8 October 2026 by ASC Team
A useful ISO 45001 internal audit checklist does not ask “do you have a policy?”. For every clause it states the requirement in short, asks an open question, names whom to ask, and names the evidence to see before you record conformity, with a sample size and the shift. The tables below cover clauses 4 to 10 of ISO 45001:2018 for a South African site, including the legal records an OH&S auditor should sample. Use them to build your own checklist, then follow the work rather than the clause numbers.
How should you use an ISO 45001 audit checklist?
As a reminder of what to test, not a script. Three rules from twenty years of audits:
- Ask open questions. “Do you use lockout?” gets yes and proves nothing. “Show me how the person cleaning this machine knows it cannot start” gets evidence.
- Name the sample. Ten of 38 permits: six targeted from the hygiene team’s night entries, four at random. Eight of 23 contractor files. A line that names no sample produces a conclusion nobody can test.
- Go where the work is. Clause 9.2.2 b) requires criteria and scope for each audit. Put the night shift, the chemical store and the construction site in the scope, and audit them when the work is happening.
Clause 9.2.2 b) does not ask for audit objectives, but ISO 19011:2026 clause 5.5.2 advises that “each individual audit should be based on defined audit objectives, scope and criteria”. Write all three.
What do you audit in clause 4, context?
| Clause | Question | Ask | Evidence to see |
|---|---|---|---|
| 4.1 | Which issues affect your OH&S outcomes, and has climate change been decided on? | SHEQ lead, top management | Issues register; the climate change determination with reasons, who decided, date and review |
| 4.2 | Who are the interested parties, and which of their needs are or could become legal requirements? | SHEQ lead | Interested parties list with workers in groups; the link to the legal register |
| 4.3 | What does the system cover? Are contractors and projects inside it? | SHEQ lead | The scope as documented information; compare it with what you saw on the walk |
| 4.4 | Which processes make up the system and how do they connect? | SHEQ lead | An activities or process map |
What do you audit in clause 5, leadership and worker participation?
| Clause | Question | Ask | Evidence to see |
|---|---|---|---|
| 5.1 | What are the site’s three highest OH&S risks, and what have you decided about them this year? | The MD | Review minutes, budget approvals, steering meeting records |
| 5.1 k) | What happens to someone who reports a hazard or an incident? | The MD, then workers | A stated rule; workers who confirm it |
| 5.2 | Where is the policy, and what does it commit to? | Top management, then workers | A policy carrying 5.2 a) to f); evidence it was communicated |
| 5.3 | Who is responsible for what, and do they know it? | Managers, section 16(2) assignees | Responsibility matrix; 16(2) letters with acceptance; the assignee’s knowledge of the area |
| 5.4 | How are workers on every shift consulted, and how do they take part? | A representative, a night shift worker, an agency worker | Representatives for each area and shift; committee minutes at least every three months; workers named on HIRA lines and investigations |
| 5.4 c) | What stops people taking part, and what was done about it? | Representatives | Barriers recorded, such as language or shift times, and the fixes |
Sections 17 and 19 of the OHS Act give you the legal floor for 5.4: representatives where there are more than 20 employees, at least one for every 50 or part of 50 outside shops and offices, and a committee that meets at least once every three months. Check them, and then check the night shift.
What do you audit in clause 6, planning?
| Clause | Question | Ask | Evidence to see |
|---|---|---|---|
| 6.1.2.1 | How do you find hazards, and when was this register last changed? | Area owner, a worker | HIRA lines covering a) to h); task based lines for non-routine work; the date of the last change against the date of the last incident |
| 6.1.2.2 | How did you rate this line, and does that control actually work? | Area owner | The defined method and criteria; the existing control tested on the floor |
| 6.1.2.3 | What opportunities have you found to remove hazards or adapt work to workers? | SHEQ lead | Opportunities recorded and acted on |
| 6.1.3 | Which laws apply to this hazard, and how? | Legal register owner | Register lines with how each applies, owner, evidence; current instruments only |
| 6.1.4 | Where did this action end up in a business process? | Manager | Actions integrated and checked for effectiveness, chosen with the hierarchy in mind |
| 6.2 | How is this objective going, and who was consulted on it? | Objective owner | Plans with 6.2.2 a) to f); monitoring data; consultation record |
Run the HIRA trail both ways. Start on the floor with a hazard you can see and find its line. Then take a high risk line and go and find its control.
What do you audit in clause 7, support?
| Clause | Question | Ask | Evidence to see |
|---|---|---|---|
| 7.1 | What did you ask for, and what did you get? | SHEQ lead, finance | Budget lines approved and spent |
| 7.2 | What must someone know before doing this job, and how do you know this person knows it? | Supervisor, HR | Competence matrix; competence the regulations name, such as certified first aiders; site licences such as forklift licences; training effectiveness checked |
| 7.3 | The six awareness questions, in the worker’s language | Five workers per shift, including agency staff | Answers about their own job, including how to remove themselves from imminent and serious danger |
| 7.4 | How do contractors and visitors hear about hazards and emergencies? | Security, contractor coordinator | Induction content; languages used; responses to external communication |
| 7.5 | Is this the current version, and can workers reach it? | Anyone using a document | Version control; documents at the point of use; records protected |
What do you audit in clause 8, operation?
| Clause | Question | Ask | Evidence to see |
|---|---|---|---|
| 8.1.1 | Take me through this permit from issue to close | Permit issuer, the person working | A sample of permits across shifts, with isolation verification and close-out |
| 8.1.2 | Why this control and not one higher up? | Area owner | Controls labelled by hierarchy level; guards and interlocks working; PPE use checks |
| 8.1.3 | What changed here recently, and when was it assessed? | Engineering, production | Change records assessed before implementation |
| 8.1.4.1 | How do you check that what you buy is safe to use? | Procurement | OH&S checks on chemicals, machines and PPE before purchase |
| 8.1.4.2 | Which OH&S criteria did you apply when you chose this contractor? | Procurement, contractor coordinator | Selection criteria applied; section 37(2) agreement where relied on; hazards coordinated both ways; the contractor’s file reviewed, not only received |
| 8.1.4.3 | How do you control the labour broker and the canteen operator? | Procurement, HR | The type and degree of control defined and applied |
| 8.2 | When was this response last tested on the night shift? | Fire team, night supervisor | Drill records by shift; first aiders on every shift; reviews after drills and real events |
What do you audit in clauses 9 and 10?
| Clause | Question | Ask | Evidence to see |
|---|---|---|---|
| 9.1.1 | What do you measure, and what did the last results tell you? | SHEQ lead | A monitoring plan; LTIFR and leading indicators; calibration or verification of instruments such as noise meters and gas detectors |
| 9.1.2 | When did you last evaluate compliance with this line, and what was the result? | Legal register owner | Compliance evaluation records at the set frequency; actions where non-compliant |
| 9.2 | Who was consulted on this programme, and how did results reach the workers? | Programme manager, representatives | Programme with frequency, consultation and reporting; reports reaching the committee |
| 9.3 | What did the last review decide, and how were workers told? | The MD | Inputs a) to g) with all six trends under d); decisions; communication to workers |
| 10.2 | Take me through what happened after this incident | Investigator, a worker on the team | Workers on the investigation; causes beyond “did not follow procedure”; similar cases checked; HIRA reviewed; effectiveness checked |
| 10.3 | What improved last year, and who heard about it? | Top management | Improvement results communicated to workers and representatives |
Which legal records should an OH&S auditor sample?
An internal auditor is not an inspector, but the legal trail tests clauses 6.1.3 and 9.1.2 better than anything else. Sample these:
| Record | Source |
|---|---|
| Annexure 1 incident records, kept three years, investigated within seven days, reviewed by the committee | General Administrative Regulation 9 |
| Section 24 reports on WCL 1 or WCL 2 within seven days, and immediate reports of the most serious incidents | OHS Act section 24; General Administrative Regulation 8 |
| COID Act accident reports within seven days of notice | COID Act section 39 |
| Representative designations and committee minutes | OHS Act sections 17 and 19; General Administrative Regulation 5 |
| Hazardous chemical agents risk assessment within two years, and the medical surveillance decision and records where regulation 7(1) applies | Regulations for Hazardous Chemical Agents, regulations 5 and 7 |
| Confined space atmosphere certificates; first aider certificates | General Safety Regulations, regulations 5 and 3 |
| Pressure equipment inspection records | Pressure Equipment Regulations, regulation 14 |
| Electrical certificate of compliance | Electrical Installation Regulations, regulation 7 |
How do you write the finding?
Requirement, evidence, statement. On the case site we use in our courses, a Kempton Park ready meals plant built from real audit patterns with no real company named, 11 of 13 forklift operators hold current licences. A finding from a warehouse audit could read:
Requirement: ISO 45001:2018 clause 7.2 b) requires the organisation to ensure that workers are competent on the basis of appropriate education, training or experience. Evidence: the forklift licence register shows 2 of 13 operators with expired licences; both were seen driving at the charging bay. Statement: competence of forklift operators is not ensured.
Write the legal side against the clause that should have caught it, and do not play inspector. If people are in danger, act at once.
Frequently asked questions
Can I use one checklist for every audit?
Use the tables as a bank and build a checklist for each audit from its criteria and scope, with the samples and shifts for that area.
How many checklist lines does an audit need?
Enough to cover the criteria. In our course workshop delegates build at least twelve lines per audit, each with a clause, an open question, the evidence and the sample.
Should the checklist include legal requirements?
Yes, through clauses 6.1.3 and 9.1.2. You test whether the system determined, applied and evaluated them.
Can we combine the ISO 45001 audit with ISO 9001?
Yes, for the shared clauses. Keep the floor walk, the worker interviews and the hazard trails intact.
What if a worker will not talk in front of the supervisor?
Interview without the supervisor, in the worker’s language, through an interpreter who is not their line manager. Clause 5.4 c) names fear of reprisal as a barrier for a reason.
Do audit results go to the workers?
Relevant results do. Clause 9.2.2 d) requires relevant audit results to be reported to workers and, where they exist, their representatives.
Which ASC course teaches you to audit ISO 45001?
This guide is drawn from Module 2 of ISO 45001:2018 Internal Auditor, FS63, which audits every clause from 4 to 10, built on ISO 45001:2018 clause 9.2 and ISO 19011:2026 by clause.
R3 850, a limited period special (normally R4 670), prices in rand with no VAT added. About 14 hours, self paced, lifetime access.
- The HIRA, legal, training, permit and incident trails, and the top management and representative interviews.
- The Audit Plan and Checklist Builder for ISO 45001, the Findings Writer and Audit Report, and two simulated audits on a case site.
- Two practice exercises and a three part assessment, all at 70 percent. Not a lead auditor course.
Enrol now and learn to audit it. See all eight courses at ISO 45001 training, or ask a question on WhatsApp ASC.
Related guides: How to become an ISO 45001 internal auditor in South Africa and Hazard identification and risk assessment under ISO 45001.
Sources
- ISO 45001:2018, Occupational health and safety management systems: Requirements with guidance for use (ISO)
- ISO 19011:2026, Guidelines for auditing management systems (ISO)
- Occupational Health and Safety Act 85 of 1993
- General Administrative Regulations, 2003; General Safety Regulations, 1986; Regulations for Hazardous Chemical Agents (GN R280 of 2021); Pressure Equipment Regulations, 2009; Electrical Installation Regulations, 2009
- Compensation for Occupational Injuries and Diseases Act 130 of 1993
ISO 45001 and ISO 19011 are copyright and are not reproduced here. ASC is not affiliated with ISO. Last updated 8 October 2026.