Conducting an ISO 45001 Audit
From opening meeting to agreed findings
Conduct begins with the opening meeting: confirm purpose, scope, criteria and plan, explain communication channels and working arrangements, state that findings will be raised as they are identified, and note that the audit is a sample.
Gather evidence by three routes: interview, observation, and document and record review. Follow the trail - start with a record, trace it to the workplace, and interview the person doing the work. Talk to non-managerial workers: their account is often the only reliable evidence of participation under 5.4 and of awareness under 7.3.
Sample deliberately, representative and risk-weighted: sample more where risk is high or where evidence is weak, and never generalise one observation into a system-wide failure.
Compare evidence against criteria, then write the finding. A well-formed nonconformity has three parts: the requirement (clause or procedure), the evidence (where, what, when), and the issue. It describes the fact, never the person. Confirm factual accuracy with the auditee as each finding is raised, and hold audit team meetings to keep consistency across the team.
Grade findings using the client's rules: "major" typically means a required element is absent, a system-wide breakdown, a legal breach or significant risk; "minor" is an isolated lapse. Opportunities for improvement are observations, not nonconformities.
Traps: writing the clause number before seeing the evidence; accepting undocumented claims ("we always do that"); interviewing only managers; believing that correcting the problem during the audit erases the nonconformity; confusing a missing record with a missing activity.
Rule of thumb: if a finding cannot be written in one sentence containing a location and a requirement, evidence gathering is not finished.