An ISO 45001 internal audit is a structured assessment of an organisation's occupational health and safety management system. Its purpose is to determine whether the system meets the requirements of ISO 45001, complies with the organisation's own arrangements and is effectively implemented.
Under ISO 45001:2018, organisations must conduct internal audits at planned intervals. However, the standard does not prescribe a fixed annual frequency.
For businesses seeking certification or maintaining an existing certified management system, internal audits are an essential part of demonstrating that workplace safety arrangements are operating as intended.
What Is an ISO 45001 Internal Audit?
Clause 9.2 of ISO 45001 requires organisations to conduct internal audits to determine whether their occupational health and safety management system:
- Conforms to the organisation's own WHS management system requirements.
- Conforms to the requirements of ISO 45001.
- Is effectively implemented and maintained.
An internal audit should go beyond checking whether policies and procedures exist.
It should examine whether the organisation has implemented its documented arrangements and whether those arrangements are effectively managing workplace health and safety risks.
For example, a business may have a documented hazard identification procedure. However, an internal audit should also examine whether hazards are being reported, risk assessments are completed, controls are implemented and corrective actions are followed through.
What Does an ISO 45001 Internal Audit Check?
The scope of an internal audit depends on the organisation's activities, risks, management system and audit programme.
Common areas examined include:
Hazard Identification and Risk Management
Reviewing whether workplace hazards have been identified, risks assessed and appropriate controls implemented and maintained.
Legal and Other Requirements
Assessing how the organisation identifies applicable WHS legislation and other requirements, evaluates compliance and responds to identified obligations.
Worker Consultation and Participation
Examining whether workers are involved in WHS matters, including hazard identification, risk assessments, operational changes and safety decisions.
Training and Competency
Reviewing training records, competency requirements, licences, inductions and arrangements for ensuring workers are competent to undertake their activities.
Incident Management and Corrective Actions
Assessing how incidents, hazards and nonconformities are reported, investigated and addressed, including verification of corrective action effectiveness.
Emergency Preparedness
Reviewing emergency plans, training, testing arrangements and records demonstrating that emergency procedures have been implemented.
Management Review and Continual Improvement
Examining whether management reviews system performance and whether opportunities for improvement are identified and addressed.
What Does an Internal Audit Look Like in Practice?
An effective ISO 45001 internal audit typically combines document reviews, interviews, operational observations and sampling of completed records.
For example, an auditor reviewing a civil construction business may examine:
- The organisation's WHS management system and risk register.
- Completed site inspection reports.
- Safe Work Method Statements and evidence of their implementation.
- Plant and equipment inspection records.
- Worker induction and training records.
- Toolbox talks and consultation records.
- Incident investigations and corrective action close-out evidence.
The auditor may then interview supervisors and workers and observe workplace activities to establish whether the documented arrangements are being followed.
This distinction is important.
Having a documented safety procedure does not automatically demonstrate that the procedure is implemented or effective.
How Often Should ISO 45001 Internal Audits Be Conducted?
ISO 45001 does not specify that every organisation must conduct a complete internal audit annually.
Instead, clause 9.2 requires an audit programme at planned intervals, taking into consideration factors such as:
- The importance of the processes being audited.
- Changes affecting the organisation.
- Results of previous audits.
- Operational risks and the complexity of activities.
Many organisations adopt an annual internal audit cycle, with higher-risk activities or processes receiving more frequent attention.
For example, a business operating across multiple construction sites may need a different audit programme from a small professional services organisation.
The audit frequency should be appropriate to the organisation's activities and capable of providing sufficient assurance that its management system remains effective.
Who Can Conduct an ISO 45001 Internal Audit?
ISO 45001 requires internal audits to be conducted in a manner that ensures objectivity and impartiality.
Auditors must have the competence necessary to assess the relevant requirements and activities.
Where practicable, auditors should not audit work for which they are directly responsible, as this may compromise impartiality.
For smaller businesses, maintaining sufficient independence can be difficult when management personnel are responsible for developing and implementing the management system.
Engaging an independent external auditor can provide an objective assessment and additional technical expertise.
Internal Audits and ISO 45001 Certification
Internal audits are an important component of the certification process.
Before seeking certification, organisations should establish and implement their internal audit programme and conduct a management review.
Certification bodies will generally expect sufficient evidence that the management system has been implemented, internally audited and reviewed before a certification decision is made.
Following certification, surveillance audits are generally conducted annually, with recertification typically occurring on a three-year cycle.
Internal audits remain an ongoing management system requirement throughout this period.
What Happens After an Internal Audit?
An internal audit should result in documented findings that identify areas of conformity, nonconformity and opportunities for improvement.
Where nonconformities are identified, the organisation should determine appropriate corrections and corrective actions, consider their causes and evaluate the effectiveness of actions taken.
A practical audit process should include:
- Recording the audit findings and supporting evidence.
- Communicating relevant findings to management.
- Identifying required corrective actions.
- Assigning responsibilities and completion timeframes.
- Monitoring corrective action progress.
- Verifying whether actions have effectively addressed the identified issues.
The objective is not simply to complete an audit checklist. It is to identify weaknesses and support continual improvement.
How Can Overwatch Safety Solutions Help?
Overwatch Safety Solutions assists businesses with ISO 45001 internal audits, management system reviews and certification preparation.
Our services can include:
- Development of risk-based internal audit programmes and schedules.
- Independent ISO 45001 internal audits.
- Reviews of WHS policies, procedures, registers and operational records.
- Workplace inspections and verification of implemented safety controls.
- Completed audit checklists and evidence-based audit reports.
- Corrective action registers and practical recommendations.
- Follow-up reviews and verification of corrective action effectiveness.
- Ongoing ISO management system advisory and improvement support.
Our approach focuses on determining whether safety management systems are documented, implemented and effective in practice, rather than simply checking whether procedures exist.
We also assist businesses operating integrated management systems incorporating ISO 9001, ISO 14001 and ISO 45001.
Frequently Asked Questions
Is an internal audit mandatory for ISO 45001?
Yes. Clause 9.2 requires organisations to conduct internal audits at planned intervals.
Does ISO 45001 require an internal audit every year?
No fixed annual frequency is prescribed. Organisations must establish an appropriate audit programme based on their operations, changes, risks and previous audit results.
Can I audit my own work?
Audits must be objective and impartial. Auditing activities for which you are directly responsible can create an impartiality concern. Independent internal or external auditors are commonly used to address this.
What is the difference between an internal audit and a surveillance audit?
An internal audit is arranged by the organisation to assess its own management system. A surveillance audit is conducted by the certification body to assess continued conformity with certification requirements.
Sources: ISO 45001:2018, clauses 9.2, 9.3 and 10.2.
Last reviewed: October 2026.