Preparing for an ISO 45001 Audit
Three stages: mandate, document review, design
Mandate. The client (usually the audit programme manager) defines the audit objectives, scope and criteria; auditors clarify them but do not unilaterally widen or narrow them. Confirm feasibility - adequate information, cooperation, time and resources. "Scope: ISO 45001" is a badly written scope; scope is the auditee's activities, sites and boundaries against which the audit is conducted.
Document review. Read the OH&S policy and scope, hazard identification and risk assessment outputs, legal and other requirements, objectives, operational control and emergency arrangements, internal audit and management review results, and previous findings. Read to plan, not to conclude - desk review is not an audit and gaps found on paper must be verified on site.
Design. Produce the audit plan: dates, sites, auditee contacts, processes and activities, time allocations, team assignments. Agree it with the auditee and approve it through the programme. Allocate time by risk and by the results of previous audits. Prepare work documents: checklists as memory aids, a sampling plan, and forms for recording findings consistently. Select a team with OH&S knowledge, sector knowledge, audit skills and language ability; a technical expert advises but does not audit alone.
Traps: treating the checklist as a script until the audit trail disappears; over-preparing so that accepting documents substitutes for gathering evidence; failing to confirm opening arrangements and logistics; confusing the audit plan (one audit) with the audit programme (the cycle); forgetting to plan sampling for multi-site or remote audits.
Rule of thumb: spend planning effort on the highest-risk processes first, then plan to test how clauses 9 and 10 drive improvement back into clauses 6 and 8.