Home / ISO 45001 training / Becoming an OH&S lead auditor
Careers in OH&S auditing
The route at a glance
- Start safety officer, SHE rep, SHEQ manager
- Step 1 ISO 45001 as a system
- Step 2 SA OHS law and HIRA
- Step 3 internal and contractor audits
- Step 4 lead auditor course
- Step 5 audit experience, then certification
- Auditor competence ISO/IEC TS 17021-10:2018
- Certification rules Global ACI-TECH-3-016
- Not the same as SACPCMP registration
- Not the same as a 16(2) appointment
Safety officers already know more of an OH&S audit than they think. They can read a site, spot an unguarded machine and find the missing lifting register. What changes when you become an auditor is the question you are answering. A safety officer asks what is unsafe here and how we fix it. An auditor asks whether the organisation’s own system finds and fixes these things, and proves it with evidence. The route from one to the other, as it works in South Africa, runs in five steps.
What changes when a safety officer becomes an auditor?
| Safety officer | Internal OH&S auditor | ISO 45001 lead auditor | |
|---|---|---|---|
| The question | Is this safe, and what must change? | Does our system meet our requirements and ISO 45001? | Does this organisation’s system conform, and should it be certified? |
| The output | Inspection findings, toolbox talks, corrective work | Audit findings to our top management | Graded findings, an audit report and a certification recommendation |
| Independence | Part of the operation | Objective and impartial, not auditing own work | Independent of the client, under ISO/IEC 17021-1 |
| What you cannot do | Ignore a hazard | Audit your own work | Consult to the client you audit, or declare it legally compliant |
| What never changes | Speak up at once when you see imminent danger | Speak up at once | Speak up at once, and record it |
The hardest habit to break is fixing things. An auditor who rewrites the risk assessment for the site has stopped auditing it. Global ACI-TECH-3-016 treats OH&S services such as performing risk assessments or investigating accidents for a client as management system consultancy, which a certification body must keep apart from auditing.
Is an ISO 45001 lead auditor qualification the same as SACPCMP registration?
No. They are two different things, and people mix them up in job adverts. The South African Council for the Project and Construction Management Professions, SACPCMP, registers construction health and safety practitioners under the Project and Construction Management Professions Act 48 of 2000. The Construction Regulations, 2014 require construction health and safety agents and officers to be registered with a statutory body approved by the Chief Inspector, and the SACPCMP is that body. That registration is about doing health and safety work on construction projects. The same regulations require health and safety audits on site at least every 30 days, by the client under regulation 5(1)(o) and by the principal contractor of each contractor under regulation 7(1)(c)(vii). Those audits check a project’s health and safety plan and compliance on site. They are not ISO 45001 management system audits.
An ISO 45001 lead auditor qualification is about auditing an OH&S management system against an international standard. A lead auditor course does not register you with SACPCMP, and SACPCMP registration does not qualify you to audit ISO 45001 for a certification body. Some people need both. Know which one the job asks for.
Is an ISO 45001 lead auditor the same as a 16(2) appointee or a health and safety representative?
No. Both are roles under the OHS Act, inside one employer. A section 16(2) assignee carries duties the chief executive officer has assigned, and the employer is not relieved of them. A health and safety representative, designated under section 17, has functions and rights under section 18 rather than the employer’s duties, including the right to take part in any internal health or safety audit. A certification body auditor holds neither role at the client and must not hold one. An internal auditor may be a representative or a 16(2) appointee at his or her own employer, as long as the audits do not cover that person’s own work. Our guides to 16(2) appointments and 37(2) agreements and the Health and Safety Representative course cover those roles.
The route, step by step
Step 1. Learn ISO 45001 as a management system
Many safety professionals know the OHS Act well and ISO 45001 less well. Learn the standard clause by clause, from context in clause 4 and worker participation in 5.4 to hazard identification in 6.1.2, the hierarchy of controls in 8.1.2, management of change in 8.1.3, evaluation of compliance in 9.1.2 and incident investigation in 10.2. The ISO 45001:2018 Understanding and Implementation course does that in about 20 hours, with the South African law built into every module.
Step 2. Be sure of the law and the risk method
An auditor tests how an organisation determines, applies and evaluates its legal requirements, so you must know them well enough to see when something is missing. The South African Occupational Health and Safety Law course takes about 7 hours, and Hazard Identification, Risk Assessment and Incident Investigation about 5. Our guide to HIRA registers that hold up shows what an auditor expects to find.
Step 3. Audit internally and at contractors
Join or start your organisation’s internal audit programme, and audit contractors before they come on site. The ISO 45001:2018 Internal Auditor course, about 14 hours, trains you to audit on the floor, on the night shift and in the worker’s language, and our guide to becoming an ISO 45001 internal auditor in South Africa covers this step in more depth. Start an audit log on your first audit, with the date, organisation, standard, audit type, your role, days on site and remote, and who can confirm it.
Step 4. Pass a lead auditor course
A lead auditor course, such as ASC Food Safety Training’s ISO 45001:2018 Lead Auditor course, adds third-party certification, meaning ISO/IEC 17021-1, the OH&S auditor competence in ISO/IEC TS 17021-10, the OH&S rules in Global ACI-TECH-3-016, audit time and risk category under TECH-3-004, temporary sites, leading a team and grading findings major or minor. Our guide to what a South African ISO 45001 lead auditor course covers goes through it in detail.
Step 5. Log audits, then qualify or certify
IRCA, and the certification bodies that qualify auditors, want audits done after the course, some of them led by you. Exemplar Global does not ask new applicants for an audit log. IRCA’s Lead Auditor grade, for example, asks for 7 audits and 35 audit days within five years of applying, at least 3 led as team leader, after an IRCA certified course. Our ISO 9001 guide sets out the full IRCA criteria and how to build an audit log, and IRCA applies the same Lead Auditor criteria across its schemes, some of which add work experience requirements.
Step 4, without a week off site
ASC’s ISO 45001:2018 Lead Auditor course takes about 44 hours, with a 13-step virtual audit of a steel fabricator and galvaniser and two video proctored exams, and is recognised by Exemplar Global.
Enrol now, USD 799Read the course outlineUSD 799, charged as R13 275. 12 months of access.
What do certification bodies look for in an OH&S auditor?
Competence for the risks in the scope they send you to. ISO/IEC TS 17021-10:2018 sets out the knowledge an OH&S management system auditor needs, from hazard identification and legal requirements to incident investigation. Global ACI-TECH-3-016 maps OH&S work into 39 scope numbers against the NACE classification of economic activities, with example hazards for each, and leaves the risk levels to each accreditation body. A certification body qualifies you for the technical areas whose hazards you understand. An auditor qualified for office work is not thereby qualified for a galvanising plant or a building site.
Expect to audit first as an auditor in training beside an evaluator, to be observed on witnessed audits, and to have your reports reviewed. Practical experience in a hazardous industry is a real advantage at this step, and it is where safety officers often have the edge over quality auditors moving across.
Which personnel certification bodies certify OH&S auditors?
The two you will meet most often are Exemplar Global and the CQI and IRCA. Each certifies on its own published criteria. IRCA asks for an IRCA certified course and logged audits. Exemplar Global asks for a certificate from a course it recognises and a Work Style Assessment at first application, repeated every three years. ASC’s ISO 45001:2018 Lead Auditor course is Exemplar Global recognised, aligned with its units OH, AU and TL, and is not CQI and IRCA certified. Read the current requirements document of the body you choose before you apply.
Will the revised ISO 45001 change the route?
Not the route. A revised ISO 45001 is expected in 2027. Its draft closed its ballot in September 2026 and can still change, and no transition period has been set. When the new edition is published, certified auditors can expect to need transition training, as quality and environmental auditors do now for the 2026 editions of ISO 9001 and ISO 14001. The audit method, the law and your audit experience carry over.
Questions people ask
Can a safety officer become an ISO 45001 lead auditor?
Yes. Safety officers already know hazards and the law. They need ISO 45001 as a management system, internal audit experience and a lead auditor course. A certification body, or IRCA, will also want logged audits after the course before it qualifies or certifies them.
Is SACPCMP registration needed to audit ISO 45001?
No. SACPCMP registers construction health and safety practitioners, and the Construction Regulations, 2014 require construction health and safety agents and officers to be registered. Auditing an ISO 45001 management system is a different qualification, set by certification bodies and personnel certification bodies.
Does an ISO 45001 lead auditor course register me with SACPCMP?
No. A lead auditor course is training in auditing OH&S management systems. SACPCMP registration is a separate professional registration with its own requirements.
How many audits do I need to be certified as a lead auditor?
It depends on the body. IRCA’s Lead Auditor grade asks for 7 audits and 35 audit days after an IRCA certified course, within five years of applying, with at least 3 audits led as team leader. Exemplar Global asks new applicants for a recognised course certificate and a Work Style Assessment rather than an audit log.
Which ASC courses should a safety officer take first?
ISO 45001:2018 Understanding and Implementation, then South African Occupational Health and Safety Law and Hazard Identification, Risk Assessment and Incident Investigation if the law or the risk method needs work, then ISO 45001:2018 Internal Auditor, then the lead auditor course.
Can a certification body auditor also consult to the same client?
No. Global ACI-TECH-3-016 treats OH&S services such as performing risk assessments or investigating accidents for a client as management system consultancy, and ISO/IEC 17021-1 requires certification bodies to keep consultancy and certification apart.
From safety officer to lead auditor
Learn to lead an OH&S certification audit on ISO 45001:2018, ISO 19011:2026 and Global ACI-TECH-3-016, at your own pace.
Enrol now, USD 799Read the course outlineUSD 799 (R13 275 at checkout). Exemplar Global recognised. Not CQI and IRCA certified.
Sources
- SACPCMP, construction health and safety, who must register
- Global ACI, TECH-3-016, application of ISO/IEC 17021-1 for OH&S management system certification
- CQI and IRCA, Lead Auditor grade requirements
- Exemplar Global, Work Style Assessment for auditors
- ISO/TC 283, news on the revision of ISO 45001
- LRQA, ISO 45001 revision update, DIS ballot
- Exemplar Global, changes to certification grades and audit experience requirements
- ASC Food Safety Training, ISO 45001:2018 Lead Auditor, course page
