Key Takeaways
- An internal audit under ISO 45001:2018 tests whether the occupational health and safety system works on the shop floor, not whether the manual looks tidy.
- Ten checkpoints cover the policy, hazards, worker consultation, legal compliance, objectives, competence, operational controls, emergencies, incidents and management review.
- Evidence beats opinion: every finding should point to a record, an observation or a conversation with a worker.
- Ontario plants should audit against the Occupational Health and Safety Act alongside the standard, because the two overlap but are not the same thing.
Many plants assume that a passing safety inspection means the management system is healthy, but an ISO 45001 internal audit checklist asks a different question: does the plant control its own risks, and can it prove it? The standard requires internal audits at planned intervals under clause 9.2 of ISO 45001:2018, and the results feed straight into management review. A registrar will ask to see them before any certification or surveillance visit.
The ten points below follow the order in which an auditor typically works through a plant. Each one names the clause, the evidence to ask for and the gap that shows up most often in Ontario manufacturing.
Before the first checkpoint, agree on scope and sampling. A plant with several shifts, a maintenance shop and a shipping dock should audit all of them across the cycle, and the auditor should be independent of the work being audited. Clause 9.2 asks for an audit program that considers the importance of the processes and the results of earlier audits, so areas with past incidents deserve more attention.
1. OH&S Policy Communication and Shop-Floor Worker Awareness
Clause 5.2 requires a policy that top management has approved and that is available to interested parties. The audit question is whether a press operator or a forklift driver can say what it commits the plant to, not whether it hangs on a wall.
- Ask three workers on different shifts what the policy means for their own job, and note whether the answers match its commitments.
- Check that the policy is current, signed by top management, and covers the commitment to eliminate hazards and to consult workers.
A common gap is a policy written once at certification and never revisited. If the plant has added a second building or a new product line since then, the audit should ask whether the policy still fits.
2. Hazard Identification and Risk Assessment Verification
Clause 6.1.2 asks the plant to identify hazards on an ongoing basis, including routine and non-routine activities, and to assess the risks. Auditors compare the register against what they see on the floor. A register that never changes after a new machine, a layout change or a near miss is a warning sign.
Sample two or three entries and follow each one to the floor. If the register rates a hazard as controlled by a guard, the guard should be there, and the person who works beside it should know why.
The guidance from the Canadian Centre for Occupational Health and Safety on hazard identification is a useful yardstick for the walk-through. For the process behind the register itself, see the plant guide on building a hazard identification and risk assessment process.
3. Worker Consultation and Health and Safety Committee Evidence
Clause 5.4 requires consultation and participation of workers, including non-managerial workers, in hazard identification, incident investigation and policy decisions. In Ontario this often shows up through the joint health and safety committee, and the provincial guide to health and safety committees explains how those committees and worker representatives are expected to operate.
Key Consideration: Minutes alone do not prove participation. Look for action items that trace back to a worker's concern, with a named owner and a closing date.
Workers also need a way to raise concerns without fear of reprisal. Ask how a new hire would report a hazard, and what happens to that report in the following week.
- Review committee minutes for the last several meetings and confirm that recommendations received a written response from management.
- Interview a worker representative to learn whether concerns are raised, heard and answered in a reasonable time.
4. Legal Compliance Evaluation Under Ontario OHSA and Regulations
Clause 6.1.3 requires the plant to determine the legal and other requirements that apply, and clause 9.1.2 requires it to evaluate compliance at planned intervals. For an Ontario plant, the core legal text is the Occupational Health and Safety Act, along with the regulations made under it, such as those covering industrial establishments.
An internal audit does not replace a Ministry of Labour inspection, and passing one does not guarantee the other. The audit tests whether the plant has a method to find out what applies, to check itself and to correct gaps before an inspector does.
One practical test is to pick a recent regulatory change or a new equipment installation and ask how the plant found out about it. The answer shows whether the legal register is a living tool or a one-time list.
5. OH&S Measurable Objectives and Program Action Plans
Clause 6.2 requires objectives that are measurable where practicable, consistent with the policy and monitored. The audit checks that each objective has an owner, resources and a timeline in an action plan, not just a target on a slide.
- Confirm that objectives connect to real risks from the register, such as machine guarding upgrades or reduced manual handling.
- Check progress records and ask what happened when an objective fell behind schedule.
Objectives that never change year to year usually mean nobody is using them. A good plan shows a few objectives closed, a few replaced and a reason for each decision.
6. Competence, Training Verifications, and Contractor Safety Oversight
Clause 7.2 requires the plant to determine the competence workers need and to keep evidence of it. The audit should compare training records with the actual tasks: who is authorized to run the press brake, who holds a lift truck certification and when each qualification expires.
Contractors belong in this checkpoint too. Clause 8.1.4 asks the plant to coordinate with contractors and control the risks they bring onto site. Maintenance crews, millwrights and temporary labor often work near live equipment, so check how they receive site orientation and how their work is controlled.
A short, direct check works well here: pick one contractor who worked on site last month and ask for the orientation record, the permit if one was needed and the name of the plant employee who supervised the job.
7. Operational Controls for Critical Industrial Machinery and Hazards
Clause 8.1 requires operational controls based on the hierarchy of controls, and the audit tests them at the machine. Walk the floor with the risk register in hand and verify that the controls it promises are in place and working.
- Inspect guarding, interlocks and emergency stops on a sample of presses, saws, conveyors and robotic cells, and compare them with the documented procedure.
- Observe a lockout and tagout event if one is scheduled, and confirm that the written steps match what the technician actually does.
- Review management of change records for any new equipment, process or material introduced since the last audit.
8. Emergency Preparedness Testing and Evacuation Drill Records
Clause 8.2 requires the plant to prepare for potential emergencies, respond to them, test the response where practicable and review it afterward. A fire, a chemical release, a serious injury on a night shift and a power failure each call for a plan that people have actually practiced.
Did You Know? Clause 8.2 of ISO 45001:2018 asks for periodic testing of planned response capability, and it expects the plant to review the plan after tests and after real emergencies.
Check drill records for the date, the shifts covered, what went wrong and what changed afterward. Confirm that first aid supplies, eyewash stations and fire equipment are in place, inspected and reachable.
Illustrative example: A plant runs an evacuation drill only on the day shift. The auditor finds that nights have a different supervisor, a smaller crew and a different exit route blocked by stock, so the corrective action covers every shift.
9. Incident Investigation Records and Root Cause Corrective Actions
Clause 10.2 requires the plant to react to incidents and nonconformities, investigate them, determine root causes and take corrective action. The audit looks at whether investigations stop at "operator error" or dig into why the system allowed the error.
Near misses should be recorded and reviewed, since they reveal risks before anyone is hurt. Sample a few investigations and trace each one from the report through to the corrective action and the check that it worked.
The same sample should show whether workers took part in the investigation, as clause 5.4 expects, and whether lessons reached other departments that run similar equipment.
10. Management Review Inputs and Continual Improvement Metrics
Clause 9.3 requires top management to review the system at planned intervals. The inputs include the status of actions from earlier reviews, audit results, incident trends, consultation outcomes and legal compliance. The outputs should include decisions about resources and improvement.
- Read the last management review record and confirm that it covers every required input, not only injury counts.
- Look for decisions with owners and dates, since a review that produces no actions has not driven improvement.
Quick-Reference Summary
| Checkpoint | Clause (ISO 45001:2018) | Primary evidence |
|---|---|---|
| Policy awareness | 5.2 | Worker interviews, signed policy |
| Hazard identification | 6.1.2 | Risk register, floor walk-through |
| Worker consultation | 5.4 | Committee minutes, management responses |
| Legal compliance | 6.1.3, 9.1.2 | Legal register, compliance evaluation |
| Objectives | 6.2 | Action plans, progress records |
| Competence and contractors | 7.2, 8.1.4 | Training records, contractor orientation |
| Operational controls | 8.1 | Machine inspection, procedures |
| Emergency preparedness | 8.2 | Drill records, equipment checks |
| Incident investigation | 10.2 | Investigation files, corrective actions |
| Management review | 9.3 | Review minutes, action log |
Plants that run these ten checks before the registrar arrives tend to find their own gaps first, which is the point of the exercise. The official page for ISO 45001:2018 confirms the current edition, and a plant preparing for its next external visit can pair this list with the surveillance audit preparation checklist. Plants that want a second opinion on their audit program can look at the ISO 45001 OH&S management service or talk to ISO Certification Consultants through the consultation page.
