ISO 45001 Checklist: Audit Before Your Assessor Does

Vehicle incidents accounted for 42% of Australia's traumatic workplace fatalities in 2023, according to Safe Work Australia's key WHS statistics. An ISO 45001 checklist that checks the traffic-management procedure but never tests vehicle segregation can miss the control that matters most.

An ISO 45001 checklist is only useful when it points to evidence an auditor can verify. A signed policy establishes intent. Site observations, worker interviews, inspection records and completed corrective actions establish whether people follow it.

For H&S managers, WHS officers and operations managers, preparation means following a task through the management system. A manufacturing maintenance job should connect to the hazard assessment, isolation procedure, authorised worker, equipment condition and supervision arrangements. The same approach works for residential building, property development, cleaning, facilities services and waste operations.

How to use this ISO 45001 checklist

• Test implementation: Compare the documented requirement with records, worker explanations and conditions at the worksite.
• Record the sample: Identify the site, task, people interviewed and records examined, rather than ticking a general compliance box.
• Assign the response: Give each gap an owner, completion date and method for checking effectiveness.

The checklist supports internal audits, certification preparation and principal contractor pre-qualification. It doesn't replace the standard or a jurisdiction-specific compliance assessment. Its purpose is to expose the difference between a system that looks complete and one that controls work.

Table of Contents

• 1. Clause 4 Context of the organisation, interested parties and scope
  • Test the boundaries against actual work
• 2. Clause 5 Leadership, policy, roles and worker participation
  • Follow worker input through to the outcome
• 3. Clause 6.1 Hazard identification, risk assessment and opportunities
  • Include psychosocial controls in the same test
• 4. Clauses 6.1.3 and 9.1.2 Legal and other requirements
  • Keep jurisdiction and evidence separate
• 5. Clause 6.2 OH&S objectives and planning to achieve them
  • Test the plan behind the target
• 6. Clause 7 Competence, awareness, communication and documented information
  • Check the version used at the task
• 7. Clause 8 Operational control, contractors, change and emergency preparedness
  • Follow the contractor beyond pre-qualification
• 8. Clauses 9 and 10 Performance evaluation, internal audit, management review and corrective action
  • Sample the closed actions, not just the overdue list
• ISO 45001 clauses at a glance
• Quick Pre-Audit Checklist and Next Steps
  • Rehearse evidence retrieval
  • Test the audit trail

1. Clause 4 Context of the organisation, interested parties and scope

A scope statement that excludes the work creating the greatest exposure is a weak starting point. The auditor tests whether the stated boundaries match the organisation's sites, activities, workers and contractual arrangements.

Consider a residential builder that starts delivering townhouse projects through another company. The reviewer should establish which entity employs workers, engages subcontractors and controls construction activities. Adding the development's address won't resolve unclear management-system boundaries.

Evidence to have ready includes:

• Scope statement: A short description of covered activities, locations and organisational boundaries.
• Context review: Relevant internal and external issues, including shift patterns, workforce changes, client requirements and host-site arrangements.
• Interested-party register: Workers, representatives, subcontractors, clients and regulators, with relevant requirements and the organisation's response.
• Change records: Evidence that new contracts, locations and operating arrangements triggered a review.

Test the boundaries against actual work

The auditor can compare the scope with project lists, contracts, induction records and the organisational chart. Satellite workshops, mobile cleaning teams and outsourced maintenance deserve attention because office-based documentation can overlook them.

The finding to guard against is a scope that describes the business as it used to operate. Labour hire and subcontractors shouldn't disappear from consideration because another organisation pays them.

ISO's explanation of ISO 45001 identifies leadership, worker participation, risk assessment, operational controls and continual improvement as connected management-system requirements. Scope decisions need to support that complete system, not create convenient exclusions.

Practical rule: A site or activity shouldn't be absent from the scope review merely because the H&S manager rarely visits it.

Keep the scope concise. Put changing site details in a controlled supporting list, and record who checks that list when operations change.

2. Clause 5 Leadership, policy, roles and worker participation

A plant manager approves a guarding change after operators report that the existing arrangement obstructs cleaning. The useful audit evidence isn't just the approval. It includes the workers' concern, the options considered, the decision and confirmation that affected operators received the outcome.

That sequence demonstrates participation in a decision, rather than attendance at a meeting. Leadership evidence should also show who authorised resources, resolved competing priorities and checked implementation.

Follow worker input through to the outcome

Under the consultation duties described by Safe Work Australia, a PCBU must, so far as is reasonably practicable, consult directly affected workers and consult, cooperate and coordinate with other relevant duty holders. Workers need a reasonable opportunity to express views, have those views considered and receive the outcome.

Prepare evidence that makes those steps visible:

• Leadership records: Resource approvals, management decisions, site visits and follow-up actions.
• Assigned responsibilities: Role descriptions, delegations and arrangements for absences.
• Consultation trail: Toolbox records, committee minutes, hazard reports and resulting changes.
• Policy communication: Induction material and worker explanations of relevant commitments.

A signed toolbox sheet doesn't establish that consultation occurred. The reviewer should ask what workers raised and what management changed, including reasons when suggestions weren't adopted.

WHS law doesn't impose a general requirement to document every consultation unless a specific regulation requires it. Records are nevertheless useful evidence. Keep them proportionate: the issue, participants, views, decision, responsible person and completion status usually tell a clearer story than lengthy minutes.

The finding to avoid is leadership accountability being assigned entirely to the H&S manager while operational managers control the resources and work.

3. Clause 6.1 Hazard identification, risk assessment and opportunities

The hazard register should explain why controls were selected, not merely attach risk ratings to familiar tasks. An auditor will compare it with routine work, breakdowns, cleaning, maintenance, contractor activities and foreseeable emergencies.

For a waste operator, manual handling at a depot might lead to a mechanical bin lift. The audit trail should include the original task assessment, worker input, lift selection, maintenance arrangements and verification that workers use it.

Records worth sampling include:

• Task assessments: Site-specific hazards, exposed people and existing controls.
• Control decisions: Consideration of elimination, substitution and engineering before administrative controls and PPE.
• Linked work methods: Relevant SWMS, procedures, permits and inspection requirements.
• Opportunities: Changes such as ground-level assembly or redesigned material handling that remove exposure.

Include psychosocial controls in the same test

ISO's technical committee guidance states that certification should assess psychosocial-risk management within the overall management system. A wellbeing policy alone doesn't show that workload, poor support, harassment or isolated work are controlled.

For a cleaning contractor, the reviewer could compare workload concerns with roster changes, supervisor availability and follow-up consultation. Attendance at awareness training isn't evidence that unreasonable work demands have changed.

Safety Space provides site or project hazard registers, corrective actions and tasks, and a risks and opportunities register. Keeping those records connected helps the reviewer trace the hazard, assigned response and control verification without reconstructing the sequence from separate spreadsheets.

The finding to guard against is a current-looking register with controls that don't match the task. Review it after changes, not just before the assessor arrives.

4. Clauses 6.1.3 and 9.1.2 Legal and other requirements

An obligations register and a compliance evaluation answer different questions. The register identifies what applies. The evaluation establishes whether the organisation meets it, using evidence.

For a construction business operating in Western Australia and South Australia, jurisdiction needs its own register field. A duty identified for one project shouldn't automatically be treated as the applicable duty for another.

The auditor's sample should connect:

• Applicable obligation: The relevant provision, code, contractual requirement or other commitment.
• Operational response: The procedure, responsible role and control used to meet it.
• Compliance evidence: Inspection results, licences, consultation records or completed assessments.
• Evaluation outcome: The reviewer, review date, conclusion and action where compliance wasn't demonstrated.

Keep jurisdiction and evidence separate

Australian registers need the applicable WHS Act, Regulations and relevant codes for the jurisdiction. Victoria operates under the OHS Act 2004, while Western Australia operates under the WHS Act 2020. An Australian register also needs more than a list of model documents.

For New Zealand operations, the Health and Safety at Work Act 2015 and WorkSafe NZ guidance require a separate applicability review. Relabelling an Australian register isn't enough. United States operations likewise need their own OSHA-based assessment rather than Australian PCBU terminology.

The PCBU duties overview helps organise the Australian duty-holder review. The register should still identify the actual obligations and evidence for each operating location.

Training completion can support that evidence, but tracking compliance video training in an LMS doesn't replace evaluating compliance in the workplace. It also doesn't establish competence by itself.

Assign a named person to monitor changes through primary regulatory sources. Record the applicability decision and resulting updates, including when a change doesn't affect operations.

5. Clause 6.2 OH&S objectives and planning to achieve them

An objective to improve safety gives an auditor little to test. An objective to reduce overdue high-priority hazard actions gives the reviewer a defined population, an accountable manager and an outcome to examine.

For a cleaning services business, the plan could specify a risk-based closure deadline, escalation arrangements and an operations-meeting review. The auditor should then check overdue actions and sampled closures, rather than accept the dashboard total.

Test the plan behind the target

Each objective needs enough detail for another manager to carry it forward:

• Defined outcome: The risk or system weakness being addressed.
• Accountability and resources: The manager responsible, required budget and operational support.
• Monitoring method: The measure, review interval and source records.
• Evaluation: How management will decide whether the change reduced exposure.

Leading indicators need interpretation. Inspection completion looks positive until the reviewer discovers that inspections omit the loading area or repeatedly identify the same unresolved defect.

Lagging indicators also need context. A low injury count doesn't establish effective controls, particularly when workers describe barriers to reporting.

A reporting target should encourage useful information, not reward managers for keeping incidents out of the register.

For manufacturing, an objective around machine-isolation verification can be more useful than another broad injury target. The supporting evidence might include sampled isolation checks, defects raised, corrective actions and operator feedback.

The finding to guard against is an objective without an executable plan. Other weaknesses include measures that nobody reviews and targets retained after the associated work has changed.

Management review records should show decisions to continue, revise or close objectives. Where a target wasn't achieved, the useful question is whether the plan, resources or assumptions need changing, not only whether the result appeared in red.

6. Clause 7 Competence, awareness, communication and documented information

An auditor will trace a worker's assigned tasks to the competence evidence for those tasks. Start with the roster, select workers, then check their qualifications, authorisations and practical assessments. A training record is one part of that evidence; the audit needs to show that competence matches the work.

Have these records ready:

• Task-based matrix: Roles, machines, required qualifications, authorisations and relevant expiry dates.
• Competence assessments: Practical observations, assessor details, identified gaps and reassessment outcomes.
• Communication evidence: Inductions, toolbox discussions and confirmation that changes reached affected workers.
• Document controls: Current versions, owners, approvals, access arrangements and archived superseded copies.

Check the version used at the task

For a manufacturer, the matrix should distinguish authorisation for different machines. Check the relevant task and controls rather than assuming that experience with similar equipment transfers.

Compare the procedure listed in the matrix with the copy available beside the machine. An approved office master does not resolve an obsolete laminated instruction on the production floor.

The BSBWHS606 training unit describes tools for collecting evidence against a benchmark and risk context, supporting consistent outcomes and efficient evidence collection. Record identifiers, versions and sample details so competence and document-control findings can be traced to the evidence reviewed.

Document access involves a practical trade-off. Tight restrictions can leave supervisors unable to retrieve instructions during a breakdown; weak control can leave outdated copies in use. Workers should be able to find the current instruction and explain the precautions relevant to their tasks.

Check that the matrix reflects labour hire, changed duties and authorisation expiry dates. Training records disconnected from assigned work leave gaps in the audit trail.

7. Clause 8 Operational control, contractors, change and emergency preparedness

The auditor can learn a great deal by following an actual task from planning to completion. For an excavation, that means checking the risk assessment, SWMS, worker consultation, plant interfaces, supervision and emergency arrangements against conditions at the excavation.

Safe Work Australia's excavation code states that a SWMS must be prepared, or ensured to have been prepared, before high-risk construction work starts. The audit test is whether it describes the actual work and controls, remains available and is revised when necessary.

Follow the contractor beyond pre-qualification

For residential builders and developers, document collection is only the start of subcontractor safety management. Current insurance doesn't demonstrate that a contractor understands site traffic arrangements or coordinates work with adjacent trades.

The reviewer should have access to:

• Contractor records: Selection criteria, relevant licences, insurances, inductions and agreed responsibilities.
• Operational evidence: Current SWMS, permits, plant inspections and field observations.
• Change assessments: Reviews completed before introducing new plant, chemicals, layouts or methods.
• Emergency evidence: Site-specific plans, drill records, observations and completed improvements.

Consider a new chemical introduced into a facilities-services contract. The change review should cover storage, compatibility, exposure controls, worker instruction and spill response before use, not after procurement has delivered it.

Field check: An emergency plan isn't demonstrated by a drill attendance sheet. The record needs to show what was tested, what failed and what changed.

Emergency exercises should reflect credible site scenarios, including access constraints and contractor interfaces. The finding to avoid is a documented control that nobody verifies during work.

Where conditions create immediate danger, the priority is the organisation's immediate risk response. Recording an audit finding doesn't substitute for controlling the exposure.

8. Clauses 9 and 10 Performance evaluation, internal audit, management review and corrective action

An action marked closed can still leave the underlying problem untouched. Replacing a damaged extension lead fixes the defect. Checking why inspection failed, changing the inspection arrangement and verifying its use addresses recurrence.

The auditor should distinguish correction, cause analysis and corrective action. Significant findings need more than a photograph of the replacement item.

Sample the closed actions, not just the overdue list

Prepare the audit programme, reports, incident investigations, monitoring results and management review records. Then select completed actions and follow them back to the original issue.

• Audit programme: Explain priorities using risk, changes, previous results and site exposure.
• Findings: State the requirement, sampled evidence and demonstrated gap.
• Corrective actions: Record causes, owners, completion evidence and effectiveness checks.
• Management review: Show decisions, resource commitments, responsibilities and follow-up.

A useful ISO 45001 gap analysis template can organise the initial assessment. It shouldn't become a reason to repeat identical samples while ignoring changed operations.

Management review needs prepared inputs, including consultation outcomes, compliance evaluations, performance trends and unresolved risks. Minutes that record discussion without decisions leave the auditor unable to establish what management directed.

The finding to guard against is administrative closure without operational verification. A revised procedure is an output; evidence that workers use it correctly establishes whether the response works.

Effective follow-up also tests related records. A changed inspection step may require updates to the hazard register, training matrix, objectives or contractor instructions. Closing the action before those connections are checked leaves an incomplete response.

ISO 45001 clauses at a glance

Use this table to plan a quick audit sample. For each clause, test whether the documented arrangement matches how work is managed.

Quick Pre-Audit Checklist and Next Steps

Run a mock audit against real work, not just the document system. Select activities with significant hazards, contractor interfaces, and differences across sites or shifts.

Ask a supervisor who did not prepare the records to test a sample over a normal working week. Give them a work activity and ask them to trace the evidence an auditor would request, from the applicable procedure through to what workers do. Note where retrieval stalls, staff give conflicting answers, or records do not match site practice. Those are practical audit findings to resolve before the assessment.

Rehearse evidence retrieval

A supervisor should be able to find the current procedure, identify who is authorised to do the work, and retrieve a relevant inspection without relying entirely on the H&S manager. If they cannot, clarify access or ownership.

At multiple sites, compare the office record with local practice. Check that teams use current forms, apply the same process for closing actions, and know how to access controlled documents. Keep confidential information, including injury details and psychosocial complaints, restricted to people who need it.

Test the audit trail

Choose a completed action and trace it from the original finding to its closure. Confirm that the record shows who acted, what changed, and how the organisation checked the result. Then ask a manager to explain any open findings and the decisions or resources needed to address them.

The final readiness test is practical: can a supervisor explain the work, retrieve the supporting evidence, and show that the records match what happens on site? Record any gap and assign an owner and response. Do not create records after the fact.

Safety Space brings hazard registers, inspections, training records, contractor documents and corrective actions into a site-based system, with setup handled by its team. Book a free H&S consultation to review how current records support this ISO 45001 checklist, where accountability is unclear, and which gaps need action before assessment.