur
  3. Emergency drills conducted only after an actual emergency
  4. Planned responses to potential emergency situations, including first aid Correct answer.

Explanation

Clause 8.2 requires the organization to establish planned responses to potential emergency situations, including provision of first aid. The organization must also test and exercise the planned responses and review them periodically. Emergency planning is proactive and involves workers.

Question 15Occupational health and safety management system fundamentals and the ISO 45001 standard

Which of the following best describes the requirement for monitoring, measurement, analysis and performance evaluation under ISO 45001 clause 9.1?

  1. The organization must determine what needs to be monitored and the methods for monitoring, measurement, analysis and evaluation Correct answer.
  2. Monitoring is optional and may be replaced by worker self-assessment
  3. Monitoring results must be kept confidential from workers
  4. Monitoring is limited to measuring the number of lost-time injuries

Explanation

Clause 9.1 requires the organization to determine what needs to be monitored and measured, the methods, criteria, and when results are to be analysed and evaluated. The organization must also evaluate OH&S performance and the effectiveness of the management system. Monitoring is mandatory, not optional.

Question 16Occupational health and safety management system fundamentals and the ISO 45001 standard

An organization is planning an internal audit of its OH&S management system. Which requirement applies under ISO 45001 clause 9.2?

  1. Internal audits must cover only the OH&S policy and objectives
  2. Internal audits must be conducted only by the certification body
  3. The organization must plan, establish, implement and maintain an internal audit programme at planned intervals Correct answer.
  4. Internal audits may be omitted if no incidents occurred during the year

Explanation

Clause 9.2 requires an internal audit programme at planned intervals to provide information on whether the OH&S management system conforms to requirements and is effectively implemented. The programme must consider the importance of processes and results of previous audits. Audits must be objective and impartial.

Question 17Occupational health and safety management system fundamentals and the ISO 45001 standard

Top management reviews the OH&S management system at planned intervals. Which input is required for management review under ISO 45001 clause 9.3?

  1. The organization's annual marketing plan
  2. The status of actions from previous management reviews Correct answer.
  3. The personal medical records of all workers
  4. The financial audit report of the organization

Explanation

Clause 9.3 lists required inputs to management review, including the status of actions from previous reviews, changes in external and internal issues, OH&S performance information, and results of compliance evaluation. Marketing plans, medical records and financial audit reports are not required inputs. Outputs must include decisions related to continual improvement and resource needs.

Question 18Occupational health and safety management system fundamentals and the ISO 45001 standard

An organization identifies that a contractor working on site has introduced a new hazard. Under ISO 45001, how should the organization address this?

  1. Apply its OH&S management system to contractors and their workers to the extent of its control Correct answer.
  2. Rely on the contractor to manage the hazard without organizational involvement
  3. Exclude contractor activities from the scope of the OH&S management system
  4. Require the contractor to obtain its own certification before work begins

Explanation

ISO 45001 requires the organization to apply its OH&S management system to contractors and their workers to the extent of its control. The organization must coordinate with contractors to identify hazards and manage risks. Outsourcing does not remove the organization's OH&S responsibilities.

Question 19Occupational health and safety management system fundamentals and the ISO 45001 standard

Which of the following best describes the concept of 'participation' as distinct from 'consultation' in ISO 45001?

  1. Participation means involving workers in decision-making processes, such as hazard identification and incident investigation Correct answer.
  2. Participation means requiring workers to sign the OH&S policy
  3. Participation means delegating management accountability to workers
  4. Participation means informing workers of decisions already made

Explanation

ISO 45001 distinguishes participation from consultation. Participation involves workers in decision-making processes, for example in hazard identification, risk assessment, and incident investigation. Consultation is the process of seeking views before decisions are made. Both are required mechanisms under clause 5.4.

Question 20Occupational health and safety management system fundamentals and the ISO 45001 standard

An organization is considering outsourcing a high-risk activity to a specialized provider. According to ISO 45001 clause 8.1.4, what must the organization do?

  1. Require the provider to implement the organization's OH&S policy verbatim
  2. Retain no responsibility for the outsourced activity once the contract is signed
  3. Determine controls for the outsourced activity and ensure the outsourced process is controlled Correct answer.
  4. Delegate all OH&S legal compliance to the outsourced provider

Explanation

Clause 8.1.4 requires the organization to ensure that outsourced processes are controlled and to determine controls consistent with the hierarchy of controls. The organization must coordinate with the provider and retain responsibility for its own OH&S obligations. Outsourcing does not transfer legal or management system accountability.

Question 21Occupational health and safety management system fundamentals and the ISO 45001 standard

During an audit, a worker states that they were not involved in the risk assessment for their work area. Which ISO 45001 requirement is most directly relevant?

  1. Clause 5.4 participation and consultation, because workers must participate in hazard identification and risk assessment Correct answer.
  2. Clause 7.2 competence, because the worker lacks training
  3. Clause 4.3 scope, because the work area was excluded
  4. Clause 9.1 monitoring, because the worker was not measured

Explanation

Clause 5.4 requires the organization to provide mechanisms for workers to participate in hazard identification and risk assessment. Excluding workers from this process is a direct nonconformity with participation requirements. The organization must also ensure workers are consulted on changes affecting their OH&S.

Question 22Occupational health and safety management system fundamentals and the ISO 45001 standard

An organization has documented a risk assessment that identifies a hazard but records no control measures and no rationale for accepting the residual risk. As an auditor, which conclusion is most appropriate?

  1. The risk assessment conforms because the hazard was identified
  2. The risk assessment conforms because the hazard is not a legal requirement
  3. The risk assessment does not demonstrate the required reduction of OH&S risks using the hierarchy of controls Correct answer.
  4. The risk assessment conforms because no incident has occurred

Explanation

ISO 45001 requires the organization to establish processes for reducing OH&S risks using the hierarchy of controls. A risk assessment that identifies hazards but does not record controls or the basis for accepting residual risk does not demonstrate that risks are being managed. The absence of incidents is not evidence of effective control.

Question 23Occupational health and safety management system fundamentals and the ISO 45001 standard

An auditor finds that an organization's OH&S policy commits to eliminating hazards and reducing risks, but the policy is not available to workers and is not communicated. Which requirement is most directly breached?

  1. Clause 5.2, which requires the policy to be communicated, available and relevant to the organization's purpose Correct answer.
  2. Clause 9.2, which requires internal audits to be conducted
  3. Clause 7.5, which requires documented information to be controlled
  4. Clause 6.1.1, which requires the organization to plan actions to address risks

Explanation

Clause 5.2 requires the OH&S policy to be documented, communicated within the organization, and available to workers and interested parties as appropriate. A policy that is not communicated fails this requirement. The policy must also be appropriate to the organization's purpose and provide a framework for setting objectives.

Question 24Occupational health and safety management system fundamentals and the ISO 45001 standard

An organization's internal audit programme has not been updated to consider the results of previous audits or the importance of processes. Which aspect of ISO 45001 is most directly nonconforming?

  1. The audit programme does not meet clause 7.4 communication requirements
  2. The audit programme does not meet clause 8.2 emergency preparedness requirements
  3. The audit programme does not satisfy clause 6.2 objective-setting requirements
  4. The audit programme does not reflect the requirements of clause 9.2 for planning based on process importance and previous results Correct answer.

Explanation

Clause 9.2 requires the internal audit programme to be planned considering the importance of processes and the results of previous audits. Failing to update the programme on these bases means the audit programme does not meet the standard. The organization must also ensure audits are conducted by objective and impartial auditors.

Question 25Occupational health and safety management system fundamentals and the ISO 45001 standard

An auditor observes that a corrective action was implemented after a serious incident, but the organization did not review the effectiveness of the action or update its risk assessment. Which conclusion is most appropriate?

  1. The organization has not completed the corrective action process required by clause 10.2 Correct answer.
  2. The organization must immediately notify the certification body of the incident
  3. The organization must suspend all operations until an external audit is completed
  4. The corrective action fully conforms because the incident was addressed

Explanation

Clause 10.2 requires the organization to evaluate the need for corrective action, implement it, review its effectiveness, and update risks and opportunities as necessary. Implementing a fix without reviewing effectiveness or updating the risk assessment leaves the corrective action process incomplete. The standard also requires retaining documented information as evidence.

Question 26Occupational health and safety management system fundamentals and the ISO 45001 standard

In ISO 45001, what does the term 'worker' cover?

  1. Only employees whose roles involve identified OH&S hazards
  2. Only those persons who have signed the OH&S participation register
  3. Only personnel on the organization's payroll who work at the main site
  4. All persons performing work under the organization's control, including contractors and agency staff Correct answer.

Explanation

ISO 45001 defines a worker as a person performing work or work-related activities under the control of the organization, which expressly includes contractors, agency personnel and other non-employee categories. The definition is based on control of the work rather than on the employment contract, so payroll status and job content do not limit who counts as a worker.

Question 27Occupational health and safety management system fundamentals and the ISO 45001 standard

An auditor is examining how an organization has applied the hierarchy of controls. Which sequence correctly reflects the order of preference required by ISO 45001?

  1. Engineering controls, elimination, PPE, administrative controls
  2. Administrative controls, elimination, engineering controls, PPE
  3. Elimination, engineering controls, administrative controls, PPE Correct answer.
  4. PPE, administrative controls, engineering controls, elimination

Explanation

The hierarchy of controls moves from the most effective to the least effective measures: eliminate the hazard, substitute or use engineering controls, then administrative controls, with personal protective equipment last. ISO 45001 requires this order to be applied when determining controls, so an auditor expects to see elimination considered before reliance on PPE.

Question 28Occupational health and safety management system fundamentals and the ISO 45001 standard

An organization's OH&S policy states a commitment to provide safe and healthy working conditions, but it contains no commitment to fulfil legal and other requirements. How should a lead auditor treat this?

  1. Raise it only as an observation, because policy content is a matter of top management discretion
  2. Raise it as a nonconformity, since ISO 45001 requires the policy to include a commitment to fulfil legal and other requirements Correct answer.
  3. Accept it, because the policy only needs to reflect the organization's own stated intentions
  4. Accept it, because legal compliance is verified through monitoring rather than stated in the policy

Explanation

ISO 45001 specifies required commitments for the OH&S policy, including providing safe and healthy working conditions, fulfilling legal and other requirements, and eliminating hazards and reducing risks. A policy missing the legal compliance commitment therefore fails a specific requirement and should be reported as a nonconformity rather than accepted or downgraded.

Question 29Occupational health and safety management system fundamentals and the ISO 45001 standard

An organization has identified a legal requirement for quarterly noise monitoring. Under ISO 45001, what must the organization do to maintain compliance?

  1. Include the requirement in the OH&S policy and communicate it to workers
  2. Add the requirement to the list of internal issues in clause 4.1
  3. Evaluate compliance with the requirement and record the results of that evaluation Correct answer.
  4. Reference the requirement in the management review minutes only

Explanation

ISO 45001 requires the organization to plan how it will evaluate compliance with legal and other requirements, evaluate that compliance, and maintain knowledge and understanding of its compliance status. Records of the compliance evaluation results serve as evidence that the requirement is being met.

Question 30Occupational health and safety management system fundamentals and the ISO 45001 standard

An auditor finds that the organization's internal audit programme has not been updated to reflect the results of previous audits, changes affecting the system, or the importance of the processes concerned. Which ISO 45001 requirement is most directly unfulfilled?

  1. The requirement to select competent auditors and ensure objectivity and impartiality
  2. The requirement to establish audit criteria and scope for each individual audit
  3. The requirement to report audit results to relevant workers and worker representatives
  4. The requirement to plan the audit programme with frequency, methods and responsibilities that consider such factors Correct answer.

Explanation

ISO 45001 requires the internal audit programme to be planned, established and maintained, with the frequency, methods, responsibilities, planning requirements and reporting defined, taking into account the importance of processes, changes, and results of previous audits. A programme that ignores these inputs fails that planning requirement.

Question 31Audit principles, audit types and the audit programme

In ISO 19011 terms, which statement best distinguishes an audit from other types of conformity assessment activity?

  1. An audit is a management review in which top management evaluates the continuing suitability of the OHSMS
  2. An audit is a systematic, independent and documented process for obtaining objective evidence and evaluating it against audit criteria Correct answer.
  3. An audit is an inspection carried out to verify that products meet contractual acceptance thresholds
  4. An audit is a certification decision taken by a conformity assessment body after technical review

Explanation

ISO 19011 defines an audit as a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively against audit criteria. Inspection, management review and certification decisions are distinct activities that may follow or feed into an audit but are not audits themselves.

Question 32Audit principles, audit types and the audit programme

Which of the following best describes the purpose of a first-party (internal) audit within an OHSMS?

  1. To provide input for management review and identify opportunities for improvement of the organization's own OHSMS Correct answer.
  2. To determine whether a certification body's auditors are technically competent
  3. To satisfy a supplier's contractual requirement that its subcontracted operations be audited
  4. To certify the organization's OHSMS against ISO 45001 for the benefit of its customers

Explanation

Internal audits are conducted by or on behalf of the organization itself to monitor and improve its own management system, and their results feed into management review and corrective action. Certification is a third-party activity, supplier audits are second-party, and auditor competence evaluation is not a first-party audit of the OHSMS.

Question 33Audit principles, audit types and the audit programme

An organization's certification body conducts a surveillance audit during the certification cycle. What is the primary purpose of this audit?

  1. To issue a new certificate for a scope that has not previously been audited
  2. To verify that the certified OHSMS continues to conform and to determine whether certification should be maintained Correct answer.
  3. To evaluate the organization's readiness for initial certification
  4. To replace the recertification audit because the cycle has been shortened

Explanation

Surveillance audits are conducted during the certification cycle to check that the certified management system continues to conform and to confirm that certification remains valid. They do not replace recertification, do not extend the scope to unaudited activities, and are not stage 1 readiness assessments.

Question 34Audit principles, audit types and the audit programme

Which statement best captures the principle of independence in auditing?

  1. Auditors should remain independent of the audit criteria and avoid reading the relevant standards
  2. Auditors should not audit their own work and should be free from bias and conflict of interest throughout the audit Correct answer.
  3. Auditors must always be accompanied by a technical expert to ensure impartiality
  4. Auditors must be employed by a different organization than the auditee in every type of audit

Explanation

Independence means auditors remain free from bias and conflict of interest and do not audit their own work, which preserves the objectivity of audit conclusions. It does not require employment by a separate organization in internal audits, nor does it mean being unfamiliar with the audit criteria.

Question 35Audit principles, audit types and the audit programme

In an ISO 45001-based audit programme, who is normally responsible for establishing the audit programme?

  1. Top management, or a person assigned responsibility for the audit programme by top management Correct answer.
  2. The certification body's lead auditor alone, regardless of the organization's wishes
  3. The external consultant who implemented the OHSMS
  4. The organization's workers' representative, acting without management involvement

Explanation

ISO 45001 requires top management to ensure the audit programme is established, and responsibility may be assigned to a person with the appropriate authority. The lead auditor implements individual audits within the programme but does not own the programme, and consultants who implemented the system should not control its audits.

Question 36Audit principles, audit types and the audit programme

Which statement best describes the difference between a stage 1 and a stage 2 certification audit?

  1. Stage 1 results in certification; stage 2 is a surveillance activity
  2. Stage 1 is optional and may be omitted at the discretion of the auditee
  3. Stage 1 evaluates effectiveness of controls; stage 2 reviews only the documented OHSMS
  4. Stage 1 evaluates readiness for stage 2 by reviewing documentation and understanding the organization; stage 2 evaluates implementation and effectiveness Correct answer.

Explanation

Stage 1 determines readiness for stage 2 by reviewing documented information, understanding the organization and identifying concerns; stage 2 then evaluates implementation and effectiveness of the OHSMS. Stage 1 does not result in certification, and in certification practice it is normally required.

Question 37Audit principles, audit types and the audit programme

An audit programme manager is planning the annual internal audit schedule. Which factor is most relevant when determining the frequency and extent of audits?

  1. The number of pages in the OHS manual
  2. The number of external consultants retained by the organization
  3. The seniority of the auditee's manager
  4. The OHS risk profile of activities, results of previous audits and the significance of changes to the organization Correct answer.

Explanation

ISO 45001 requires the audit programme to consider the importance of processes, changes affecting the organization, and the results of previous audits, so risk profile, prior findings and change are the governing factors. Documentation length, manager seniority and consultant numbers do not determine audit frequency.

Question 38Audit principles, audit types and the audit programme

A lead auditor is preparing an audit plan for a multi-site organization. Which approach best reflects the principle of risk-based sampling?

  1. Let the auditee choose which sites will be audited
  2. Audit every site for the same duration to ensure equal treatment
  3. Select only the sites that are geographically closest to the auditor's office
  4. Prioritize sites and processes with higher OHS risk, poor prior audit results or significant recent change Correct answer.

Explanation

Risk-based sampling directs audit effort toward higher-risk activities, areas with poor prior performance and recently changed processes, which maximizes the value of the audit. Geographic convenience, identical durations for every site, and auditee selection do not reflect risk-based planning and may compromise independence.

Question 39Audit principles, audit types and the audit programme

During an internal audit, an auditor finds evidence of an OHSMS nonconformity. To which of the following does the finding most directly relate?

  1. The auditee's annual financial targets
  2. The number of workers employed at the site
  3. The audit criteria, such as the requirements of ISO 45001 or the organization's own procedures Correct answer.
  4. The auditor's personal opinion about best practice

Explanation

Audit findings must be evaluated against the audit criteria, which may be the standard's requirements, the organization's procedures or contractual obligations. Personal opinions, financial targets and headcount are not audit criteria and cannot by themselves establish a nonconformity.

Question 40Audit principles, audit types and the audit programme

Which is the most appropriate action for an auditor who identifies a situation that presents an immediate and serious danger to workers during an audit?

  1. Continue the audit silently and mention the issue only in the final report
  2. Report the situation immediately to the auditee so that action can be taken, and record it as an audit finding Correct answer.
  3. Stop the audit permanently and leave the site without notifying anyone
  4. Ignore the issue because health and safety enforcement is outside the auditor's role

Explanation

Where an audit reveals an immediate risk to health and safety, the auditor should promptly inform the auditee so that action can be taken, and then record the matter as a finding. Delaying notification, abandoning the audit without communication, or ignoring the risk would be inappropriate.

Question 41Audit principles, audit types and the audit programme

An auditor has completed the audit and is preparing the audit report. Which is the most appropriate way to express a nonconformity?

  1. Use vague wording so that the auditee cannot dispute the finding
  2. State only the name of the responsible manager so that accountability is clear
  3. Include personal criticism of the auditee's staff to encourage improvement
  4. State the requirement, the objective evidence found, and the resulting nonconformity in clear, factual terms Correct answer.

Explanation

A well-written nonconformity identifies the requirement, the objective evidence and the resulting gap, allowing the auditee to understand and correct the issue. Naming individuals, using vague wording or criticizing staff undermines objectivity and does not support effective corrective action.

Question 42Audit principles, audit types and the audit programme

Which statement best describes the purpose of the audit programme's monitoring and review?

  1. To confirm that the auditee has closed every finding before the next audit
  2. To verify that each individual auditor has completed their assigned checklist
  3. To evaluate whether the programme is achieving its objectives and to identify needed improvements to the programme Correct answer.
  4. To replace the need for management review of the OHSMS

Explanation

ISO 19011 requires the audit programme to be monitored and reviewed so that its implementation and effectiveness can be evaluated and improvements identified. It does not substitute for management review, and closure of individual findings is tracked through corrective action rather than being the purpose of programme review.

Question 43Audit principles, audit types and the audit programme

An organization wishes to combine its ISO 45001 internal audit with its ISO 14001 internal audit. Which statement best reflects the requirements for a combined audit?

  1. Combining audits removes the need to evaluate conformity with either standard
  2. Combined audits are prohibited because each management system must be audited separately
  3. The audit may be combined provided the audit criteria for each system are addressed and the competence of the audit team covers both Correct answer.
  4. A combined audit is permitted only if the same auditor writes both reports in a single document

Explanation

ISO 19011 allows combined audits where an auditee is audited against more than one set of criteria, provided each set of criteria is addressed and the team has the necessary competence. Combining audits does not remove the obligation to evaluate conformity with each standard.

Question 44Audit principles, audit types and the audit programme

An auditor is assigned to audit the organization's incident investigation process but was previously responsible for managing that process. What is the most appropriate course of action?

  1. Proceed because previous experience guarantees a thorough audit
  2. Proceed and use the audit to justify the decisions made while managing the process
  3. Decline the assignment because auditing one's own former work compromises independence Correct answer.
  4. Proceed but omit any findings that could reflect poorly on the auditor's prior work

Explanation

Auditors should not audit their own work, and having managed the process being audited creates a conflict of interest that compromises independence. Experience may be useful, but it does not remove the need for an independent auditor, and omitting or justifying findings would further undermine objectivity.

Question 45Audit principles, audit types and the audit programme

During an internal audit, the auditee disagrees with a finding and provides additional objective evidence that the auditor had not seen. What is the most appropriate response?

  1. Maintain the finding unchanged because auditors must never appear to be wrong
  2. Escalate immediately to the certification body for a decision
  3. Remove all findings from the report to avoid conflict with the auditee
  4. Review the additional evidence and revise the finding if it is no longer supported Correct answer.

Explanation

Audit conclusions must be based on objective evidence, so new evidence must be evaluated and the finding adjusted if it is no longer supported. Maintaining a finding regardless of evidence, deleting all findings or escalating an internal disagreement to a certification body would be inappropriate.

Question 46Audit principles, audit types and the audit programme

Which of the following best describes the relationship between the audit programme and individual audit plans?

  1. The programme and the plan are identical documents with different titles
  2. The programme sets the overall schedule and arrangements for a set of audits, while each plan describes the activities for a single audit Correct answer.
  3. The plan sets the overall schedule for the year, while the programme describes a single audit
  4. The programme is prepared by the auditee, while the plan is prepared by the certification body

Explanation

An audit programme is the set of arrangements for a series of audits over a period, while an audit plan details the activities and arrangements for one specific audit. They operate at different levels and are not interchangeable documents.

Question 47Audit principles, audit types and the audit programme

An audit team is conducting a remote audit of a site that handles hazardous chemicals. Which consideration is most important when deciding whether remote techniques are appropriate?

  1. Whether the audit can be completed in a shorter time than an on-site audit
  2. Whether the remote methods can provide sufficient objective evidence of the physical conditions and controls relevant to the audit criteria Correct answer.
  3. Whether the auditor has a faster internet connection than the auditee
  4. Whether the auditee prefers not to host visitors on site

Explanation

The choice of remote or on-site methods must be driven by whether sufficient objective evidence can be obtained, particularly for physical conditions and controls that may not be observable remotely. Auditee preference, connection speed and time savings are not sufficient reasons to adopt methods that compromise evidence quality.

Question 48Audit principles, audit types and the audit programme

An audit programme manager is reviewing the competence needs of the audit team for an upcoming audit of a complex process. Which approach best reflects ISO 19011 guidance?

  1. Assign the audit to the process owner to ensure detailed technical knowledge
  2. Assign the audit to whoever is available, since competence can be developed during the audit
  3. Identify the knowledge and skills required by the audit and select team members whose competence matches those needs Correct answer.
  4. Assign only auditors who have the longest tenure with the organization

Explanation

ISO 19011 requires the competence of the audit team to be determined by the specific knowledge and skills needed for the audit, and team members selected accordingly. Assigning by availability, tenure or to the process owner does not ensure the required competence and may compromise independence.

Question 49Audit principles, audit types and the audit programme

A certification body's audit team identifies a potential nonconformity concerning a legal requirement that the auditee disputes on the basis of a recent regulatory interpretation. What is the most appropriate approach for the lead auditor?

  1. Defer entirely to the auditee's interpretation without further evaluation
  2. Withdraw the finding automatically because the auditee disagrees
  3. Report the matter as a criminal offence to the authorities
  4. Evaluate the evidence against the applicable legal requirement and the audit criteria, documenting the basis for the conclusion Correct answer.

Explanation

The lead auditor must base conclusions on objective evidence evaluated against the applicable legal requirement and agreed audit criteria, and document the reasoning. Automatic withdrawal, referral as a criminal matter or uncritical acceptance of the auditee's view would not be evidence-based.

Question 50Audit principles, audit types and the audit programme

An audit programme manager notices that the same minor nonconformity has recurred across three consecutive audit cycles in different departments. Which conclusion is most defensible?

  1. The recurrence should be ignored because minor findings do not require corrective action
  2. Each occurrence is unrelated and no action beyond individual correction is needed
  3. The corrective action process may be ineffective at addressing root causes, and the audit programme should be reviewed to examine systemic causes Correct answer.
  4. The recurrence proves that the auditors are applying inconsistent criteria

Explanation

Recurrence of the same nonconformity across cycles suggests that root causes are not being addressed and may point to a systemic weakness warranting review of the programme and corrective action process. Treating each occurrence in isolation, blaming auditors without evidence, or ignoring minor findings would miss the systemic issue.