ISO 45001 Internal Auditor Training: Audit Your OH&S Management System

Starts with a question: how do you know your safety controls really work, when the honest answer is often that nobody has been hurt yet? After a self-rating, three major incidents follow, beginning in January 2019 at Vale's iron ore mine near Brumadinho, Brazil, then hazardous material stored for years and workers' housing, each turned into an auditor's question. Two auditors check the same confined-space procedure to show why evidence matters. You then meet Delta Chemicals, a specialty chemicals plant in Singapore with a distribution warehouse in Manila, plus a construction project in Dubai and a mining company in Sydney. The module covers the clause 4.2 climate change note, outlines the twenty-six modules and mock audit, and ends with a recap.

What you will be able to do

• Explain why an OH&S internal audit is worth what it finds
• Turn a major incident into questions an auditor would ask
• Describe the organisation the course audits and how it works

Why it matters

Auditing the work, not only the paperwork, finds weak safety controls before someone is hurt.

Practice: Practice: Welcome: why OH&S internal audit matters · 3 questions

Opens at the Delta warehouse in Manila, where the manager says the safety system covers twenty-two payroll staff while the auditor sees agency forklift drivers, a contractor's cleaning crew and truck drivers. You then learn the key terms through an auditor's eyes: a worker is defined by control, not by payroll; consultation asks first and participation decides together. The module covers hazards as sources of harm, OH&S risk as likelihood and severity, and why a near miss is an incident, so a year with no near misses raises questions, with a steel plant in Mumbai showing hazards that are not machines. It explains the structure of the standard, requirements in clauses 4 to 10, Plan, Do, Check, Act, and five rules for reading them. It ends with a recap.

What you will be able to do

• Explain who counts as a worker under ISO 45001
• Tell consultation from participation and a hazard from a risk
• Describe where the auditable requirements sit in clauses 4 to 10

Why it matters

Knowing the words tells you whom to sample and interview, including contractors and agency staff often left out.

Practice: Practice: The language of OH&S through an auditor's eyes · 3 questions

Starts at the Delta plant in Singapore, where the plant manager easily names issues such as more contractors at shutdowns, night shift fatigue and heat at the Manila warehouse, and the auditor tests whether the list leads anywhere. You then learn what clause 4.1 requires: external and internal issues, positive or negative, that affect the intended outcomes of the system. The module covers the 2024 requirement to determine whether climate change is a relevant issue, and how another organisation may decide it is not and record why. It shows following an issue into hazard identification under clause 6.1.2.1, risks, actions and management review, and checking context notes or the business plan. It ends with citing the most specific requirement missed, and a recap.

What you will be able to do

• Test whether listed issues lead into risks, actions and review
• Check that a climate change decision was made and justified
• Cite the most specific requirement the evidence shows was missed

Why it matters

Following each issue into real decisions tells you whether context was analysed or written the week before the audit.

Practice: Practice: Context, including climate change · 3 questions

Opens at the Delta warehouse in Manila, where the interested parties register has one line for clients, yet a large retail client's contract sets safety requirements for Delta's drivers that the register, supervisor and drivers do not reflect. You then learn clause 4.2: workers and other relevant parties, their needs, and which are or could become legal and other requirements, with parents complaining about chemical tankers at a school gate. The module explains clause 4.3, an honest scope including every activity within control or influence, with examples from a construction project in Dubai and a sister utility in Toronto outside scope. It covers clause 4.4, processes and their interactions, testing hand-overs such as hazard identification feeding the risk register, the common trap, and a recap.

What you will be able to do

• Check that interested party needs reach registers and the floor
• Test whether the scope leaves out activities that affect OH&S
• Audit hand-overs between OH&S processes

Why it matters

Checking what crosses every boundary finds requirements and risks the system has quietly left out.

Practice: Practice: Workers, other parties, scope and the system · 3 questions

Starts with an interview with Delta's managing director, who says safety is the safety manager's job and pauses long when asked how he knows the system works. You then learn clause 5.1, its thirteen items and accountability that cannot be delegated, as the clause 5.3 note confirms. The module covers the items only ISO 45001 adds: culture, protecting workers from reprisals, a consultation process and support for health and safety committees. It shows testing no reprisals with a forklift driver at the Manila warehouse who received a written warning citing his near-miss report, and checking the near-miss log. It explains clause 5.2: six policy commitments fitted to the real risks, documented, communicated and available, compared with the hazard and risk registers. It ends with a recap.

What you will be able to do

• Test top management accountability through decisions, not words
• Check for reprisals after workers report near misses
• Compare the OH&S policy commitments with the real risks

Why it matters

Leadership shows in decisions and in what happens after workers report, which is exactly what you can test.

Practice: Practice: Leadership and the OH&S policy · 3 questions

Opens at the Delta plant in Singapore, where the safety committee has six members, all managers or supervisors, and meets at ten in the morning. You then learn clause 5.3: roles, responsibilities and authorities assigned, communicated and documented, tested with a supervisor chosen at random rather than appointment letters alone. The module explains clause 5.4: a process with mechanisms, time, training, information and barriers removed, and non-managerial workers consulted on nine topics and taking part in seven, plus worker access to documents under clause 7.5.3. A steel plant in Mumbai with crew representatives and shift huddles, and a container port terminal in Hong Kong with agency crews, show other mechanisms. It ends with looking for workers' names in risk assessments and investigations, and a recap.

What you will be able to do

• Test roles and authorities with a supervisor chosen at random
• Check worker consultation and participation against clause 5.4
• Find one control that changed because workers spoke

Why it matters

Asking the people who do the work shows whether workers really have a voice, beyond the committee's terms of reference.

Practice: Practice: Roles, and the workers' voice · 3 questions

Starts in Delta's mixing room on the night shift, where the hazard register neatly covers charging, mixing and transfer, then the auditor sees a fitter climbing out of a vessel cleaned by hand. You then learn clause 6.1.1: context, parties and scope in, risks and opportunities out, and risks of planned changes assessed beforehand. The module explains clause 6.1.2.1 as an ongoing, proactive process taking eight items into account, including how work is organised, social factors at a steel plant in Mumbai, and workers who are not on site. It links the resin plant explosion from Module 1 to Delta's kettles and shows a mining company in Sydney listing new hazards. It ends with testing non-routine work, permits and registers on the floor, and a recap.

What you will be able to do

• Check that hazard identification covers non-routine work
• Apply the eight items of clause 6.1.2.1 to a real task
• Test whether the hazard register changes as work changes

Why it matters

Comparing the register with how work is really done finds the non-routine jobs where people are most often hurt.

Practice: Practice: Hazard identification, ongoing and proactive · 3 questions

Opens at the Delta warehouse in Manila, where two supervisors score the same hazard, forklifts reversing at loading bay three where pickers walk, as six and as fifteen using the same matrix. You then learn that the method is what you audit: defined criteria, documented and used the same way every time, with the matrix itself the organisation's choice, and an evidence finding that the procedure does not define likelihood. The module covers two levels of risk, OH&S risks scored against controls that really work and other risks to the system, and psychosocial risks at a steel plant in Mumbai. It explains clause 6.1.2.3 opportunities, such as adapting work and eliminating hazards, worker participation under clause 5.4, and ends with recalculating one line and a recap.

What you will be able to do

• Audit a risk assessment method for defined, consistent criteria
• Recalculate one risk register line against the method
• Check that OH&S opportunities are assessed, especially at change

Why it matters

Recalculating one line and checking one control shows whether risk scores can be trusted or depend on who scored them.

Practice: Practice: Assessing risks and opportunities · 3 questions

Starts in the safety office at the Delta plant, where the legal and other requirements register, last updated in 2024, misses last year's change to confined-space entry rules, and the permit form still shows the old version. You then learn clause 6.1.3: access to the current text, not an old summary, how each requirement applies and who needs to be told, with the note that requirements can create risks and opportunities. The module explains that the register is kept up to date and tested later under clause 9.1.2. It covers clause 6.1.4: actions planned for risks, opportunities, legal requirements and emergencies, using the hierarchy of controls, integrated into processes and evaluated. It ends with four samples that show whether the register is alive, and a recap.

What you will be able to do

• Check that the legal register gives access to current requirements
• Trace a legal change from the register to the permit form
• Audit planned actions against the hierarchy of controls

Why it matters

Following a requirement from the register to the floor finds outdated permits before they put workers at risk.

Practice: Practice: Legal requirements, and planning action · 3 questions

Opens with Delta's objectives for the year on one page: improve the safety culture, zero accidents, train everyone, with no numbers, dates or owners, and progress discussed only at year end. You then learn clause 6.2.1: objectives consistent with the policy, measurable or capable of evaluation, monitored, communicated and updated, taking into account requirements, the risk assessment and the results of consulting workers. The module includes a five-minute check of consultation records that often changes the conclusion. It covers clause 6.2.2: a plan with what will be done, resources, who, when and how results are evaluated, and retained documented information. A mining company in Sydney shows two objectives with full plans and indicators such as dropped objects reported each month. It ends with a recap.

What you will be able to do

• Test whether an objective is measurable and monitored
• Check that objectives reflect workers' consultation
• Audit the plan behind each objective for owners, dates and resources

Why it matters

Telling a wish from an objective helps management turn safety intentions into results that can be tracked.

Practice: Practice: OH&S objectives and plans to achieve them · 3 questions

Starts beside a forklift at the Delta warehouse in Manila, where the driver names his hazards well but is unsure what to do in serious danger, despite a signed induction with a full test score. You then learn clause 7.1, comparing resources asked for with those given, and clause 7.2, competence defined and ensured, training effectiveness evaluated and evidence retained, tested by tracing one row of the training matrix. The module explains clause 7.3 awareness, including the ability to stop and get out of imminent and serious danger without undue consequences. It covers clause 7.4 communication that reaches and is understood by everyone, with safety rules e-mailed in English to crews from twelve countries, and external communication. It ends with testing at the workstation and a recap.

What you will be able to do

• Check training effectiveness, not just training attendance
• Ask workers whether they know they can withdraw from serious danger
• Test whether communication is understood by every crew

Why it matters

Testing at the workstation, not in the training file, shows whether people can act safely when it matters.

Practice: Practice: Resources, competence, awareness, communication · 3 questions

Opens at a filling station in Delta's plant, where a laminated chemical handling instruction on the wall is revision two while the master list shows revision four. You then learn clause 7.5.1: the documented information the standard requires, such as objectives and plans, operational processes and emergency plans, and what the organisation needs, kept as simple as possible. The module covers clause 7.5.2: documents identified, in a suitable format and language, reviewed and approved, with a permit form in English only at a site where most contractors read another language. It explains clause 7.5.3: the current version at the point of use, external documents controlled, confidential records protected, and how a record can look complete and not be true. It ends with old records and a recap.

What you will be able to do

• Compare a posted document with the master list
• Check document format and language for the people who use it
• Test whether a complete-looking record is actually true

Why it matters

Finding out-of-date procedures at the point of use is one of the quickest wins in an OH&S audit.

Practice: Practice: Documented information · 3 questions

Starts in the picking aisles of the Delta warehouse in Manila, where forklifts and pickers share aisles all shift, the risk is rated high, and the listed controls begin with high-visibility vests. You then learn clause 8.1.1: criteria for each process, control in line with them and records to the extent needed, with Annex A's examples such as systems of work, competence and maintenance, work adapted to workers and coordination at multi-employer workplaces. The module explains clause 8.1.2: eliminate, substitute, engineer, administer, then protect, usually combined and never starting at the bottom, with an interlock from the resin plant lesson and a rail tunnelling project in London replacing a solvent degreaser. It covers following one closed hot work permit, and ends with a recap.

What you will be able to do

• Check controls against the hierarchy, reading from the top
• Audit operational criteria and records for a high-risk process
• Follow one closed permit from issue to closure

Why it matters

Reading controls from the top shows when a site relies on vests and signs where hazards could be designed out.

Practice: Practice: Operational control and the hierarchy of controls · 3 questions

Opens at Delta Chemicals in Singapore, where the auditor finds solvent drums stacked close to a hot oil line in the raw materials store, and the shift supervisor explains a change nobody reviewed. You then learn clause 8.1.3: a process for implementing and controlling planned changes, temporary and permanent, with a review of unintended ones and effort scaled from a short form to a full review. The module covers participation of non-managerial workers under clause 5.4, and new information as a change, with a mining company in Sydney learning more about blasting dust. It shows the evidence you usually find, change requests, updated risk assessments, approvals, training and post-change review, and finding changes from purchase orders, work orders and the floor. It ends with like-for-like replacement and a recap.

What you will be able to do

• Find changes from purchase and work orders, not only the change log
• Check that changes are assessed before they happen
• Follow one real change from request to review

Why it matters

Catching changes that bypassed review finds new hazards, like drums beside a hot line, before they cause harm.

Practice: Practice: Management of change · 3 questions

Starts during shutdown week at Delta Chemicals, where a contractor crew cleans the inside of a mixing vessel and its supervisor says they use their own safety system for permits and gas tests. You then learn the three terms from clause 3 that decide how this clause is audited, and why contractors' workers are workers in your system when the work is under your control. The module explains procurement controls that keep hazards out, and clause 8.1.4.2 OH&S criteria for selecting contractors, then executing work with joint inspections, permit checks and near-miss reporting, and coordination at multi-employer workplaces under clause 8.1.1. It covers clause 8.1.4.3 outsourcing with the type and degree of control defined, checking the crew on site against the file, and a recap.

What you will be able to do

• Check that contractors are selected with OH&S criteria
• Audit contractor crews on site against their file
• Explain how outsourced functions must be controlled

Why it matters

Treating contractor crews as workers in your system protects the people doing the riskiest jobs of the year.

Practice: Practice: Procurement, contractors and outsourcing · 3 questions

Opens at two in the morning at Delta Chemicals, where an operator asked about a solvent store fire points to the wrong assembly point and is not sure who leads the emergency team tonight. You then learn clause 8.2: a planned response covering the emergencies from the hazard register, with first aid and training, where night shifts and weekends are often thin. The module shows the Manila warehouse typhoon plan, checking that the fire service has the site plan and chemical list, and Delta's own procedure requiring a drill on each shift every six months. It explains testing, evaluating and revising the response after drills and real events, and covering all shifts, contractors, visitors and people around the site. It ends with asking the night shift, and a recap.

What you will be able to do

• Check that emergency plans cover the hazards in the register
• Audit drill records across every shift
• Ask workers on the night shift what they would do

Why it matters

Asking the night shift, not just reading the plan, shows whether people would know what to do in a real fire.

Practice: Practice: Emergencies: prepare and respond · 3 questions

Starts with Delta's HSE manager proudly showing zero lost-time injuries in six months, until the auditor asks for near-miss reports for the same period and finds far fewer than a year earlier. You then learn clause 9.1.1: determining what to monitor, the methods, criteria and timing, with calibrated equipment, results evaluated and trends sent to management review under clause 9.3. The module shows tracing one dashboard number back to its source and the floor, sampling the report forms behind the register, with a steel plant in Mumbai monitoring heat and long hours. It explains clause 9.1.2: evaluating compliance, acting on gaps and knowing the status, using a compliance evaluation record at Delta. It ends with the evidence to expect and a recap.

What you will be able to do

• Trace a safety dashboard figure back to its source
• Check that monitoring equipment is calibrated
• Audit a compliance evaluation record and its follow-up

Why it matters

Checking the data behind a falling injury rate shows whether the plant is safer or people have stopped reporting.

Practice: Practice: Monitoring, measurement and compliance · 3 questions

Opens with Delta's internal audit programme, where every department gets half a day once a year and the canteen gets the same time as the mixing area with confined space entry. You then learn clause 9.2 is audited like any other clause: a programme with frequency, methods, responsibilities, consultation, planning and reporting, following the importance of processes and previous results. The module covers clause 9.2.2: criteria and scope for each audit, objective auditors, workers consulted on the programme and relevant results reported to them. It explains clause 9.3: management review considering inputs and trends, closing with decisions and an action log with owners and dates. It shows the evidence you usually find, and ends with tracing one decision from input to closed action, and a recap.

What you will be able to do

• Check that the audit programme follows risk and past results
• Audit auditor objectivity and reporting of results to workers
• Trace one management review decision to a closed action

Why it matters

Auditing the audit programme itself makes sure effort goes where risk is highest, not in equal slices.

Practice: Practice: Internal audit and management review · 3 questions

Starts at the Manila warehouse, where a reversing forklift missed a picker by about a metre, the picker reported it, and the auditor follows the report from that day to its cause and action. You then learn clause 10.2: react and correct, find root causes and act on them by the hierarchy of controls, from eliminating hazards to procedures and PPE. The module explains investigation with workers taking part under clause 5.4, here a team including the picker, a driver and a committee member, and why a report ending in worker carelessness has stopped too early. A mining company in Sydney shows an incident in heavy rain. It covers reviewing the effectiveness of each action, clause 10.3 continual improvement as a trend you can show, and a recap.

What you will be able to do

• Follow one incident from report to effectiveness check
• Check that corrective actions follow the hierarchy of controls
• Recognise an investigation that stopped at worker carelessness

Why it matters

Treating each near miss as a warning, and checking actions worked, stops the same incident hurting someone next time.

Practice: Practice: Incidents, corrective action, improvement · 3 questions

Opens at the Delta loading bay, where the auditor notes five forklift drivers and asks HR for each driver's training and licence record, finding gaps for some. You then learn clause 7.5.1, the documented information the standard requires, and clause 7.2, retaining evidence of competence. The module explains maintain, meaning documents kept current, and retain, meaning records kept as evidence, and planning from two lists: what the standard names and what the organisation's own system requires, including external documents written by others. It walks department by department, such as the HSE office with the legal register, risk method and compliance results, with a construction site office in Dubai as a lighter example. It ends with starting from the people doing the work, access notes and a Part B recap.

What you will be able to do

• Explain the difference between maintained and retained information
• Plan document requests from the standard and the organisation's system
• Start from the people doing the work, then find their records

Why it matters

Knowing what is required before you ask avoids raising findings for documents the standard never demanded.

Practice: Practice: Documented information, department by department · 3 questions

Begins with the guidance itself: ISO 19011:2026, the fourth edition published in May 2026, replacing the 2018 edition, as guidance rather than requirements, while the requirement to audit sits in ISO 45001 clause 9.2. You then learn the language of auditing, including audit criteria in clause 3.8, objective evidence such as a gas detector bump-test log, findings and conclusions, and roles such as a guide under clause 6.4.2. The module explains the three types of audit, with the internal audit as the first-party audit, and what management uses it for. It covers the seven principles that make an audit trustworthy, and a scenario where the maintenance supervisor is the auditor's brother, testing independence. It ends with the chain from criteria to conclusion and a recap.

What you will be able to do

• Explain the chain from audit criteria and evidence to findings
• Describe the three types of audit and where internal audit fits
• Apply the seven audit principles, including independence

Why it matters

Basing every finding on criteria and verifiable evidence turns an auditor's opinion into something managers act on.

Practice: Practice: Audit concepts and principles · 3 questions

Opens with last year's audit at Delta Chemicals, planned in one line for one day, starting at reception and working through procedures in manual order until time ran out. You then learn the audit programme: based on importance and previous results, with workers consulted and most effort where risk is highest, such as auditing contractor control in May and June around the shutdown. The module explains defining each audit's objectives, scope and criteria with every clause named by number and title, and stating the method, on site or remote, as clause 5.1 g) of the guidance suggests. It covers an audit plan that puts the riskiest area first, and a checklist that turns requirements into open questions with a sample, such as clause 7.2 for confined space entrants. It ends with a recap.

What you will be able to do

• Build a risk-based audit programme with worker consultation
• Define an audit's objectives, scope and criteria
• Write a checklist of open questions with planned samples

Why it matters

Planning from risk puts the riskiest area first, while there is still time in the day to dig.

Practice: Practice: Planning the audit programme, plan, checklist · 3 questions

Starts in Delta's mixing area, where an auditor walks in with no opening meeting and without the required safety glasses, and the supervisor is annoyed before a question is asked. You then learn the opening meeting from the guidance: confirming agreement to the plan, introducing the team and roles, and confirming the audit can run, short but never skipped, including a two-minute version for the quality laboratory. The module covers safety on the audit, keeping every rule you audit and hands off, and protecting personal data such as photos of injury logs. It explains when remote methods fit, such as records and training files shared on screen as they are, while the floor is audited in person. It ends with the human aspects of building trust, and a recap.

What you will be able to do

• Run a short opening meeting that confirms the audit plan
• Apply site safety rules to yourself during the audit
• Choose remote methods for records and in-person audits for the floor

Why it matters

Opening well and working safely builds the trust that makes people give an auditor complete, accurate information.

Practice: Practice: Conducting the audit, I opening, site, people · 3 questions

Opens with a supervisor saying they gas-test before every entry, and the point that this is information, not yet evidence. You then learn to investigate to the depth necessary, following the trail from answer to record to next question and stopping when the sample is sufficient. The module explains verifying information as complete, correct, consistent and current, sampling by judgement or statistics sized to risk, open questions, and hearing the workers who do the job under clause 5.4. It shows a weak note against a good one that names the vessel, the permits sampled and two with no gas test, and checks such as detector calibration under clause 9.1. A mining company in Sydney applies the same checks. It ends with following one high risk end to end, and a recap.

What you will be able to do

• Verify information before treating it as audit evidence
• Size an audit sample to the risk and choose open questions
• Write audit notes that record exactly what was seen

Why it matters

Verifying what you hear and recording it precisely gives findings that stand up when a manager challenges them.

Practice: Practice: Conducting the audit, II evidence and one high risk · 3 questions

Starts with a question: does a nonconformity have to be accepted by the auditee before you report it? No; it must be understood and its evidence acknowledged. You then learn to share findings area by area so the closing meeting holds no surprises, and to grade findings using the organisation's own defined grades. The module explains writing every statement in four parts, criteria, evidence, the statement and the grade, comparing weak and strong examples such as three drums outside the bund against clause 8.1.1 and the storage procedure, or one permit in twenty without a gas test. It covers the closing meeting, agreeing an action plan time frame, reporting results to managers and workers, and follow-up under clauses 9.2.2 and 10.2 until actions work. It ends with a recap.

What you will be able to do

• Write a nonconformity in four parts with criteria and evidence
• Run a closing meeting with no surprises
• Verify that corrective actions worked before closing a finding

Why it matters

Clear, evidenced findings and real follow-up mean the audit ends when the actions work, not when the report is filed.

Practice: Practice: Findings, closing and follow-up · 3 questions

Starts with a question: should the audit of an area start with its procedure or with the standard? With the standard, and the module shows why. You then walk through an effective internal audit step by step: identify all applicable ISO 45001 requirements, build the checklist from them, then check that the procedure describes what the area really does. A mock audit follows at Delta Chemicals, scoped to the loading bay on both shifts with records from April to June, including a night-shift drill in June that conforms and an opportunity for improvement on near-miss forms typed up a week late. It shows the common mistake of auditing only the procedure. It ends with the course recap, the practice exercises and the final exam.

What you will be able to do

• Plan an area audit from the standard before the procedure
• Apply every audit step in a mock audit of one area
• Write findings that management will act on and follow up

Why it matters

Auditing end to end from the standard helps management act on findings, so workers end up safer.

Practice: Practice: An effective internal audit, end to end · 3 questions