Audit preparation task list for ISO 45001: who does what?
An audit task list for ISO 45001 sets out, per element, who provides the evidence, what that evidence is and when it must be ready. That is the difference between an audit that runs smoothly and an audit where everyone spends the whole week chasing documents. The auditor does not look at your intentions, but at what you can show. This page gives a workable list you can use for the internal audit and the certification audit. For the whole process, read the ISO 45001 audit process. For an overview per clause of the standard, use the checklist and the page on mandatory documents.
On this page
We first explain what the task list should contain. Then follows an example for a company with 60 employees, and finally the mistakes that occur most often.
What do you put in the task list?
A useful task list has five columns. More columns make it heavy. Fewer columns leave gaps.
| Column | What you enter |
|---|---|
| Element | The clause or requirement, for example 6.1 risks and opportunities |
| Evidence | The document or record you show |
| Owner | One person, not a department |
| Ready by | A date, two weeks before the audit |
| Status | Done, in progress or open |
One owner per line is important. If two people are responsible, it is usually no one. How to arrange this in a small organisation is explained on ISO 45001 for small and medium-sized enterprises (mkb).
The task list is for you, not for the auditor. The auditor wants to see the evidence, not the list. So do not present the list as your only document: provide the evidence itself.
Example: task list for a company with 60 employees
The example below is fictional and shows the structure. Adjust the owners and dates to your own organisation.
| Element | Evidence | Owner | Ready by | Status |
|---|---|---|---|---|
| 4.1 Context | List of internal and external factors, updated this year | Director | 2 weeks before audit | Done |
| 4.2 Interested parties | Overview of interested parties with their requirements | Quality coordinator | 2 weeks before audit | In progress |
| 5.4 Consultation and participation | Minutes of consultation with the works council (OR) and safety meetings, last 12 months | HR adviser | 3 weeks before audit | Open |
| 6.1 Risks and opportunities | Risk inventory and evaluation (RI&E) and hazard register, with review date | Prevention officer | 3 weeks before audit | Done |
| 7.2 Competence | Training register with evidence of diplomas and certificates | HR adviser | 2 weeks before audit | In progress |
| 8.1 Operational control | Work instructions for the three highest risks | Team leaders | 2 weeks before audit | Open |
| 8.2 Emergency situations | Drill report from the last six months | Emergency response coordinator (BHV, bedrijfshulpverlening) | 1 month before audit | Open |
| 9.1 Monitoring | Measurement results and accident statistics per quarter | Prevention officer | 2 weeks before audit | In progress |
| 9.2 Internal audit | Audit report, findings and follow-up | Audit coordinator | 1 month before audit | Open |
| 9.3 Management review | Report with decisions and actions | Director | 2 weeks before audit | Open |
| 10.2 Improvement | Action list with status and effectiveness check | Quality coordinator | 2 weeks before audit | Open |
Pay attention to the order. The internal audit and the management review must take place before the external audit. A management review that does not yet exist is an open point of the highest order.
How to build the list in four steps
- Go through the clauses. Start with clause 4 and work through to 10. For each requirement, write down what evidence you have.
- Mark the gaps. Where no evidence exists, write “open” and name an owner.
- Spread the workload. Divide the open points across the weeks before the audit. Not everything in the last week.
- Check once with a colleague. Someone who is not involved in the system quickly sees what does not add up.
For the mandatory documents, use the overview on mandatory documents. That saves searching during the audit.
Common mistakes
- Evidence that is out of date. A risk inventory and evaluation (RI&E) from 2019 at an audit in 2026 stands out. Check dates and review dates.
- Leaving everything to the last week. Then you only find the gaps when it is too late. Start at least six weeks in advance.
- No owner per line. A task list without names does not get finished.
- Making the list without checking it. A list that says “done” while the evidence is missing is worse than an open point. It shows that you did not check it.
- Forgetting findings from the previous audit. The auditor checks whether you resolved them. Include them in the list.
The last two weeks before the audit
In the last two weeks, the work shifts from writing documents to showing evidence. That means:
- Day 1 to 3. Go through the task list with the owners. Does every line say “done” with evidence? If not, start on the open points the same day.
- Day 4 to 7. Have the employees involved in the audit explain their own workplace and work instruction. This is practice for the questions the auditor will ask.
- Day 8 to 10. Make a folder with the evidence per clause, in the same order as the task list. That saves searching.
- Day 11 to 14. Do a final check. Are all dates still valid? Are all signatures in place?
This is a way of working, not a hard rule. A small company with a short system needs less time. A company with several locations should start earlier.
After the audit
The task list does not stop at the audit. The auditor’s findings are added as new lines, with an owner and a date. Pay particular attention to nonconformities and points for improvement. You must deal with these before the next audit takes place.
Keep using the list in the following year too. A surveillance audit looks at many of the same points. Whoever keeps the task list has a head start next time. See the audit process after the audit for what you can expect from the body.
What you do not put in the task list
- Personal data of employees, such as sickness absence files. These do not belong in a list shown to the auditor.
- Old findings that were closed without evidence. Close them with a reference to the evidence.
- Tasks unrelated to the system. Keep the list focused on the standard.
Frequently asked questions
Is the task list mandatory? The standard does not require a task list as such. ISO 45001 does require demonstrable planning, responsibilities and evidence. A task list is a practical way to arrange that.
How far in advance should I start? As a rule of thumb (an indication, not a requirement of the standard), plan six to eight weeks for an existing system. A new system takes longer. See the step-by-step plan for the order of steps.
Who makes the list: me or the adviser? The list belongs to the organisation. An adviser can help with the structure, but the owners are employees of your company.
What do I do with the outcome of the internal audit? You add it to the task list as new lines. See the internal audit.
Sources
- Raad voor Accreditatie (RvA, Dutch Accreditation Council) : to check whether your auditor is accredited for ISO 45001.
- ISO: the 45000 family : the ISO 45001 standard as the flagship of the family.