An ISO 45001:2018 audit checks whether a company finds hazards, controls them in the right order of preference, involves its workers, and learns from incidents. Test it by walking the site, talking to workers and reading incident records, not only by reading the safety manual.
Last reviewed: 17 October 2026. Facts checked. This guide follows the published structure of ISO 45001:2018, the international standard for occupational health and safety (OH&S) management systems, which replaced the earlier OHSAS 18001 specification. The standard is a paid document, so we have not reproduced its text. Check the current edition. We have not cited Indian safety laws or limits, since they depend on industry and state. Check what applies to the site you audit.
What is different about ISO 45001
ISO 45001 shares its ten-clause layout with ISO 9001 and ISO 14001, so the general approach in our ISO 9001 checklist applies. Three things stand out.
- Workers must be consulted and take part. Not only the safety officer.
- Controls must follow a hierarchy.
- The organisation must think about contractors and visitors, not only its employees.
The hierarchy of controls is the order of preference for controlling a hazard: eliminate it, substitute something safer, use engineering controls, use administrative controls (rules, training, signs), and finally personal protective equipment (PPE). PPE is the last resort, not the first answer.
Checklist by clause
Clause 4: Context
Does the company understand the needs of workers and other interested parties? Does the scope cover all sites, activities and people under its control?
Clause 5: Leadership and worker participation
- Is the OH&S policy committed to safe workplaces, eliminating hazards and reducing risk?
- Can leaders show they take part, for example in site walks?
- 5.4: Are there ways for non-managerial workers to be consulted and take part, and are they free from reprisal when they report?
Clause 6: Planning
- 6.1.2 Hazard identification: Is there a process that looks at routine and non-routine work, past incidents, emergencies, people (including contractors and visitors) and changes?
- Are risks assessed and rated, and are legal requirements identified?
- Are objectives measurable?
Clause 7: Support
Competence for safety-critical tasks, awareness of hazards and workers' right to remove themselves from danger, communication, and document control.
Clause 8: Operation
- 8.1.2 Eliminating hazards and reducing risks: Do controls follow the hierarchy? Ask why PPE was chosen in place of a higher control.
- 8.1.3 Management of change: Are new equipment, processes and layouts assessed before they start?
- 8.1.4 Procurement, contractors and outsourcing: Are contractor risks assessed and communicated?
- 8.2 Emergency preparedness: Plans, drills, first aid, evacuation and post-drill review.
Clause 9: Performance evaluation
Monitoring, evaluation of compliance with legal requirements, internal audit and management review. Management review must include worker consultation results and incident trends.
Clause 10: Improvement
- 10.2: Are incidents reported, investigated, root causes found, and corrective action taken and checked?
- Are near misses recorded as well as injuries?
Evidence and what to look for on site
| Area | Evidence | Look for |
|---|---|---|
| Hazard register | Assessments by task | Missing tasks, old dates |
| Worker voice | Committee minutes, suggestion records | Actions that were closed |
| Controls | Machine guards, lockout points | Guards removed, PPE worn wrongly |
| Contractors | Induction and permits to work | Contractors without induction |
| Emergency | Drill logs, exits, extinguishers | Blocked exits, expired equipment |
| Incidents | Investigation reports | Cause stops at "worker error" |
Talk to workers away from managers if you can. Ask: what is the most dangerous part of your job and what has been done about it?
Common findings
- Hazard assessment not updated after a process change.
- No evidence that workers were consulted on risk assessment.
- PPE used as the main control without considering higher controls.
- Contractors working without induction.
- Incident investigations that blame the worker and stop.
- Emergency drills held for fire only.
Reporting
State requirement, evidence and gap in each finding, and grade them as per ISO audit nonconformities. If you see an immediate danger, stop and tell management on the spot. Do not wait for the closing meeting.
Frequently Asked Questions
Did ISO 45001 replace OHSAS 18001?
Yes. ISO 45001:2018 is the international standard and replaced the OHSAS 18001 specification. Check the transition status of any old certificate.
What is the hierarchy of controls?
The order in which to control a hazard: eliminate, substitute, engineering controls, administrative controls, then PPE.
Does ISO 45001 cover contractors?
Yes. The organisation must consider risks from contractors and outsourced work that it influences, and coordinate with them.
Who should an auditor interview?
Workers who do the tasks, supervisors, safety representatives, contractors and top management. Interview them separately where possible.
Is an ISO 45001 certificate proof of legal compliance?
No. The standard requires the company to know and evaluate compliance, but certification is not a legal clearance.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error