ISO 45001 Occupational, Health & Safety Auditor
The ISO 45001 auditor exam tests the 2018 standard’s requirements for hazard identification, risk control, worker consultation and participation, legal compliance, and incident investigation, plus audit practice under ISO 19011:2018 and IAF MD 22.
Core rules
- ISO 45001:2018 follows Annex SL. “Worker” covers employees, contractors, agency staff, and self-employed persons; the organization’s OH&S management system covers work activities under its control.
- Clause 5.4 distinguishes consultation (providing information and seeking feedback before decisions) from participation (involvement in hazard identification, risk assessment, incident investigation, and developing policy and objectives). Barriers to participation must be removed.
- Clause 6.1.2 requires hazard identification considering routine and non-routine activities, emergency situations, human factors, and existing controls. Clause 6.1.3 covers legal and other requirements. Documented information is required for both.
- Clause 8.1.2 mandates the hierarchy of controls: elimination, substitution, engineering controls and work reorganization, administrative controls including training, then PPE. PPE is the last resort, not the first.
- Clause 10.2 covers incidents (including near misses and ill health), nonconformities, and corrective action. Incident investigation must determine root causes without blaming workers.
Worked example
A forklift route crosses a pedestrian walkway. The risk assessment rates the risk as “medium” and relies on a painted line and a caution sign. A near miss is recorded. Under 3.35, a near miss is an incident because it “could” result in injury; 10.2 therefore requires investigation and corrective action. The controls are administrative only. Clause 8.1.2 requires consideration of higher-order controls such as physical barriers or segregated routes. The finding is against 8.1.2 and possibly 10.2 if the near miss was not investigated. Consultation evidence under 5.4 may also be missing.
Traps
Using OHSAS 18001 clause numbers; treating consultation and participation as synonyms; accepting PPE or signage as the primary control; failing to treat a near miss as an incident; and confusing “hazard” (source of harm) with “risk” (combination of likelihood and severity).