ISO 45001 Internal Audit Checklist Guide: A Practical Guide for Workplace Safety

Workplace safety needs more than written rules. Businesses must check that their safety procedures work in real conditions. They must also find gaps, address risks, and improve how they protect workers. An ISO 45001 internal audit checklist helps teams do this in a clear and consistent way.

ISO 45001 provides a framework for an occupational health and safety management system (OH&S management system). It helps organizations manage workplace hazards, reduce risks, and improve safety performance. An internal audit checks whether the system meets the organization’s requirements, follows the standard, and works as intended. Clause 9.2 covers internal audits and the audit programme.

With eAuditor Audits & Inspections, teams can use digital checklists to record audit results, document findings, and support follow-up actions. As a result, safety managers can keep a clearer record of what they checked, what they found, and what needs to improve.

What Is an ISO 45001 Internal Audit Checklist?

An ISO 45001 internal audit checklist is a structured list of questions used to assess an organization’s occupational health and safety management system.

It helps auditors check whether the business has suitable safety processes and whether workers follow them in practice. It also helps auditors collect evidence instead of relying on assumptions.

For example, an auditor may check whether the organization identifies workplace hazards, evaluates risks, trains workers, investigates incidents, and reviews corrective actions.

The checklist should cover the relevant requirements of ISO 45001:2018 and the organization’s own safety procedures. It should also reflect the site’s activities, hazards, legal duties, and previous audit findings.

Most importantly, an audit should assess how well the system works. Simply confirming that a procedure exists is not enough. Auditors should also check whether staff understand it and follow it in daily work.

Why Is an ISO 45001 Internal Audit Important?

Internal audits help organizations find weaknesses before they lead to serious problems. They also provide evidence that the business reviews its safety management system and works to improve it.

1. Helps Identify Safety Gaps

An audit can reveal missing procedures, unclear responsibilities, weak risk controls, or incomplete records. Once teams identify these gaps, they can plan suitable action.

2. Checks Whether Controls Work

A written risk assessment does not prove that workers follow the required controls. Therefore, auditors should compare documented procedures with actual work practices.

3. Supports Continual Improvement

Audit findings can show where training, equipment, communication, or procedures need improvement. Teams can then use these findings to strengthen the safety system.

4. Encourages Worker Participation

Workers often understand hazards that managers may not see during routine reviews. Auditors can speak with workers to learn how procedures work on the ground and where problems occur.

5. Supports Management Decisions

Audit results help managers understand recurring issues and areas that need attention. They can then use this information to plan resources and review safety performance.

6. Helps Prepare for External Audits

Clear audit records and closed corrective actions can help an organization prepare for a certification or surveillance audit. However, an internal audit does not guarantee certification or prove full compliance by itself.

Who Should Use an ISO 45001 Internal Audit Checklist?

Any organization that operates or maintains an OH&S management system can benefit from a structured internal audit checklist.

Common users include:

• Health and safety managers: To review safety procedures, risk controls, and audit findings.
• Internal auditors: To assess conformity and collect objective evidence.
• Operations managers: To check whether work activities follow approved safety procedures.
• Human resources teams: To review relevant training and competence records.
• Maintenance teams: To check equipment safety, inspections, and maintenance controls.
• Construction businesses: To assess site hazards, contractor controls, permits, and worker training.
• Manufacturers: To review machine guarding, hazardous substances, emergency procedures, and operational risks.
• Warehouse operators: To check traffic routes, manual handling, storage, and equipment safety.
• Senior management: To review audit outcomes and support improvement.

Auditors should have suitable knowledge and skills. Where possible, they should not audit their own work, because impartiality helps produce more reliable findings.

What Should an ISO 45001 Internal Audit Checklist Cover?

A useful checklist should reflect the relevant clauses of ISO 45001:2018, especially Clauses 4 through 10. It should also consider the organization’s own processes and workplace risks.

Clause 4: Context of the Organization

This clause covers the issues and needs that shape the OH&S management system.

Auditors should check whether the organization:

• Identifies internal and external issues that affect workplace health and safety.

• Identifies relevant interested parties and their applicable needs.

• Defines the scope of its OH&S management system.

• Includes relevant activities, sites, and operations within that scope.

• Reviews the context and scope when important changes occur.

Clause 5: Leadership and Worker Participation

This clause focuses on leadership commitment, responsibilities, and worker involvement.

Auditors should check whether the organization:

• Has an OH&S policy that reflects its safety commitments.

• Defines roles and responsibilities for safety management.

• Shows leadership involvement in the OH&S management system.

• Provides ways for workers to participate in safety decisions.

• Consults workers on relevant hazards, risks, and control measures.

• Communicates safety responsibilities to the people who need to know them.

Clause 6: Planning

This clause covers hazards, risks, opportunities, objectives, and applicable legal requirements.

Auditors should check whether the organization:

• Identifies hazards from routine and non-routine work.

• Assesses OH&S risks and relevant opportunities.

• Considers changes, contractors, visitors, and emergency situations.

• Identifies applicable legal and other requirements.

• Evaluates compliance at planned intervals.

• Sets measurable OH&S objectives where appropriate.

• Plans actions to address risks and achieve safety objectives.

Clause 7: Support

This clause covers resources, competence, awareness, communication, and documented information.

Auditors should check whether the organization:

• Provides suitable resources for the OH&S management system.

• Identifies the skills needed for safety-related tasks.

• Provides relevant training and evaluates competence where needed.

• Makes workers aware of the safety policy, hazards, and their responsibilities.

• Communicates relevant safety information to workers and other interested parties.

• Controls documents and records so staff can access current information.

• Retains relevant training and competence records.

Clause 8: Operation

This clause covers operational planning, hazard controls, change management, procurement, contractors, and emergency preparedness.

Auditors should check whether the organization:

• Applies controls to reduce workplace risks.

• Follows approved safe work procedures.

• Uses suitable controls for high-risk activities.

• Manages changes that may affect workplace safety.

• Reviews safety requirements for contractors and purchased services.

• Coordinates safety responsibilities with contractors where needed.

• Prepares for potential emergency situations.

• Tests emergency arrangements at planned intervals where appropriate.

• Reviews lessons from drills, incidents, and changes.

Clause 9: Performance Evaluation

This clause covers monitoring, compliance evaluation, internal audits, and management review.

Auditors should check whether the organization:

• Monitors relevant OH&S performance indicators.

• Evaluates compliance with applicable legal and other requirements.

• Maintains records of compliance evaluations.

• Has a planned internal audit programme.

• Defines the scope and criteria for each audit.

• Uses competent auditors and supports impartiality.

• Reports audit results to relevant management and workers as appropriate.

• Retains evidence of the audit programme and results.

• Conducts management reviews at planned intervals.

Clause 10: Improvement

This clause focuses on incidents, nonconformities, corrective actions, and continual improvement.

Auditors should check whether the organization:

• Records and investigates relevant incidents and nonconformities.

• Takes action to control or correct identified problems.

• Determines the causes of significant or recurring issues.

• Implements corrective actions that address the causes.

• Checks whether corrective actions are effective.

• Updates risk assessments or procedures when needed.

• Uses audit findings and safety performance data to improve the system.

This clause-based checklist is a starting point. Auditors should adapt it to the actual work, risks, applicable requirements, and current controlled version of the standard.

How to Conduct an ISO 45001 Internal Audit

A well-planned audit helps teams gather useful evidence and focus on meaningful improvements. Follow these steps to manage the process.

Step 1: Prepare the Audit Programme

Set out which processes, sites, and activities will be audited and when. Consider the risks involved, changes in operations, previous findings, and the importance of each process.

Not every area needs the same level of attention. For example, a process with serious hazards or repeated incidents may need more frequent review than a low-risk administrative activity.

Step 2: Define the Scope and Criteria

State what the audit will cover. This may include a department, site, process, or specific ISO 45001 clauses.

Next, define the criteria. These may include the applicable standard requirements, internal procedures, risk assessments, legal obligations, and other approved requirements.

Step 3: Select a Competent Auditor

Choose someone who understands the audit criteria and the work being reviewed. The auditor should be able to ask clear questions, assess evidence, and record findings objectively.

Where practical, avoid assigning people to audit their own work.

Step 4: Review Relevant Documents

Before visiting the workplace, review the records needed for the audit. These may include:

• OH&S policy and objectives.
• Hazard identification and risk assessments.
• Legal and other requirements registers.
• Training and competence records.
• Inspection and maintenance records.
• Incident reports and investigations.
• Emergency plans and drill records.
• Previous audit reports and corrective actions.
• Management review records.

Document review helps the auditor identify areas that need closer attention during the site inspection.

Step 5: Inspect the Workplace

Observe actual work practices and compare them with approved procedures. Look for unsafe conditions, missing controls, and differences between written instructions and daily activities.

For example, check whether workers use required protective equipment, whether access routes remain clear, and whether equipment safety controls are in place.

Record objective evidence rather than relying on general statements.

Step 6: Speak With Workers and Managers

Ask workers how they identify hazards, report incidents, and access safety instructions. Ask managers how they monitor risks and follow up on problems.

These conversations can reveal gaps that documents alone may not show. However, auditors should respect confidentiality and record information accurately.

Step 7: Record Audit Findings

Compare the evidence with the defined audit criteria. Record conformities, nonconformities, and improvement opportunities where appropriate.

A useful finding should explain what was observed, what requirement applies, and what evidence supports the conclusion. Avoid vague statements such as “safety needs improvement” without specific supporting facts.

Step 8: Report the Results

Prepare an audit report that explains the scope, criteria, key findings, and conclusions. Share the results with the relevant managers and workers in line with the audit process.

Prioritize findings according to their significance and the organization’s procedures. Address immediate danger without waiting for the final report.

Step 9: Assign Corrective Actions

For each nonconformity, decide what needs to be corrected and whether the underlying cause needs further investigation. Assign responsibility and set a suitable completion date.

A quick fix may address the immediate problem. However, a corrective action should also consider why the problem happened and how to prevent it from recurring.

Step 10: Verify and Close the Findings

Review the evidence after the action is complete. Confirm whether it addresses the finding and whether the action has been effective.

If the problem remains, take further action. Finally, use recurring findings and lessons learned to improve the next audit programme.

How eAuditor Audits & Inspections Supports ISO 45001 Internal Audits

Managing an internal audit with paper forms and separate files can make it harder to track findings and follow-up work. eAuditor Audits & Inspections can support a more organized digital process.

1. Build Digital Audit Checklists

Teams can configure checklist questions to match their ISO 45001 audit process. They can organize questions around relevant clauses, departments, processes, or workplace hazards.

This helps auditors follow a consistent structure. However, the organization must ensure the checklist reflects the correct requirements and its own management system.

2. Record Audit Results on Site

Auditors can record inspection results as they work. Depending on the configured checklist and available features, they may also add comments or supporting evidence to explain what they found.

This can make audit records easier to understand and review later.

3. Document Nonconformities and Hazards

When an auditor identifies a gap, the finding can be recorded for follow-up. Clear notes help explain the issue and provide context for the person responsible for resolving it.

Where relevant action-management features are enabled, teams can assign follow-up actions and track their progress.

4. Support Accountability

Digital records can help teams see which audits have been completed and which findings still need attention. They can also help clarify responsibilities and support communication between auditors, managers, and action owners.

5. Keep Audit Evidence Organized

A consistent digital workflow can reduce reliance on scattered paper forms. It can also help teams review previous findings when planning future audits.

6. Support Continual Improvement

Managers can use recorded findings to identify recurring issues and areas that may need additional attention. They can then review whether training, procedures, or risk controls need to change.

Important: eAuditor supports checklist-based inspections and the recording of findings. It does not automatically determine ISO conformity, replace a competent auditor, interpret every legal obligation, or guarantee certification. The organization remains responsible for its audit programme, evidence, decisions, and corrective actions.

Explore available options in the eAuditor Template Library.

Common ISO 45001 Internal Audit Mistakes to Avoid

An audit may miss important issues if the team focuses only on paperwork or treats the checklist as a form to complete. Avoid these common mistakes.

Checking Documents Without Observing Work

A procedure may look complete while workers follow a different process. Compare documents with actual conditions and ask workers how the process works.

Using a Generic Checklist Without Adapting It

A checklist designed for an office may not cover the risks in a construction site or manufacturing plant. Adapt the questions to the site’s activities, hazards, and applicable requirements.

Failing to Define the Audit Scope

Without a clear scope, auditors may overlook important processes or spend too much time on unrelated issues. Define the boundaries and criteria before the audit starts.

Allowing Conflicts of Interest

Auditing one’s own work can affect impartiality. Choose an auditor who can assess the process objectively.

Writing Vague Findings

A finding without evidence is difficult to verify or resolve. Record the requirement, the observed condition, and the supporting evidence.

Closing Actions Too Early

Marking an action complete does not prove that it worked. Check the result and determine whether the issue has been corrected effectively.

Ignoring Worker Feedback

Workers may know about hazards, workarounds, or recurring problems that do not appear in formal records. Include relevant worker input in the audit.

Repeating the Same Audit Plan Every Year

A fixed plan may fail to reflect changes in risk or performance. Review the programme and adjust it based on previous results, significant changes, and safety priorities.

Best Practices for Effective ISO 45001 Internal Audits

Use these practices to improve audit quality and make the results more useful.

• Plan around risk: Give suitable attention to higher-risk processes and recurring issues.
• Use competent auditors: Make sure auditors understand the criteria, evidence, and work being reviewed.
• Maintain impartiality: Avoid auditing your own work wherever practical.
• Use clear questions: Ask questions that help establish whether requirements are met in practice.
• Collect objective evidence: Review records, observe activities, and speak with relevant people.
• Involve workers: Encourage honest feedback and consider their experience of workplace hazards.
• Record findings clearly: Explain what was observed and why it matters.
• Address urgent hazards quickly: Follow emergency and hazard-control procedures when immediate action is needed.
• Investigate root causes: Look beyond the immediate error when planning corrective actions.
• Verify effectiveness: Confirm that corrective actions prevent recurrence or reduce the problem as intended.
• Keep records controlled: Maintain accurate audit plans, reports, findings, and action records.
• Review the programme: Use audit results and changes in operations to improve future audits.

Benefits of Using a Digital ISO 45001 Internal Audit Checklist

A digital checklist can help make internal audits easier to manage, especially when an organization has several teams, departments, or sites.

More Consistent Audits

A common checklist structure helps auditors cover the same core requirements. At the same time, teams can adapt questions to suit different operations.

Clearer Audit Records

Recorded answers, notes, and supporting evidence can help explain why a finding was raised and what needs to happen next.

Better Follow-Up

A structured process can help teams assign responsibility for findings and review their status. This supports accountability and reduces the chance that issues will be overlooked.

Easier Review of Recurring Issues

Past findings can help managers identify repeat problems. They can then review whether procedures, resources, or training need improvement.

Improved Team Coordination

Digital records can support communication between auditors, supervisors, and action owners. This can be especially useful when several departments contribute to the safety management system.

These benefits depend on how the organization configures and uses its digital audit process. The quality of the audit still depends on competent auditors, suitable criteria, reliable evidence, and effective follow-up.

Related eAuditor Resources

Explore these eAuditor resources for further workplace safety and risk assessment guidance:

• eAuditor Template Library — Browse available digital checklist templates.
• Safety Audits Checklist — Explore general safety audit practices.
• General Workplace Health and Safety Checklist — Review common workplace safety checks.
• Chemical Risk Assessment Form — Explore a related risk assessment topic.

Use these resources as starting points and adapt the content to your organization’s management system and applicable requirements.

Frequently Asked Questions About ISO 45001 Internal Audit Checklists

1. What is an ISO 45001 internal audit checklist?

It is a structured set of questions used to assess whether an organization’s OH&S management system meets applicable requirements and works effectively. It helps auditors review processes, collect evidence, and record findings.

2. Which ISO 45001 clause covers internal audits?

Clause 9.2 of ISO 45001:2018 covers internal audits. It addresses the audit objectives and the need to establish and maintain an audit programme, define criteria and scope, support auditor impartiality, report results, and retain documented information.

3. How often should an ISO 45001 internal audit be conducted?

The organization must conduct audits at planned intervals. The audit programme should consider process importance, risks, previous results, and significant changes. The appropriate frequency depends on the organization’s circumstances and audit programme.

4. Who can conduct an ISO 45001 internal audit?

A competent person with suitable knowledge of the audit criteria and process can conduct the audit. Auditors should be selected and assigned in a way that supports objectivity and impartiality.

5. What documents should be reviewed during an ISO 45001 internal audit?

Relevant documents may include the OH&S policy, risk assessments, legal requirements register, training records, incident investigations, inspection records, emergency plans, previous audit reports, and corrective action records.

6. What is the difference between an internal audit and an external audit?

An internal audit is conducted on behalf of the organization to assess its own management system. An external certification audit is performed by an independent certification body to evaluate whether the organization meets the certification requirements.

7. What should an ISO 45001 internal audit report include?

It should identify the audit scope and criteria, explain the audit process, summarize the evidence reviewed, document findings, and state the audit conclusions. It should also identify required follow-up actions where applicable.

8. What happens when an auditor finds a nonconformity?

The organization should address the issue, assess its causes where appropriate, implement corrective action, and review whether the action was effective. The finding should remain open until the organization’s closure criteria have been met.

9. Can eAuditor Audits & Inspections be used for ISO 45001 internal audits?

eAuditor can support digital checklist-based audits, record results, document findings, and help manage follow-up actions where the relevant features are enabled. Organizations must still verify the checklist against ISO 45001 and their own requirements.

10. Does completing an ISO 45001 internal audit checklist guarantee certification?

No. A checklist is an audit aid, not a guarantee of conformity or certification. Certification depends on the organization’s overall management system and the independent certification process, where certification is sought.

Final Thoughts

An ISO 45001 internal audit checklist helps organizations review their safety management system in a structured way. It gives auditors a clear path for checking requirements, observing work, speaking with workers, and recording findings.

However, the value of an audit depends on more than completing questions. Teams must collect reliable evidence, report problems clearly, address root causes, and verify that corrective actions work.

With eAuditor Audits & Inspections, organizations can support the audit process through digital checklists, recorded findings, and follow-up workflows where available. By combining these tools with competent auditors and a risk-based audit programme, businesses can build a stronger approach to workplace health and safety.