Free ISO-45001-LEAD-AUDITOR Practice Test

Statement C is false because audits are conducted using a sampling methodology. It is neither practical nor required to interview every employee in an organization. The audit team selects a representative sample of personnel to interview to gather sufficient evidence regarding the implementation and effectiveness of the OHS management system.
Statement E is false as there is no requirement in any auditing standard for an organization to cancel all staff leave during an audit. While the organization must ensure that key personnel and representatives for relevant functions are available as per the agreed audit plan, a blanket cancellation of all leave is an unreasonable and disruptive measure that is not mandated.

A. The organisation should review the audit plan for agreement. This is a standard and necessary step. The auditee's review ensures the plan is feasible, minimizes disruption, and confirms the availability of required personnel and resources.
B. The audit team leader does not select the OHS audit team members. This is correct. The audit team is typically selected and appointed by the individual managing the audit programme (e.g., from the certification body), not the audit team leader.
D. The audit team leader should present the plan to the auditee before the Stage 2 audit. This is a mandatory requirement. Communicating the audit plan in advance allows the auditee to prepare, arrange logistics, and ensure the availability of relevant personnel.
F. The plan does not need to include the names of the senior managers. This is correct. The audit plan must identify the organizational units and functions to be audited (e.g., "Top Management"), but it does not necessarily need to list specific individuals by name.

1. ISO 19011:2018, Guidelines for auditing management systems.

For C: Clause A.6, "Sampling," states that auditing is typically conducted by sampling, not by examining 100% of available information. This principle applies to interviews, document reviews, and observations.

For A & D: Clause 6.3.2.1, "Preparing the audit plan," specifies that the audit plan should be communicated to the auditee in advance. It also implies agreement is sought to confirm the plan.

For B: Clause 5.4.4, "Assigning responsibility for an individual audit," states that the individual(s) managing the audit programme should select and appoint the audit team.

2. ISO/IEC 17021-1:2015, Conformity assessment — Requirements for bodies providing audit and certification of management systems.

For A & D: Clause 9.2.3.2, "The certification body shall communicate the audit plan and agree on the date of the audit." This confirms the requirement for presenting the plan for agreement.

For E: While not explicitly stating leave should not be cancelled, the principles of planning (Clause 9.2) focus on effective auditing with due regard for the client's operations. A requirement to cancel all leave would be contrary to this principle of reasonable planning and cooperation. The focus is on ensuring the availability of necessary personnel.

The scenario provides objective evidence of two nonconformities. First, the park cannot provide the required documented information (a current inspection report) to demonstrate its compliance with legal requirements, which is a nonconformity against Clause 9.1.2. The only report available is eight years old, generic, and unverified, failing to serve as evidence of ongoing compliance. Second, the park has outsourced a critical safety function (independent inspection) but has demonstrated no control over this process, as required by Clause 8.1.4.3. Relying solely on the insurance company to select a "reputable body" and accepting a completely inadequate report shows a failure to ensure the outsourced arrangement conforms to the OHS management system's requirements.

B. The manager’s statement about "trusting" staff is a concern, but the scenario provides no direct evidence that monitoring of the checks does not occur.
D. The manager’s comment on insurance is about risk treatment (financing), not an admission that the insurer performs the park's OHS risk evaluation process.
E. The scenario provides no information regarding safe loading tests; therefore, a nonconformity cannot be raised based on the evidence provided.

1. ISO 45001:2018, Occupational health and safety management systems — Requirements with guidance for use.

Section 9.1.2, "Evaluation of compliance": States that "The organization shall retain documented information of the compliance evaluation result(s)." The park's inability to provide a current inspection report is a failure to meet this requirement.

Section 8.1.4.3, "Outsourcing": Requires that "The organization shall ensure that outsourced functions and processes are controlled." The park's reliance on the insurer without its own verification or evaluation process for the inspection body is a failure of this control.

2. PECB. (2021). PECB Certified ISO 45001 Lead Auditor Training Course Material.

Domain 5: Conducting the audit, Section: "Audit evidence": Emphasizes that audit conclusions and nonconformities must be based on verifiable and objective audit evidence. The lack of a current report (for A) and the acceptance of a substandard report without verification (for C) constitute objective evidence.

3. Friend, M. A., & Kohn, J. P. (2018). Fundamentals of Occupational Safety and Health (7th ed.). Rowman & Littlefield.

Chapter 5, "Recordkeeping and Reporting": This university-level textbook explains that maintaining records of legally required inspections is fundamental to demonstrating due diligence and compliance with occupational safety and health regulations. The eight-year-old report is insufficient as evidence of current compliance.

The four correct statements accurately reflect the principles and requirements of ISO 45001:2018.
(B) The standard defines risk as the "effect of uncertainty" (Clause 3.20), which can be a positive deviation (an opportunity) or a negative one.
(C) ISO 45001 is not prescriptive about the specific tools or methods for risk assessment; it requires the organization to define and apply its own methodologies and criteria (Clause 6.1.2.2).
(E) A fundamental requirement of the standard is for the organization to establish a process to identify hazards and assess the resulting OH&S risks (Clause 6.1.2.2).
(F) The definition of OH&S risk in the standard is the "combination of the likelihood of occurrence... and the severity..." (Clause 3.21), where severity is synonymous with impact or consequence.

A. The standard requires a systematic process for identifying hazards and risks, but the term "every risk" is an unachievable absolute; the focus is on reasonably foreseeable risks.
D. Top management is accountable for the OHSMS (Clause 5.1), but the activity of risk assessment requires worker participation (Clause 5.4) and is performed by competent persons.

1. International Organization for Standardization (ISO). (2018). ISO 45001:2018 Occupational health and safety management systems — Requirements with guidance for use.

For B: Clause 3.20 (Definition of risk) and Annex A, Section A.6.1.1, which clarifies that risks and opportunities can result in both adverse and beneficial effects.

For C: Clause 6.1.2.2, which states, "The organization’s methodologies and criteria for the assessment of OH&S risks shall be defined...".

For E: Clause 6.1.2.2 b), which explicitly requires "assessing OH&S risks from the identified hazards".

For F: Clause 3.21, which defines "OH&S risk".

For A (Incorrect): The standard outlines a process in Clause 6.1.2 but does not use absolute language like "every risk".

For D (Incorrect): Clause 5.1 assigns "overall responsibility and accountability" to top management, while Clause 5.4 c) 1) mandates worker participation in the "identification of hazards and assessment of risks".

2. Robson, L. S., et al. (2021). The ISO 45001 voluntary occupational health and safety management system standard: A review of its benefits and limitations. Safety Science, 140, 105285. https://doi.org/10.1016/j.ssci.2021.105285

(Section 2.2, Table 1) This article reviews the clauses of ISO 45001, reinforcing that while top management leadership is critical (Clause 5), the standard emphasizes a process-based approach with worker participation for hazard identification and risk assessment (Clause 5.4, 6.1.2), not an activity performed solely by management.

The basis for the nonconformity is the Deputy College Principal's demonstrated lack of awareness of the OH&S policy. As a member of top management, the DP is expected to understand and be able to articulate the organization's policy and commitment to OH&S. The scenario explicitly shows the DP needing to look up the policy to answer a basic question, indicating a failure in leadership commitment and awareness. This directly contravenes the expectation that top management is actively involved and knowledgeable about the OHSMS. The finding is based on direct evidence gathered during the interview, which points to a gap in the communication and internalization of the policy at the management level.

B. This is a potential consequence of the lack of awareness, not the basis for the nonconformity itself. The audit finding must be based on the observed evidence of unawareness.
C. The term "competent" is broad, and the scenario provides specific evidence of a lack of awareness of the policy, which is a more precise finding. Also, "CM ISMS" is an irrelevant term.
D. The scenario does not support this claim. It states the policy is on a noticeboard, so it does exist and is displayed; the issue is the DP's lack of familiarity with it.

1. ISO 45001:2018, Occupational health and safety management systems — Requirements with guidance for use.

Section 5.1, Leadership and commitment: States that "Top management shall demonstrate leadership and commitment with respect to the OH&S management system by... b) ensuring the OH&S policy and related OH&S objectives are established and are compatible with the strategic direction of the organization". The DP's lack of familiarity demonstrates a failure in this commitment.

Section 7.3, Awareness: Requires that "Workers shall be made aware of: a) the OH&S policy...". As a senior manager, the DP is considered a worker under this standard and must be aware of the policy.

2. PECB. (2021). ISO 45001 Lead Auditor Training Course - Module 2: Audit principles, preparation and launching of an audit.

Section: Conducting the opening meeting and interviewing employees. This section of the official training emphasizes that auditors must interview top management to verify their commitment and understanding of the OHSMS, including the policy. A manager being unable to discuss the policy without reading it from a noticeboard is a clear indicator of a nonconformity related to leadership and awareness.

ISO 45001:2018, Clause 6.1.2.1 "Hazard identification," mandates a comprehensive approach to identifying hazards. The standard requires the organization to consider not only traditional physical hazards from work activities but also how work is organized, social factors (including workload, work hours, bullying, and harassment), human factors, and the design of work areas and processes. Option A is the only choice that accurately captures this broad scope, specifically including work activities, workplace design, and the crucial psychosocial and human factors that are a key emphasis of the ISO 45001 standard.

B. This option is too vague. While hazards do present a "possibility of danger," the standard requires a much more systematic and detailed consideration of specific categories of hazards.
C. This lists specific examples of high-risk activities. The standard requires the organization to consider broad categories of hazards during planning, not just a predefined list of specific tasks.
D. This option is incomplete. While "bad weather" is a valid external factor to consider, this choice omits the critical internal elements like work organization, social factors, and human factors required by the standard.

1. ISO 45001:2018, Occupational health and safety management systems — Requirements with guidance for use.

Clause 6.1.2.1 Hazard identification: This clause states the process shall take into account, among other things: "a) how work is organized, social factors (including workload, work hours, victimization, harassment and bullying), leadership and the culture in the organization;" "b) human factors;" and "f) other issues, including consideration of: 1) the design of work areas, processes, installations, machinery/equipment, operating procedures and work organization...". This directly supports all elements of option A.

2. PECB. (2021). ISO 45001 Lead Auditor Training Course Material.

Module: Planning (Clause 6), Section: Hazard Identification: The official PECB training materials emphasize that ISO 45001 expands the scope of hazard identification beyond traditional safety issues to include psychosocial risks. The courseware explicitly details the need to analyze work organization, social factors like bullying, and human factors as integral parts of the planning process, aligning directly with option A.

3. Górny, A. (2021). Risk Assessment in the ISO 45001:2018 Standard—New Opportunities or Threats?. International Journal of Environmental Research and Public Health, 18(11), 5673.

Section 3.2. Hazard Identification: This academic paper discusses the novel aspects of ISO 45001, stating, "The standard also draws attention to new areas of hazard identification, such as... how work is organized, social factors (including workload, work hours, victimization, harassment and bullying), leadership and the culture in the organization... [and] human factors" (p. 5). This peer-reviewed analysis confirms the comprehensive nature of hazard identification required by the standard, as described in option A. DOI: https://doi.org/10.3390/ijerph18115673

According to ISO 45001:2018, Clause 3.24, 'documented information' is defined as "information required to be controlled and maintained by the organization and the medium on which it is contained." The notes to this definition clarify that it can be in any format or media (e.g., paper, electronic, audio) and can refer to the management system itself (e.g., policies, procedures), information created for the organization to operate (documentation), and evidence of results achieved (records). Therefore, option B is the most accurate and comprehensive description.

A. This is incorrect because 'documented information' is not limited to "paperwork"; it can be in any format, including electronic files, databases, or videos.
C. This option provides examples of documented information but is not the definition itself. The term encompasses a much broader scope than just these two types of documents.
D. This is too restrictive. The term includes all controlled copies, not just "master copies," and crucially, it also includes records (evidence of results), not just documents used for operation.

1. ISO 45001:2018, Occupational health and safety management systems — Requirements with guidance for use, Clause 3.24, "Terms and definitions". This clause provides the official definition of "documented information". Note 1 to the entry states: "Documented information can be in any format and media and from any source." Note 2 clarifies it refers to the management system, operational documentation, and records.

2. ISO 45001:2018, Occupational health and safety management systems — Requirements with guidance for use, Clause 7.5.1, "General". This section requires the OH&S management system to include documented information required by the standard and any additional information the organization deems necessary for effectiveness, reinforcing the broad scope of the term.

3. PECB. (2022). ISO 45001 Lead Auditor Training Course Material. PECB University, Module 2: Audit Principles and Preparation. The courseware explains that the term 'documented information' was introduced in modern ISO management system standards to replace the separate terms 'documents' and 'records', explicitly broadening the concept to cover all formats and media.

This mapping is based directly on the structure and requirements of the ISO 45001:2018 standard:

• Clause 4.1 (Understanding the organization and its context) requires the organization to determine external and internal issues relevant to its purpose.
• Clause 6.1.2.2 (Assessment of OH&S risks and other risks) specifically governs the process for assessing risks to the OH&S management system.
• Clause 6.1.3 (Determination of legal requirements and other requirements) mandates that the organization maintain and retain documented information regarding its legal requirements.
• Clause 8.1.4.2 (Contractors) falls under Procurement and requires the organization to coordinate with contractors (external providers) to control procurement processes, effectively covering agreements on OH&S responsibilities.

ISO 45001:2018(en) Occupational health and safety management systems — Requirements with guidance for use.

Clause 4.1: "The organization shall determine external and internal issues that are relevant to its purpose..."

Clause 6.1.2.2: "Assessment of OH&S risks and other risks to the OH&S management system."

Clause 6.1.3: "The organization shall maintain and retain documented information on its legal requirements and other requirements..."

Clause 8.1.4.2: "The organization shall coordinate its procurement process(es) with its contractors, in order to identify hazards and to assess and control the OH&S risks..."

According to ISO 19011:2018 Guidelines for auditing management systems:

• The Audit Team Leader is specifically responsible for preparing and completing the audit report (Clause 6.5.1).
• Auditors are responsible for preparing their own work documents, which include audit checklists and sampling plans, for their specific assignments (Clause 6.3.4).
• An Auditor in training participates in the audit to gain competence but must do so under the direction and guidance of a competent auditor.
• The Auditee is responsible for determining and initiating corrective actions (follow-up) to address audit findings within an agreed timeframe (Clause 6.7).
• An Observer is defined strictly as an individual who accompanies the audit team but does not audit (Clause 3.14).
• A Guide is appointed by the auditee to assist the audit team, which includes responsibilities like witnessing the audit and acting as an escort for safety and security, but they do not participate in the audit itself (Clause 6.4.5).

ISO 19011:2018, Guidelines for auditing management systems:

Clause 3.14 (Observer): Defines observer as an "individual who accompanies the audit team but does not act as an auditor."

Clause 6.3.4 (Auditor): States "The audit team members should... prepare work documents... [which] can include... audit checklists."

Clause 6.4.5 (Guides and Observers): States guides should assist the audit team and act on the request of the audit team leader, often serving to witness or escort.

Clause 6.5.1 (Audit Team Leader): States "The audit team leader should report the audit results in accordance with the audit programme procedures."

Clause 6.7 (Auditee): Discusses that actions to address findings are "decided and undertaken by the auditee within an agreed timeframe."

This mapping corresponds directly to the definitions provided in the ISO 45001:2018 standard:

1. 7.3 (Awareness): Specifically mandates that workers must be made aware of "hazards and OH&S risks... that are relevant to them."
2. 7.2 (Competence): Requires the organization to ensure workers are competent based on "appropriate education, training or experience."
3. 6.1.2.1 (Hazard identification): Explicitly lists social factors, including workload, work hours, and how work is organized, as hazards that must be identified.
4. 8.2 (Emergency preparedness and response): Involves establishing processes to respond to emergency situations, which includes preparedness measures like ensuring workers carry necessary emergency contact information.

ISO 45001:2018(en), Occupational health and safety management systems — Requirements with guidance for use:

Clause 6.1.2.1 (Hazard identification): Paragraph (a), which cites "social factors (including workload, work hours, victimization, harassment and bullying)."

Clause 7.2 (Competence): Paragraph (b), regarding competence via training.

Clause 7.3 (Awareness): Paragraph (d), regarding awareness of relevant hazards.

Clause 8.2 (Emergency preparedness and response): Paragraph (a), regarding establishing a planned response to emergency situations.

The ISO 45001 standard is structured around the Plan-Do-Check-Act (PDCA) cycle to achieve continual improvement in Occupational Health and Safety (OHS) performance. The OHSMS Policy (Plan), Treatment of Risks (Plan/Do), and Analyzing OHSMS Performance (Check) are all integral components specified within the clauses of ISO 45001. An "Environment Management Program" is a component of an Environmental Management System (EMS), which is governed by the ISO 14001 standard. While an organization can integrate its OHSMS with an EMS, an environmental program is not an intrinsic part of the ISO 45001 PDCA cycle itself, which focuses exclusively on OHS.

A. Treatment of Risks: This is a core part of the 'Plan' phase (Clause 6.1, planning actions to address risks) and the 'Do' phase (Clause 8, implementing planned actions).
B. OHSMS Policy: Establishing the OHS policy is a fundamental requirement of the 'Plan' phase, as detailed in Clause 5.2 of the standard.
D. Analyzing OHSMS Performance: This is the central activity of the 'Check' phase, as mandated by Clause 9.1 on monitoring, measurement, analysis, and performance evaluation.

1. ISO 45001:2018 - Occupational health and safety management systems — Requirements with guidance for use.

Section 0.3, "Plan-Do-Check-Act cycle": This section explicitly describes how the standard is based on the PDCA concept and maps the clauses to each phase. It shows that planning (Clauses 4-7), support and operation (Clause 8), performance evaluation (Clause 9), and improvement (Clause 10) form the OHSMS cycle. It makes no mention of environmental programs.

Clause 5.2, "OHS policy": Details the requirement for top management to establish, implement, and maintain an OHS policy, which is part of the 'Plan' phase.

Clause 6.1.2, "Hazard identification and assessment of risks and opportunities": Outlines the process for planning actions to address OHS risks, a key part of the 'Plan' phase.

Clause 9.1, "Monitoring, measurement, analysis and performance evaluation": Specifies the requirements for the 'Check' phase.

2. PECB. (2018). ISO 45001 Lead Auditor Training Course Material.

Module 2, "Audit principles, preparation and launching of an audit": This module explains the structure of ISO 45001 and its alignment with the PDCA cycle, emphasizing the OHS-specific elements within each phase (e.g., OHS Policy, Risk Assessment, Performance Evaluation). It distinguishes these from the requirements of other standards like ISO 14001.

3. Sari, A., et al. (2020). "Integration of ISO 45001: 2018 with Plan-Do-Check-Act (PDCA) Cycle for Occupational Health and Safety Performance." IOP Conference Series: Materials Science and Engineering, Vol. 847, 012063.

Section 3, "Results and Discussion": This paper provides a detailed mapping of ISO 45001 clauses to the PDCA cycle, confirming that OHS policy, risk management, and performance analysis are integral parts of the cycle, while environmental aspects are outside its direct scope. (https://doi.org/10.1088/1757-899X/847/1/012063)