Auditing OH&S hazards, risk assessment and legal/other requirements
This domain tests whether you can audit the technical core of ISO 45001 - 6.1.2 hazard identification and risk assessment, 6.1.3 legal and other requirements, and 9.1.2 evaluation of compliance - rather than confirming that documents exist.
Core rules and concepts
- Audit the chain: hazard, risk assessment, controls, monitoring or health surveillance, review. If any link is missing, the system is ineffective regardless of paperwork.
- Adequacy of hazard identification: does it cover routine and non-routine tasks, emergency situations, human factors such as fatigue, workload and competence, maintenance and cleaning, contractors and visitors, change, and the hazards of the organisation's products and services?
- Quality of risk assessment: is the method defined and applied consistently, and does it judge existing controls against the 8.1.2 hierarchy? Look for PPE used as the primary control where elimination or engineering is reasonably practicable.
- 6.1.3: the legal register must reflect actual hazards and stay current. 9.1.2 requires evaluation of compliance with evidence of evaluation, not just a list. Test how new legislation and new hazards enter the register.
- Supporting clauses where risk assessment usually fails in practice: 8.1.3 management of change, 8.1.4 contractors and outsourcing, 8.2 emergency preparedness, 7.2 competence.
- Interview the exposed people: ask what could hurt them and what they do about it. Their answer shows whether risk assessment reached the workplace.
Worked example
Stone benchtop fabrication. The risk assessment lists 'dust - wear mask'. The legal register omits respirable crystalline silica requirements, no exposure monitoring exists, RPE fit-testing is absent, and two workers describe dry cutting as normal practice. Three findings follow: 6.1.2.2 (assessment inadequate, controls not evaluated against the hierarchy), 6.1.3 (legal requirements incomplete) and 9.1.2 (no evaluation of compliance). Specific findings, not one vague 'risk management is weak'.
Traps that cost marks
- Treating a risk matrix on file as evidence the assessment is adequate.
- Confirming legal compliance by reading the register alone.
- Accepting PPE-first controls where engineering is practicable.
- Letting a zero-harm slogan stand in for hazard identification.