ISO 45001 LA cheat sheet

ISO 45001:2018 is the first international OH&S management system standard; it superseded OHSAS 18001, whose certifications ceased to be valid after the three-year migration period ending 12 March 2021.

ISO 45001 uses the Annex SL harmonised structure: clauses 1-3 are informative, requirements are contained in clauses 4-10, and no mandatory OH&S manual or prescribed hazard-register format exists.

The standard applies the Plan-Do-Check-Act cycle: Plan = clause 6 (planning), Do = clauses 7 and 8 (support, operation), Check = clause 9 (performance evaluation), Act = clause 10 (improvement).

Intended outcomes of the OH&S MS are prevention of work-related injury and ill health to workers, provision of safe and healthy workplaces, and fulfilment of legal and other requirements.

The term documented information replaces documented procedure/manual; the organisation determines what is needed for effectiveness, plus the items the standard explicitly requires to be retained or maintained.

Preventive action no longer exists as a separate clause; it is subsumed into risk-based planning (6.1) and action planning, and into management of change (8.1.3).

Two emphasis areas distinguish ISO 45001 from generic management system standards: consultation and participation of workers at all levels (5.4), and the hierarchy of controls (8.1.2).

The standard sets requirements for the management system, not absolute OH&S performance levels; top management remains accountable for the effectiveness of the OH&S MS (5.1).

Clause 4: determine external and internal issues (4.1), interested parties and their relevant needs and expectations (4.2), the scope as maintained documented information (4.3), and establish the OH&S MS and its processes (4.4).

Clause 5: top management must demonstrate leadership and take accountability for the OH&S MS (5.1), establish an OH&S policy as maintained documented information (5.2), and assign roles, responsibilities and authorities (5.3) including worker participation structures.

Clause 6.1.2.1 requires hazard identification to consider work organisation and social factors, routine and non-routine activities, past incidents and emergencies, uncontrolled situations, people factors, design of work and equipment, and actual or proposed changes.

Clause 8.1.2 sets the hierarchy of controls in descending precedence: eliminate the hazard, substitute with less hazardous processes, use engineering controls and reorganisation of work, use administrative controls including training, then PPE.

Clause 6.1.3 requires determination and access to up-to-date legal and other requirements; clause 9.1.2 requires evaluation of fulfilment of those requirements with retained documented information of results.

Clause 6.2 objectives must be consistent with the OH&S policy, measurable (if practicable), monitored, communicated, updated, and supported by planned actions with resources, responsibility, timeframe and evaluation indicators.

Clause 8.1.4 addresses procurement: 8.1.4.2 requires coordination of contractor control and verification of contractor competence and hazard control, and 8.1.4.3 addresses outsourced functions and processes.

Clause 9.2 internal audit: planned intervals, programme based on the importance of processes and results of previous audits, defined criteria and scope, objective and impartial auditors, reporting to management, and retained documented information.

Clause 10 distinguishes 10.2 (respond to incidents and nonconformities, investigate root cause, implement action, review effectiveness, update risk assessments) from 10.3 (continual improvement of OH&S performance and the OH&S MS).

An audit is a systematic, independent and documented process for obtaining objective evidence and evaluating it objectively against audit criteria to determine the extent of conformity.

ISO 19011:2018 sets seven principles: integrity, fair presentation, due professional care, confidentiality, independence, evidence-based approach and risk-based approach.

Independence is the basis for impartiality of the audit conclusion; auditors shall not audit their own work or an activity for which they hold direct responsibility.

Evidence-based approach means audit evidence must be verifiable and, since audits are conducted within finite time and resources, evidence is gathered by sampling.

Audit types by party: first party (internal audit), second party (audit by a customer or on behalf of a supplier relationship), third party (certification body or regulator).

ISO 19011 audit sequence: initiating the audit, preparing audit activities, conducting audit activities, preparing and distributing the report, completing the audit, and follow-up.

Findings are evaluated against criteria and classified as conformity or nonconformity; they may also record risks, opportunities and improvement points, and feed into the audit conclusion.

Auditor competence per ISO 19011 clause 7 combines personal behaviour, education, work experience, audit training and audit experience, plus discipline-specific OH&S knowledge.

Confidentiality: audit information shall not be disclosed to third parties without the client's authorisation, unless required by law or professional obligations.

Feasibility check comes first: confirm the audit is achievable given available information, auditee cooperation, time and resources; escalate to the client if it is not.

Document review of the OH&S MS documented information is done before on-site activity; gaps or contradictions found become specific audit focus areas in the plan.

The audit plan per ISO 19011 covers objectives, scope, criteria, dates and locations, expected time and duration, roles, resource allocation, communication arrangements and confidentiality.

Sampling design is prepared in advance and is risk-based: high-hazard processes, non-routine and night-shift work, contractors, recent incidents and previous nonconformities get proportionally more coverage.

The programme manager selects the audit team on the basis of competence required by the audit objectives, scope and criteria; technical experts provide knowledge but do not audit independently.

The auditee has the right to object to a proposed team member on documented grounds of conflict of interest; the objection is resolved with the client before the audit proceeds.

Work documents (checklists, forms, sampling plans) are guides only; they do not restrict the additional investigation an auditor may need to perform.

For certification, stage 1 evaluates documented information and site-specific conditions, information for planning stage 2, and readiness for stage 2; it does not necessarily take place on site.

The audit report states objectives, scope, criteria, dates and locations, participants, findings, conclusions, the degree of conformity with criteria, and any unresolved or divergent views.

The audit team leader owns and issues the report within the timeframe agreed in the audit plan; the report is dated, reviewed and approved and remains the property of the client.

Corrective action follows 10.2: correction of the condition, evaluation of the need for action, root cause investigation, implementation of action, review of effectiveness, and update of risks and opportunities.

Follow-up verification confirms that corrections and corrective actions were implemented and are effective; certification is granted or maintained only when major nonconformities have been verified as closed.

Certification cycle under ISO/IEC 17021-1: stage 1 and stage 2 initial audit, surveillance audits at least once a calendar year (first within 12 months of the certification decision), and recertification every three years.

The audit is completed when all activities in the agreed audit plan are accomplished, or otherwise agreed with the client, and audit records are retained and confidentiality maintained.

Follow-up is not part of every audit unless defined by the audit programme, legal requirements or the client; when omitted, this is stated in the report.

ISO 19011:2018 clause 5 sequence: establish programme objectives, identify programme risks and opportunities, establish the programme, implement it, monitor it, and review and improve it.

Audit programme means the arrangements for one or more audits planned for a specific time frame and directed at a specific purpose, including schedule, criteria and resources.

Programme frequency and depth are risk-based and proportional to: hazard significance, legal requirements, incident and ill health data, changes, results of previous audits and internal audit effectiveness.

The programme manager is responsible for resourcing, auditor competence and performance, communication with top management, and reporting on the programme's status and effectiveness.

Combined audit means two or more management systems audited together at a single auditee; joint audit means an audit carried out by two or more auditing organisations; a team may include technical experts and interpreters.

Programme records to retain include audit plans, reports, records of auditor competence and evaluation, and records of programme review and improvement actions.

Programme monitoring indicators include auditor and team performance, conformity of the programme with the plan, feedback from auditees and clients, and trend analysis of nonconformities.