Skip to content

Free template

Updated

ISO 45001 internal audit checklist

An ISO 45001 internal audit checklist is the set of questions an internal auditor uses to check that a site's occupational health and safety management system works as planned and meets ISO 45001. Clause 9.2 of the standard asks for internal audits at planned intervals; this checklist is for the part most audits do worst, the plant floor. It has 44 original questions in 16 topics, from task-level risk assessment, the hierarchy of controls, lockout and machine guarding to contractors, chemicals, change and legal requirements. Each question names the clause it tests (ISO 45001:2018 numbering), the evidence to look for and the sample to take, and 12 open interview prompts cover the people who do the work, which is where record-based audits fall short. The PDF has the audit plan, the checklist, an interview record, a finding report, a findings log, how to run the audit and a worked example. The Excel version grades each answer, works out conformance by topic and by clause, flags findings missing from the log and overdue actions, and checks that the interviews reached at least 5 people on more than one shift.

Free to use: print it, copy it and edit it for your team. Enter your name and work email once to download.

Page 1 of the ISO 45001 internal audit checklistThe audit plan with an independence check, the sample to take for each of 16 safety topics and the five grades.
44 questions in 16 topicsISO 45001:2018 clause for eachEvidence to look for and sample to take12 worker interview promptsGrades your programme ownsFindings log with owners and due datesConformance by topic and clauseUS OSHA rule referencesWorked example

When to use it

When to use an ISO 45001 internal audit checklist

  • Running the site's ISO 45001 internal audit programme: one area or department per audit, on the schedule the programme sets.
  • Before a certification or surveillance audit, to find the gaps on the floor before the certification body does.
  • After a serious injury, a run of near misses or a big change (a new line, a new chemical, a new contractor), as an audit of that area.
  • When a customer asks for evidence that your safety management system is checked from the inside.

How to fill it in

  1. 1

    Plan the audit from risk

    Pick the area from the audit programme: the highest risks, recent injuries and near misses, changes, and what the last audit found. Fill in the audit plan, choose auditors who do not work in or manage the area, send the plan a few days ahead and book a visit to the night or weekend shift.

  2. 2

    Start with the people who do the work

    Talk to at least 5 people who are not managers or supervisors, on more than one shift, away from their supervisor. Use the 12 prompts, write roles and shifts, not names, and note which checklist question each answer feeds.

  3. 3

    Watch the tasks, then check the records

    Take the sample shown for each topic: watch the task, ask the operator, then follow it to the risk assessment, the permit, the training record. Write what you saw for every question, conforming ones too.

  4. 4

    Grade each question

    Conforming, opportunity, minor, major or N/A. The definitions are this template's choice; your audit programme decides them. Conformance = (conforming + opportunity) ÷ questions graded, with N/A left out.

  5. 5

    Make it safe, then write the finding

    Anyone at immediate risk: stop the work before you move on. Then write each finding in four parts: the condition, the requirement it fails, the evidence and the impact.

  6. 6

    Follow up until each finding is checked

    The area owner fixes it now, finds the cause and puts in a corrective action, using the strongest control that is practical. Close a finding only after someone has checked that it worked, and report the results to managers and to the workers concerned (9.2.2).

Worker interviews

12 open questions to ask the people who do the work

Clause 5.4 of ISO 45001:2018 asks for the consultation and participation of non-managerial workers, and a checklist answered from records cannot test it. Ask at least 5 people on more than one shift, away from their supervisor, and write roles, not names. Then check what they tell you on the floor and in the records.

  • 1

    Ask
    Walk me through your job from the start of the shift. Which part of it could hurt you?
    What you are listening for
    Hazards and non-routine steps that are not on the risk assessment.
    Clause
    6.1.2.1

  • 2

    Ask
    What do you do when the machine jams or a part sticks? Can you show me?
    What you are listening for
    Reaching past a guard, whether they lock out, inch mode, the tools they use.
    Clause
    8.1

  • 3

    Ask
    Tell me about the last time you raised a safety concern. What happened next?
    What you are listening for
    How they raised it, whether anyone came back to them, how long it took.
    Clause
    5.4

  • 4

    Ask
    What has changed in your work in the last few months: machine, material, layout, hours, crew?
    What you are listening for
    Changes that are missing from the change log.
    Clause
    8.1.3

  • 5

    Ask
    Which job here do people least like doing, and why?
    What you are listening for
    Lifting, reaching, repetition, heat or noise, and the workarounds people use.
    Clause
    6.1.2.1

  • 6

    Ask
    If you thought a job could seriously hurt you, what would you do? What would happen to you?
    What you are listening for
    Whether they know they can stop, and whether they fear what happens next.
    Clause
    7.3

  • 7

    Ask
    Who decided what PPE you wear here? Does any of it get in the way of the work?
    What you are listening for
    Whether they were asked, how it fits, items taken off because they slow the job down.
    Clause
    8.1.2

  • 8

    Ask
    What did you hear about the last injury or near miss in this area?
    What you are listening for
    Whether the findings and the changes reached them.
    Clause
    10.2

  • 9

    Ask
    How did you learn to do this job safely? Who showed you, and how did they check?
    What you are listening for
    Whether it agrees with the training record and the sign-off.
    Clause
    7.2

  • 10

    Ask
    When contractors work near you, how do you find out what they are doing and what to keep clear of?
    What you are listening for
    Whether the host tells the area, and contractors seen working with nobody from the site.
    Clause
    8.1.4.2

  • 11

    Ask
    Is there anything that would make someone here think twice before reporting a small injury?
    What you are listening for
    Bonuses, prizes or boards tied to injury-free days, blame, paperwork, waiting time.
    Clause
    5.4

  • 12

    Ask
    If you could change one thing to make this job safer, what would it be? Have you told anyone?
    What you are listening for
    Ideas nobody asked for, and ideas raised and then lost.
    Clause
    5.4

What's on the checklist

The 44 audit questions, by plant-floor topic

Sixteen topics, each with the sample to take: watch the work, talk to the people who do it, then check the records. Every question names the ISO 45001:2018 clause it tests and what to look for; the OSHA references apply to US plants only. On the sheet each question has space for the evidence you saw, a grade and a finding number.

Hazard identification and risk assessment

Sample: 3 tasks running today, at least one of them non-routine (clearing a jam, a die change, cleaning, a repair), and the newest risk assessment in the area.

  1. 1Watch a task being done, then read its risk assessment: does the assessment describe the job as it is really done, including setting up, clearing and cleaning? Look for: steps and hazards you saw that the assessment leaves out. (6.1.2.1 Hazard identification)
  2. 2Are non-routine jobs assessed, or only normal running? Ask an operator what they do when the machine jams, then find that job in the assessments. Look for: assessments for clearing jams, changeovers, cleaning and breakdown repairs. (6.1.2.1 Hazard identification)
  3. 3Did the people who do the task take part in its assessment, and was the assessment reviewed after the last incident, change or new information on that task? Look for: who took part, the review date, the last incident on the task and what changed in the assessment after it. (6.1.2.2 Assessment of OH&S risks and other risks to the OH&S management system)
  4. 4Is the site's rating method used the same way on every task, and does each rating count only the controls that are really in place? Look for: the method and its criteria, two ratings compared side by side, any rating that relies on a control you found missing. (6.1.2.2 Assessment of OH&S risks and other risks to the OH&S management system)

Hierarchy of controls

Sample: the 3 highest-rated risks in the area and every control listed for them, each control seen in place.

  1. 5For the highest risks, were removing the hazard, substituting it and engineering controls considered before procedures and PPE, with a reason written down where a stronger control was not used? Look for: the options considered, the control chosen and the reason for it. (8.1.2 Eliminating hazards and reducing OH&S risks)
  2. 6Is each control on the assessment in place and working at the station? Ask the operator whether it ever gets bypassed, and when. Look for: the guard fitted, the interlock working, the extraction running, the barrier in place, signs of a workaround. (8.1.2 Eliminating hazards and reducing OH&S risks)
  3. 7When an action was taken on a risk, did someone check afterwards that it worked and rate the risk again? Look for: one completed action, the check made after it (a measurement or an observation), the new rating. (6.1.4 Planning action)

Lockout/tagout and energy control

Sample: 2 machines with written energy control procedures, 1 lockout done this week (or one done for you), and the last periodic inspection of each procedure.

  1. 8Does each machine in the sample have its own energy control procedure that lists every energy source, stored energy included (springs, air, hydraulics, gravity, capacitors)? Look for: the procedure checked against the machine itself and its labelled isolation points. US plants: OSHA 29 CFR 1910.147(c)(4). (8.1 Operational planning and control)
  2. 9Walk through a recent lockout with the person who did it: was every source isolated and locked with their own lock, and was zero energy checked before work started? Look for: personal locks and tags, the try or test step, a group lockout box where a crew worked. (8.1 Operational planning and control)
  3. 10Has each procedure in the sample been inspected in the last 12 months by an authorized person who does not use it, including a talk with the people who do? Look for: the inspection record, who inspected, who was reviewed. US plants: OSHA 29 CFR 1910.147(c)(6) sets at least once a year. (9.1 Monitoring, measurement, analysis and performance evaluation)

Machine guarding

Sample: 4 machines, including the oldest, one changed in the last year and one where operators clear jams.

  1. 11On each machine in the sample, are the point of operation, nip points, rotating parts and flying chips or sparks guarded, with guards fixed in place or interlocked? Look for: each machine walked round while it runs; missing, open or modified guards. US plants: OSHA 29 CFR 1910.212(a). (8.1.2 Eliminating hazards and reducing OH&S risks)
  2. 12Are interlocks, light curtains and emergency stops tested at a set frequency, and does a test you watch agree with the record? Look for: the test record, one test watched with maintenance. (9.1 Monitoring, measurement, analysis and performance evaluation)
  3. 13Ask the operator to show you how they clear a jam or make an adjustment: can it be done without reaching past a guard while the machine can move? Look for: the method against the procedure, the tools provided, tape, ties or magnets on interlocks. (8.1 Operational planning and control)

Emergency preparedness

Sample: the area's emergency plan, the last drill, 3 workers from different shifts and 5 pieces of emergency equipment.

  1. 14Ask 3 workers what they would do if the alarm sounded now, or if someone near them was hurt: where they go, who they call, who gives first aid. Look for: answers that agree with the plan; first aiders named for every shift. (8.2 Emergency preparedness and response)
  2. 15Was the response tested by a drill at the interval the site set, on more than one shift, and was something changed after the drill was reviewed? Look for: the drill record, the time to clear and account for everyone, the review and what changed. (8.2 Emergency preparedness and response)
  3. 16Is emergency equipment in place, unblocked and checked: extinguishers, eyewash stations and showers, spill kits, exits? Look for: 5 items against their check tags. US plants: OSHA 29 CFR 1910.157(e) asks for a monthly visual check and annual maintenance of portable extinguishers. (8.2 Emergency preparedness and response)

Contractor control

Sample: every contractor on site on the audit day, and 2 contractor jobs from the last month.

  1. 17Were the contractors on site today selected using safety criteria, and told the site rules and the hazards of the area before they started? Look for: the approval record, a sign-in or induction for each person, the hazards they were told about. (8.1.4.2 Contractors)
  2. 18For high-risk contractor work (at height, hot work, confined space, energy isolation), is there a permit or an agreed plan, and does the work you see match it? Look for: the permit at the job; for lockout, each employer knows the other's procedure (US plants: OSHA 29 CFR 1910.147(f)(2)). (8.1.4.2 Contractors)
  3. 19Does someone from the site check contractor work while it is going on, and do contractor injuries and near misses go into the site's reports? Look for: a check record or a named host, contractor entries in the incident log. (8.1.4.2 Contractors)

Incident reporting and investigation

Sample: the last 3 incidents or near misses in the area, at least one of them an injury, and 2 workers asked how they report.

  1. 20Ask 2 workers how they would report an injury, a near miss or a hazard, and what happened the last time they did. Look for: they know the route, their report is in the system, they heard back. US plants: OSHA 29 CFR 1904.35 requires a reporting procedure that does not discourage reporting. (10.2 Incident, nonconformity and corrective action)
  2. 21Were the 3 investigations started promptly, with the workers involved, and do they find causes in the work and the system instead of stopping at operator error? Look for: dates, who took part, the cause statements, actions that change conditions. (10.2 Incident, nonconformity and corrective action)
  3. 22Were serious incidents reported to the authority within the legal time limits? Look for: the incident log against the reports made. US plants: OSHA 29 CFR 1904.39 sets 8 hours for a death and 24 hours for an in-patient hospitalization, an amputation or the loss of an eye. (6.1.3 Determination of legal requirements and other requirements)

Worker participation and consultation

Sample: at least 5 workers who are not managers or supervisors, from more than one shift, talked to away from their supervisor. Use the worker interview prompts.

  1. 23Can workers give a real example of having a say in a risk assessment, a control or the last change in their area? Look for: examples from at least 3 of the 5 people, worker names on assessments, safety committee minutes with worker members. (5.4 Consultation and participation of workers)
  2. 24What stops people raising a concern or reporting a small injury: no time, language, fear of blame, nothing coming back, a bonus or prize tied to injury-free days? Look for: what workers say, the rules of any incentive scheme, meetings held in paid time, material in the languages people read. (5.4 Consultation and participation of workers)
  3. 25Do workers know they can remove themselves from work they believe puts them in imminent, serious danger, and that they are protected when they do? Look for: workers' own answers, where the rule is written down and trained. (7.3 Awareness)
  4. 26Did the results of the last audit and the last investigations reach the workers they concern? Look for: a briefing record or the area board; ask workers whether they heard and what changed. (9.2.2 Internal audit programme)

Competence and training

Sample: 5 workers, including the newest person in the area and someone recently moved to a new task, and their training records.

  1. 27Is the safety competence each job needs written down, including spotting hazards, and do the 5 people meet it? Look for: the training matrix or job requirements, the 5 records, gaps and how they are covered until closed. (7.2 Competence)
  2. 28Ask the newest person to show you a safety-critical step of their job: does it match the procedure and the training they signed for? Look for: what you watch against the procedure, the trainer's sign-off. (7.2 Competence)
  3. 29Is training checked for effect, not only attendance, and are refreshers in date (forklift, first aid, lockout)? Look for: a test or an observed sign-off, expiry dates against today. US plants: OSHA 29 CFR 1910.178(l)(4)(iii) asks for a forklift operator evaluation at least every 3 years. (7.2 Competence)

Personal protective equipment

Sample: 6 workers at 3 tasks and the PPE assessment for those tasks.

  1. 30Is the PPE for each task set by a written hazard assessment, and is it what the people at the task wear? Look for: the assessment against what you see on 6 workers. US plants: OSHA 29 CFR 1910.132(d) asks for a written, certified hazard assessment. (8.1.2 Eliminating hazards and reducing OH&S risks)
  2. 31Ask workers whether their PPE fits, how they get a worn item replaced on their shift, and when they were shown how to use it. Look for: fit and condition, a replacement route that works on nights and weekends, training records (OSHA 29 CFR 1910.132(f) in US plants). (8.1.2 Eliminating hazards and reducing OH&S risks)

Ergonomics

Sample: 2 tasks with lifting, repetition or awkward posture: the one workers name as the hardest and one with reports of discomfort.

  1. 32Have lifting, repetition and posture been assessed for the tasks workers say are hardest, with a stated method (for example the NIOSH lifting equation or an observation checklist)? Look for: the assessment and its method, the worker's own account of the task. (6.1.2.1 Hazard identification)
  2. 33Where a task was assessed as high risk, was the work itself changed (height, reach, weight, lift assist, rotation), not only lifting training given? Look for: the change in place; ask the operator whether it helped. (8.1 Operational planning and control)

Chemical management

Sample: 5 chemicals used in the area, including the newest one bought.

  1. 34Is every chemical in the area on the inventory, with a current safety data sheet that workers can reach on every shift? Look for: 5 containers against the list; ask a worker to find one sheet. US plants: OSHA 29 CFR 1910.1200(e) and (g)(8). (6.1.2.1 Hazard identification)
  2. 35Are containers labelled (secondary containers too), stored away from incompatible chemicals, and used with the controls the safety data sheet calls for? Look for: labels, storage, extraction running, the gloves and eye protection in use. (8.1.2 Eliminating hazards and reducing OH&S risks)
  3. 36Before the newest chemical was bought, did someone check its hazards and set the controls? Look for: the purchase approval, who signed it, the safety data sheet reviewed before first use. (8.1.4 Procurement)

Management of change

Sample: the last 3 changes in the area (equipment, layout, chemical, staffing, shift pattern or procedure), temporary ones too.

  1. 37Was each change reviewed for safety before it was made, with the people affected, and were the risk assessment, procedures and training updated? Look for: the change record, a risk review dated before the change, the updated documents. (8.1.3 Management of change)
  2. 38Are there changes nobody reviewed? Ask workers what has changed in the last 3 months and compare their answers with the change log. Look for: a moved machine, a new supplier's material, overtime or crew changes missing from the log. (8.1.3 Management of change)

Monitoring and measurement

Sample: the area's safety measures for the last 3 months and 3 measuring devices (gas detector, sound level meter, air sampling pump, load tester).

  1. 39Does the area track leading measures (inspections done, actions closed on time, near misses reported) as well as injuries, and act when one moves the wrong way? Look for: the board or report, the last time a measure slipped and what was done. (9.1 Monitoring, measurement, analysis and performance evaluation)
  2. 40Is equipment used to measure exposure or to test safety devices calibrated or bump-tested as required? Look for: records for 3 devices, with dates against today. (9.1 Monitoring, measurement, analysis and performance evaluation)

Legal requirements

Sample: the register of legal and other requirements for the area, the last compliance evaluation, and 3 requirements traced to the floor.

  1. 41Does the site know which legal and other requirements apply to this area (machinery, chemicals, noise, lifting gear, permits, customer rules), and is the list kept up to date? Look for: the register, its last update, one new or changed rule on it. (6.1.3 Determination of legal requirements and other requirements)
  2. 42Has compliance been evaluated at the set frequency, with the gaps closed? Pick 3 requirements and check them on the floor yourself. Look for: the evaluation record; 3 items traced, for example a lifting gear inspection, a noise survey, an extinguisher check. (9.1.2 Evaluation of compliance)

Nonconformity and corrective action

Sample: 3 corrective actions from the area in the last 6 months, including one from the last internal audit.

  1. 43Do corrective actions use the hierarchy of controls and go through the change process, with the new risk checked before the action was put in? Look for: the type of control chosen in each of the 3, a change review where the action changed equipment or method. (10.2 Incident, nonconformity and corrective action)
  2. 44Were the actions checked for effect before they were closed, and are the last audit's findings closed and not seen again today? Look for: the effectiveness check, the last audit's findings against what you see now. (10.2 Incident, nonconformity and corrective action)

A filled-in example

Illustrative, not a benchmark

An example: an internal safety audit of a press shop (presses 1 to 8, the die shop and the coil store) on day and night shift, by two trained auditors from other departments (illustrative, the same as the Excel worked example).

  • 44 questions, 2 N/A: no incident in 12 months that had to be reported to the authority, and no high-risk manual task left after a coil upender was fitted.
  • 42 graded: 35 conforming, 2 opportunities, 4 minor, 1 major.
  • The major: two roofing contractors working at height above press 6 with no permit and no fall protection plan (8.1.4.2). The work was stopped and restarted only with a permit and checked harnesses.
  • 6 worker interviews on two shifts turned up 2 of the 4 minors: night shift wearing torn cut-resistant gloves because stores only open on days, and small cuts going unreported because the crew loses its bonus with a recordable injury.
  • The other 2 minors: a lockout procedure 14 months after its last annual inspection, and a parts washer cleaner swapped for a solvent with no change review.

Conformance = (35 + 2) ÷ 42 = 88.1%. Three weeks later 1 of the 7 findings is closed and verified, 1 is overdue (the gloves), and the major stays open until the next 3 contractor jobs at height have been checked.

Common mistakes

  • Auditing from the office

    A risk assessment on file says nothing about a task you have not watched. Start at the station and work back to the paperwork, not the other way round.

  • Talking only to supervisors

    Clause 5.4 is about the people who do the work. Supervisors tell you how the system is meant to run; operators tell you how it runs at 3 am.

  • Day shift only

    PPE, permits, lockout and contractor control drift most when managers are not there. Plan at least part of every audit on nights or weekends.

  • Accepting PPE as the answer

    ISO 45001 puts PPE last in the hierarchy of controls (8.1.2). Ask what stronger control was considered and why it was not used, and look for the reason in writing.

  • Treating the certificate as legal compliance

    ISO 45001 certification is not OSHA compliance. The audit checks that the site knows and evaluates its legal requirements (6.1.3, 9.1.2); it does not replace an OSHA inspection or a legal review.

Download the template

Free to use: print it, copy it and edit it for your team. Enter your name and work email once to download.

Run this template in LeanSuite

In LeanSuite you run safety inspections, Gemba walks and LOTO checks from ready-made templates, a failed item raises a safety tag automatically, and every corrective action has an owner and a due date, with delays flagged.

See it in a 45-minute demo

In the lean glossary

Free tools

Guides

FAQ

ISO 45001 internal audit checklist: common questions

More free templates

All templates
Browse all 189 templates

Can't find the template you need?

Tell us what you're looking for. We'll make it and send it to your inbox, free.

A shift handover sheet, a red tag log, a changeover checklist for one machine: if your team uses it on the floor, ask.

By sending this form you agree to our Terms of Service and Privacy Policy.

Pass it on

We want LeanSuite to be the best place on the internet for lean help. If this was useful, send it to someone on your team or in your network who needs it.