ISO 45001 LA common mistakes
ISO 45001 LA · Understand the traps and how to avoid them.
Uses 'hazard', 'risk' and 'OH&S opportunity' interchangeably - e.g. answering that a trailing cable is a 'risk', or describing an opportunity as 'a chance event' rather than a circumstance that can lead to improvement of OH&S performance.
Everyday workplace language blurs the terms; candidates memorise the definitions as a list rather than as distinct concepts, and ISO 45001 uses 'OH&S risk' and 'OH&S opportunity' in a way that differs from plain-English 'risk'.
What to do instead
Drill the ISO 45001:2018 definitions verbatim until they are automatic (hazard = source with potential to cause injury and ill health; OH&S risk = combination of likelihood of occurrence of a work-related hazardous event and its severity; OH&S opportunity = circumstance or set of circumstances that can lead to improvement of OH&S performance). Then rewrite 20 scenario sentences, classifying each noun as hazard, risk, or opportunity, and check yourself against the definitions.
Answers questions on leadership and worker involvement by defaulting to generic 'management commitment' language and misses that clause 5.4 requires consultation AND participation of workers, and that clause 5.5 requires consultation with contractors and other interested parties where relevant.
5.4/5.5 are the requirements that most distinguish ISO 45001 from ISO 9001 and ISO 14001, so candidates who study by pattern-matching the other standards skip them; 'communication' (7.4) feels like it covers the same ground.
What to do instead
Build a one-page 'ISO 45001-only requirements' sheet (5.4 consultation and participation, 5.5 consultation with contractors, 8.1.2 hierarchy of controls, 6.1.2.1 hazard identification inputs such as human factors and work organisation, 9.1.2 evaluation of compliance, 8.1.4.1 outsourcing/procurement/contractors). Review it before every practice set and force yourself to name the exact clause any time a scenario involves workers or contractors.
Tracks each clause as an isolated checklist item so that a failure in the link between them is missed - for example, accepting a hazard identification record without following it through to the applicable control in 8.1.2 and the monitoring evidence in 9.1.2.
Study guides and personal checklists are organised clause-by-clause, which trains a horizontal 'cover every clause' habit; the standard is actually built on interacting processes and PDCA.
What to do instead
Practise 'vertical traces': pick one real hazard (e.g. work at height), then require evidence for each of its clauses in order - identification and risk assessment (6.1.2), legal requirement (6.1.3), objective and plan (6.2), control per the hierarchy (8.1.2), operational control (8.1.1), monitoring (9.1.2), incident/nonconformity (10.2). Audit one hazard all the way end-to-end rather than one clause across everything.
Misclassifies findings - records 'opportunity for improvement' or 'observation' when the evidence shows a requirement not fulfilled, or writes up a single isolated lapse as a major nonconformity (and vice versa for a system-wide breakdown).
Candidates lack a decision rule and are uncomfortable with the confrontational tone of writing a nonconformity; many also carry over 'observation' as a category that has no defined meaning in a certification audit.
What to do instead
Apply a written two-step decision rule every time: (1) Which 'shall' is not fulfilled by objective evidence? If none, it is not a finding - do not write it. (2) Is the non-fulfilment a systemic breakdown or does it leave the OH&S MS unable to achieve its intended results (or does an unrecognised legal obligation exist)? Then major; otherwise minor. State the rule's outcome in one sentence in your answer so the reasoning is visible.
Submits an audit plan that lists only dates, names and clause numbers, with no explicit audit criteria, no scope boundaries, no sampling/site coverage rationale and no note of previous audit results or the organisation's context and hazard profile.
Feels like paperwork; candidates rush to write checklists and treat the plan as a scheduling form rather than the contract that defines what will be judged against what.
What to do instead
Draft every plan from a fixed template that forces the fields: audit objectives, scope (organisational, functional, physical, temporal), audit criteria (ISO 45001 clauses, the organisation's own procedures, applicable legal and other requirements), sites/shifts to be covered with justification, sampling approach, and inputs from prior results, incidents and context. If any field is blank, the plan is not finished.
Writes nonconformity statements that are conclusions without evidence - e.g. 'No evidence of consultation with workers was found' or 'Procedure not followed' - with no clause quotation, no witness/location, and no document reference or date.
Reports written in a hurry from memory after interviews; candidates assume the reader saw what they saw, and 'no evidence' phrasing feels safe and non-judgemental.
What to do instead
Use a rigid three-part sentence structure and refuse to submit anything that doesn't fit it: Requirement (clause number + the 'shall' text) → Objective evidence (what was seen, read or heard, with document title/ID, revision/date, interviewee role, location, sample size) → Gap (how the evidence fails the requirement). 'No evidence of' may only appear in the gap sentence, never as the finding itself.
Conducts the audit at the desk - verifying the procedure exists, interviewing the manager, reading records - and never walks the workplace, watches the task being performed, or interviews the workers doing it; supported by leading questions such as 'You do have a permit-to-work system, don't you?'
Documents and managers are fast, comfortable and low-risk; workplace observation takes time, and leading questions get quick friendly confirmations.
What to do instead
Force triangulation on every clause sampled: documentation, interview, and direct observation or record - three origins of evidence. Convert every question to an open form ('Walk me through what happens when a contractor arrives on site' / 'Show me the last time you did this'), and record contradicting evidence rather than resolving it silently in the interview.
Recommends closure of corrective actions on the basis that the training was delivered, the procedure was re-issued, or the manager said it was fixed - without checking root-cause analysis, implementation evidence, and effectiveness (containment of recurrence).
Closing is treated as an administrative step to finish the report, and the difference between correction (fix the symptom) and corrective action (eliminate the cause) is not held firmly.
What to do instead
Before recommending closure, demand three artefacts in writing: the root-cause determination, evidence of implementation (dates, who, what changed), and evidence of effectiveness (verification activity and result, e.g. re-audit, monitoring data post-change, no recurrence over a defined period). Where effectiveness data cannot yet exist, record a follow-up verification date instead of closing.
Answers questions about managing an audit programme with content about a single audit - describing the audit plan, opening meeting and checklist when the question asked about programme objectives, auditor competence, programme monitoring and review, or resource planning - and vice versa.
The two vocabulary sets overlap heavily ('plan', 'schedule', 'review'), and most study time goes into the mechanics of running one audit.
What to do instead
Hold two separate mental models and name them explicitly before answering: the programme (ISO 19011 programme management - authority, objectives, extent, resources, competencies, procedures, monitoring and review of the programme's performance, records, risk to the programme) versus the audit (one audit plan, one team, one set of criteria, one report). Read the question stem for words like 'annual', 'overall', 'competence of the team' - programme signals.
Confuses the compliance-obligations requirements: treats 6.1.3 (determine and have access to up-to-date legal and other requirements) and 9.1.2 (evaluate compliance with those requirements, maintain knowledge and understanding) as the same requirement, and/or accepts a legal register with no evidence of evaluation.
Both clauses involve 'legal requirements', so candidates memorise one concept and map it to whichever clause appears in the question.
What to do instead
Learn them as two steps in a chain and test them separately during practice: 6.1.3 = identification, access and currency of the obligations (is the register complete and up to date?); 9.1.2 = evaluation of compliance, frequency, results and maintenance of knowledge and understanding of the compliance status. When a scenario gives you a register with no evaluation records, the finding is against 9.1.2, not 6.1.3.