ISO-45001-LEAD-AUDITOR practice question 3 of 10

You are an audit team leader conducting a Stage 2 audit of a Financial Services Provider. You are currently interviewing the organisation's Risk and…

You are an audit team leader conducting a Stage 2 audit of a Financial Services Provider. You are currently interviewing the organisation's Risk and Compliance Officer, who appears very competent when it comes to the management of business risks. As the Risk and Compliance Officer, she is also identified as having lead responsibility for the management of OH&S risk, and you are now seeking evidence that she understands the requirements relating to risk that are contained within ISO 45001. During your conversation, she makes the following six statements about risk within an ISO 45001- based OHSMS. Which four of his statements are correct?

Answer options

A: The organisation must attempt to identify and address every risk it faces.

B: The effect of uncertainty (i.e. risk) can result in positive outcomes as well as negative ones. Correct answer

C: Although organisations are required to carry out risk management, the method by which they do so is up to them. Correct answer

D: Risk assessment is an activity that must be carried out by top management.

E: The organisation is required to assess risks arising from OH&S hazards. Correct answer

F: Risk is often expressed as a combination of likelihood and impact. Correct answer

Correct Answer:

B. The effect of uncertainty (i.e. risk) can result in positive outcomes as well as negative ones.; C. Although organisations are required to carry out risk management, the method by which they do so is up to them.; E. The organisation is required to assess risks arising from OH&S hazards.; F. Risk is often expressed as a combination of likelihood and impact.

Explanation

The four correct statements accurately reflect the principles and requirements of ISO 45001:2018.
(B) The standard defines risk as the "effect of uncertainty" (Clause 3.20), which can be a positive deviation (an opportunity) or a negative one.
(C) ISO 45001 is not prescriptive about the specific tools or methods for risk assessment; it requires the organization to define and apply its own methodologies and criteria (Clause 6.1.2.2).
(E) A fundamental requirement of the standard is for the organization to establish a process to identify hazards and assess the resulting OH&S risks (Clause 6.1.2.2).
(F) The definition of OH&S risk in the standard is the "combination of the likelihood of occurrence... and the severity..." (Clause 3.21), where severity is synonymous with impact or consequence.

Why Incorrect

A. The standard requires a systematic process for identifying hazards and risks, but the term "every risk" is an unachievable absolute; the focus is on reasonably foreseeable risks.
D. Top management is accountable for the OHSMS (Clause 5.1), but the activity of risk assessment requires worker participation (Clause 5.4) and is performed by competent persons.

References

1. International Organization for Standardization (ISO). (2018). ISO 45001:2018 Occupational health and safety management systems — Requirements with guidance for use.

For B: Clause 3.20 (Definition of risk) and Annex A, Section A.6.1.1, which clarifies that risks and opportunities can result in both adverse and beneficial effects.

For C: Clause 6.1.2.2, which states, "The organization’s methodologies and criteria for the assessment of OH&S risks shall be defined...".

For E: Clause 6.1.2.2 b), which explicitly requires "assessing OH&S risks from the identified hazards".

For F: Clause 3.21, which defines "OH&S risk".

For A (Incorrect): The standard outlines a process in Clause 6.1.2 but does not use absolute language like "every risk".

For D (Incorrect): Clause 5.1 assigns "overall responsibility and accountability" to top management, while Clause 5.4 c) 1) mandates worker participation in the "identification of hazards and assessment of risks".

2. Robson, L. S., et al. (2021). The ISO 45001 voluntary occupational health and safety management system standard: A review of its benefits and limitations. Safety Science, 140, 105285. https://doi.org/10.1016/j.ssci.2021.105285

(Section 2.2, Table 1) This article reviews the clauses of ISO 45001, reinforcing that while top management leadership is critical (Clause 5), the standard emphasizes a process-based approach with worker participation for hazard identification and risk assessment (Clause 5.4, 6.1.2), not an activity performed solely by management.

Keep practicing

Take the free ISO-45001-LEAD-AUDITOR practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test