meets the applicable ISO 45001 requirements
An ISO 45001 internal audit is one of the most important tests of your Occupational Health and Safety Management System.
It determines whether the system meets the applicable ISO 45001 requirements, meets your organisation’s own OH&S management requirements, is actually being implemented, is maintained effectively and provides management with reliable information about workplace health and safety.
An effective internal audit should do much more than check whether policies, procedures and risk assessments exist. It should test what happens where the work is actually performed.
Are hazards being identified? Are risk controls operating? Are workers involved? Are contractors following requirements? Are incidents investigated properly? And are corrective actions actually working?
For organisations preparing for ISO 45001 certification, the internal audit is also one of the best opportunities to identify and correct weaknesses before the independent certification body finds them.
The goal is not to prove that your organisation has no problems. It is to determine whether your management system can find, control and improve them.
meets the applicable ISO 45001 requirements
meets your organisation's own OH&S management requirements
is actually being implemented
An internal audit should therefore do much more than check whether policies, procedures and risk assessments exist.
An ISO 45001 internal audit is one of the most important tests of your Occupational Health and Safety Management System.
It is to determine whether your management system can find, control and improve them.
A functioning audit process should address several key areas.
These are not administrative formalities.
They make internal audit a reliable management tool.
An ISO 45001 internal audit is a systematic and objective evaluation of the organisation's Occupational Health and Safety Management System.
The audit assesses whether the OHSMS conforms to:
It also determines whether the system is effectively implemented and maintained.
Internal audits may be performed by:
The important principles are competence, objectivity and impartiality.
The internal auditor should be able to evaluate the system critically rather than simply approve their own work.
Internal audit is a required part of the ISO 45001 management-system cycle.
Before pursuing external certification, the organisation should have implemented an internal-audit programme and be able to demonstrate that internal audits have actually taken place.
That means having evidence of:
Simply creating an annual audit schedule is not enough.
The process needs to operate.
An external certification auditor will generally want evidence that your organisation has already evaluated its own OHSMS before asking a third party to certify it.
Internal audits and certification audits serve different purposes.
The internal auditor helps the organisation understand whether the system works.
The certification auditor independently evaluates whether the organisation meets the requirements for certification.
A good internal audit should answer practical questions.
For example:
Are the OH&S risks identified in our risk assessments actually controlled?
Do employees follow the controls?
Does the hierarchy of controls influence our decisions?
Are workers genuinely consulted and able to participate?
Are contractors managed as described?
Are incidents properly investigated?
Are legal and other requirements being managed?
Do supervisors understand their responsibilities?
Does management act on OH&S performance information?
The audit should reveal the difference between:
what the organisation intends to happen
and
what actually happens.
That difference is often where the most valuable audit findings are found.
The audit programme is the broader plan for auditing the OHSMS over time.
It should reflect the organisation's actual risk environment rather than dividing audit attention equally across every department.
When planning the programme, consider factors such as:
A high-risk production process may deserve greater audit attention than a stable, low-risk administrative process.
For example, an organisation may prioritise internal auditing of:
Risk-based internal auditing helps direct limited audit resources towards areas where control failure could matter most.
Every audit should have a clear purpose.
Audit criteria are the requirements against which evidence will be compared.
Audit scope describes the boundaries of the audit.
An internal auditor needs appropriate competence.
Every audit should have a clear purpose.
An audit objective could be:
Without an objective, an audit can easily turn into a generic checklist exercise.
Audit criteria are the requirements against which evidence will be compared.
Depending on the audit, criteria might include:
The auditor should know:
Otherwise an audit finding can become personal opinion rather than objective evidence.
Audit scope describes the boundaries of the audit.
It can identify:
For example:
Audit objective: Evaluate contractor OH&S controls.
Scope: Maintenance contractors operating at the Johannesburg manufacturing site.
Criteria: Contractor-management procedure, applicable OHSMS requirements and relevant internal safety controls.
That gives the audit direction.
“ISO 45001 audit” alone does not.
An internal auditor needs appropriate competence.
That may require knowledge of:
The level of technical competence required depends on what is being audited.
Auditing office ergonomics requires different technical knowledge from auditing hazardous-chemical exposure or complex machinery controls.
Where specialist expertise is required, the audit team may need additional technical support.
ISO 45001 does not prescribe one universal personal certification that every internal auditor must hold.
The organisation needs to determine whether the auditor is competent for the work being performed.
Competence can come from a combination of:
Formal internal-auditor training can be valuable.
But possessing an auditor certificate alone does not prove someone can conduct an effective OH&S audit.
The quality of the audit matters.
The audit process needs to maintain objectivity and impartiality.
Ideally, auditors should not simply audit the activities for which they are directly responsible.
Possible approaches include:
In smaller organisations, absolute organisational independence may be difficult.
The practical objective is to avoid situations where someone is simply evaluating and approving their own work.
A strong audit follows processes through the organisation rather than remaining in the meeting room.
Before the audit, review relevant information.
This might include:
The auditor should understand enough about the activity to know where important risks may sit.
For a formal audit, explain:
Internal audit should not be designed to catch employees out.
People should understand that the purpose is to evaluate and improve the management system.
One of the strongest auditing techniques is following a process from beginning to end.
For example, if auditing forklift safety, do not stop after confirming that a forklift procedure exists.
Follow the activity.
Ask:
That provides much stronger assurance.
Worker interviews are particularly important under ISO 45001 because consultation and participation are core parts of the management system.
Useful questions can include:
Employees do not need to know ISO clause numbers.
They need to understand the health and safety controls relevant to their work.
The auditor should go where the work is performed.
Depending on the organisation, observations might include:
This often reveals differences between documented procedures and real operating practices.
ISO 45001 internal auditing should test whether risk assessments reflect actual work.
Ask:
A low risk score should not be accepted simply because it appears in a spreadsheet.
The auditor should look for the controls behind the number.
The auditor should test whether participation is meaningful.
Evidence may include:
Do not audit participation only by checking meeting attendance sheets.
Speak to workers.
Ask whether their input influences decisions.
Where contractors create material OH&S risk, internal audit should evaluate how they are managed.
Check areas such as:
A strong contractor procedure is meaningless if site controls are not applied in practice.
Internal auditing normally relies on sampling rather than checking every record.
Relevant evidence might include:
Audit findings should be specific and evidence-based.
Avoid statements such as:
“Safety needs improvement.”
That gives management very little information.
A stronger finding might identify:
Requirement: The organisation's procedure requires pre-use forklift inspections before each shift.
Evidence: Three sampled forklifts had no inspection record for the current shift.
Finding: The required pre-use inspection process was not consistently implemented.
Now management knows exactly what was expected and what evidence showed the gap.
The audit report should clearly explain:
The best report is not necessarily the longest.
It is the report management can use.
The exact scope depends on the audit programme, but a broader OHSMS audit may evaluate the following areas.
Check whether:
Check whether management:
The audit should not allow the safety manager to answer every leadership question on behalf of top management.
Check whether workers:
Check whether:
Check whether:
Check whether the organisation has a functioning process for:
An internal management-system audit should not be confused automatically with specialist legal-compliance auditing.
Where complex legal interpretation is required, suitable expertise may be necessary.
Check whether objectives:
Test whether controls work in practice.
Depending on the workplace, examples may include:
Check whether control decisions automatically default to administrative procedures or PPE.
Ask whether stronger controls were reasonably considered.
For example:
Could the hazard have been eliminated?
Could it have been substituted?
Could an engineering solution reduce exposure?
That gives more assurance than simply checking PPE issue records.
Check whether people are:
Training attendance alone does not automatically demonstrate competence.
Check whether:
Check whether the organisation monitors useful OH&S indicators.
Do not rely exclusively on injury statistics.
Consider both:
Check whether incidents are used for learning.
Ask:
Yes, the internal-audit process itself should eventually be audited.
Check:
Check whether management review produces useful decisions.
Does leadership consider:
The review should influence action.
Check whether:
A checklist can help provide coverage, but it should not replace auditor judgement.
An audit finding results from comparing evidence with audit criteria.
Findings may identify:
The organisation should have a clear way to record and manage findings.
A nonconformity exists where a requirement has not been fulfilled.
For example:
Requirement: Workers operating a specific machine must complete defined competence training.
Evidence: Two sampled operators were performing the task without evidence of the required competence assessment.
Finding: The organisation could not demonstrate that the defined competence requirement had been implemented for all sampled operators.
That is an evidence-based finding.
Internal auditors should not turn personal preferences into nonconformities.
For example:
“I think you should use a different colour form.”
is not a valid finding unless there is an actual requirement that has not been fulfilled.
Auditors test:
Requirement → Evidence → Conformity or Gap
They do not impose their preferred management style.
Internal audit often identifies issues requiring more than an immediate fix.
Consider a missing machine guard.
Correction: Replace the guard.
That addresses the immediate unsafe condition.
But if guards repeatedly go missing, corrective action requires more investigation.
Possible underlying causes include:
Corrective action addresses the cause to reduce recurrence.
This is an important part of ISO 45001 continual improvement.
Not every minor issue requires a complicated root-cause investigation.
But significant or recurring nonconformities should be understood properly.
Useful questions include:
Avoid using:
“Human error”
as the automatic final answer.
People make mistakes.
The management-system question is often:
ISO 45001 requires internal audits at planned intervals.
It does not prescribe one universal frequency that every organisation must follow.
The organisation should determine appropriate frequency based on factors such as:
A common approach is to operate an annual audit programme while distributing audits throughout the year.
For example:
Quarter 1: Contractor management
Quarter 2: Hazard identification and risk controls
Quarter 3: Emergency preparedness and competence
Quarter 4: Broader OHSMS certification-readiness audit
Higher-risk processes can be audited more frequently.
The programme should fit the organisation.
The purpose of the audit programme is to provide enough reliable information to determine whether the OHSMS conforms and is effectively implemented and maintained.
That does not mean every clause needs an identical standalone audit every calendar year.
The organisation should plan appropriate coverage considering:
Over time, the audit programme should provide suitable coverage of the OHSMS.
These activities are related, but they are not automatically identical.
An ISO 45001 internal auditor might assess whether the organisation:
But a detailed technical evaluation of whether every South African statutory requirement has been correctly interpreted may require specialist legal, engineering, occupational-hygiene or other technical expertise.
This distinction matters.
An ISO management-system auditor should not pretend to provide specialist legal conclusions outside their competence.
For South African organisations, the internal audit should consider whether the OHSMS's legal-compliance processes are functioning effectively.
The Occupational Health and Safety Act 85 of 1993 and applicable regulations may create specific duties depending on the organisation and activities.
Internal auditing can test whether relevant legal requirements have been:
However:
And an ISO 45001 internal audit does not automatically replace specialist statutory inspections, occupational hygiene assessments or other legally required evaluations.
For organisations pursuing certification, internal audit is one of the strongest indicators of readiness.
Before Stage 1 and Stage 2, the internal audit should give management a realistic picture of whether:
The more honest the internal audit is, the more useful it becomes.
An audit designed to produce “zero findings” can create false confidence.
A certification body may then identify weaknesses the organisation should have discovered itself.
Do not conduct the internal audit the day before the certification body arrives.
The organisation needs enough time to:
Where significant gaps are identified, the certification schedule may need to be reconsidered.
Finding a serious problem internally and addressing it properly is better than knowingly proceeding into certification with an ineffective control.
An organisation can appoint a competent external auditor to perform its internal audit.
This can be particularly useful where:
The audit is still considered an internal audit because it is conducted for the organisation's own management-system purposes.
The external internal-audit provider does not issue ISO certification.
Certification remains the responsibility of the independent certification body.
An external audit can provide several advantages.
External auditors may notice practices employees have become accustomed to.
Experienced auditors can identify common management-system weaknesses efficiently.
A competent auditor can connect documentation to workplace risk rather than only checking clauses.
A strong pre-certification audit can identify problems before the certification body arrives.
The organisation does not need to maintain the same depth of audit capability internally.
However, outsourcing the audit does not outsource management responsibility.
Management still needs to understand the findings and implement corrective action.
Where an organisation operates an Integrated Management System, internal audits can often evaluate multiple standards through the same business process.
This can be more effective than auditing three separate systems.
For example, a contractor-management audit could examine:
Likewise, one integrated audit can potentially assess common processes such as:
The audit team still needs sufficient competence across all disciplines being evaluated.
A risk assessment proves that someone completed a risk assessment.
It does not prove the risk is controlled.
Go to the workplace.
Checklist coverage can help.
But process auditing tells you much more about whether the system works.
This can undermine objectivity.
Use cross-functional or external auditing where appropriate.
Internal audit is an ongoing management-system tool.
It should not exist only because the certification auditor is coming.
Do not ask operators:
“What does Clause 5.4 require?”
Ask:
“How do you raise a safety concern?”
The second question tests the management system.
ISO 45001 is about occupational health and safety.
The audit needs to reach the workplace.
Check whether the controls behind that score actually exist and work.
Interview workers.
Do not assess consultation only through minutes and attendance sheets.
Connect requirements to objective evidence.
Corrective action should improve the actual system, not simply change a document status from open to closed.
An ISO 45001 internal audit is an objective assessment used to determine whether an Occupational Health and Safety Management System conforms to applicable requirements and is effectively implemented and maintained.
Yes. Internal auditing is part of ISO 45001's performance-evaluation requirements and forms an important part of certification readiness.
A competent employee, audit team or external competent auditor can perform the audit, provided appropriate objectivity and impartiality are maintained.
ISO 45001 does not prescribe one universal personal auditor qualification. Organisations need to ensure auditors have appropriate competence for the audit they conduct.
Auditors should maintain objectivity and impartiality. Where auditing their own responsibilities would compromise this, another auditor or external resource should be used.
Audits must occur at planned intervals. The organisation should establish frequency based on risk, importance, previous findings, changes and other relevant factors rather than rely on one universal timetable.
The audit programme needs suitable coverage to determine whether the OHSMS conforms and works effectively. This does not necessarily require every clause to receive an identical standalone audit every year.
Worker interviews are highly valuable because ISO 45001 places strong emphasis on worker consultation and participation. They also help the auditor establish whether documented controls reflect actual work.
Risk management should receive appropriate audit attention. Auditors can test whether hazards are identified, assessments reflect actual activities and controls are implemented effectively.
No. They can overlap, but an ISO 45001 internal audit evaluates the management system against defined audit criteria. Detailed statutory compliance assessment may require additional specialist expertise.
Yes. A competent external auditor can conduct the internal audit on the organisation's behalf.
The internal-audit process should be implemented before external certification, together with other required management-system processes such as management review.
Yes. Organisations operating an Integrated Management System can combine suitable audit activities, provided the requirements and technical issues of each discipline receive adequate coverage.
The best internal audit is not the one with the fewest findings.
It is the one that gives management the clearest picture of whether occupational health and safety risks are actually under control.
A strong ISO 45001 internal audit helps you understand:
That makes internal auditing a business tool, not simply an ISO requirement.
ISO Specialist South Africa can support organisations with ISO 45001 internal audits as part of implementation, certification readiness and ongoing management-system improvement.
We audit the system where it operates: in your processes and workplace, not just inside your documentation.
Not sure whether your organisation is ready for ISO 45001 certification?
Our ISO 45001 Readiness Checklist helps you assess the key areas of your Occupational Health and Safety Management System before you start implementation or prepare for certification.
It gives you a practical way to review how you identify hazards and manage risks, meet your legal requirements, involve workers in health and safety, and handle incidents. You’ll see where you’re already strong, where the gaps are, and what steps you need to take to become certification-ready.