ISO 45001 LI common mistakes
ISO 45001 LI · Understand the traps and how to avoid them.
Treating ISO 45001 as a document-control or 'write the manual' exercise, so when asked what the standard actually requires at a given clause the candidate recites 'we must have a documented procedure' for clauses that carry no documented-information requirement (e.g., 5.2 policy communication, 6.1.2 hazard identification process, 8.1.2 eliminating hazards).
Candidates transfer habits from older OHSAS 18001/ISO 9001-era training where 'procedure' was the default answer, and they memorize clause titles rather than the verbs ('maintain', 'retain', 'establish', 'consider').
What to do instead
Build a one-page clause map from memory listing, for each clause 4–10, whether it requires: nothing documented, 'maintain documented information', or 'retain documented information'. Test yourself by covering the standard and writing the requirement verb before checking. In practice questions, ask 'what does the standard require here?' before 'what would a good consultant do?'
Confusing 'hazard' with 'risk' and 'opportunity' in scenario items - e.g., labelling 'working at height' as the risk, or calling a legal nonconformity an OH&S opportunity - and then choosing an answer that mixes the three.
Everyday language uses 'risk' loosely, and the standard's definitions (hazard = source of potential injury/ill-health; risk = combination of likelihood and severity; OH&S opportunity = circumstance that can lead to improvement) are only subtly different in translation.
What to do instead
Drill with a fixed template: for any scenario write the hazard as a noun phrase ('unprotected roof edge'), the risk as the combination ('fall from height, fatal'), the control as the action, and the opportunity as the improvement. Re-read clauses 3.19, 3.21 and 3.20 definitions and the note in 6.1.1 before each practice set.
Skipping or rushing the context and scope work in initiation items - accepting a scope copied from a sister site, or failing to identify interested parties and their relevant needs and expectations (4.2) before designing the OH&S MS.
Candidates want to get to hazard identification and planning quickly, and scope/context feel like paperwork; exam items that describe a scope decision sound plausible on the surface.
What to do instead
Memorize that 4.1 requires determining external and internal issues, 4.2 requires determining interested parties and which of their needs become compliance obligations, and 4.3 requires the scope to be available as documented information and to state which activities/products/services are covered. Practise writing a defensible scope statement in two sentences and check it against 4.3's three bullets.
Designing the implementation sequence wrongly - e.g., planning to conduct the internal audit and management review before the OH&S MS processes are implemented, or starting with certification body selection before leadership commitment and worker consultation are established.
Candidates memorize clause numbers as a list and lose the logic that 4→5→6→7→8 must actually operate before 9 can evaluate anything.
What to do instead
Draw the PDCA cycle and place each clause on it, then write a realistic 12-month Gantt from memory: leadership/context/scope, hazard identification and legal register, risk and opportunity and objectives, support and operational control, then monitoring, internal audit, management review, then certification. Practise ordering questions by asking 'what must exist before this activity can produce a valid result?'
Treating hazard identification as a one-off list and missing the requirement to be proactive and to consider the four inputs in 6.1.2.1 - routine and non-routine activities, emergency situations, human factors, and past relevant incidents - plus the need to consider how work is organised, social factors and leadership.
Candidates default to the physical-hazard checklist they know from site inductions and forget psychosocial, organisational and emergency inputs, which is exactly what exam scenarios probe.
What to do instead
Rehearse a five-column grid: routine / non-routine / emergency / human and organisational factors / changes and incidents, and fill it for one familiar workplace. Memorize the 6.1.2.1 list as a mnemonic and check every hazard-identification question against it before choosing.
Misapplying the hierarchy of controls in 8.1.2 - selecting PPE, training or signage as the 'primary' control, or failing to recognise that the standard requires eliminating hazards first and using administrative controls only where higher-order controls are not practicable.
Real workplaces over-rely on PPE, so the distractor feels familiar; candidates also forget that 8.1.2 requires the hierarchy to be applied in the specified order and that PPE is last with a note about it being used only when other controls cannot adequately reduce risk.
What to do instead
Learn the order as a ladder (elimination, substitution, engineering controls and reorganisation of work, administrative controls including training, PPE) and for each practice scenario rank all options on the ladder before answering. Note that 'reorganisation of work' sits at the engineering level - a common trap.
Blaming the individual worker when a scenario involves a violation, instead of examining the systemic causes the standard expects - competence, consultation, supervision, design of the task, and whether the risk assessment was adequate.
Disciplinary framing is culturally dominant and appears as a plausible corrective action; candidates also confuse correction (fixing the immediate issue) with corrective action (addressing the cause).
What to do instead
For every incident scenario write two lists: 'correction' and 'corrective action', and force at least three systemic causes before any individual-behaviour cause. Recall 7.2 competence, 7.4 communication, 5.4 consultation and participation, and 10.2's requirement to evaluate the need for action to eliminate root causes.
Confusing performance evaluation with monitoring and measurement - e.g., citing 'number of inspections completed' as an OH&S performance indicator when the question asks for a measure of OH&S performance, or proposing to use the internal audit result as the only input to management review.
Lagging activity counts are easy to collect and appear in real KPI packs; candidates do not separate 9.1.1 (what to monitor and measure, methods, criteria, when results are analysed and evaluated) from 9.1.2 (evaluation of compliance) from 9.2 (internal audit) from 9.3 (management review).
What to do instead
Sort indicators into leading (proactive) and lagging (reactive) and be able to justify each. Learn the four 9.1.1 elements as a checklist and the 9.3 management review inputs as a numbered list. Practise questions by first naming which of 9.1.1 / 9.1.2 / 9.2 / 9.3 the item is testing.
Treating nonconformity, corrective action and continual improvement as interchangeable - writing 'retrain the worker' as a corrective action, closing a nonconformity without verifying effectiveness, or describing routine compliance as continual improvement.
The verbs sound similar and real management-system reports blur them; candidates also forget that 10.2 requires reviewing and evaluating the effectiveness of any corrective action taken and updating risks and opportunities if necessary.
What to do instead
Use a fixed three-question test for each scenario: Is this fixing the symptom (correction), removing the cause (corrective action), or enhancing performance (improvement)? Memorize 10.1's note that improvement includes innovation and reorganisation, and 10.2's sequence: react, evaluate need for action, implement, review effectiveness, update the risk assessment if needed, make changes to the OH&S MS.
Misunderstanding the certification audit itself - believing the certification body will tell the organisation how to fix findings, expecting a single-stage audit, assuming the stage 1 audit is optional or that the certificate is issued after stage 2 without any follow-up for major nonconformities, or thinking the auditor certifies the OH&S performance rather than the management system.
Certification is often learned second-hand from colleagues and from marketing material, and candidates mix ISO/IEC 17021-1 certification rules with ISO 19011 audit principles.
What to do instead
Learn the two-stage model: stage 1 reviews readiness and documentation and identifies concerns; stage 2 evaluates implementation and effectiveness. Learn that major nonconformities must be closed and verified before certification, that the certificate covers the management system and its scope, and that surveillance audits follow. Be able to distinguish the auditor's role (verify conformity, not consult) from the consultant's.