ISO 45001 Internal Audit — Clause 9.2 for Occupational Health & Safety
ISO 45001:2018 keeps the same internal-audit obligation as other Annex SL standards — Clause 9.2 — but the audit substance is occupational health and safety: hazard identification, risk assessment (Clause 6.1.2) and compliance with OH&S legal requirements (Clause 9.1.2).
Clause 9.2 for OH&S
Clause 9.2 requires internal audits at planned intervals to determine whether the OH&S management system conforms to the organization’s own requirements and to ISO 45001. The audit program is planned using the results of risk assessment, the significance of OH&S risks, and previous audit outcomes.
Auditing hazards and risk control
An effective OH&S audit tests whether the hazard identification and risk controls (Clause 6.1.2) are actually in place and working — guarding, lockout/tagout, ergonomics, contractor safety — and whether the organization can evidence compliance with OH&S legal and other requirements (Clause 9.1.2).
Common OH&S audit gaps
Frequent findings: hazard assessments that don’t cover non-routine work; incomplete contractor and visitor controls (Clause 8.1.4); and corrective actions (Clause 10.2) that address an incident’s immediate cause but not the underlying system weakness.
Frequently asked questions
Is ISO 45001 internal audit the same structure as ISO 9001?
The Clause 9.2 requirement is identical in structure, but the content is OH&S-specific — hazards, risks and legal compliance rather than product or process conformity.
What legal requirements must the audit cover?
Clause 9.1.2 requires the organization to evaluate and maintain evidence of compliance with its OH&S legal and other requirements. The audit must verify that evidence exists and is current.
How often should OH&S audits run?
The standard says planned intervals. High-hazard operations typically audit more frequently (often semi-annually for critical areas) with a full-system cycle of 1–3 years.