ISO 45001:2018 Internal Auditor

ISO 45001:2018 Internal Auditor

About this course

An OH&S audit done in the SHEQ office between 08h00 and 16h00 audits the paperwork of a hygiene team that works from 22h00 to 05h00. It finds an emergency procedure, a permit system and a training matrix, and it misses that the ammonia leak drill has never once been run on the night shift. A real OH&S audit happens at the isolator, in the chemical store, on the construction site and in the worker’s own language, and it is ready for the moment the auditor sees a danger that cannot wait for the closing meeting.

This course teaches you to audit that way. It is built on ISO 45001:2018 clause 9.2, which requires an audit programme that includes consultation and that reports relevant results to workers and their representatives, and on ISO 19011:2026, the fourth edition of the auditing guidance, by clause, including its expanded guidance on remote auditing methods and virtual locations. ISO 19011 says “should” throughout, and the course keeps it as guidance.

The path runs from the principles and the auditor’s competence, through auditing every clause from 4 to 10 with the HIRA trail, the legal register trail, the training trail, the permit trail and the incident trail, to building a risk based programme, planning and conducting two audits on a case site, writing nonconformities, and judging corrective action responses under 10.2. The OHS Act applies whatever the certificate says, and the course places the internal audit beside the inspector, never in place of the inspector. The case is a training scenario built from real audit, inspection and incident patterns. No real company is named.

Who it is for

Internal auditors of OH&S management systems and people about to become one. SHEQ officers and managers who run the internal audit programme. ISO 9001 or ISO 14001 internal auditors who now have to audit OH&S as well, alone or in a combined audit. Process owners who will be audited and want to know what the auditor will ask. Introduction to ISO 45001:2018, or working familiarity with the standard, is recommended before you start. This is an internal auditor course: it trains you to audit your own organisation’s system, not to audit for a certification body.

What you finish with

An audit workbook built in four tools and exported as one file: an OH&S internal audit programme with risk based frequencies, objectivity checks, the consultation of workers and the reporting route to workers and representatives; two audit plans with objectives, criteria, scope and samples, including the night shift; checklists that follow the work; nonconformities written as requirement, evidence and statement; two audit reports; and decisions on two corrective action responses. The four tools are the Audit Programme Builder, the Audit Plan and Checklist Builder for ISO 45001, the Findings Writer and Audit Report for ISO 45001, and the Audit Workbook self check and export. Alongside them sits the Audit Evidence Pack, a practice exercise of fourteen exhibits from the two audits: you decide each one, and the model answers open only when every exhibit carries your decision.

Curriculum

Module 1: The internal auditor, the requirement and the principles

• Lesson 1.1: What clause 9.2 asks, and what an OH&S internal audit is for
• Lesson 1.2: The seven principles of auditing in ISO 19011:2026, applied to OH&S
• Lesson 1.3: Competence, objectivity and the OH&S auditor’s extra competence: hazards, law, the floor
• Lesson 1.4: What makes an OH&S audit different: the walk, the law, the worker interview, the danger you see

Module 2: Auditing the requirements, clause by clause

• Lesson 2.1: Auditing context, workers and interested parties, scope and the system (clause 4)
• Lesson 2.2: Auditing leadership, policy, roles and worker participation (clause 5): the top management and representative interviews
• Lesson 2.3: Auditing hazard identification, risk assessment, legal requirements and planning (6.1): the HIRA trail and the legal register trail
• Lesson 2.4: Auditing objectives, support, competence and awareness (6.2 and 7): the training trail and the floor interview script
• Lesson 2.5: Auditing operation (clause 8): controls, permits, lockout, management of change, procurement, contractors and emergencies
• Lesson 2.6: Auditing performance evaluation and improvement (clauses 9 and 10): monitoring, compliance, incidents, corrective action and management review

Module 3: The audit programme (9.2.2)

• Lesson 3.1: The programme content and the risk based frequency (9.2.2 a)
• Lesson 3.2: Criteria, scope and objectives for each audit, and combined audits (9.2.2 b)
• Lesson 3.3: Selecting auditors, objectivity, and consulting workers on the programme (9.2.2 a) and c), 5.4 d) 8)
• Lesson 3.4: Reporting to managers, workers and representatives (9.2.2 d), and into management review

Module 4: Planning and conducting the audit

• Lesson 4.1: The audit plan and the document review (ISO 19011:2026, 6.2 and 6.3)
• Lesson 4.2: The opening meeting, guides and observers
• Lesson 4.3: The site walk: looking for the hazard the register missed
• Lesson 4.4: Interviewing workers, representatives, contractors and the MD, in the site’s languages
• Lesson 4.5: Sampling and audit trails: permits, training, incidents and the law
• Lesson 4.6: Remote and hybrid methods, virtual locations and digital tools (ISO 19011:2026, 5.5.3, Annex A, A.16)
• Lesson 4.7: Imminent danger during an audit, difficult situations, and the closing meeting
• Practice exercise 1: plan and run an audit on the case site

Module 5: Findings, reporting and follow-up

• Lesson 5.1: Writing a nonconformity: requirement, evidence, statement, and legal findings
• Lesson 5.2: Classification, and the imminent danger you report at once
• Lesson 5.3: The closing meeting and the audit report
• Lesson 5.4: Judging a corrective action response under 10.2
• Lesson 5.5: Verifying effectiveness, closing out, and evaluating the programme and the auditors
• Practice exercise 2: findings and corrective action decisions

Module 6: Workshop and the three part assessment

• Lesson 6.1: Workshop briefing: two audits, three sittings, three assessment parts
• Lesson 6.2: Sitting 1: plan the two audits
• Lesson 6.3: Sitting 2: conduct the audit on the Audit Evidence Pack
• Lesson 6.4: Sitting 3: report, corrective action review and closure
• Lesson 6.5: The three part assessment explained
• Assessment part 1: build the audit programme
• Assessment part 2: plan and conduct the two audits
• Assessment part 3: findings and corrective action decisions

How you are assessed

Each of Modules 1 to 5 has a knowledge check of 15 questions drawn from a bank of 24, at 30 seconds a question, a game of 10 rounds drawn from 14, at 45 seconds a round, scenario checks of 6 questions drawn from 8, and a case study assessment on one scenario with data, 10 questions drawn from 12. Two practice exercises, at the end of Modules 4 and 5, each draw 12 questions from 15 at 60 seconds a question: the first on planning and running an audit on the case site, the second on findings and corrective action decisions.

The course ends in a three part assessment, each part a timed quiz of 20 questions drawn from a bank of 35, at 60 seconds a question: Part 1 on building the audit programme, Part 2 on planning and conducting the two audits, set on the Evidence Pack exhibits with the facts each question needs given in the question, and Part 3 on findings and corrective action decisions. Each part is video proctored, with copy and paste blocked. You need a pass in all three.

The pass mark is 70 percent on everything. Each assessment allows two timed attempts, with a 24 hour break after a failed first attempt. Marking is automatic, and the feedback on a failed attempt names what to fix and which lesson to reread.

What you need

A laptop or tablet with an internet connection. Use one device and one browser for the workshop, because the tools save on the device you use, and export at the end of each sitting. You do not need a site of your own: the two audits run on the case site with its data supplied. Working knowledge of ISO 45001:2018, from Introduction to ISO 45001:2018 or from experience, is recommended. A licensed copy of ISO 45001:2018 is recommended and a copy of ISO 19011:2026 is useful; ISO sells both, and the SABS publishes ISO 45001 in South Africa as SANS/ISO 45001. The three assessment parts are video proctored with copy and paste blocked, so you also need a webcam. The course quotes short passages of the requirements and the guidance by clause; it does not reproduce either document.

Certificate

When you have passed every assessment, including all three parts of the final, ASC issues a certificate of completion that names the course, the code FS63 and the date, and carries a verification code an employer can check. It is a training certificate from ASC Food Safety Consultants. It is not a certification of your organisation and not a lead auditor qualification.

Free guides for this course

• How to become an ISO 45001 internal auditor in South Africa
• ISO 45001 internal audit checklist: questions and evidence clause by clause

See all eight ISO 45001 and health and safety courses and which one fits your job at ascfoodsafetytraining.com/iso-45001/.

Questions people ask

Is this a lead auditor course?

No. It trains you to audit your own organisation’s OH&S management system under clause 9.2. It is not a certification body auditor qualification and does not lead to one.

Can a health and safety representative be an internal auditor?

Yes, for work they are not responsible for. Clause 9.2.2 c) requires auditors to be selected and audits conducted to ensure objectivity and the impartiality of the audit process. Lesson 3.3 applies that test to representatives, section 16(2) assignees and contractors, and shows how to record the decision.

What if I see a danger during an audit?

You act at once and report it at the time, not at the closing meeting. Lessons 4.7 and 5.2 cover what to do, whom to tell and how to record it, and the workshop gives you the situation to practise.

Can I audit OH&S together with ISO 9001 or ISO 14001?

Yes. Lesson 3.2 covers combined audits: shared clauses audited once, and the OH&S trails, the floor walk and the worker interviews kept intact.

Do I need to do the Implementation course first?

No. Working knowledge of ISO 45001 is enough, from Introduction to ISO 45001:2018 or from experience. The Implementation course is for the person who builds the system; this course is for the person who tests it.

Will this course go out of date when ISO 45001:2027 is published?

No. Voting on the draft, ISO/DIS 45001, closed on 9 September 2026, and ISO expects to publish the new edition in the first half of 2027. No transition period has been set yet; certification bodies expect three years, as was set for ISO 9001:2026, and a 2018 certificate stays valid during the transition. Until the new edition is published, ISO 45001:2018 with Amendment 1:2024 is the standard sites are audited against, and it is what this course teaches. Nothing in this course speculates on the final text.

Is the R3 850 price permanent?

No. R3 850 is a limited period special; the normal price is R4 670. Prices are in rand with no VAT added, and group arrangements are available on request.

ISO 45001:2018 and ISO 19011:2026 are standards published by ISO. This course is an independent training product and is not approved or endorsed by ISO or by any certification body.